joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402585
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Initialize winsock library
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x44
mov dword [esp], 8
call sym._malloc
mov edx, eax
mov eax, dword [ebp + 8]
mov dword [eax], edx
mov eax, dword [ebp + 8]
mov ebx, dword [eax]
mov dword [esp], 0x198
call sym._malloc
mov dword [ebx], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov byte [eax + 4], 0
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
mov dword [esp], str.VSTClient____initialising_Winsock..._n
call sym.VSTLogger_log_char_const__..._
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], eax
mov dword [esp], 0x202
mov eax, dword [sym.imp.WS2_32.dll_WSAStartup]
call eax
sub esp, 8
test eax, eax
setne al
test al, al
je 0x40260e
mov eax, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call eax
mov dword [esp + 4], eax
mov dword [esp], str.VSTClient____failed._Error_Code_:__d
call sym.VSTLogger_log_char_const__..._
jmp 0x40274b
mov dword [esp], str.VSTClient____initialised._n
call sym.VSTLogger_log_char_const__..._
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 2
mov eax, dword [sym.imp.WS2_32.dll_socket]
call eax
sub esp, 0xc
mov edx, dword [ebp - 0xc]
mov dword [edx + 0x190], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x190]
cmp eax, 0xffffffff
jne 0x40266e
mov eax, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call eax
mov dword [esp + 4], eax
mov dword [esp], str.VSTClient____could_not_create_socket_:__d
call sym.VSTLogger_log_char_const__..._
jmp 0x40274b
mov dword [esp], str.VSTClient____socket_created._n
call sym.VSTLogger_log_char_const__..._
mov dword [esp], str.127.0.0.1
mov eax, dword [sym.imp.WS2_32.dll_inet_addr]
call eax
sub esp, 4
mov dword [ebp - 0x18], eax
mov word [ebp - 0x1c], 2
mov eax, dword [ebp + 0xc]
movzx eax, ax
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_htons]
call eax
sub esp, 4
mov word [ebp - 0x1a], ax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x190]
mov dword [esp + 8], 0x10
lea edx, [ebp - 0x1c]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_connect]
call eax
sub esp, 0xc
shr eax, 0x1f
test al, al
je 0x4026e5
mov dword [esp], str.VSTClient____connect_failed._Error_n
call sym.VSTLogger_log_char_const__..._
jmp 0x40274b
mov dword [esp], 0
call sym._time
mov edx, dword [ebp - 0xc]
mov dword [edx + 0x194], eax
mov dword [ebp - 0x20], 1
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x190]
mov dword [esp + 0x10], 4
lea edx, [ebp - 0x20]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 1
mov dword [esp + 4], 6
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_setsockopt]
call eax
sub esp, 0x14
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov byte [eax + 4], 1
mov dword [esp], str.VSTClient____socket_Connected_n
call sym.VSTLogger_log_char_const__..._
mov ebx, dword [ebp - 4]
leave
ret
Function at 0x4027b3
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
cmp dword [ebp + 8], 0
je 0x40288e
mov eax, dword [ebp + 8]
mov eax, dword [eax]
test eax, eax
je 0x40288e
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
movzx eax, byte [eax + 4]
test al, al
je 0x40288e
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x190]
mov dword [esp + 0xc], 8
mov edx, dword [ebp + 0x10]
mov dword [esp + 8], edx
mov edx, dword [ebp + 0xc]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_recv]
call eax
sub esp, 0x10
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x40283c
mov eax, dword [ebp + 8]
mov byte [eax + 4], 0
mov eax, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call eax
mov dword [esp + 4], eax
mov dword [esp], str.VSTClient____disconnected_with_error:__d_n
call sym.VSTLogger_log_char_const__..._
jmp 0x40288e
cmp dword [ebp - 0x10], 0
jne 0x402879
mov dword [esp], 0
call sym._time
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x194]
mov edx, dword [ebp - 0x14]
sub edx, eax
cmp edx, 0xa
jle 0x40288e
mov eax, dword [ebp + 8]
mov byte [eax + 4], 0
mov dword [esp], str.VSTClient____time_out:__n
call sym.VSTLogger_log_char_const__..._
jmp 0x40288e
mov dword [esp], 0
call sym._time
mov edx, dword [ebp - 0xc]
mov dword [edx + 0x194], eax
nop
leave
ret

Function at 0x402891
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
cmp dword [ebp + 8], 0
je 0x40290a
mov eax, dword [ebp + 8]
mov eax, dword [eax]
test eax, eax
je 0x40290a
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
movzx eax, byte [eax + 4]
test al, al
je 0x40290a
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x190]
mov dword [esp + 0xc], 0
mov edx, dword [ebp + 0x10]
mov dword [esp + 8], edx
mov edx, dword [ebp + 0xc]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_send]
call eax
sub esp, 0x10
shr eax, 0x1f
test al, al
je 0x40290a
mov eax, dword [ebp + 8]
mov byte [eax + 4], 0
mov eax, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call eax
mov dword [esp + 4], eax
mov dword [esp], str.VSTClient____disconnected_with_error:__d_n
call sym.VSTLogger_log_char_const__..._
nop
leave
ret
Function at 0x403f20
Capabilities:
Contain obfuscated stackstrings
Print debug messages

Disassembly:
push edi
xor eax, eax
mov ecx, 0x10
sub esp, 0x88
lea edi, [esp + 0x40]
mov dword [esp + 0x15], 0x6f727245
mov dword [esp + 0x19], 0x6c632072
mov dword [esp + 0x1d], 0x696e6165
mov dword [esp + 0x21], 0x7520676e
mov dword [esp + 0x25], 0x70732070
mov dword [esp + 0x29], 0x6b5f6e69
mov dword [esp + 0x2d], 0x20737965
mov dword [esp + 0x31], 0x20726f66
mov dword [esp + 0x35], 0x65726874
mov dword [esp + 0x39], 0x206461
mov dword [esp + 0x3d], 0
mov dword [esp + 0x7c], 0
rep stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea edx, [esp + 0x3c]
mov dword [esp + 8], 0xa
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll__ultoa]
cmp byte [esp + 0x3c], 0
je 0x403ffb
mov eax, 0x27
lea edx, [esp + 0x15]
jmp 0x403fcd
cmp eax, 0x6a
je 0x403fea
mov ecx, eax
add eax, 1
cmp byte [edx + eax], 0
jne 0x403fc8
cmp eax, 0x6a
je 0x403fea
add ecx, 2
mov byte [esp + eax + 0x15], 0xa
mov byte [esp + ecx + 0x15], 0
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
sub esp, 4
call sym._abort
mov ecx, 0x28
mov eax, 0x27
lea edx, [esp + 0x15]
jmp 0x403fe0

Function at 0x404380
Capabilities:
Allocate thread local storage

Disassembly:
cmp dword [0x50c07c], 1
je 0x404438
push edi
mov eax, 0x50c07c
push esi
push ebx
sub esp, 0x10
call dbg.enterOnceObject
lea esi, [eax + 4]
mov ebx, eax
mov dword [esp], esi
call dbg.pthread_mutex_lock
mov edi, dword [0x50c07c]
test edi, edi
jne 0x4043f0
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x4be014], eax
cmp eax, 0xffffffff
je sym.__pthread_once_raw.constprop.0.isra.0.cold
mov dword [0x50c07c], 1
mov dword [esp], esi
call dbg.pthread_mutex_unlock
test ebx, ebx
je 0x40442a
add esp, 0x10
mov eax, ebx
pop ebx
pop esi
pop edi
jmp sym._leaveOnceObject.part.0
cmp edi, 1
je 0x4043d2
mov dword [esp], 2
call dword [0x4be0d0]
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0x50c07c
mov dword [esp + 4], str._once__p_is__d_n
mov dword [esp], eax
call sym._fprintf
mov dword [esp], esi
call dbg.pthread_mutex_unlock
test ebx, ebx
jne 0x4043de
add esp, 0x10
pop ebx
pop esi
pop edi
ret
ret
Function at 0x404440
Capabilities:
Set thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
call sym._pop_pthread_mem
mov edx, dword [entry3]
test edx, edx
je 0x404570
mov ebx, eax
test eax, eax
je 0x404570
mov dword [eax + 0x24], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebx + 0x3c], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [ebx + 0x1c], 0xffffffff
mov dword [ebx + 0x18], eax
sub esp, 0x10
lea eax, [ebx + 0x38]
mov dword [esp], eax
call dbg.pthread_spin_destroy
cmp eax, 1
je 0x40457c
mov ebp, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebx + 0x38], 0xffffffff
mov dword [ebx + 0x64], 0
mov dword [ebx + 0x14], 0
call ebp
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov esi, eax
call ebp
lea edx, [ebx + 0x14]
mov dword [esp + 8], edi
mov dword [esp + 0x18], 2
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edx
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
sub esp, 0x1c
test eax, eax
je sym.___pthread_self_lite.part.0.cold
mov eax, dword [ebx + 0x14]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [ebx + 0x68], 0
mov dword [ebx + 0x6c], eax
movzx eax, byte [ebx + 0x20]
sub esp, 4
and eax, 0xffffffcf
or eax, 0x10
mov byte [ebx + 0x20], al
mov eax, dword [0x4be014]
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
je 0x404581
add esp, 0x2c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
add esp, 0x2c
xor ebx, ebx
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
call sym._replace_spin_keys.part.0
jmp sym.___pthread_self_lite.part.0.cold

Function at 0x404590
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
sub esp, 0x1c
call sym.__pthread_once_raw.constprop.0.isra.0
mov eax, dword [0x4be014]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x4045b8
add esp, 0x1c
ret
add esp, 0x1c
jmp sym.___pthread_self_lite.part.0
Function at 0x4046fa
Capabilities:
Set thread local storage value

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x28
mov esi, dword [ecx]
call dbg._fpreset
mov dword [esp], 0x4be00c
lea ebx, [esi + 0x1c]
call dbg.pthread_mutex_lock
mov dword [esp], ebx
call dbg.pthread_mutex_lock
call sym.__pthread_once_raw.constprop.0.isra.0
mov eax, dword [0x4be014]
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [esi + 0x3c], eax
mov dword [esp], ebx
call dbg.pthread_mutex_unlock
lea eax, [esi + 0x70]
mov dword [ebp - 0x1c], esi
mov dword [esp + 4], 0
mov dword [esp], eax
call sym.__setjmp3
mov dword [esp], 0x4be00c
test eax, eax
jne 0x404821
call dbg.pthread_mutex_unlock
mov esi, dword [ebp - 0x1c]
mov eax, dword [esi + 8]
test eax, eax
je 0x404828
mov edx, dword [esi + 4]
mov dword [esp], edx
call eax
mov ebx, eax
mov dword [esp], 0x4be00c
call dbg.pthread_mutex_lock
mov eax, dword [ebp - 0x1c]
mov dword [eax + 4], ebx
mov eax, dword [eax + 0xb4]
test eax, eax
je 0x4047b0
call sym.__pthread_cleanup_dest.part.0
mov esi, dword [ebp - 0x1c]
lea ebx, [esi + 0x1c]
mov dword [esp], ebx
call dbg.pthread_mutex_lock
mov eax, esi
mov esi, dword [esi + 4]
mov eax, dword [eax + 0x18]
test eax, eax
je 0x4047d4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
mov eax, dword [ebp - 0x1c]
xor edx, edx
cmp dword [eax + 0x14], 0
mov dword [eax + 0x18], edx
je 0x40483b
mov dword [esp], ebx
call dbg.pthread_mutex_unlock
mov dword [esp], ebx
call dbg.pthread_mutex_destroy
mov eax, dword [ebp - 0x1c]
mov dword [eax + 0x1c], 0xffffffff
mov dword [eax + 0x68], 1
mov dword [esp], 0x4be00c
call dbg.pthread_mutex_unlock
test eax, eax
jne 0x404832
xor eax, eax
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_Sleep]
push edx
jmp 0x404803
call dbg.pthread_mutex_lock
jmp 0x4047b0
mov ebx, pe_nt_image_headers32
jmp 0x40478f
mov dword [esp], esi
call dword [sym.imp.msvcrt.dll__endthreadex]
mov edi, dword [ebp - 0x1c]
mov dword [edi], 0xdeadbeef
mov dword [esp], ebx
call dbg.pthread_mutex_unlock
mov dword [esp], ebx
call dbg.pthread_mutex_destroy
mov eax, edi
call sym._push_pthread_mem
mov eax, dword [0x4be014]
xor ecx, ecx
mov dword [esp + 4], ecx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push ebx
push ebx
jmp 0x404803
Function at 0x404880
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov eax, dword [esp + 0x34]
test eax, eax
jne 0x4048b0
mov ecx, dword [esp + 0x38]
test ecx, ecx
je 0x404980
add esp, 0x1c
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret 0xc
cmp eax, 1
je 0x4049b0
cmp eax, 3
jne 0x40489b
mov eax, dword [0x4be014]
cmp eax, 0xffffffff
je 0x40489b
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x40489b
lea esi, [eax + 0x1c]
lea edi, [eax + 0x38]
test byte [eax + 0x20], 0x30
je 0x4049e0
mov eax, dword [eax + 0xb4]
test eax, eax
je 0x4048f9
call sym.__pthread_cleanup_dest.part.0
mov eax, dword [ebx + 0x14]
test eax, eax
je 0x40492b
mov dword [esp], eax
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
call ebp
mov eax, dword [ebx + 0x18]
sub esp, 4
test eax, eax
je 0x40491d
mov dword [esp], eax
call ebp
sub esp, 4
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x14], 0
mov dword [esp], esi
call dbg.pthread_mutex_destroy
mov dword [esp], edi
call dbg.pthread_spin_destroy
cmp eax, 1
je 0x404aa6
mov eax, dword [ebx + 0xb0]
mov dword [ebx + 0x38], 0xffffffff
test eax, eax
je 0x404a9a
mov eax, dword [0x4be014]
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
jmp 0x40489b
mov eax, dword [0x50c058]
test eax, eax
je 0x40489b
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_RemoveVectoredExceptionHandler]
mov dword [0x50c058], 0
sub esp, 4
jmp 0x40489b
mov dword [esp + 4], dbg.SetThreadName_VEH
mov dword [esp], 1
call dword [sym.imp.KERNEL32.dll_AddVectoredExceptionHandler]
sub esp, 8
mov dword [0x50c058], eax
mov eax, 1
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret 0xc
mov edx, dword [ebx + 0x68]
mov eax, dword [eax + 0x18]
test edx, edx
jne 0x404a50
test eax, eax
je 0x4049fa
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov eax, dword [ebx + 0xb4]
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x68], 1
test eax, eax
je 0x404a17
call sym.__pthread_cleanup_dest.part.0
test byte [ebx + 0x24], 4
je 0x404a90
mov eax, dword [ebx + 0x14]
mov dword [ebx], 0xdeadbeef
test eax, eax
je 0x40492b
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebx + 0x14], 0
sub esp, 4
mov dword [esp], esi
call dbg.pthread_mutex_destroy
jmp 0x404933
test eax, eax
je 0x404a90
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebx + 0x18], 0
sub esp, 4
mov dword [esp], esi
call dbg.pthread_mutex_destroy
mov dword [esp], edi
call dbg.pthread_spin_destroy
cmp eax, 1
je 0x404aa6
mov dword [ebx + 0x38], 0xffffffff
jmp 0x40489b
mov dword [esp], esi
call dbg.pthread_mutex_destroy
jmp 0x404a6f
mov eax, ebx
call sym._push_pthread_mem.part.0
jmp 0x404959
call sym._replace_spin_keys.part.0
lea esi, [esi]
nop
Function at 0x405330
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 0x1c
call sym.__pthread_once_raw.constprop.0.isra.0
mov eax, dword [0x4be014]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x405358
mov eax, dword [eax + 0x18]
add esp, 0x1c
ret
call sym.___pthread_self_lite.part.0
test eax, eax
jne 0x40534d
add esp, 0x1c
ret

Function at 0x405420
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov esi, dword [esp + 0x20]
call sym.___pthread_self_lite
mov dword [eax + 4], esi
mov ebx, eax
mov eax, dword [eax + 0xb4]
test eax, eax
je 0x405442
call sym.__pthread_cleanup_dest.part.0
test byte [ebx + 0x20], 0x30
jne 0x40545c
add ebx, 0x70
mov dword [esp + 4], 1
mov dword [esp], ebx
call dword [sym.imp.msvcrt.dll_longjmp]
mov eax, dword [0x4be014]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
push edx
test eax, eax
je 0x40549d
cmp dword [ebx + 0x14], 0
mov eax, dword [eax + 0x18]
je 0x4054dd
mov dword [ebx + 0x68], 1
mov esi, dword [ebx + 4]
test eax, eax
je 0x405492
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
xor eax, eax
mov dword [ebx + 0x18], eax
test byte [ebx + 0x24], 4
jne 0x4054a6
mov dword [esp], esi
call dword [sym.imp.msvcrt.dll__endthreadex]
mov eax, dword [ebx + 0x14]
mov dword [ebx], 0xdeadbeef
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
push ecx
mov dword [ebx + 0x14], eax
mov eax, ebx
call sym._push_pthread_mem
xor eax, eax
mov dword [esp + 4], eax
mov eax, dword [0x4be014]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push edx
push edx
jmp 0x40549d
mov dword [ebx], 0xdeadbeef
test eax, eax
je 0x4054f1
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
xor eax, eax
mov esi, dword [ebx + 4]
mov dword [ebx + 0x18], eax
jmp 0x4054be

Function at 0x405500
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x50c084]
test eax, eax
jne 0x405510
xor eax, eax
ret
sub esp, 0x1c
call sym.__pthread_once_raw.constprop.0.isra.0
mov eax, dword [0x4be014]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x405550
mov edx, dword [eax + 0x10]
test edx, edx
jle 0x405540
xor eax, eax
add esp, 0x1c
ret
test byte [eax + 0x20], 3
je 0x405534
mov eax, dword [eax + 0x24]
and eax, 1
jmp 0x405536
call sym.___pthread_self_lite.part.0
test eax, eax
jne 0x40552d
jmp 0x405534

Function at 0x405560
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 0x1c
call sym.__pthread_once_raw.constprop.0.isra.0
mov eax, dword [0x4be014]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x4055a0
mov edx, dword [esp + 0x20]
test edx, edx
jle 0x405590
lock add dword [eax + 0x10], 1
add esp, 0x1c
ret
lock sub dword [eax + 0x10], 1
add esp, 0x1c
ret
call sym.___pthread_self_lite.part.0
test eax, eax
jne 0x40557d
add esp, 0x1c
ret
Function at 0x4056a0
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
call sym.__pthread_once_raw.constprop.0.isra.0
mov eax, dword [0x4be014]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x405710
test byte [ebx + 0x20], 0xc
jne 0x4056d0
mov eax, dword [0x50c084]
test eax, eax
jne 0x4056e0
add esp, 0x14
pop ebx
pop esi
ret
lea esi, [ebx + 0x1c]
mov dword [esp], esi
call dbg.pthread_mutex_lock
movzx eax, byte [ebx + 0x20]
test al, 3
je 0x405702
mov edx, dword [ebx + 0x24]
test dl, 1
je 0x405702
mov ecx, dword [ebx + 0x10]
test ecx, ecx
jle 0x405721
mov dword [esp], esi
call dbg.pthread_mutex_unlock
add esp, 0x14
pop ebx
pop esi
ret
call sym.___pthread_self_lite.part.0
mov ebx, eax
test eax, eax
jne 0x4056c1
add esp, 0x14
pop ebx
pop esi
ret
and eax, 0xfffffff3
and edx, 0xfffffffe
or eax, 4
mov dword [ebx + 0x24], edx
mov byte [ebx + 0x20], al
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x405741
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push eax
mov dword [esp], esi
call dbg.pthread_mutex_unlock
call dbg._pthread_invoke_cancel
nop
Function at 0x406230
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x24
mov esi, dword [esp + 0x30]
test esi, esi
je 0x406360
mov dword [esp], 0x4be00c
call dbg.pthread_mutex_lock
mov eax, esi
call dbg.__pthread_get_pointer
mov dword [esp], 0x4be00c
mov ebx, eax
call dbg.pthread_mutex_unlock
test ebx, ebx
je 0x406360
mov eax, dword [ebx + 0x14]
test eax, eax
je 0x406360
lea edx, [esp + 0x1c]
mov dword [esp], eax
mov dword [esp + 4], edx
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
sub esp, 8
test eax, eax
je 0x406360
test byte [ebx + 0x24], 4
jne 0x406370
call sym.__pthread_once_raw.constprop.0.isra.0
mov eax, dword [0x4be014]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x406390
cmp esi, dword [eax + 0xb4]
je 0x4063b8
mov ecx, dword [ebx + 0x68]
mov eax, dword [ebx + 0x14]
test ecx, ecx
je 0x4062d7
lea edx, [eax - 1]
cmp edx, 0xfffffffd
ja 0x4062ee
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebx + 0x14]
sub esp, 8
mov dword [esp], eax
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
mov eax, dword [ebx + 0x18]
sub esp, 4
test eax, eax
je 0x40630b
mov dword [esp], eax
call esi
sub esp, 4
mov edx, dword [esp + 0x34]
mov dword [ebx + 0x18], 0
lea eax, [ebx + 0x1c]
test edx, edx
je 0x4063a8
mov edx, dword [ebx + 4]
mov ecx, dword [esp + 0x34]
mov dword [ecx], edx
mov dword [esp], eax
call dbg.pthread_mutex_destroy
lea eax, [ebx + 0x38]
mov dword [esp], eax
call dbg.pthread_spin_destroy
cmp eax, 1
je 0x4063bf
mov eax, dword [ebx + 0xb0]
mov dword [ebx + 0x38], 0xffffffff
test eax, eax
je 0x406380
xor eax, eax
add esp, 0x24
pop ebx
pop esi
ret
mov eax, 3
add esp, 0x24
pop ebx
pop esi
ret
add esp, 0x24
mov eax, 0x16
pop ebx
pop esi
ret
mov eax, ebx
call sym._push_pthread_mem.part.0
xor eax, eax
jmp 0x406355
call sym.___pthread_self_lite.part.0
test eax, eax
jne 0x4062b9
jmp 0x4062c5
mov dword [esp], eax
call dbg.pthread_mutex_destroy
jmp 0x406332
mov eax, 0x24
jmp 0x406365
call sym._replace_spin_keys.part.0
lea esi, [esi]
lea esi, [esi]
nop

Function at 0x412750
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call dbg.__acrt_iob_func
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sym._fwrite
mov dword [esp], 2
call dbg.__acrt_iob_func
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sym._vfprintf
call sym._abort
lea esi, [esi]