joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41a2c0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x41a920
mov esi, ecx
lea eax, [ebp - 0x18]
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
mov eax, dword [0x4a0064]
test eax, eax
je 0x41a315
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jbe 0x41a32e
cmp dword [eax + 4], 0
mov ebx, eax
je 0x41a32e
add ebx, 8
jmp 0x41a3ea
push 0x4a0064
call fcn.004515e0
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
ja 0x41a305
mov eax, dword [0x4a0064]
test eax, eax
je 0x41a3cb
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
je 0x41a3e8
mov edi, eax
test eax, eax
jne 0x41a38e
movzx eax, byte [0x4a06e5]
push 4
push 0xc
call fcn.004417e0
add esp, 8
test eax, eax
je 0x41a40f
mov dword [eax], 0x4a0064
mov dword [eax + 4], 0
mov edi, eax
mov eax, dword [0x4a0064]
test eax, eax
je 0x41a3fd
dec eax
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test esi, esi
je 0x41a3a3
mov eax, dword [esi]
mov dword [esi], 0
test eax, eax
je 0x41a3a5
mov eax, dword [esi + 4]
jmp 0x41a3a5
xor eax, eax
mov ecx, dword [edi + 8]
cmp dword [edi + 4], 0
lea ebx, [edi + 8]
mov dword [edi + 4], 1
mov dword [edi + 8], eax
je 0x41a3ea
test ecx, ecx
je 0x41a3ea
lock dec dword [ecx]
jne 0x41a3ea
call fcn.00410560
jmp 0x41a3ea
push 0x4a0064
call fcn.004515e0
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jne 0x41a34c
xor ebx, ebx
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, ebx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x4a0064
call fcn.004515e0
add esp, 4
jmp 0x41a386
mov dword [ebp - 0x10], 0
push 0xc
push 4
call fcn.00451c70
add esp, 8
ud2
Function at 0x41a450
Capabilities:
Generate random numbers via winapi
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff0
sub esp, 0x30
mov eax, dword [0x4a0074]
test eax, eax
je 0x41a54f
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jbe 0x41a481
mov esi, eax
mov eax, dword [eax]
or eax, dword [esi + 4]
jne 0x41a54a
mov eax, dword [0x4a0074]
test eax, eax
je 0x41a571
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
je 0x41a58e
mov esi, eax
test eax, eax
jne 0x41a4ec
movzx eax, byte [0x4a06e5]
push 8
push 0x20
call fcn.004417e0
add esp, 8
test eax, eax
je 0x41a5aa
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 0x18], 0x4a0074
mov esi, eax
mov eax, dword [0x4a0074]
test eax, eax
je 0x41a598
dec eax
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [ebp + 8]
test eax, eax
je 0x41a50b
mov ecx, dword [eax]
movups xmm0, xmmword [eax + 8]
mov dword [eax + 4], 0
mov dword [eax], 0
cmp ecx, 1
je 0x41a539
xorps xmm0, xmm0
mov eax, esp
movaps xmmword [esp], xmm0
push 2
push 0x10
push eax
push 0
call dword [sym.imp.bcrypt.dll_BCryptGenRandom]
test eax, eax
js 0x41a52b
movaps xmm0, xmmword [esp]
jmp 0x41a539
lea ecx, [esp + 0x10]
call fcn.00417c90
movups xmm0, xmmword [esp + 0x10]
mov dword [esi + 4], 0
mov dword [esi], 1
movups xmmword [esi + 8], xmm0
add esi, 8
jmp 0x41a590
push 0x4a0074
call fcn.004515e0
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
ja 0x41a474
jmp 0x41a481
push 0x4a0074
call fcn.004515e0
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jne 0x41a49f
xor esi, esi
mov eax, esi
lea esp, [ebp - 4]
pop esi
pop ebp
ret
push 0x4a0074
call fcn.004515e0
add esp, 4
jmp 0x41a4e4
push 0x20
push 8
call fcn.00451c70
add esp, 8
ud2
Function at 0x428570
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov esi, edx
mov edi, dword [ebp + 8]
mov eax, dword [0x4a0088]
xor eax, ebp
mov dword [ebp - 0x10], eax
push 0x104
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x4286de
push str.MicrosoftWindowsStart_MenuPrograms_
push 0x104
push edi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
test eax, eax
jne 0x4286de
mov ecx, dword [esi + 0x10]
lea eax, [ecx - 0x7ffffffb]
cmp eax, 3
jbe 0x4286f0
mov eax, dword [esi]
mov dword [ebp - 0x38], eax
mov edx, dword [esi + 0x14]
lea edi, [ebp - 0x28]
mov dword [edi], 0
lea eax, [ecx + 4]
mov ebx, 7
cmp eax, 8
jb 0x428654
mov dword [ebp - 0x30], edx
mov edx, eax
or edx, 7
cmp edx, 0xb
mov ebx, 0xa
cmovae ebx, edx
mov edx, SysReAllocString
cmp ebx, edx
cmovae ebx, edx
lea edi, [ebx + ebx]
cmp ebx, 0x7ff
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x2c], eax
jb 0x42863a
cmp ebx, 0x7fffffee
jae 0x4286f5
add edi, 0x25
push edi
call fcn.0044f125
add esp, 4
lea edi, [eax + 0x23]
and edi, 0xffffffe0
mov dword [edi - 4], eax
jmp 0x428648
add edi, 2
push edi
call fcn.0044f125
add esp, 4
mov edi, eax
mov dword [ebp - 0x28], edi
mov ecx, dword [ebp - 0x34]
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2c]
cmp edx, 8
cmovae esi, dword [ebp - 0x38]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], ebx
lea eax, [ecx + ecx]
push eax
push esi
push edi
mov esi, ecx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov dword [edi + esi*2 + 4], 0x6b006e
mov dword [edi + esi*2], 0x6c002e
mov word [edi + esi*2 + 8], 0
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
jb 0x428693
mov eax, dword [ebp - 0x28]
push eax
push 0x104
push dword [ebp + 8]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x4286de
mov ecx, dword [ebp - 0x28]
lea esi, [eax + eax]
add esi, 2
cmp esi, 0x1000
jb 0x4286d4
mov edx, dword [ecx - 4]
add ecx, 0xfffffffc
sub ecx, edx
cmp ecx, 0x20
jae 0x4286fa
add eax, eax
add eax, 0x25
mov esi, eax
mov ecx, edx
push esi
push ecx
call fcn.0044f155
add esp, 8
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0044f7d0
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.00452ec0
call fcn.00452ed0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x42874b
mov eax, dword [ebp + 0xc]
movdqu xmm0, xmmword [eax]
pcmpeqb xmm0, xmmword [0x462f90]
pmovmskb edx, xmm0
cmp edx, 0xffff
je 0x428742
movdqu xmm0, xmmword [eax]
pcmpeqb xmm0, xmmword [0x462fa0]
pmovmskb edx, xmm0
mov eax, 0x80004002
cmp edx, 0xffff
jne 0x428750
mov eax, dword [ebp + 8]
mov dword [ecx], eax
xor eax, eax
jmp 0x428750
mov eax, 0x80004003
pop ebp
ret 0xc
Function at 0x42a450
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [0x4a0088]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x18], eax
mov esi, eax
call fcn.00401160
mov ecx, dword [eax]
or ecx, 2
xor edx, edx
push esi
push edx
push dword [ebp + 0xc]
push edx
push edx
push dword [eax + 4]
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___stdio_common_vswprintf]
add esp, 0x1c
xor ecx, ecx
dec ecx
test eax, eax
cmovs eax, ecx
lea edi, [eax + 1]
lea ebx, [eax + eax]
add ebx, 2
push ebx
call fcn.0044f117
add esp, 4
mov esi, eax
push ebx
xor eax, eax
push eax
push esi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea ebx, [ebp + 0x18]
mov dword [ebp - 0x18], ebx
call fcn.00401160
push ebx
xor ecx, ecx
push ecx
push dword [ebp + 0xc]
push edi
push esi
push dword [eax + 4]
push dword [eax]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___stdio_common_vswprintf]
add esp, 0x1c
mov eax, str.Error:__s___S:_d_
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push esi
push eax
call fcn.00451d80
add esp, 0x10
lea ecx, [eax + 1]
mov dword [ebp - 0x1c], ecx
lea ebx, [eax + eax]
add ebx, 2
cmp eax, 0xffffffff
mov eax, 0xffffffff
cmovl ebx, eax
push ebx
call fcn.0044f117
add esp, 4
mov edi, eax
push ebx
xor ebx, ebx
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push esi
mov eax, str.Error:__s___S:_d_
push eax
push 0xffffffffffffffff
push dword [ebp - 0x1c]
push edi
call fcn.00451de0
add esp, 0x1c
push dword [ebp + 8]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test eax, eax
je 0x42a57f
mov ebx, eax
lea eax, [ebp - 0x14]
mov dword [eax], edi
sub esp, 0x24
xor ecx, ecx
mov dword [esp + 0x20], ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], ecx
movaps xmm0, xmmword [0x463450]
movups xmmword [esp + 4], xmm0
mov dword [esp], ebx
mov dword [esp + 0x14], 1
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push ebx
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
push edi
call fcn.0044f120
add esp, 4
push esi
call fcn.0044f120
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0044f7d0
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x42b650
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x3c
mov dword [ebp - 0x48], edx
mov ebx, ecx
mov eax, dword [0x4a0088]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor eax, eax
lea edi, [ebp - 0x28]
mov dword [edi], eax
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], 7
mov word [edi], 0
sub esp, 0xc
mov al, byte [ebp - 0x40]
mov byte [esp + 4], al
mov dword [esp + 8], str.SOFTWAREMozillaFirefoxDefault_Browser_Agent
mov dword [esp], 0x2e
mov ecx, edi
call fcn.00452fa0
mov eax, dword [edi + 0x10]
mov ecx, dword [edi + 0x14]
cmp eax, ecx
jae 0x42b7e1
lea edx, [eax + 1]
mov dword [ebp - 0x18], edx
cmp ecx, 8
jb 0x42b6bc
mov ecx, dword [ebp - 0x28]
jmp 0x42b6bf
lea ecx, [ebp - 0x28]
mov word [ecx + eax*2], 0x5c
mov word [ecx + eax*2 + 2], 0
lea esi, [ebp - 0x40]
mov ecx, ebx
mov edx, esi
push dword [ebp + 8]
call fcn.0042ae40
add esp, 4
mov eax, dword [esi + 0x10]
cmp dword [esi + 0x14], 8
jb 0x42b6ea
mov esi, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
mov ebx, edx
sub ebx, ecx
cmp ebx, eax
jb 0x42b7ee
lea ebx, [ecx + eax]
mov dword [ebp - 0x18], ebx
cmp edx, 8
jb 0x42b70a
mov edi, dword [ebp - 0x28]
lea ecx, [edi + ecx*2]
add eax, eax
push eax
push esi
push ecx
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
mov word [edi + ebx*2], 0
mov eax, dword [ebp - 0x2c]
cmp eax, 8
mov edi, dword [ebp - 0x48]
jb 0x42b760
mov ecx, dword [ebp - 0x40]
lea esi, [eax + eax]
add esi, 2
cmp esi, 0x1000
jb 0x42b756
mov edx, dword [ecx - 4]
add ecx, 0xfffffffc
sub ecx, edx
cmp ecx, 0x20
jae 0x42b810
add eax, eax
add eax, 0x25
mov esi, eax
mov ecx, edx
push esi
push ecx
call fcn.0044f155
add esp, 8
cmp dword [ebp - 0x14], 8
jb 0x42b76b
mov eax, dword [ebp - 0x28]
jmp 0x42b76e
lea eax, [ebp - 0x28]
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
mov ecx, eax
and ecx, 0xfffffffd
movzx edx, ax
or edx, 0x80070000
test eax, eax
cmovle edx, eax
test ecx, ecx
cmove edx, ecx
mov dword [edi], edx
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x42b7cd
mov ecx, dword [ebp - 0x28]
lea esi, [eax + eax]
add esi, 2
cmp esi, 0x1000
jb 0x42b7c3
mov edx, dword [ecx - 4]
add ecx, 0xfffffffc
sub ecx, edx
cmp ecx, 0x20
jae 0x42b810
add eax, eax
add eax, 0x25
mov esi, eax
mov ecx, edx
push esi
push ecx
call fcn.0044f155
add esp, 8
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0044f7d0
mov eax, edi
add esp, 0x3c
pop esi
pop edi
pop ebx
pop ebp
ret
lea ecx, [ebp - 0x28]
call fcn.00455620
jmp 0x42b6cc
sub esp, 0x10
mov cl, byte [ebp - 0x44]
mov byte [esp + 4], cl
mov dword [esp + 0xc], eax
mov dword [esp + 8], esi
mov dword [esp], eax
lea ecx, [ebp - 0x28]
call fcn.004530b0
jmp 0x42b720
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x4388e0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov al, 1
cmp byte [ecx + 4], 0
jne 0x4389b0
mov esi, ecx
mov edi, dword [ecx]
test edi, edi
jne 0x438925
xor eax, eax
push str.MozillaFirefoxDefaultBrowserAgentRegistryMutex
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov edi, eax
mov eax, dword [esi]
lea ecx, [eax + 1]
cmp ecx, 2
jb 0x43891b
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], edi
test edi, edi
je 0x4389b4
push 0xbb8
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x438969
cmp eax, 0x80
je 0x438988
test eax, eax
je 0x4389a5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xbb
push str.Acquire
push str.Failed_to_wait_on_registry_mutex:__X
push dword [sym.default_browser_agent.exe_gWinEventLogSourceName]
call fcn.0042a450
add esp, 0x14
jmp 0x4389a9
push 0xae
push str.Acquire
push str.Timed_out_waiting_for_registry_mutex
push dword [sym.default_browser_agent.exe_gWinEventLogSourceName]
call fcn.0042a450
add esp, 0x10
jmp 0x4389a9
push 0xb5
push str.Acquire
push str.Found_abandoned_registry_mutex._Continuing...
push dword [sym.default_browser_agent.exe_gWinEventLogSourceName]
call fcn.0042a450
add esp, 0x10
mov byte [esi + 4], 1
cmp byte [esi + 4], 0
setne al
pop esi
pop edi
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xa4
push str.Acquire
push str.Couldnt_open_registry_mutex:__X
push dword [sym.default_browser_agent.exe_gWinEventLogSourceName]
call fcn.0042a450
add esp, 0x14
xor eax, eax
jmp 0x4389b0
Function at 0x4394a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov esi, edx
mov eax, dword [0x4a0088]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor edi, edi
lea ebx, [ebp - 0x14]
mov dword [ebx], edi
push ebx
push 0x20019
push edi
push str.SOFTWAREPoliciesMozillaFirefox
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, dword [ebx]
test ebx, ebx
je 0x43955b
lea eax, [ebp - 0x18]
mov dword [eax], edi
lea ecx, [ebp - 0x1c]
mov dword [ecx], edi
sub esp, 0x30
xorps xmm0, xmm0
movups xmmword [esp + 0x20], xmm0
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], edi
mov dword [esp + 8], edi
mov dword [esp + 4], edi
mov dword [esp], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov edi, 2
test eax, eax
jne 0x439552
lea ecx, [ebp - 0x20]
mov dword [ecx], 0xffffffff
lea eax, [ebp - 0x24]
mov dword [eax], 4
xor edi, edi
push eax
push ecx
push edi
push 0x10
push esi
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
xor ecx, ecx
lea edx, [ebp - 0x20]
cmp dword [edx], edi
sete cl
test eax, eax
mov edi, 2
cmove edi, ecx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x439560
mov edi, 2
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0044f7d0
mov eax, edi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x44e9c0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x1c
mov eax, dword [0x4a0150]
test eax, eax
je 0x44ead3
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jbe 0x44e9f1
cmp dword [eax + 4], 0
mov esi, eax
je 0x44e9f1
add esi, 4
jmp 0x44eacb
mov eax, dword [0x4a0150]
test eax, eax
je 0x44eae5
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
je 0x44eac9
mov esi, eax
test eax, eax
jne 0x44ea53
mov al, byte [0x4a06e5]
push 4
push 0x20
call fcn.00415040
add esp, 8
test eax, eax
je 0x44eb09
mov dword [eax], 0x4a0150
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0x4a0150]
test eax, eax
je 0x44eaf7
dec eax
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [ebp + 8]
add esi, 4
test eax, eax
je 0x44ea8c
mov ecx, dword [eax]
mov dword [eax], 0
test ecx, ecx
je 0x44ea8c
movsd xmm0, qword [eax + 0x14]
movsd xmm2, qword [eax + 4]
movsd xmm1, qword [eax + 0xc]
movsd qword [ebp - 0xc], xmm0
movsd qword [ebp - 0x14], xmm1
movsd qword [ebp - 0x1c], xmm2
mov dword [ebp - 0x20], ecx
jmp 0x44ea98
lea eax, [ebp - 0x20]
push eax
call fcn.0044e790
add esp, 4
movsd xmm1, qword [ebp - 0x18]
movsd xmm0, qword [ebp - 0x20]
cmp dword [esi], 0
movsd qword [esi + 8], xmm1
movsd xmm1, qword [ebp - 0x10]
movsd qword [esi + 0x10], xmm1
mov eax, dword [ebp - 8]
movsd qword [esi], xmm0
mov dword [esi + 0x18], eax
je 0x44eacb
lock dec dword [0x4a0700]
jmp 0x44eacb
xor esi, esi
mov eax, esi
add esp, 0x1c
pop esi
pop ebp
ret
push 0x4a0150
call fcn.004515e0
add esp, 4
jmp 0x44e9d5
push 0x4a0150
call fcn.004515e0
add esp, 4
jmp 0x44e9ff
push 0x4a0150
call fcn.004515e0
add esp, 4
jmp 0x44ea4b
push 0x20
push 4
call fcn.00451c70
int3
Function at 0x44eb20
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov ebx, dword [0x4a0708]
test ebx, ebx
jne 0x44ec36
push 0x475431
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x44eb75
mov edi, eax
push str.WaitOnAddress
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x44eb75
mov esi, eax
push str.WakeByAddressSingle
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x44eb75
mov edi, eax
mov dword [ebp - 0x10], 0
jmp 0x44ebe9
push 0x4753ec
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x44ec40
mov esi, eax
push str.NtCreateKeyedEvent
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x44ec40
mov ebx, eax
push str.NtReleaseKeyedEvent
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x44ec40
mov edi, eax
push str.NtWaitForKeyedEvent
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x44ec40
mov ecx, ebx
mov esi, eax
mov dword [ebp - 0x10], edi
call dword [section..00cfg]
xor eax, eax
lea ecx, [ebp - 0x14]
push eax
push eax
push 0xc0000000
push ecx
call ebx
test eax, eax
jne 0x44ec40
mov edi, dword [ebp - 0x14]
mov al, byte [0x4a06e5]
push 4
push 0xc
call fcn.00415040
add esp, 8
test eax, eax
je 0x44ec45
mov ebx, eax
mov eax, dword [ebp - 0x10]
mov dword [ebx], eax
mov dword [ebx + 4], esi
mov dword [ebx + 8], edi
xor eax, eax
lock cmpxchg dword [0x4a0708], ebx
je 0x44ec36
cmp dword [ebx], 0
mov esi, eax
je 0x44ec27
push dword [ebx + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 4
push 0xc
push ebx
call fcn.004150b0
add esp, 0xc
mov ebx, esi
mov eax, ebx
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.0045cb70
push 0xc
push 4
call fcn.00451c70
int3
Function at 0x450e80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push edi
push esi
sub esp, 0x68
movzx eax, byte [esp + 0x78]
mov esi, dword [esp + 0x84]
mov ebx, dword [esp + 0x7c]
mov ecx, dword [esp + 0x8c]
mov edx, dword [esp + 0x88]
mov edi, dword [esp + 0x80]
test eax, eax
mov dword [esp + 8], ebx
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], edi
mov dword [esp + 0x14], edx
je 0x450ed1
cmp eax, 1
jne 0x450f48
mov dword [esp], 0x45f023
jmp 0x450ed8
mov dword [esp], 0x45f025
mov edx, 2
mov eax, dword [esp + 0x90]
cmp dword [ecx], 0
mov dword [esp + 4], edx
jne 0x450f64
mov ecx, esp
lea edx, [esp + 8]
lea esi, [esp + 0x10]
mov dword [esp + 0x38], 0x45f088
mov dword [esp + 0x3c], 4
mov dword [esp + 0x48], 0
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], 0x40ed30
mov dword [esp + 0x20], edx
lea edx, [esp + 0x18]
mov dword [esp + 0x24], 0x40ecb0
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], 0x40ecb0
mov dword [esp + 0x40], edx
mov dword [esp + 0x44], 3
jmp 0x450fea
mov edx, 7
mov dword [esp], str.matches_assertion_failed:___left__right___n__left:_____n_right:___:
mov eax, dword [esp + 0x90]
cmp dword [ecx], 0
mov dword [esp + 4], edx
je 0x450eed
movsd xmm0, qword [ecx + 0x10]
movsd xmm2, qword [ecx]
movsd xmm1, qword [ecx + 8]
mov edx, esp
lea esi, [esp + 8]
mov dword [esp + 0x38], 0x45f064
mov dword [esp + 0x3c], 4
mov dword [esp + 0x48], 0
mov dword [esp + 0x18], edx
lea edx, [esp + 0x10]
mov dword [esp + 0x1c], 0x40ed30
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], 0x40ecb0
lea esi, [esp + 0x50]
mov dword [esp + 0x28], edx
lea edx, [esp + 0x18]
mov dword [esp + 0x2c], 0x40ecb0
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], fcn.0040a860
mov dword [esp + 0x40], edx
mov dword [esp + 0x44], 4
movsd qword [esp + 0x60], xmm0
movsd qword [esp + 0x58], xmm1
movsd qword [esp + 0x50], xmm2
lea ecx, [esp + 0x38]
push eax
push ecx
call fcn.00450c40
add esp, 8
ud2
Function at 0x4515e0
Capabilities:
Allocate thread local storage

Disassembly:
push ebx
push edi
push esi
sub esp, 0x20
mov edi, dword [esp + 0x30]
cmp dword [edi + 4], 0
je 0x45165a
lea ebx, [edi + 0xc]
mov dword [esp + 4], 0
lea eax, [esp + 4]
push 0
push eax
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_InitOnceBeginInitialize]
cmp eax, 1
mov dword [esp], eax
jne 0x451695
cmp dword [esp + 4], 0
je 0x45167c
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x4516b8
mov esi, eax
inc eax
mov dword [edi], eax
mov eax, dword [0x4a026c]
nop word [eax + eax]
mov dword [edi + 8], eax
lock cmpxchg dword [0x4a026c], edi
jne 0x451640
push 0
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_InitOnceComplete]
jmp 0x45168c
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [esp], eax
je 0x4516ff
mov ecx, eax
xor eax, eax
inc ecx
lock cmpxchg dword [edi], ecx
jne 0x451680
mov esi, dword [esp]
jmp 0x45168c
mov esi, dword [edi]
jmp 0x45168b
mov esi, eax
push dword [esp]
call dword [sym.imp.KERNEL32.dll_TlsFree]
dec esi
mov eax, esi
add esp, 0x20
pop esi
pop edi
pop ebx
ret
mov dword [esp + 8], 0
lea eax, [esp + 8]
mov ecx, esp
mov edx, 0x461c80
push 0x461cb4
push eax
call fcn.00451230
add esp, 8
ud2
push 0
push 4
push ebx
call dword [sym.imp.KERNEL32.dll_InitOnceComplete]
mov dword [esp + 8], 0x461cd8
mov dword [esp + 0xc], 1
mov dword [esp + 0x18], 0
mov dword [esp + 0x10], 0x4603d0
mov dword [esp + 0x14], 0
lea eax, [esp + 8]
push 0x461ce0
push eax
call fcn.00450c40
add esp, 8
ud2
mov ecx, esp
lea edx, [esp + 8]
mov dword [esp + 8], 0x461cd8
mov dword [esp + 0xc], 1
mov dword [esp + 0x10], 0x4603d0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call fcn.00451290
ud2