joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4030e0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push 0x40
lea eax, [ebp - 0x50]
push 0
push eax
mov dword [ebp - 0x54], 0x44
call fcn.00403180
add esp, 0xc
xor eax, eax
lea ecx, [ebp - 0x10]
push ecx
mov ecx, dword [ebp + 8]
lea edx, [ebp - 0x54]
push edx
push eax
push eax
push 0x8000000
push eax
push eax
push eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push eax
push ecx
mov dword [ebp - 0x10], 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x403139
xor al, al
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 0xc]
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call esi
mov eax, dword [ebp - 0x10]
push 0xffffffffffffffff
push eax
mov bl, 1
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x40316f
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x403171
mov ecx, dword [ebp - 0x10]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x403171
xor bl, bl
mov edx, dword [ebp - 0x10]
push edx
call esi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4032c0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 8
push esi
mov esi, dword [ebp + 0xc]
push eax
push 0x104
push esi
call fcn.004041b0
add esp, 0xc
test al, al
je 0x4033b8
push 0x40155c
push 0x104
push esi
call fcn.00404200
add esp, 0xc
test al, al
je 0x4033b8
push ebx
push 0x104
push esi
call fcn.00404180
mov ebx, 0x104
sub ebx, eax
add esp, 8
mov dword [ebp - 8], eax
cmp ebx, 0xb
jae 0x403325
pop ebx
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
push edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
shr ecx, 0xc
xor eax, ecx
mov dword [ebp - 4], eax
mov edi, 0xa
jmp 0x403340
mov edx, dword [ebp - 8]
push ebx
lea eax, [esi + edx*2]
push eax
lea eax, [ebp - 4]
push 4
push eax
dec edi
call fcn.00404110
add esp, 0x10
test al, al
je 0x403395
mov eax, dword [ebp - 8]
add eax, 5
cmp eax, 0x104
jae 0x40336e
xor ecx, ecx
mov word [esi + eax*2], cx
push 0x401638
push 0x104
push esi
call fcn.00404200
add esp, 0xc
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x40339e
inc dword [ebp - 4]
test edi, edi
jne 0x403340
pop edi
pop ebx
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
push 0x401634
push 0x104
push esi
call fcn.00404200
add esp, 0xc
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4033c0
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x250
push esi
mov esi, dword [ebp + 8]
push edi
push 0x104
push esi
call fcn.00404180
push 0x401644
push 0x104
push esi
mov edi, eax
call fcn.00404200
add esp, 0x14
test al, al
je 0x4034c9
push ebx
push 0x24c
lea eax, [ebp - 0x24c]
push 0
push eax
mov dword [ebp - 0x250], 0
call fcn.00403180
add esp, 0xc
lea ecx, [ebp - 0x250]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4034b3
cmp word [ebp - 0x1c], 0
lea eax, [ebp - 0x1c]
jne 0x403440
lea eax, [ebp - 0x224]
cmp word [eax], 0x2e
jne 0x40345c
movzx ecx, word [eax + 2]
test cx, cx
je 0x40349a
cmp cx, 0x2e
jne 0x40345c
cmp word [eax + 4], 0
je 0x40349a
lea ecx, [edi + 1]
cmp ecx, 0x104
jae 0x40346d
xor edx, edx
mov word [esi + ecx*2], dx
push eax
push 0x104
push esi
call fcn.00404200
add esp, 0xc
test al, al
je 0x40349a
test byte [ebp - 0x250], 0x10
push esi
je 0x403494
call fcn.004033c0
add esp, 4
jmp 0x40349a
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x250]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x403430
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
pop ebx
cmp edi, 0x104
jae 0x4034c2
xor ecx, ecx
mov word [esi + edi*2], cx
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x403cc0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push esi
lea edx, [ebp - 0x20c]
push edx
xor eax, eax
xor ecx, ecx
push 0x104
mov word [ebp - 4], ax
mov word [ebp - 0x20c], cx
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov esi, dword [ebp + 0xc]
test eax, eax
je 0x403d14
cmp eax, 0x104
jae 0x403d14
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.004032c0
add esp, 8
test al, al
je 0x403d14
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 8]
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp eax, 0x104
jae 0x403d63
test eax, eax
je 0x403d63
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.004043d0
add esp, 8
test eax, eax
je 0x403d63
lea edx, [ebp - 0x20c]
xor ecx, ecx
push esi
push edx
mov word [eax], cx
call fcn.004032c0
add esp, 8
pop esi
mov esp, ebp
pop ebp
ret
xor al, al
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x403d70
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x668
mov edx, dword [ebp + 8]
xor eax, eax
push edx
mov word [ebp - 0x254], ax
lea eax, [ebp - 0x45c]
xor ecx, ecx
push 0x104
push eax
mov word [ebp - 0x45c], cx
call fcn.004041b0
add esp, 0xc
test al, al
je 0x403ee5
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x45c]
push 0x104
push edx
call fcn.00404200
add esp, 0xc
test al, al
je 0x403ee5
push 0x401664
lea eax, [ebp - 0x45c]
push 0x104
push eax
call fcn.00404200
add esp, 0xc
test al, al
je 0x403ee5
push edi
push 0x24c
lea ecx, [ebp - 0x24c]
push 0
push ecx
mov dword [ebp - 0x250], 0
call fcn.00403180
add esp, 0xc
push 0
push 0
push 1
lea edx, [ebp - 0x250]
push edx
push 0
lea eax, [ebp - 0x45c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov edi, eax
cmp edi, 0xffffffff
je 0x403ee4
xor ecx, ecx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextFileW]
xor edx, edx
push esi
mov word [ebp - 0x460], cx
mov word [ebp - 0x668], dx
mov edi, edi
test byte [ebp - 0x250], 0x10
je 0x403ec9
cmp word [ebp - 0x1c], 0
lea esi, [ebp - 0x1c]
jne 0x403e69
lea esi, [ebp - 0x224]
cmp word [esi], 0x2e
jne 0x403e85
movzx eax, word [esi + 2]
test ax, ax
je 0x403ec9
cmp ax, 0x2e
jne 0x403e85
cmp word [esi + 4], 0
je 0x403ec9
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x668]
push 0x104
push ecx
call fcn.004041b0
add esp, 0xc
test al, al
je 0x403ec9
push esi
lea edx, [ebp - 0x668]
push 0x104
push edx
call fcn.00404200
add esp, 0xc
test al, al
je 0x403ec9
lea eax, [ebp - 0x668]
push eax
call fcn.004033c0
add esp, 4
lea ecx, [ebp - 0x250]
push ecx
push edi
call ebx
test eax, eax
jne 0x403e50
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x403ef0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
lea edx, [ebp - 0x20c]
push edx
xor eax, eax
xor ecx, ecx
push 0x104
mov word [ebp - 4], ax
mov word [ebp - 0x20c], cx
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x403f4f
cmp eax, 0x104
jae 0x403f4f
push esi
xor esi, esi
jmp 0x403f30
mov eax, dword [esi + 0x40166c]
push eax
lea ecx, [ebp - 0x20c]
push ecx
call fcn.00403d70
add esi, 4
add esp, 8
cmp esi, 8
jb 0x403f30
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x403f60
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa58
push esi
call fcn.00403ef0
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], 0x65
call fcn.004029b0
lea ecx, [ebp - 0x1c]
call fcn.00402a00
test al, al
je 0x4040d5
mov eax, dword [ebp - 0xc]
sub eax, 1
jne 0x403fa8
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], eax
call fcn.004029d0
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp + 8]
lea edx, [ebp - 0x434]
push edx
xor eax, eax
xor ecx, ecx
push esi
mov word [ebp - 0x22c], ax
mov word [ebp - 0x434], cx
call fcn.00403cc0
add esp, 8
test al, al
jne 0x403fe3
lea ecx, [ebp - 0x1c]
call fcn.004029d0
mov eax, 0x65
pop esi
mov esp, ebp
pop ebp
ret
xor edx, edx
xor eax, eax
xor ecx, ecx
mov word [ebp - 0x20], dx
mov word [ebp - 0x84c], dx
mov word [ebp - 0x438], ax
mov word [ebp - 0x228], ax
mov word [ebp - 0x850], ax
lea edx, [ebp - 0xa58]
push edx
mov word [ebp - 0x640], cx
mov word [ebp - 0x644], cx
mov word [ebp - 0xa58], cx
lea eax, [ebp - 0x84c]
push eax
lea ecx, [ebp - 0x228]
push ecx
lea edx, [ebp - 0x640]
push edx
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0x1c]
push esi
push ecx
call fcn.004038a0
add esp, 0x1c
test al, al
jne 0x40405b
mov dword [ebp - 4], 0x66
jmp 0x404095
push 0xffffffffffffffff
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
lea edx, [ebp - 4]
push edx
lea eax, [ebp - 0x228]
push eax
lea ecx, [ebp - 0x640]
push ecx
lea edx, [ebp - 0x1c]
push edx
call fcn.00403bf0
add esp, 0x10
test al, al
jne 0x404095
mov dword [ebp - 4], 0x67
call fcn.004034d0
test al, al
je 0x4040d5
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x640]
push eax
call esi
lea ecx, [ebp - 0x228]
push ecx
call esi
lea edx, [ebp - 0x84c]
push edx
call esi
lea eax, [ebp - 0xa58]
push eax
call esi
lea ecx, [ebp - 0x434]
push ecx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov esi, dword [ebp - 4]
lea ecx, [ebp - 0x1c]
call fcn.004029d0
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4040f0
Capabilities:
Terminate process

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call fcn.00403f60
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x404460
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
mov eax, dword [esi]
mov ecx, dword [esi + 4]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x404481
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 4
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
jne 0x404499
pop ebx
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 4
mov edx, dword [esi]
mov eax, dword [esi + 4]
push edi
push edx
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 8]
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push ecx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4044ed
push 0
lea edx, [ebp - 4]
push edx
push edi
push ebx
push esi
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
test eax, eax
jne 0x4044f8
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebx
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 4
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
test eax, eax
pop ebx
setne al
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x406533
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040541b
and dword [ebp - 4], 0
cmp dword [0x40c370], 0
mov ebx, eax
jne 0x4065e4
push 0x401ddc
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x406695
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x401dd0
push edi
call esi
test eax, eax
je 0x406695
push eax
call fcn.004053a9
mov dword [esp], 0x401dc0
push edi
mov dword [0x40c370], eax
call esi
push eax
call fcn.004053a9
mov dword [esp], 0x401dac
push edi
mov dword [0x40c374], eax
call esi
push eax
call fcn.004053a9
mov dword [esp], 0x401d90
push edi
mov dword [0x40c378], eax
call esi
push eax
call fcn.004053a9
pop ecx
mov dword [0x40c380], eax
test eax, eax
je 0x4065e4
push 0x401d78
push edi
call esi
push eax
call fcn.004053a9
pop ecx
mov dword [0x40c37c], eax
mov eax, dword [0x40c37c]
cmp eax, ebx
je 0x40663c
cmp dword [0x40c380], ebx
je 0x40663c
push eax
call fcn.00405424
push dword [0x40c380]
mov esi, eax
call fcn.00405424
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40663c
test edi, edi
je 0x40663c
call esi
test eax, eax
je 0x406633
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x406633
test byte [ebp - 0xc], 1
jne 0x40663c
or dword [ebp + 0x10], 0x200000
jmp 0x406675
mov eax, dword [0x40c374]
cmp eax, ebx
je 0x406675
push eax
call fcn.00405424
pop ecx
test eax, eax
je 0x406675
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x406675
mov eax, dword [0x40c378]
cmp eax, ebx
je 0x406675
push eax
call fcn.00405424
pop ecx
test eax, eax
je 0x406675
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x40c370]
call fcn.00405424
pop ecx
test eax, eax
je 0x406695
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x406697
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4083c8
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40b9f8]
jne 0x4083d2
repz ret
jmp fcn.00409a75
Function at 0x407dd0
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
call sub.KERNEL32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x407e06
mov dword [esp + 4], sym.get_globals_dtor_void_
mov dword [esp], eax
mov dword [0x43b830], eax
call sym.___mingwthr_key_dtor
test eax, eax
sete al
movzx eax, al
mov dword [0x434080], eax
mov esp, ebp
pop ebp
ret
call fcn.00410be0
jmp 0x407df5

Function at 0x40b770
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [esp + 4], 1
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sym._fread
mov esp, ebp
pop ebp
ret

Function at 0x40b7a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [esp + 4], 1
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sym._fwrite
mov esp, ebp
pop ebp
ret

Function at 0x40cf40
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], ebx
mov ebx, dword [0x43ba60]
call sub.KERNEL32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x40cf81
mov dword [ebx + 0x28], eax
mov dword [esp + 4], sym._fc_key_dtor
mov eax, dword [ebx + 0x28]
mov dword [esp], eax
call sym.___mingwthr_key_dtor
test eax, eax
sete al
movzx eax, al
mov dword [ebx + 0x2c], eax
mov ebx, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
call fcn.00410be0
jmp 0x40cf6f
Function at 0x40d2d0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov eax, dword [0x43ba60]
mov edi, dword [ebp + 8]
test eax, eax
je 0x40d452
mov ecx, dword [eax + 0x2c]
test ecx, ecx
js 0x40d443
mov edx, dword [eax + 0x2c]
test edx, edx
jne 0x40d41a
mov eax, dword [eax + 0x24]
mov dword [ebp - 0x10], eax
lea esi, [esi]
lea edi, [edi]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
test eax, eax
jne 0x40d410
xor ecx, ecx
mov eax, 5
cmp eax, 5
mov edx, 5
je 0x40d37b
test eax, eax
mov edx, 3
jne 0x40d37b
test ecx, ecx
jne 0x40d343
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
jmp 0x40d310
mov dword [esp + 0x10], edi
lea ebx, [ebp - 0x14]
mov dword [esp + 0x14], ebx
mov eax, dword [edi]
mov edx, dword [edi + 4]
mov dword [esp + 4], 1
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
mov dword [esp], 1
call ecx
cmp eax, 6
je 0x40d385
cmp eax, 8
mov edx, 3
je 0x40d33c
lea esp, [ebp - 0xc]
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [edi + 0xc], 0
mov eax, dword [ebp - 0x14]
mov dword [edi + 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov dword [esp + 4], ebx
mov dword [esp], edi
call sym.__Unwind_RaiseException_Phase2
cmp eax, 7
mov edx, eax
jne 0x40d37b
mov eax, dword [0x43ba60]
mov ebx, dword [ebp - 0x14]
test eax, eax
je 0x40d402
mov edi, dword [eax + 0x2c]
test edi, edi
js 0x40d3f6
mov esi, dword [eax + 0x2c]
test esi, esi
jne 0x40d3d9
mov dword [eax + 0x24], ebx
mov eax, dword [ebp - 0x14]
lea edx, [eax + 0x20]
mov ebp, dword [eax + 0x20]
mov ecx, dword [edx + 4]
mov esp, dword [edx + 8]
jmp ecx
mov eax, dword [eax + 0x28]
mov dword [esp + 4], ebx
mov dword [esp], eax
call sub.KERNEL32.dll_TlsSetValue
sub esp, 8
test eax, eax
jne 0x40d3c8
call fcn.00410be0
jmp 0x40d3c8
call sym._fc_key_init_once
mov eax, dword [0x43ba60]
jmp 0x40d3be
call sym.___w32_sharedptr_initialize
mov eax, dword [0x43ba60]
jmp 0x40d3b7
mov ecx, dword [eax + 0x18]
xor eax, eax
jmp 0x40d325
mov ebx, dword [eax + 0x28]
call fcn.00410be0
mov esi, eax
mov dword [esp], ebx
call sub.KERNEL32.dll_TlsGetValue
sub esp, 4
mov ebx, eax
mov dword [esp], esi
call sub.KERNEL32.dll_SetLastError
sub esp, 4
mov eax, ebx
jmp 0x40d302
call sym._fc_key_init_once
mov eax, dword [0x43ba60]
jmp 0x40d2f4
call sym.___w32_sharedptr_initialize
mov eax, dword [0x43ba60]
jmp 0x40d2e9
Function at 0x40d570
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov eax, dword [0x43ba60]
mov edi, dword [ebp + 8]
test eax, eax
je 0x40d670
mov ecx, dword [eax + 0x2c]
test ecx, ecx
js 0x40d660
mov edx, dword [eax + 0x2c]
test edx, edx
jne 0x40d633
mov eax, dword [eax + 0x24]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov dword [edi + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [edi + 0x10], eax
lea eax, [ebp - 0x14]
mov dword [esp + 4], eax
mov dword [esp], edi
call sym.__Unwind_ForcedUnwind_Phase2
cmp eax, 7
je 0x40d5d0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [0x43ba60]
mov ebx, dword [ebp - 0x14]
test eax, eax
je 0x40d627
mov edi, dword [eax + 0x2c]
test edi, edi
js 0x40d61b
mov esi, dword [eax + 0x2c]
test esi, esi
jne 0x40d5fe
mov dword [eax + 0x24], ebx
mov eax, dword [ebp - 0x14]
lea edx, [eax + 0x20]
mov ebp, dword [eax + 0x20]
mov ecx, dword [edx + 4]
mov esp, dword [edx + 8]
jmp ecx
mov eax, dword [eax + 0x28]
mov dword [esp + 4], ebx
mov dword [esp], eax
call sub.KERNEL32.dll_TlsSetValue
sub esp, 8
test eax, eax
jne 0x40d5ed
call fcn.00410be0
jmp 0x40d5ed
call sym._fc_key_init_once
mov eax, dword [0x43ba60]
jmp 0x40d5e3
call sym.___w32_sharedptr_initialize
mov eax, dword [0x43ba60]
jmp 0x40d5dc
mov ebx, dword [eax + 0x28]
call fcn.00410be0
mov esi, eax
mov dword [esp], ebx
call sub.KERNEL32.dll_TlsGetValue
sub esp, 4
mov ebx, eax
mov dword [esp], esi
call sub.KERNEL32.dll_SetLastError
sub esp, 4
mov eax, ebx
jmp 0x40d5a2
call sym._fc_key_init_once
mov eax, dword [0x43ba60]
jmp 0x40d594
call sym.___w32_sharedptr_initialize
mov eax, dword [0x43ba60]
jmp 0x40d589
Function at 0x40d680
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov eax, dword [0x43ba60]
mov edi, dword [ebp + 8]
test eax, eax
je 0x40d7a0
mov ecx, dword [eax + 0x2c]
test ecx, ecx
js 0x40d790
mov edx, dword [eax + 0x2c]
test edx, edx
jne 0x40d764
mov eax, dword [eax + 0x24]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
mov eax, dword [edi + 0xc]
test eax, eax
jne 0x40d750
mov dword [esp], edi
lea eax, [ebp - 0x14]
mov dword [esp + 4], eax
call sym.__Unwind_RaiseException_Phase2
cmp eax, 7
jne 0x40d7af
mov eax, dword [0x43ba60]
mov ebx, dword [ebp - 0x14]
test eax, eax
je 0x40d740
mov edi, dword [eax + 0x2c]
test edi, edi
js 0x40d730
mov esi, dword [eax + 0x2c]
test esi, esi
jne 0x40d710
mov dword [eax + 0x24], ebx
mov eax, dword [ebp - 0x14]
lea edx, [eax + 0x20]
mov ebp, dword [eax + 0x20]
mov ecx, dword [edx + 4]
mov esp, dword [edx + 8]
jmp ecx
mov eax, dword [eax + 0x28]
mov dword [esp + 4], ebx
mov dword [esp], eax
call sub.KERNEL32.dll_TlsSetValue
sub esp, 8
test eax, eax
jne 0x40d6f8
call fcn.00410be0
jmp 0x40d6f8
call sym._fc_key_init_once
mov eax, dword [0x43ba60]
jmp 0x40d6ee
call sym.___w32_sharedptr_initialize
mov eax, dword [0x43ba60]
jmp 0x40d6e7
mov dword [esp], edi
lea eax, [ebp - 0x14]
mov dword [esp + 4], eax
call sym.__Unwind_ForcedUnwind_Phase2
jmp 0x40d6d2
mov ebx, dword [eax + 0x28]
call fcn.00410be0
mov esi, eax
mov dword [esp], ebx
call sub.KERNEL32.dll_TlsGetValue
sub esp, 4
mov ebx, eax
mov dword [esp], esi
call sub.KERNEL32.dll_SetLastError
sub esp, 4
mov eax, ebx
jmp 0x40d6b2
call sym._fc_key_init_once
mov eax, dword [0x43ba60]
jmp 0x40d6a4
call sym.___w32_sharedptr_initialize
mov eax, dword [0x43ba60]
jmp 0x40d699
call sym._abort
lea esi, [esi]
lea edi, [edi]
Function at 0x40d7c0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 4], edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], esi
mov ebx, dword [edi + 0xc]
test ebx, ebx
je 0x40d8d7
mov eax, dword [0x43ba60]
test eax, eax
je 0x40d8c8
mov ecx, dword [eax + 0x2c]
test ecx, ecx
js 0x40d8b9
mov edx, dword [eax + 0x2c]
test edx, edx
jne 0x40d890
mov eax, dword [eax + 0x24]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
mov dword [esp + 4], eax
mov dword [esp], edi
call sym.__Unwind_ForcedUnwind_Phase2
cmp eax, 7
jne 0x40d8ec
mov eax, dword [0x43ba60]
mov ebx, dword [ebp - 0x14]
test eax, eax
je 0x40d880
mov edi, dword [eax + 0x2c]
test edi, edi
js 0x40d86d
mov esi, dword [eax + 0x2c]
test esi, esi
jne 0x40d850
mov dword [eax + 0x24], ebx
mov eax, dword [ebp - 0x14]
lea edx, [eax + 0x20]
mov ebp, dword [eax + 0x20]
mov ecx, dword [edx + 4]
mov esp, dword [edx + 8]
jmp ecx
mov eax, dword [eax + 0x28]
mov dword [esp + 4], ebx
mov dword [esp], eax
call sub.KERNEL32.dll_TlsSetValue
sub esp, 8
test eax, eax
jne 0x40d83e
call fcn.00410be0
jmp 0x40d83e
call sym._fc_key_init_once
mov eax, dword [0x43ba60]
jmp 0x40d834
call sym.___w32_sharedptr_initialize
mov eax, dword [0x43ba60]
jmp 0x40d82d
mov ebx, dword [eax + 0x28]
call fcn.00410be0
mov esi, eax
mov dword [esp], ebx
call sub.KERNEL32.dll_TlsGetValue
sub esp, 4
mov ebx, eax
mov dword [esp], esi
call sub.KERNEL32.dll_SetLastError
sub esp, 4
mov eax, ebx
jmp 0x40d803
call sym._fc_key_init_once
mov eax, dword [0x43ba60]
jmp 0x40d7f5
call sym.___w32_sharedptr_initialize
mov eax, dword [0x43ba60]
jmp 0x40d7ea
mov dword [esp], edi
call sym.__Unwind_SjLj_RaiseException
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
call sym._abort
jmp sym.__Unwind_DeleteException

Function at 0x40dd30
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
call sub.KERNEL32.dll_TlsAlloc
cmp eax, 0xffffffff
mov edx, eax
je 0x40dd60
mov eax, dword [ebp + 8]
mov dword [eax], edx
mov eax, dword [ebp + 0xc]
mov dword [esp], edx
mov dword [esp + 4], eax
call sym.___mingwthr_key_dtor
mov esp, ebp
pop ebp
ret
call fcn.00410be0
jmp 0x40dd56

Function at 0x410dc0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp sym.___do_sjlj_init