joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46d256
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
xor esi, 0x38b1
pop esi
cmp dword [ebp - 0xc2c], 0
jne 0x46d278
mov dword [ebp - 0x6ec], 0
jmp 0x46d4d8
mov ecx, dword [ebp - 0xc2c]
mov dword [ebp - 0x4d8], ecx
push edi
jmp 0x46d28c
and edi, 0x10681
jmp 0x46d298
call 0x46d2a6
add byte [ecx + 0x32], al
dec ebx
inc eax
aaa
dec ebp
add esp, 4
pop edi
push ebx
push eax
add esp, 4
sub ebx, 0x381b
pop ebx
lea edx, [ebp - 0x16cc]
mov dword [ebp - 0xc28], edx
mov eax, dword [ebp - 0x4d8]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xc24], ecx
xor edx, edx
mov word [ebp - 0x1fc], dx
xor eax, eax
mov word [ebp - 0x104], ax
push ecx
push esi
add esp, 4
call 0x46d2f7
add byte [esi + 0x3b], al
inc ebp
cmp eax, 0x44463e33
dec eax
add esp, 4
or ecx, 0x45c3
pop ecx
push eax
sub eax, 0x131bf
or eax, 0x770d
or eax, 0x1571e
pop eax
mov ecx, dword [ebp - 0xc24]
mov dx, word [ecx]
mov word [ebp - 0xf82], dx
mov eax, dword [ebp - 0xc24]
add eax, 2
mov dword [ebp - 0xc24], eax
mov cx, word [ebp - 0xf82]
mov word [ebp - 0x1fc], cx
mov edx, dword [ebp - 0xc28]
mov ax, word [edx]
mov word [ebp - 0xf84], ax
mov ecx, dword [ebp - 0xc28]
add ecx, 2
mov dword [ebp - 0xc28], ecx
mov dx, word [ebp - 0xf84]
mov word [ebp - 0x104], dx
push ebx
xor ebx, 0x7b92
xor ebx, 0x1200
add ebx, 0xf21
sub ebx, 0x45ef
pop ebx
push ecx
push ebx
add esp, 4
xor ecx, 0x518c
or ecx, 0x14c2c
sub ecx, 0x17462
pop ecx
movzx eax, word [ebp - 0x104]
test eax, eax
jne 0x46d3c4
movzx ecx, word [ebp - 0x1fc]
movzx edx, word [ebp - 0x104]
sub ecx, edx
mov dword [ebp - 0x14e4], ecx
jmp 0x46d427
movzx eax, word [ebp - 0x1fc]
movzx ecx, word [ebp - 0x104]
cmp eax, ecx
je 0x46d2e3
movzx edx, word [ebp - 0x1fc]
xor edx, 0x20
movzx eax, word [ebp - 0x104]
cmp edx, eax
je 0x46d2e3
movzx ecx, word [ebp - 0x1fc]
movzx edx, word [ebp - 0x104]
cmp ecx, edx
jge 0x46d411
mov dword [ebp - 0x14e0], 0xffffffff
jmp 0x46d41b
mov dword [ebp - 0x14e0], 1
mov eax, dword [ebp - 0x14e0]
mov dword [ebp - 0x14e4], eax
cmp dword [ebp - 0x14e4], 0
jne 0x46d470
push esi
sub esi, 0xd969
pop esi
push ecx
and ecx, 0xebdc
sub ecx, 0x110e2
pop ecx
push edi
xor edi, 0x16091
xor edi, 0x14ed3
pop edi
push edi
push eax
add esp, 4
jmp 0x46d461
pop edi
mov ecx, dword [ebp - 0x4d8]
mov dword [ebp - 0x6ec], ecx
jmp 0x46d4d8
push eax
xor eax, 0x4961
xor eax, 0xc5d4
sub eax, 0x9a1
or eax, 0x9461
pop eax
push ecx
push esi
add esp, 4
or ecx, 0x502f
xor ecx, 0x1106a
sub ecx, 0x13025
pop ecx
mov edx, dword [ebp - 0x4d8]
mov eax, dword [edx]
mov dword [ebp - 0x4d8], eax
mov ecx, dword [ebp - 0x4d8]
cmp ecx, dword [ebp - 0xc2c]
je 0x46d4ce
mov edx, dword [ebp - 0x4d8]
cmp dword [edx + 0x30], 0
jne 0x46d284
mov dword [ebp - 0x6ec], 0
Function at 0x46d2a6
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
xor esi, 0x38b1
pop esi
cmp dword [ebp - 0xc2c], 0
jne 0x46d278
mov dword [ebp - 0x6ec], 0
jmp 0x46d4d8
mov ecx, dword [ebp - 0xc2c]
mov dword [ebp - 0x4d8], ecx
push edi
jmp 0x46d28c
and edi, 0x10681
jmp 0x46d298
call 0x46d2a6
add byte [ecx + 0x32], al
dec ebx
inc eax
aaa
dec ebp
add esp, 4
pop edi
push ebx
push eax
add esp, 4
sub ebx, 0x381b
pop ebx
lea edx, [ebp - 0x16cc]
mov dword [ebp - 0xc28], edx
mov eax, dword [ebp - 0x4d8]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xc24], ecx
xor edx, edx
mov word [ebp - 0x1fc], dx
xor eax, eax
mov word [ebp - 0x104], ax
push ecx
push esi
add esp, 4
call 0x46d2f7
add byte [esi + 0x3b], al
inc ebp
cmp eax, 0x44463e33
dec eax
add esp, 4
or ecx, 0x45c3
pop ecx
push eax
sub eax, 0x131bf
or eax, 0x770d
or eax, 0x1571e
pop eax
mov ecx, dword [ebp - 0xc24]
mov dx, word [ecx]
mov word [ebp - 0xf82], dx
mov eax, dword [ebp - 0xc24]
add eax, 2
mov dword [ebp - 0xc24], eax
mov cx, word [ebp - 0xf82]
mov word [ebp - 0x1fc], cx
mov edx, dword [ebp - 0xc28]
mov ax, word [edx]
mov word [ebp - 0xf84], ax
mov ecx, dword [ebp - 0xc28]
add ecx, 2
mov dword [ebp - 0xc28], ecx
mov dx, word [ebp - 0xf84]
mov word [ebp - 0x104], dx
push ebx
xor ebx, 0x7b92
xor ebx, 0x1200
add ebx, 0xf21
sub ebx, 0x45ef
pop ebx
push ecx
push ebx
add esp, 4
xor ecx, 0x518c
or ecx, 0x14c2c
sub ecx, 0x17462
pop ecx
movzx eax, word [ebp - 0x104]
test eax, eax
jne 0x46d3c4
movzx ecx, word [ebp - 0x1fc]
movzx edx, word [ebp - 0x104]
sub ecx, edx
mov dword [ebp - 0x14e4], ecx
jmp 0x46d427
movzx eax, word [ebp - 0x1fc]
movzx ecx, word [ebp - 0x104]
cmp eax, ecx
je 0x46d2e3
movzx edx, word [ebp - 0x1fc]
xor edx, 0x20
movzx eax, word [ebp - 0x104]
cmp edx, eax
je 0x46d2e3
movzx ecx, word [ebp - 0x1fc]
movzx edx, word [ebp - 0x104]
cmp ecx, edx
jge 0x46d411
mov dword [ebp - 0x14e0], 0xffffffff
jmp 0x46d41b
mov dword [ebp - 0x14e0], 1
mov eax, dword [ebp - 0x14e0]
mov dword [ebp - 0x14e4], eax
cmp dword [ebp - 0x14e4], 0
jne 0x46d470
push esi
sub esi, 0xd969
pop esi
push ecx
and ecx, 0xebdc
sub ecx, 0x110e2
pop ecx
push edi
xor edi, 0x16091
xor edi, 0x14ed3
pop edi
push edi
push eax
add esp, 4
jmp 0x46d461
pop edi
mov ecx, dword [ebp - 0x4d8]
mov dword [ebp - 0x6ec], ecx
jmp 0x46d4d8
push eax
xor eax, 0x4961
xor eax, 0xc5d4
sub eax, 0x9a1
or eax, 0x9461
pop eax
push ecx
push esi
add esp, 4
or ecx, 0x502f
xor ecx, 0x1106a
sub ecx, 0x13025
pop ecx
mov edx, dword [ebp - 0x4d8]
mov eax, dword [edx]
mov dword [ebp - 0x4d8], eax
mov ecx, dword [ebp - 0x4d8]
cmp ecx, dword [ebp - 0xc2c]
je 0x46d4ce
mov edx, dword [ebp - 0x4d8]
cmp dword [edx + 0x30], 0
jne 0x46d284
mov dword [ebp - 0x6ec], 0
Function at 0x46d2f7
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
xor esi, 0x38b1
pop esi
cmp dword [ebp - 0xc2c], 0
jne 0x46d278
mov dword [ebp - 0x6ec], 0
jmp 0x46d4d8
mov ecx, dword [ebp - 0xc2c]
mov dword [ebp - 0x4d8], ecx
push edi
jmp 0x46d28c
and edi, 0x10681
jmp 0x46d298
call 0x46d2a6
add byte [ecx + 0x32], al
dec ebx
inc eax
aaa
dec ebp
add esp, 4
pop edi
push ebx
push eax
add esp, 4
sub ebx, 0x381b
pop ebx
lea edx, [ebp - 0x16cc]
mov dword [ebp - 0xc28], edx
mov eax, dword [ebp - 0x4d8]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xc24], ecx
xor edx, edx
mov word [ebp - 0x1fc], dx
xor eax, eax
mov word [ebp - 0x104], ax
push ecx
push esi
add esp, 4
call 0x46d2f7
add byte [esi + 0x3b], al
inc ebp
cmp eax, 0x44463e33
dec eax
add esp, 4
or ecx, 0x45c3
pop ecx
push eax
sub eax, 0x131bf
or eax, 0x770d
or eax, 0x1571e
pop eax
mov ecx, dword [ebp - 0xc24]
mov dx, word [ecx]
mov word [ebp - 0xf82], dx
mov eax, dword [ebp - 0xc24]
add eax, 2
mov dword [ebp - 0xc24], eax
mov cx, word [ebp - 0xf82]
mov word [ebp - 0x1fc], cx
mov edx, dword [ebp - 0xc28]
mov ax, word [edx]
mov word [ebp - 0xf84], ax
mov ecx, dword [ebp - 0xc28]
add ecx, 2
mov dword [ebp - 0xc28], ecx
mov dx, word [ebp - 0xf84]
mov word [ebp - 0x104], dx
push ebx
xor ebx, 0x7b92
xor ebx, 0x1200
add ebx, 0xf21
sub ebx, 0x45ef
pop ebx
push ecx
push ebx
add esp, 4
xor ecx, 0x518c
or ecx, 0x14c2c
sub ecx, 0x17462
pop ecx
movzx eax, word [ebp - 0x104]
test eax, eax
jne 0x46d3c4
movzx ecx, word [ebp - 0x1fc]
movzx edx, word [ebp - 0x104]
sub ecx, edx
mov dword [ebp - 0x14e4], ecx
jmp 0x46d427
movzx eax, word [ebp - 0x1fc]
movzx ecx, word [ebp - 0x104]
cmp eax, ecx
je 0x46d2e3
movzx edx, word [ebp - 0x1fc]
xor edx, 0x20
movzx eax, word [ebp - 0x104]
cmp edx, eax
je 0x46d2e3
movzx ecx, word [ebp - 0x1fc]
movzx edx, word [ebp - 0x104]
cmp ecx, edx
jge 0x46d411
mov dword [ebp - 0x14e0], 0xffffffff
jmp 0x46d41b
mov dword [ebp - 0x14e0], 1
mov eax, dword [ebp - 0x14e0]
mov dword [ebp - 0x14e4], eax
cmp dword [ebp - 0x14e4], 0
jne 0x46d470
push esi
sub esi, 0xd969
pop esi
push ecx
and ecx, 0xebdc
sub ecx, 0x110e2
pop ecx
push edi
xor edi, 0x16091
xor edi, 0x14ed3
pop edi
push edi
push eax
add esp, 4
jmp 0x46d461
pop edi
mov ecx, dword [ebp - 0x4d8]
mov dword [ebp - 0x6ec], ecx
jmp 0x46d4d8
push eax
xor eax, 0x4961
xor eax, 0xc5d4
sub eax, 0x9a1
or eax, 0x9461
pop eax
push ecx
push esi
add esp, 4
or ecx, 0x502f
xor ecx, 0x1106a
sub ecx, 0x13025
pop ecx
mov edx, dword [ebp - 0x4d8]
mov eax, dword [edx]
mov dword [ebp - 0x4d8], eax
mov ecx, dword [ebp - 0x4d8]
cmp ecx, dword [ebp - 0xc2c]
je 0x46d4ce
mov edx, dword [ebp - 0x4d8]
cmp dword [edx + 0x30], 0
jne 0x46d284
mov dword [ebp - 0x6ec], 0
Function at 0x46d92f
Capabilities:
Get number of processors

Disassembly:
add esp, 4
pop ebx
mov ecx, dword [ebp - 0x18b0]
mov dword [ebp - 0x18b4], ecx
lea edx, [ebp - 0x1628]
push edx
call dword [ebp - 0x18b4]
test eax, eax
jne 0x46d991
push eax
push esi
add esp, 4
sub eax, 0x11eef
pop eax
push ebx
push edi
add esp, 4
and ebx, 0x27c4
pop ebx
push edi
xor edi, 0xb8e4
or edi, 0x8eca
xor edi, 0x915f
xor edi, 0x6640
pop edi
mov dword [ebp - 0x738], 0
jmp 0x46e07b
Function at 0x401001
Capabilities:
Parse pe header

Disassembly:
push ebp
xor edx, edx
mov ebp, esp
sub esp, 0x18
cmp word [0x400000], 0x5a4d
mov dword [0x48c048], 1
mov dword [0x48c044], 1
mov dword [0x48c040], 1
jne 0x401082
mov ecx, dword [0x40003c]
cmp dword [ecx + 0x400000], 0x4550
lea eax, [ecx + 0x400000]
jne 0x401082
mov ecx, dword [eax + 0x18]
cmp cx, 0x10b
je 0x40105d
cmp cx, 0x20b
je 0x40106c
jmp 0x401082
cmp dword [eax + 0x74], 0xe
jbe 0x401082
cmp dword [eax + 0xe8], 0
jmp 0x40107c
cmp dword [eax + 0x84], 0xe
jbe 0x401082
cmp dword [eax + 0xf8], 0
setne dl
movzx edx, dl
cmp dword [0x48c054], 0
mov dword [0x48c00c], edx
je 0x40109a
mov dword [esp], 2
jmp 0x4010a1
mov dword [esp], 1
call sym.___set_app_type
call sym.___p__fmode
mov edx, dword [0x48c068]
mov dword [eax], edx
call sym.___p__commode
mov edx, dword [0x48c050]
mov dword [eax], edx
call sym.__setargv
cmp dword [0x47f05c], 1
jne 0x4010da
mov dword [esp], sym.__matherr
call sym.___mingw_setusermatherr
leave
xor eax, eax
ret

Function at 0x402140
Capabilities:
Validate payment card number using luhn algorithm

Disassembly:
push ebp
mov ebp, esp
push edi
xor edi, edi
push esi
mov esi, eax
push ebx
push ecx
mov eax, dword [eax + 0xc]
movsx ecx, byte [eax]
cmp cl, 0x6e
jne 0x402165
lea edx, [eax + 1]
mov edi, 1
mov dword [esi + 0xc], edx
movsx ecx, byte [eax + 1]
xor ebx, ebx
lea eax, [ecx - 0x30]
cmp al, 9
jbe 0x402176
test edi, edi
je 0x4021ac
neg ebx
jmp 0x4021ac
lea eax, [ecx - 0x30]
mov ecx, 0xa
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
mov eax, 0x7fffffff
sub eax, edx
cdq
idiv ecx
cmp eax, ebx
jl 0x4021a9
imul ebx, ebx, 0xa
mov eax, dword [ebp - 0x10]
add ebx, eax
mov eax, dword [esi + 0xc]
lea edx, [eax + 1]
mov dword [esi + 0xc], edx
movsx ecx, byte [eax + 1]
jmp 0x402167
or ebx, 0xffffffff
pop edx
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x40413f
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push ebx
mov ebx, eax
mov eax, dword [ecx]
cmp eax, 3
je 0x404244
sub eax, 0x19
cmp eax, 0x3a
ja case.0x40415f.40
jmp dword [eax*4 + 0x483258]
mov edx, str._restrict
jmp 0x404172
mov edx, str._volatile
mov eax, ebx
pop ebx
pop esi
pop ebp
jmp sym._d_append_string
mov edx, str._const
jmp 0x404172
mov edx, str._transaction_safe
jmp 0x404172
mov edx, str._noexcept
jmp 0x404196
mov edx, str._throw
mov eax, ebx
call sym._d_append_string
cmp dword [esi + 0x10], 0
je case.0x40415f.33
mov edx, 0x28
mov eax, ebx
call sym._d_append_char
mov ecx, dword [esi + 0x10]
jmp 0x404258
mov edx, 0x20
mov eax, ebx
call sym._d_append_char
mov ecx, dword [esi + 0x10]
jmp 0x404275
mov edx, 0x2a
jmp 0x404269
mov edx, 0x20
mov eax, ebx
call sym._d_append_char
mov edx, 0x26
jmp 0x404269
mov edx, 0x20
mov eax, ebx
call sym._d_append_char
mov edx, 0x48322e
jmp 0x404172
mov edx, str.__Complex
jmp 0x404172
mov edx, str.__Imaginary
jmp 0x404172
cmp byte [ebx + 0x104], 0x28
je 0x40422b
mov edx, 0x20
mov eax, ebx
call sym._d_append_char
mov ecx, dword [esi + 0xc]
mov edx, 0x11
mov eax, ebx
call sym._d_print_comp
mov edx, 0x483247
jmp 0x404172
mov ecx, dword [ecx + 0xc]
jmp 0x404275
mov edx, str.___vector_
mov eax, ebx
call sym._d_append_string
mov ecx, dword [esi + 0xc]
mov edx, 0x11
mov eax, ebx
call sym._d_print_comp
mov edx, 0x29
mov eax, ebx
pop ebx
pop esi
pop ebp
jmp sym._d_append_char
mov ecx, esi
mov eax, ebx
mov edx, 0x11
pop ebx
pop esi
pop ebp
jmp sym._d_print_comp
pop ebx
pop esi
pop ebp
ret

Function at 0x4045ad
Capabilities:
Parse credit card information

Disassembly:
cmp dword [ecx], 0x33
jne 0x4045c0
mov edx, dword [ecx + 0xc]
mov ecx, dword [edx + 8]
mov edx, dword [edx + 4]
jmp sym._d_append_buffer
mov edx, 0x11
jmp sym._d_print_comp

Function at 0x407810
Capabilities:
Parse pe header

Disassembly:
push ebp
xor edx, edx
mov ebp, esp
mov eax, dword [ebp + 8]
cmp word [eax], 0x5a4d
jne 0x407835
add eax, dword [eax + 0x3c]
cmp dword [eax], 0x4550
jne 0x407835
xor edx, edx
cmp word [eax + 0x18], 0x10b
sete dl
mov eax, edx
pop ebp
ret

Function at 0x407839
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push esi
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
push ebx
xor ebx, ebx
add edx, dword [edx + 0x3c]
movzx eax, word [edx + 0x14]
movzx esi, word [edx + 6]
lea eax, [edx + eax + 0x18]
cmp ebx, esi
jae 0x40786d
mov edx, dword [eax + 0xc]
cmp ecx, edx
jb 0x407867
add edx, dword [eax + 8]
cmp ecx, edx
jb 0x40786f
inc ebx
add eax, 0x28
jmp 0x407855
xor eax, eax
pop ebx
pop esi
pop ebp
ret
Function at 0x40e22c
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], 0x485318
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esp + 4], str.rand_s
mov dword [esp], eax
call ebx
push edx
push edx
test eax, eax
jne 0x40e285
mov dword [esp], str.advapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push edx
mov dword [esp + 4], str.SystemFunction036
mov dword [esp], eax
call ebx
push ecx
push ecx
mov dword [0x48ca64], eax
mov eax, sym._mingw_rand_s
mov dword [sym._init_rand_s], eax
mov dword [ebp + 8], esi
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
jmp eax

Function at 0x41027a
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
push ebx
mov ebx, eax
sub esp, 0x50
mov dword [esp], eax
call sym._pthread_spin_destroy
dec eax
jne 0x4102cf
xor eax, eax
lea edi, [ebp - 0x3d]
lea ebx, [ebp - 0x3d]
mov ecx, 0x35
rep stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [esp + 8], str.Error_cleaning_up_spin_keys_for_thread__lu._n
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0x35
mov dword [esp], ebx
call sym._snprintf.constprop.0
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push eax
call sym._abort
mov dword [ebx], 0xffffffff
lea esp, [ebp - 8]
pop ebx
pop edi
pop ebp
ret
Function at 0x410365
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
call sym.__pthread_once_raw.constprop.0.isra.0
mov eax, dword [0x47f20c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
push ecx
test eax, eax
jne 0x41046e
call sym._pop_pthread_mem
mov ebx, eax
test eax, eax
je 0x41046e
mov dword [eax + 0x24], 1
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebx + 0x3c], eax
xor eax, eax
mov dword [esp + 0xc], edi
mov dword [esp + 8], edi
mov dword [esp + 4], 1
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CreateEventA]
sub esp, 0x10
mov dword [ebx + 0x18], eax
lea eax, [ebx + 0x38]
mov dword [ebx + 0x1c], 0xffffffff
call sym._replace_spin_keys.constprop.0
mov edx, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor eax, eax
mov dword [ebx + 0x64], eax
mov dword [ebp - 0x1c], edx
mov dword [ebx + 0x14], eax
call edx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov edx, dword [ebp - 0x1c]
mov esi, eax
call edx
xor edx, edx
mov dword [esp + 0x18], 2
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], edx
lea edx, [ebx + 0x14]
mov dword [esp + 0xc], edx
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
sub esp, 0x1c
test eax, eax
jne 0x410435
call sym._abort
mov eax, dword [ebx + 0x14]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
xor ecx, ecx
push edx
mov dword [ebx + 0x6c], eax
mov al, byte [ebx + 0x20]
mov dword [ebx + 0x68], ecx
and eax, 0xffffffcf
or eax, 0x10
mov byte [ebx + 0x20], al
mov dword [esp + 4], ebx
mov eax, dword [0x47f20c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
push esi
test eax, eax
je 0x410430
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x410d31
Capabilities:
Set thread local storage value

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push esi
push ebx
push ecx
sub esp, 0x2c
mov eax, dword [ecx]
mov dword [ebp - 0x1c], eax
call sym.__fpreset
mov dword [esp], 0x47f204
call sym._pthread_mutex_lock
mov eax, dword [ebp - 0x1c]
lea ebx, [eax + 0x1c]
mov dword [esp], ebx
call sym._pthread_mutex_lock
call sym.__pthread_once_raw.constprop.0.isra.0
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], eax
mov eax, dword [0x47f20c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edx, dword [ebp - 0x1c]
mov dword [edx + 0x3c], eax
mov dword [esp], ebx
xor ebx, ebx
call sym._pthread_mutex_unlock
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], ebx
add eax, 0x70
mov dword [esp], eax
call sym.__setjmp3
mov dword [esp], 0x47f204
test eax, eax
jne 0x410e15
call sym._pthread_mutex_unlock
mov eax, dword [ebp - 0x1c]
mov ebx, pe_nt_image_headers32
mov eax, dword [eax + 8]
test eax, eax
je 0x410dd8
mov esi, dword [ebp - 0x1c]
mov edx, dword [esi + 4]
mov dword [esp], edx
call eax
mov ebx, eax
mov dword [esp], 0x47f204
call sym._pthread_mutex_lock
mov eax, dword [ebp - 0x1c]
mov dword [eax + 4], ebx
mov eax, dword [eax + 0xb4]
mov dword [esp], eax
call sym.__pthread_cleanup_dest
mov eax, dword [ebp - 0x1c]
lea ebx, [eax + 0x1c]
mov dword [esp], ebx
call sym._pthread_mutex_lock
mov eax, dword [ebp - 0x1c]
mov esi, dword [eax + 4]
mov eax, dword [eax + 0x18]
test eax, eax
jne 0x410e1c
jmp 0x410e26
call sym._pthread_mutex_lock
jmp 0x410df8
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
mov eax, dword [ebp - 0x1c]
xor edx, edx
cmp dword [eax + 0x14], 0
mov dword [eax + 0x18], edx
jne 0x410e6d
mov eax, dword [ebp - 0x1c]
mov dword [eax], 0xdeadbeef
mov dword [esp], ebx
call sym._pthread_mutex_unlock
mov dword [esp], ebx
call sym._pthread_mutex_destroy
mov eax, dword [ebp - 0x1c]
call sym._push_pthread_mem
mov eax, dword [0x47f20c]
xor ecx, ecx
mov dword [esp + 4], ecx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push ebx
push ebx
jmp 0x410e8e
mov dword [esp], ebx
call sym._pthread_mutex_unlock
mov dword [esp], ebx
call sym._pthread_mutex_destroy
mov eax, dword [ebp - 0x1c]
mov dword [eax + 0x1c], 0xffffffff
mov dword [eax + 0x68], 1
mov dword [esp], 0x47f204
call sym._pthread_mutex_unlock
test eax, eax
jne 0x410eac
xor eax, eax
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_Sleep]
push edx
jmp 0x410e8e
mov dword [esp], esi
call dword [sym.imp.msvcrt.dll__endthreadex]
Function at 0x410ff9
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
call sym.___pthread_self_lite
mov dword [eax + 4], esi
mov ebx, eax
mov eax, dword [eax + 0xb4]
mov dword [esp], eax
call sym.__pthread_cleanup_dest
test byte [ebx + 0x20], 0x30
jne 0x411036
add ebx, 0x70
mov dword [esp + 4], 1
mov dword [esp], ebx
call dword [sym.imp.msvcrt.dll_longjmp]
mov eax, dword [0x47f20c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
push edx
test eax, eax
je 0x4110ca
cmp dword [ebx + 0x14], 0
mov eax, dword [eax + 0x18]
jne 0x411072
mov dword [ebx], 0xdeadbeef
test eax, eax
je 0x411068
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
xor eax, eax
mov esi, dword [ebx + 4]
mov dword [ebx + 0x18], eax
jmp 0x4110ad
mov dword [ebx + 0x68], 1
mov esi, dword [ebx + 4]
test eax, eax
je 0x41108a
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
xor eax, eax
mov dword [ebx + 0x18], eax
test byte [ebx + 0x24], 4
je 0x4110ca
mov eax, dword [ebx + 0x14]
mov dword [ebx], 0xdeadbeef
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
push ecx
mov dword [ebx + 0x14], eax
mov eax, ebx
call sym._push_pthread_mem
xor eax, eax
mov dword [esp + 4], eax
mov eax, dword [0x47f20c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push edx
push edx
mov dword [esp], esi
call dword [sym.imp.msvcrt.dll__endthreadex]
Function at 0x411319
Capabilities:
Hijack thread execution

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2ec
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym.___pth_gpointer_locked
test eax, eax
je 0x4114df
mov edi, eax
mov eax, dword [eax + 0x14]
lea ecx, [eax - 1]
cmp ecx, 0xfffffffd
ja 0x4114df
lea esi, [ebp - 0x2e4]
mov dword [esp], eax
mov dword [esp + 4], esi
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
push ebx
push ebx
test eax, eax
je 0x4114df
lea ebx, [edi + 0x1c]
mov dword [esp], ebx
call sym._pthread_mutex_lock
call sym._pthread_self
mov ecx, eax
mov al, byte [edi + 0x20]
cmp ecx, dword [ebp + 8]
jne 0x4113d4
test al, 3
jne 0x4113e6
and eax, 0xfffffffc
or eax, 1
mov byte [edi + 0x20], al
lock inc dword [0x48cacc]
mov eax, dword [edi + 0x18]
test eax, eax
je 0x4113a5
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
push ecx
mov eax, dword [edi + 0x24]
mov ecx, eax
not ecx
and cl, 3
jne 0x4114d2
and eax, 0xfffffffe
mov dword [edi + 0x24], eax
mov al, byte [edi + 0x20]
and eax, 0xfffffff3
or eax, 4
mov byte [edi + 0x20], al
mov dword [esp], ebx
call sym._pthread_mutex_unlock
call sym.__pthread_invoke_cancel
mov ecx, dword [edi + 0x24]
not ecx
and cl, 3
jne 0x4114a9
test al, 0xc
je 0x4113ff
mov dword [esp], ebx
call sym._pthread_mutex_unlock
test byte [edi + 0x20], 0xc
jne 0x4114df
xor eax, eax
jmp 0x4114e4
test al, 0xf
jne 0x4114df
mov dword [ebp - 0x2e4], 0x10001
mov eax, dword [edi + 0x14]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push eax
xor eax, eax
mov dword [esp + 4], eax
mov eax, dword [edi + 0x14]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push edx
push edx
cmp eax, 0x102
jne 0x4114d2
mov dword [esp + 4], esi
mov eax, dword [edi + 0x14]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
push ecx
push ecx
mov dword [ebp - 0x22c], sym.__pthread_invoke_cancel
mov dword [esp + 4], esi
mov eax, dword [edi + 0x14]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
push esi
push esi
mov al, byte [edi + 0x20]
and dword [edi + 0x24], 0xfffffffe
and eax, 0xfffffff0
or eax, 5
mov byte [edi + 0x20], al
lock inc dword [0x48cacc]
mov eax, dword [edi + 0x18]
test eax, eax
je 0x411493
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
push edx
mov dword [esp], ebx
call sym._pthread_mutex_unlock
mov eax, dword [edi + 0x14]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x4114d1
test al, 3
jne 0x4113e6
and eax, 0xfffffffc
or eax, 1
mov byte [edi + 0x20], al
lock inc dword [0x48cacc]
mov eax, dword [edi + 0x18]
test eax, eax
je 0x4114d2
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
push eax
mov dword [esp], ebx
call sym._pthread_mutex_unlock
jmp 0x4113f8
mov eax, 3
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret