joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45d068
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
mov edi, edx
mov eax, dword [ebp - 4]
mov ebx, dword [ebp + 0xc]
add eax, 0x3c
mov esi, 0x10
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x38]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp + 8]
add eax, dword [ebp - 8]
mov dword [edx], eax
cmp esi, eax
jbe 0x45d0d0
mov ecx, dword [ebp - 8]
push ecx
push edi
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0x10]
add eax, 0x28
push eax
call fcn.0045c72c
add esp, 0xc
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
add dword [edx + 0x38], ecx
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax], edx
xor eax, eax
jmp 0x45d1db
cmp ebx, edi
jne 0x45d0de
mov eax, 0x1001
jmp 0x45d1db
mov edx, esi
sub edx, dword [ebp - 0x10]
push edx
push edi
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 0x10]
add ecx, 0x28
push ecx
call fcn.0045c72c
mov eax, esi
mov edx, esi
sub eax, dword [ebp - 0x10]
sub edx, dword [ebp - 0x10]
sub dword [ebp - 8], edx
add edi, eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 4]
add esp, 0xc
mov eax, dword [ecx + 0x18]
xor eax, dword [edx + 0x28]
mov dword [ebx], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ecx + 0x1c]
xor eax, dword [edx + 0x2c]
mov dword [ebx + 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ecx + 0x20]
xor eax, dword [edx + 0x30]
mov dword [ebx + 8], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ecx + 0x24]
xor eax, dword [edx + 0x34]
mov edx, ebx
mov dword [ebx + 0xc], eax
mov eax, dword [ebp - 0xc]
call fcn.0045ebbc
add ebx, esi
cmp esi, dword [ebp - 8]
ja 0x45d18d
mov eax, ebx
sub eax, esi
mov edx, dword [eax]
xor edx, dword [edi]
mov dword [ebx], edx
mov ecx, dword [eax + 4]
xor ecx, dword [edi + 4]
mov dword [ebx + 4], ecx
mov edx, dword [eax + 8]
xor edx, dword [edi + 8]
mov dword [ebx + 8], edx
mov eax, dword [eax + 0xc]
xor eax, dword [edi + 0xc]
mov dword [ebx + 0xc], eax
mov edx, ebx
mov eax, dword [ebp - 0xc]
call fcn.0045ebbc
add edi, esi
add ebx, esi
sub dword [ebp - 8], esi
cmp esi, dword [ebp - 8]
jbe 0x45d152
mov eax, ebx
mov ecx, dword [ebp - 4]
sub eax, esi
mov edx, dword [eax]
mov dword [ecx + 0x18], edx
mov ecx, dword [ebp - 4]
mov edx, dword [eax + 4]
mov dword [ecx + 0x1c], edx
mov ecx, dword [ebp - 4]
mov edx, dword [eax + 8]
mov dword [ecx + 0x20], edx
mov edx, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov dword [edx + 0x24], eax
mov eax, dword [ebp - 8]
push eax
push edi
mov ecx, dword [ebp - 4]
add ecx, 0x28
push ecx
call fcn.0045c72c
add esp, 0xc
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [eax + 0x38], edx
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 8]
sub dword [ecx], eax
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x45d1e4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov ebx, eax
push esi
push edi
mov dword [ebp - 4], ecx
lea eax, [ebx + 0x3c]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 0x10
mov edi, edx
mov edx, dword [ebx + 0x38]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp + 8]
add eax, dword [ebp - 4]
mov dword [edx], eax
cmp eax, dword [ebp - 0xc]
jae 0x45d244
mov ecx, dword [ebp - 4]
push ecx
push edi
mov eax, dword [ebp - 0x10]
add eax, ebx
add eax, 0x28
push eax
call fcn.0045c72c
add esp, 0xc
mov edx, dword [ebp - 4]
add dword [ebx + 0x38], edx
mov ecx, dword [ebp + 8]
xor eax, eax
mov dword [ecx], eax
xor eax, eax
jmp 0x45d321
cmp esi, edi
jne 0x45d252
mov eax, 0x1001
jmp 0x45d321
mov edx, dword [ebp - 0xc]
sub edx, dword [ebp - 0x10]
push edx
push edi
mov ecx, dword [ebp - 0x10]
add ecx, ebx
add ecx, 0x28
push ecx
call fcn.0045c72c
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0xc]
sub eax, dword [ebp - 0x10]
sub edx, dword [ebp - 0x10]
add edi, eax
add esp, 0xc
sub dword [ebp - 4], edx
lea edx, [ebx + 0x18]
mov eax, dword [ebp - 8]
call fcn.0045ebbc
mov ecx, dword [ebx + 0x18]
xor ecx, dword [ebx + 0x28]
mov dword [esi], ecx
mov eax, dword [ebx + 0x1c]
xor eax, dword [ebx + 0x2c]
mov dword [esi + 4], eax
mov edx, dword [ebx + 0x20]
xor edx, dword [ebx + 0x30]
mov dword [esi + 8], edx
mov ecx, dword [ebx + 0x24]
xor ecx, dword [ebx + 0x34]
mov dword [esi + 0xc], ecx
add esi, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0xc]
jb 0x45d2f7
lea edx, [ebx + 0x18]
mov eax, dword [ebp - 8]
call fcn.0045ebbc
mov edx, dword [edi]
xor edx, dword [ebx + 0x18]
mov dword [esi], edx
mov ecx, dword [edi + 4]
xor ecx, dword [ebx + 0x1c]
mov dword [esi + 4], ecx
mov eax, dword [edi + 8]
xor eax, dword [ebx + 0x20]
mov dword [esi + 8], eax
mov edx, dword [edi + 0xc]
xor edx, dword [ebx + 0x24]
mov dword [esi + 0xc], edx
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0xc]
sub dword [ebp - 4], edx
add edi, eax
mov ecx, dword [ebp - 4]
add esi, eax
cmp ecx, dword [ebp - 0xc]
jae 0x45d2b5
mov eax, dword [ebp - 4]
lea edx, [ebx + 0x28]
push eax
push edi
push edx
call fcn.0045c72c
add esp, 0xc
mov ecx, dword [ebx + 0x38]
and ecx, 0xf0000000
add ecx, dword [ebp - 4]
mov dword [ebx + 0x38], ecx
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 4]
sub dword [eax], edx
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x45d32c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov ebx, eax
push esi
push edi
mov dword [ebp - 4], ecx
lea eax, [ebx + 0x3c]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 0x10
mov edi, edx
mov edx, dword [ebx + 0x38]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp + 8]
add eax, dword [ebp - 4]
mov dword [edx], eax
cmp eax, dword [ebp - 0xc]
jae 0x45d38c
mov ecx, dword [ebp - 4]
push ecx
push edi
mov eax, dword [ebp - 0x10]
add eax, ebx
add eax, 0x28
push eax
call fcn.0045c72c
add esp, 0xc
mov edx, dword [ebp - 4]
add dword [ebx + 0x38], edx
mov ecx, dword [ebp + 8]
xor eax, eax
mov dword [ecx], eax
xor eax, eax
jmp 0x45d481
cmp esi, edi
jne 0x45d39a
mov eax, 0x1001
jmp 0x45d481
mov edx, dword [ebp - 0xc]
sub edx, dword [ebp - 0x10]
push edx
push edi
mov ecx, dword [ebp - 0x10]
add ecx, ebx
add ecx, 0x28
push ecx
call fcn.0045c72c
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0xc]
sub eax, dword [ebp - 0x10]
sub edx, dword [ebp - 0x10]
add edi, eax
add esp, 0xc
sub dword [ebp - 4], edx
lea edx, [ebx + 0x18]
mov eax, dword [ebp - 8]
call fcn.0045ebbc
mov ecx, dword [ebx + 0x28]
xor dword [ebx + 0x18], ecx
mov eax, dword [ebx + 0x2c]
xor dword [ebx + 0x1c], eax
mov edx, dword [ebx + 0x30]
xor dword [ebx + 0x20], edx
mov ecx, dword [ebx + 0x34]
xor dword [ebx + 0x24], ecx
mov eax, dword [ebx + 0x18]
mov dword [esi], eax
mov edx, dword [ebx + 0x1c]
mov dword [esi + 4], edx
mov ecx, dword [ebx + 0x20]
mov dword [esi + 8], ecx
mov eax, dword [ebx + 0x24]
mov dword [esi + 0xc], eax
add esi, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
cmp edx, dword [ebp - 0xc]
jb 0x45d457
lea edx, [ebx + 0x18]
mov eax, dword [ebp - 8]
call fcn.0045ebbc
mov ecx, dword [edi]
xor dword [ebx + 0x18], ecx
mov eax, dword [edi + 4]
xor dword [ebx + 0x1c], eax
mov edx, dword [edi + 8]
xor dword [ebx + 0x20], edx
mov ecx, dword [edi + 0xc]
xor dword [ebx + 0x24], ecx
mov eax, dword [ebx + 0x18]
mov dword [esi], eax
mov edx, dword [ebx + 0x1c]
mov dword [esi + 4], edx
mov ecx, dword [ebx + 0x20]
mov dword [esi + 8], ecx
mov eax, dword [ebx + 0x24]
mov dword [esi + 0xc], eax
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0xc]
sub dword [ebp - 4], edx
add edi, eax
mov ecx, dword [ebp - 4]
add esi, eax
cmp ecx, dword [ebp - 0xc]
jae 0x45d409
mov eax, dword [ebp - 4]
lea edx, [ebx + 0x28]
push eax
push edi
push edx
call fcn.0045c72c
add esp, 0xc
mov ecx, dword [ebx + 0x38]
and ecx, 0xf0000000
add ecx, dword [ebp - 4]
mov dword [ebx + 0x38], ecx
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 4]
sub dword [eax], edx
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x45d5dc
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov dword [esp + 4], ecx
mov dword [esp], edx
mov ecx, dword [esp + 4]
mov esi, dword [ebx + 0x38]
mov edx, 0x10
lea eax, [ebx + 0x3c]
mov dword [ecx], edx
lea edx, [ebx + 0x18]
call fcn.0045ebbc
xor ecx, ecx
mov eax, dword [esp]
mov edx, eax
lea eax, [ebx + 0x28]
cmp esi, ecx
jbe 0x45d61f
mov bl, byte [eax]
inc ecx
xor bl, byte [eax - 0x10]
inc eax
mov byte [edx], bl
inc edx
cmp esi, ecx
ja 0x45d611
mov eax, dword [esp + 4]
mov dword [eax], esi
xor eax, eax
pop ecx
pop edx
pop esi
pop ebx
ret
Function at 0x45da08
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov ebx, eax
push esi
push edi
mov dword [ebp - 4], ecx
lea eax, [ebx + 0x3c]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 0x10
mov edi, edx
mov edx, dword [ebx + 0x38]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp + 8]
add eax, dword [ebp - 4]
mov dword [edx], eax
cmp eax, dword [ebp - 0xc]
ja 0x45da68
mov ecx, dword [ebp - 4]
push ecx
push edi
mov eax, dword [ebp - 0x10]
add eax, ebx
add eax, 0x28
push eax
call fcn.0045c72c
add esp, 0xc
mov edx, dword [ebp - 4]
add dword [ebx + 0x38], edx
mov ecx, dword [ebp + 8]
xor eax, eax
mov dword [ecx], eax
xor eax, eax
jmp 0x45db4a
cmp edi, esi
jne 0x45da76
mov eax, 0x1001
jmp 0x45db4a
mov edx, dword [ebp + 8]
mov dword [edx], eax
mov ecx, dword [ebp - 0xc]
sub ecx, dword [ebp - 0x10]
push ecx
push edi
mov eax, dword [ebp - 0x10]
add eax, ebx
add eax, 0x28
push eax
call fcn.0045c72c
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
sub edx, dword [ebp - 0x10]
sub ecx, dword [ebp - 0x10]
add edi, edx
add esp, 0xc
sub dword [ebp - 4], ecx
lea edx, [ebx + 0x18]
mov eax, dword [ebp - 8]
call fcn.0045ebbc
mov ecx, dword [ebx + 0x18]
xor ecx, dword [ebx + 0x28]
mov dword [esi], ecx
mov eax, dword [ebx + 0x1c]
xor eax, dword [ebx + 0x2c]
mov dword [esi + 4], eax
mov edx, dword [ebx + 0x20]
xor edx, dword [ebx + 0x30]
mov dword [esi + 8], edx
mov ecx, dword [ebx + 0x24]
xor ecx, dword [ebx + 0x34]
mov dword [esi + 0xc], ecx
add esi, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0xc]
jbe 0x45db20
lea edx, [ebx + 0x18]
mov eax, dword [ebp - 8]
call fcn.0045ebbc
mov edx, dword [edi]
xor edx, dword [ebx + 0x18]
mov dword [esi], edx
mov ecx, dword [edi + 4]
xor ecx, dword [ebx + 0x1c]
mov dword [esi + 4], ecx
mov eax, dword [edi + 8]
xor eax, dword [ebx + 0x20]
mov dword [esi + 8], eax
mov edx, dword [edi + 0xc]
xor edx, dword [ebx + 0x24]
mov dword [esi + 0xc], edx
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0xc]
sub dword [ebp - 4], edx
add edi, eax
mov ecx, dword [ebp - 4]
add esi, eax
cmp ecx, dword [ebp - 0xc]
ja 0x45dade
mov eax, dword [ebp - 4]
lea edx, [ebx + 0x28]
push eax
push edi
push edx
call fcn.0045c72c
add esp, 0xc
mov ecx, dword [ebx + 0x38]
and ecx, 0xf0000000
add ecx, dword [ebp - 4]
mov dword [ebx + 0x38], ecx
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 4]
sub dword [eax], edx
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x45db54
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov ebx, eax
push esi
push edi
mov dword [ebp - 4], ecx
lea eax, [ebx + 0x3c]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 0x10
mov esi, edx
mov edx, dword [ebx + 0x38]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp + 8]
add eax, dword [ebp - 4]
mov dword [edx], eax
cmp eax, dword [ebp - 0xc]
ja 0x45dbb4
mov ecx, dword [ebp - 4]
push ecx
push esi
mov eax, dword [ebp - 0x10]
add eax, ebx
add eax, 0x28
push eax
call fcn.0045c72c
add esp, 0xc
mov edx, dword [ebp - 4]
add dword [ebx + 0x38], edx
mov ecx, dword [ebp + 8]
xor eax, eax
mov dword [ecx], eax
xor eax, eax
jmp 0x45dcc5
cmp esi, edi
jne 0x45dbc2
mov eax, 0x1001
jmp 0x45dcc5
mov edx, dword [ebp + 8]
mov dword [edx], eax
mov ecx, dword [ebp - 0xc]
sub ecx, dword [ebp - 0x10]
push ecx
push esi
mov eax, dword [ebp - 0x10]
add eax, ebx
add eax, 0x28
push eax
call fcn.0045c72c
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
sub edx, dword [ebp - 0x10]
sub ecx, dword [ebp - 0x10]
add esi, edx
add esp, 0xc
sub dword [ebp - 4], ecx
lea edx, [ebx + 0x18]
mov eax, dword [ebp - 8]
call fcn.0045ebbc
mov ecx, dword [ebx + 0x18]
xor ecx, dword [ebx + 0x28]
mov dword [edi], ecx
mov eax, dword [ebx + 0x1c]
xor eax, dword [ebx + 0x2c]
mov dword [edi + 4], eax
mov edx, dword [ebx + 0x20]
xor edx, dword [ebx + 0x30]
mov dword [edi + 8], edx
mov ecx, dword [ebx + 0x24]
xor ecx, dword [ebx + 0x34]
mov dword [edi + 0xc], ecx
mov eax, dword [ebx + 0x28]
mov dword [ebx + 0x18], eax
mov edx, dword [ebx + 0x2c]
mov dword [ebx + 0x1c], edx
mov ecx, dword [ebx + 0x30]
mov dword [ebx + 0x20], ecx
mov eax, dword [ebx + 0x34]
mov dword [ebx + 0x24], eax
add edi, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
cmp edx, dword [ebp - 0xc]
jbe 0x45dc9b
lea edx, [ebx + 0x18]
mov eax, dword [ebp - 8]
call fcn.0045ebbc
mov ecx, dword [ebx + 0x18]
xor ecx, dword [esi]
mov dword [edi], ecx
mov eax, dword [ebx + 0x1c]
xor eax, dword [esi + 4]
mov dword [edi + 4], eax
mov edx, dword [ebx + 0x20]
xor edx, dword [esi + 8]
mov dword [edi + 8], edx
mov ecx, dword [ebx + 0x24]
xor ecx, dword [esi + 0xc]
mov dword [edi + 0xc], ecx
mov eax, dword [esi]
mov dword [ebx + 0x18], eax
mov edx, dword [esi + 4]
mov dword [ebx + 0x1c], edx
mov ecx, dword [esi + 8]
mov dword [ebx + 0x20], ecx
mov eax, dword [esi + 0xc]
mov dword [ebx + 0x24], eax
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0xc]
sub dword [ebp - 4], edx
add esi, eax
mov ecx, dword [ebp - 4]
add edi, eax
cmp ecx, dword [ebp - 0xc]
ja 0x45dc42
mov eax, dword [ebp - 4]
lea edx, [ebx + 0x28]
push eax
push esi
push edx
call fcn.0045c72c
add esp, 0xc
mov ecx, dword [ebx + 0x38]
and ecx, 0xf0000000
add ecx, dword [ebp - 4]
mov dword [ebx + 0x38], ecx
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 4]
sub dword [eax], edx
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x45de6c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, eax
mov dword [esp], ecx
mov edi, edx
mov edx, dword [esp]
mov esi, dword [ebx + 0x38]
lea eax, [ebx + 0x3c]
mov dword [edx], esi
lea edx, [ebx + 0x18]
call fcn.0045ebbc
xor ecx, ecx
mov edx, edi
lea eax, [ebx + 0x28]
cmp esi, ecx
jbe 0x45dea3
mov bl, byte [eax]
inc ecx
xor bl, byte [eax - 0x10]
inc eax
mov byte [edx], bl
inc edx
cmp esi, ecx
ja 0x45de95
mov eax, dword [esp]
mov dword [eax], esi
xor eax, eax
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x405340
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x546a20]
cmp eax, 2
je 0x4053d3
push esi
push 0
push 1
push 0x546a20
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
jne 0x4053af
push 4
call fcn.004c65df
mov esi, eax
add esp, 4
mov dword [ebp - 4], esi
mov dword [esi], 0
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
push 0x546a20
mov dword [esi], eax
push 0x405470
mov dword [0x546a24], esi
call fcn.00404560
mov eax, dword [0x546a24]
add esp, 8
mov dword [0x546a20], 2
pop esi
mov esp, ebp
pop ebp
ret
cmp eax, 2
je 0x4053d2
mov eax, dword [0x546a20]
cmp eax, 2
je 0x4053d2
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call esi
mov eax, dword [0x546a20]
cmp eax, 2
jne 0x4053c4
pop esi
mov eax, dword [0x546a24]
mov esp, ebp
pop ebp
ret

Function at 0x405b20
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fc3ad
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x53e180]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.00405a60
mov edi, dword [ebp + 8]
test edi, edi
js 0x405bc7
call fcn.00405340
push dword [eax]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test ebx, ebx
je 0x405bc7
call fcn.00405a60
mov esi, eax
push esi
mov dword [ebp - 0x10], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [ebp - 4], 0
mov eax, dword [ebx]
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], eax
call fcn.00405a60
mov edi, eax
lea eax, [ebp - 0x18]
push eax
lea ecx, [edi + 0x18]
call fcn.00405d80
push eax
add eax, 0x10
push eax
push ecx
lea eax, [ebp - 0x18]
push eax
lea ecx, [edi + 0x18]
call fcn.00405da0
cmp byte [ebp - 0x14], 0
jne 0x405bdb
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x14]
cmp eax, dword [ebx]
je 0x405bdb
test esi, esi
je 0x405bc7
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
inc dword [ebx + 8]
mov eax, dword [ebp + 8]
mov dword [ebx + 0xc], eax
test esi, esi
je 0x405bef
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x407dc0
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x546a28]
cmp eax, 2
je 0x407e53
push esi
push 0
push 1
push 0x546a28
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
jne 0x407e2f
push 4
call fcn.004c65df
mov esi, eax
add esp, 4
mov dword [ebp - 4], esi
mov dword [esi], 0
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
push 0x546a28
mov dword [esi], eax
push 0x405470
mov dword [0x546a2c], esi
call fcn.00404560
mov eax, dword [0x546a2c]
add esp, 8
mov dword [0x546a28], 2
pop esi
mov esp, ebp
pop ebp
ret
cmp eax, 2
je 0x407e52
mov eax, dword [0x546a28]
cmp eax, 2
je 0x407e52
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call esi
mov eax, dword [0x546a28]
cmp eax, 2
jne 0x407e44
pop esi
mov eax, dword [0x546a2c]
mov esp, ebp
pop ebp
ret

Function at 0x408f40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
mov ebx, ecx
mov dword [esp + 8], 0
mov ecx, dword [ebp + 8]
push esi
push edi
xor edi, edi
lea eax, [ecx - 1]
mov dword [esp + 0x1c], eax
sar eax, 1
mov dword [esp + 0x18], eax
test eax, eax
jle 0x409013
lea ecx, [edi + edi]
lea eax, [ecx*8]
mov dword [esp + 0x14], ecx
sub eax, ecx
mov ecx, dword [ebx + eax*8 + 0x70]
mov edi, dword [ebx + eax*8 + 0x74]
lea edx, [ebx + eax*8]
mov esi, dword [edx + 0x3c]
mov eax, dword [edx + 0x38]
cmp edi, esi
jl 0x408fa9
jg 0x408f9b
cmp ecx, eax
jbe 0x408f9f
xor eax, eax
jmp 0x408fbb
cmp edi, esi
jg 0x408fb0
jl 0x408fa9
cmp ecx, eax
jae 0x408fb0
mov eax, 1
jmp 0x408fbb
mov ecx, dword [edx + 0x78]
xor eax, eax
cmp ecx, dword [edx + 0x40]
setle al
mov edi, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
inc edi
add edi, eax
lea eax, [edi*8]
sub eax, edi
lea esi, [ebx + eax*8]
lea eax, [ecx*8]
sub eax, ecx
mov ecx, dword [esi + 4]
lea edx, [ebx + eax*8]
mov eax, dword [esi]
mov dword [edx], eax
mov dword [edx + 4], ecx
lea ecx, [edx + 0x10]
mov eax, dword [esi + 8]
mov dword [edx + 8], eax
mov al, byte [esi + 0xc]
mov byte [edx + 0xc], al
lea eax, [esi + 0x10]
push eax
call fcn.00408ac0
mov eax, dword [esp + 0x18]
mov dword [esp + 0x10], edi
cmp edi, eax
jl 0x408f70
mov ecx, dword [ebp + 8]
mov edx, edi
cmp edi, eax
jne 0x40905e
test cl, 1
jne 0x40905e
lea eax, [ecx*8]
sub eax, ecx
mov ecx, dword [ebx + eax*8 - 0x34]
lea esi, [ebx + eax*8]
lea eax, [edi*8]
sub eax, edi
lea edx, [ebx + eax*8]
mov eax, dword [esi - 0x38]
mov dword [edx], eax
mov dword [edx + 4], ecx
lea ecx, [edx + 0x10]
mov eax, dword [esi - 0x30]
mov dword [edx + 8], eax
mov al, byte [esi - 0x2c]
mov byte [edx + 0xc], al
lea eax, [esi - 0x28]
push eax
call fcn.00408ac0
mov edx, dword [esp + 0x1c]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ecx
mov ecx, ebx
call fcn.00408990
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x409090
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov eax, dword [esi + 8]
mov dword [esi], vtable.nbase::Thread.0
test eax, eax
je 0x4090d7
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x4090c0
mov eax, dword [esi + 8]
test eax, eax
je 0x4090d7
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 4], 0
mov dword [esi + 8], 0
test byte [ebp + 8], 1
je 0x4090e8
push 0x10
push esi
call fcn.004c660f
add esp, 8
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x409910
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
mov esi, ecx
call fcn.00407dc0
push dword [eax]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push 1
cmp byte [eax + 0x14], 0
lea eax, [ebp - 0x1c]
je 0x409975
push 0xf
push 0xf
push 0
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
jne 0x409971
push 1
push 0x113
push 0x113
push eax
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
jne 0x409971
push eax
lea eax, [esi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
mov bl, 1
jmp 0x409987
push 0
push 0
push 0
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
setne bl
push 0
lea eax, [esi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
test bl, bl
jne 0x40999f
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xc]
lea eax, [ebp - 0x1c]
mov ecx, esi
push eax
call fcn.00409860
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40a2b0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fca8d
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x53e180]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
lea esi, [edi + 0xc]
push esi
mov dword [ebp - 0x10], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [ebp - 4], 0
cmp dword [edi + 0x24], 0
je 0x40a308
call fcn.00407dc0
push dword [eax]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, dword [edi + 0x24]
jne 0x40a308
mov bl, 1
jmp 0x40a30a
xor bl, bl
test esi, esi
je 0x40a315
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret