joyce8/EMBER2024-capa huggingface dataset:
Function at 0x438a60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
mov eax, 0x2110
call fcn.007082a0
mov esi, esp
mov dword [esi + 0x20f8], ebp
mov dword [esi + 0x20fc], esp
mov dword [esi + 0x2108], 0xffffffff
mov dword [esi + 0x2104], 0x702700
lea eax, [esi + 0x2100]
mov edx, dword fs:[0]
mov dword [esi + 0x2100], edx
mov dword fs:[0], eax
mov eax, dword [ecx]
mov edx, eax
xor edx, 3
lock cmpxchg dword [ecx], edx
jne 0x438ab0
test al, 1
je 0x438b7c
test al, 2
jne 0x438b97
test al, 8
mov dword [esi + 0xc], ecx
jne 0x438af0
add ecx, 0x18
lea edx, [esi + 0x40]
mov dword [esi + 0x40], 2
mov dword [esi + 0x2108], 0
call fcn.00480b50
jmp 0x438b1b
test al, 0x10
je 0x438b1b
mov ecx, dword [esi + 0xc]
mov eax, dword [ecx + 0x20e8]
mov dword [esi + 0x2108], 0
test eax, eax
je 0x438c08
push dword [ecx + 0x20ec]
call dword [eax + 8]
add esp, 4
mov dword [esi + 0x2108], 0xffffffff
mov edi, dword [esi + 0xc]
lea edx, [esi + 0x18]
mov dword [esi + 0x18], edi
mov ecx, dword [edi + 0x18]
mov dword [esi + 0x2108], 0xffffffff
call fcn.006c94f0
cmp eax, 1
mov eax, 2
sbb eax, 0
mov dword [esi + 0x10], eax
shl eax, 6
neg eax
lock xadd dword [edi], eax
shr eax, 6
cmp eax, dword [esi + 0x10]
jb 0x438bba
jne 0x438b68
mov ecx, edi
call fcn.00437130
mov eax, dword [esi + 0x2100]
mov dword fs:[0], eax
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, 0x8cb504
mov edx, 0x23
mov dword [esi + 0x2108], 0xffffffff
push 0x8cb528
jmp 0x438bb0
mov ecx, str.assertion_failed:__prev.is_complete__
mov edx, 0x25
mov dword [esi + 0x2108], 0xffffffff
push 0x8cb4f4
call fcn.0070a0f0
add esp, 4
ud2
lea ecx, [esi + 0x14]
lea edx, [esi + 0x10]
mov dword [esi + 0x18], 0x8cb548
mov dword [esi + 0x1c], 2
mov dword [esi + 0x28], 0
mov dword [esi + 0x14], eax
mov dword [esi + 0x30], ecx
lea ecx, [esi + 0x30]
mov dword [esi + 0x34], 0x4262e0
mov dword [esi + 0x38], edx
mov edx, 0x8cb558
mov dword [esi + 0x3c], 0x4262e0
mov dword [esi + 0x20], ecx
lea ecx, [esi + 0x18]
mov dword [esi + 0x24], 2
call fcn.00709f70
ud2
lea ecx, [esi + 0x40]
mov edx, 0x8cb0cc
mov dword [esi + 0x40], 0x8cb0c4
mov dword [esi + 0x44], 1
mov dword [esi + 0x50], 0
mov dword [esi + 0x48], str.not_implementedC:Users_runneradmin.cargo_registry_srcindex.crates.io_6f17d22bba15001fwinit_0.28.6_srcplatform_implwindowsdrop_handler.rs
mov dword [esi + 0x4c], 0
call fcn.00709f70
ud2
Function at 0x438d50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
mov eax, 0x2108
call fcn.007082a0
mov esi, esp
mov dword [esi + 0x20f0], ebp
mov dword [esi + 0x20f4], esp
mov dword [esi + 0x2100], 0xffffffff
mov dword [esi + 0x20fc], 0x702710
lea eax, [esi + 0x20f8]
mov edx, dword fs:[0]
mov dword [esi + 0x20f8], edx
mov dword fs:[0], eax
mov eax, dword [ecx]
mov edx, eax
xor edx, 3
lock cmpxchg dword [ecx], edx
jne 0x438da0
test al, 1
je 0x438e6c
test al, 2
jne 0x438e87
test al, 8
mov dword [esi + 0xc], ecx
jne 0x438de0
add ecx, 0x18
lea edx, [esi + 0x40]
mov dword [esi + 0x40], 2
mov dword [esi + 0x2100], 0
call fcn.00480910
jmp 0x438e0b
test al, 0x10
je 0x438e0b
mov ecx, dword [esi + 0xc]
mov eax, dword [ecx + 0x20e0]
mov dword [esi + 0x2100], 0
test eax, eax
je 0x438ef8
push dword [ecx + 0x20e4]
call dword [eax + 8]
add esp, 4
mov dword [esi + 0x2100], 0xffffffff
mov edi, dword [esi + 0xc]
lea edx, [esi + 0x18]
mov dword [esi + 0x18], edi
mov ecx, dword [edi + 0x18]
mov dword [esi + 0x2100], 0xffffffff
call fcn.006c98c0
cmp eax, 1
mov eax, 2
sbb eax, 0
mov dword [esi + 0x10], eax
shl eax, 6
neg eax
lock xadd dword [edi], eax
shr eax, 6
cmp eax, dword [esi + 0x10]
jb 0x438eaa
jne 0x438e58
mov ecx, edi
call fcn.00436490
mov eax, dword [esi + 0x20f8]
mov dword fs:[0], eax
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, 0x8cb504
mov edx, 0x23
mov dword [esi + 0x2100], 0xffffffff
push 0x8cb528
jmp 0x438ea0
mov ecx, str.assertion_failed:__prev.is_complete__
mov edx, 0x25
mov dword [esi + 0x2100], 0xffffffff
push 0x8cb4f4
call fcn.0070a0f0
add esp, 4
ud2
lea ecx, [esi + 0x14]
lea edx, [esi + 0x10]
mov dword [esi + 0x18], 0x8cb548
mov dword [esi + 0x1c], 2
mov dword [esi + 0x28], 0
mov dword [esi + 0x14], eax
mov dword [esi + 0x30], ecx
lea ecx, [esi + 0x30]
mov dword [esi + 0x34], 0x4262e0
mov dword [esi + 0x38], edx
mov edx, 0x8cb558
mov dword [esi + 0x3c], 0x4262e0
mov dword [esi + 0x20], ecx
lea ecx, [esi + 0x18]
mov dword [esi + 0x24], 2
call fcn.00709f70
ud2
lea ecx, [esi + 0x40]
mov edx, 0x8cb0cc
mov dword [esi + 0x40], 0x8cb0c4
mov dword [esi + 0x44], 1
mov dword [esi + 0x50], 0
mov dword [esi + 0x48], str.not_implementedC:Users_runneradmin.cargo_registry_srcindex.crates.io_6f17d22bba15001fwinit_0.28.6_srcplatform_implwindowsdrop_handler.rs
mov dword [esi + 0x4c], 0
call fcn.00709f70
ud2
Function at 0x439040
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x70
mov esi, esp
mov dword [esi + 0x58], ebp
mov dword [esi + 0x5c], esp
mov dword [esi + 0x68], 0xffffffff
mov dword [esi + 0x64], 0x702720
lea eax, [esi + 0x60]
mov edx, dword fs:[0]
mov dword [esi + 0x60], edx
mov dword fs:[0], eax
mov eax, dword [ecx]
nop word [eax + eax]
mov edx, eax
xor edx, 3
lock cmpxchg dword [ecx], edx
jne 0x439080
test al, 1
je 0x439137
test al, 2
jne 0x43914f
test al, 8
mov dword [esi + 0xc], ecx
jne 0x4390bd
add ecx, 0x18
lea edx, [esi + 0x30]
mov dword [esi + 0x30], 4
mov dword [esi + 0x68], 0
call fcn.004807a0
jmp 0x4390df
test al, 0x10
je 0x4390df
mov ecx, dword [esi + 0xc]
mov eax, dword [ecx + 0x48]
mov dword [esi + 0x68], 0
test eax, eax
je 0x4391bd
push dword [ecx + 0x4c]
call dword [eax + 8]
add esp, 4
mov dword [esi + 0x68], 0xffffffff
mov edi, dword [esi + 0xc]
lea edx, [esi + 0x18]
mov dword [esi + 0x18], edi
mov ecx, dword [edi + 0x18]
mov dword [esi + 0x68], 0xffffffff
call fcn.006c98c0
cmp eax, 1
mov eax, 2
sbb eax, 0
mov dword [esi + 0x10], eax
shl eax, 6
neg eax
lock xadd dword [edi], eax
shr eax, 6
cmp eax, dword [esi + 0x10]
jb 0x43916f
jne 0x439126
mov ecx, edi
call fcn.00436f40
mov eax, dword [esi + 0x60]
mov dword fs:[0], eax
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, 0x8cb504
mov edx, 0x23
mov dword [esi + 0x68], 0xffffffff
push 0x8cb528
jmp 0x439165
mov ecx, str.assertion_failed:__prev.is_complete__
mov edx, 0x25
mov dword [esi + 0x68], 0xffffffff
push 0x8cb4f4
call fcn.0070a0f0
add esp, 4
ud2
lea ecx, [esi + 0x14]
lea edx, [esi + 0x10]
mov dword [esi + 0x18], 0x8cb548
mov dword [esi + 0x1c], 2
mov dword [esi + 0x28], 0
mov dword [esi + 0x14], eax
mov dword [esi + 0x48], ecx
lea ecx, [esi + 0x48]
mov dword [esi + 0x4c], 0x4262e0
mov dword [esi + 0x50], edx
mov edx, 0x8cb558
mov dword [esi + 0x54], 0x4262e0
mov dword [esi + 0x20], ecx
lea ecx, [esi + 0x18]
mov dword [esi + 0x24], 2
call fcn.00709f70
ud2
lea ecx, [esi + 0x30]
mov edx, 0x8cb0cc
mov dword [esi + 0x30], 0x8cb0c4
mov dword [esi + 0x34], 1
mov dword [esi + 0x40], 0
mov dword [esi + 0x38], str.not_implementedC:Users_runneradmin.cargo_registry_srcindex.crates.io_6f17d22bba15001fwinit_0.28.6_srcplatform_implwindowsdrop_handler.rs
mov dword [esi + 0x3c], 0
call fcn.00709f70
ud2
Function at 0x4392e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x70
mov esi, esp
mov dword [esi + 0x58], ebp
mov dword [esi + 0x5c], esp
mov dword [esi + 0x68], 0xffffffff
mov dword [esi + 0x64], 0x702730
lea eax, [esi + 0x60]
mov edx, dword fs:[0]
mov dword [esi + 0x60], edx
mov dword fs:[0], eax
mov eax, dword [ecx]
nop word [eax + eax]
mov edx, eax
xor edx, 3
lock cmpxchg dword [ecx], edx
jne 0x439320
test al, 1
je 0x4393b9
test al, 2
jne 0x4393d1
test al, 8
mov dword [esi + 0xc], ecx
jne 0x43935d
add ecx, 0x18
lea edx, [esi + 0x18]
mov dword [esi + 0x18], 4
mov dword [esi + 0x68], 0
call fcn.00480d90
jmp 0x43937f
test al, 0x10
je 0x43937f
mov ecx, dword [esi + 0xc]
mov eax, dword [ecx + 0x40]
mov dword [esi + 0x68], 0
test eax, eax
je 0x439446
push dword [ecx + 0x44]
call dword [eax + 8]
add esp, 4
mov ecx, dword [esi + 0xc]
mov dword [esi + 0x10], 1
mov eax, 0xffffffc0
lock xadd dword [ecx], eax
shr eax, 6
cmp eax, dword [esi + 0x10]
jb 0x4393f1
jne 0x4393a8
mov dword [esi + 0x68], 0xffffffff
call fcn.00436760
mov eax, dword [esi + 0x60]
mov dword fs:[0], eax
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, 0x8cb504
mov edx, 0x23
mov dword [esi + 0x68], 0xffffffff
push 0x8cb528
jmp 0x4393e7
mov ecx, str.assertion_failed:__prev.is_complete__
mov edx, 0x25
mov dword [esi + 0x68], 0xffffffff
push 0x8cb4f4
call fcn.0070a0f0
add esp, 4
ud2
lea ecx, [esi + 0x14]
lea edx, [esi + 0x10]
mov dword [esi + 0x40], 0x8cb548
mov dword [esi + 0x44], 2
mov dword [esi + 0x50], 0
mov dword [esi + 0x14], eax
mov dword [esi + 0x68], 0xffffffff
mov dword [esi + 0x30], ecx
lea ecx, [esi + 0x30]
mov dword [esi + 0x34], 0x4262e0
mov dword [esi + 0x38], edx
mov edx, 0x8cb558
mov dword [esi + 0x3c], 0x4262e0
mov dword [esi + 0x48], ecx
lea ecx, [esi + 0x40]
mov dword [esi + 0x4c], 2
call fcn.00709f70
ud2
lea ecx, [esi + 0x18]
mov edx, 0x8cb0cc
mov dword [esi + 0x18], 0x8cb0c4
mov dword [esi + 0x1c], 1
mov dword [esi + 0x28], 0
mov dword [esi + 0x20], str.not_implementedC:Users_runneradmin.cargo_registry_srcindex.crates.io_6f17d22bba15001fwinit_0.28.6_srcplatform_implwindowsdrop_handler.rs
mov dword [esi + 0x24], 0
call fcn.00709f70
ud2
Function at 0x439560
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x70
mov esi, esp
mov dword [esi + 0x58], ebp
mov dword [esi + 0x5c], esp
mov dword [esi + 0x68], 0xffffffff
mov dword [esi + 0x64], 0x702740
lea eax, [esi + 0x60]
mov edx, dword fs:[0]
mov dword [esi + 0x60], edx
mov dword fs:[0], eax
mov eax, dword [ecx]
nop word [eax + eax]
mov edx, eax
xor edx, 3
lock cmpxchg dword [ecx], edx
jne 0x4395a0
test al, 1
je 0x439657
test al, 2
jne 0x43966f
test al, 8
mov dword [esi + 0xc], ecx
jne 0x4395dd
add ecx, 0x18
lea edx, [esi + 0x30]
mov dword [esi + 0x30], 4
mov dword [esi + 0x68], 0
call fcn.004807a0
jmp 0x4395ff
test al, 0x10
je 0x4395ff
mov ecx, dword [esi + 0xc]
mov eax, dword [ecx + 0x48]
mov dword [esi + 0x68], 0
test eax, eax
je 0x4396dd
push dword [ecx + 0x4c]
call dword [eax + 8]
add esp, 4
mov dword [esi + 0x68], 0xffffffff
mov edi, dword [esi + 0xc]
lea edx, [esi + 0x18]
mov dword [esi + 0x18], edi
mov ecx, dword [edi + 0x18]
mov dword [esi + 0x68], 0xffffffff
call fcn.006c94f0
cmp eax, 1
mov eax, 2
sbb eax, 0
mov dword [esi + 0x10], eax
shl eax, 6
neg eax
lock xadd dword [edi], eax
shr eax, 6
cmp eax, dword [esi + 0x10]
jb 0x43968f
jne 0x439646
mov ecx, edi
call fcn.00436af0
mov eax, dword [esi + 0x60]
mov dword fs:[0], eax
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, 0x8cb504
mov edx, 0x23
mov dword [esi + 0x68], 0xffffffff
push 0x8cb528
jmp 0x439685
mov ecx, str.assertion_failed:__prev.is_complete__
mov edx, 0x25
mov dword [esi + 0x68], 0xffffffff
push 0x8cb4f4
call fcn.0070a0f0
add esp, 4
ud2
lea ecx, [esi + 0x14]
lea edx, [esi + 0x10]
mov dword [esi + 0x18], 0x8cb548
mov dword [esi + 0x1c], 2
mov dword [esi + 0x28], 0
mov dword [esi + 0x14], eax
mov dword [esi + 0x48], ecx
lea ecx, [esi + 0x48]
mov dword [esi + 0x4c], 0x4262e0
mov dword [esi + 0x50], edx
mov edx, 0x8cb558
mov dword [esi + 0x54], 0x4262e0
mov dword [esi + 0x20], ecx
lea ecx, [esi + 0x18]
mov dword [esi + 0x24], 2
call fcn.00709f70
ud2
lea ecx, [esi + 0x30]
mov edx, 0x8cb0cc
mov dword [esi + 0x30], 0x8cb0c4
mov dword [esi + 0x34], 1
mov dword [esi + 0x40], 0
mov dword [esi + 0x38], str.not_implementedC:Users_runneradmin.cargo_registry_srcindex.crates.io_6f17d22bba15001fwinit_0.28.6_srcplatform_implwindowsdrop_handler.rs
mov dword [esi + 0x3c], 0
call fcn.00709f70
ud2
Function at 0x43b080
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
mov esi, esp
mov dword [esi + 0x28], ebp
mov dword [esi + 0x2c], esp
mov dword [esi + 0x38], 0xffffffff
mov dword [esi + 0x34], 0x7027d0
mov dword [esi + 0xc], ecx
lea eax, [esi + 0x30]
mov dword [esi + 8], edx
mov ecx, dword fs:[0]
mov dword [esi + 0x30], ecx
mov dword fs:[0], eax
mov dword [esi + 0x10], 2
mov byte [esi + 3], 1
mov dword [esi + 0x38], 0
call fcn.0044c130
mov ecx, dword [ebp + 8]
test eax, eax
je 0x43b0f5
movzx edx, byte [eax + 0x39]
cmp byte [eax + 0x38], 0
je 0x43b0e9
test dl, dl
je 0x43b163
dec dl
movzx edi, word [eax + 0x38]
mov byte [eax + 0x39], dl
mov dword [esi + 4], edi
jmp 0x43b0fc
xor eax, eax
mov ah, al
mov dword [esi + 4], eax
mov edi, dword [esi + 8]
lea edx, [esi + 0x10]
mov eax, dword [edi + 8]
mov eax, dword [eax + 0xc]
mov dword [esi + 0x38], 1
push ecx
push edx
push edi
call eax
add esp, 0xc
cmp dword [esi + 0x10], 2
movsd xmm0, qword [esi + 0x20]
mov eax, dword [esi + 0xc]
movsd xmm2, qword [esi + 0x10]
movsd xmm1, qword [esi + 0x18]
movsd qword [eax + 0x10], xmm0
movsd qword [eax + 8], xmm1
movsd qword [eax], xmm2
jne 0x43b17e
cmp byte [esi + 4], 0
je 0x43b17e
mov byte [esi + 3], 0
mov dword [esi + 0x38], 0
call fcn.006d1060
test eax, eax
je 0x43b17e
mov ecx, dword [esi + 4]
mov byte [eax + 0x38], 1
mov byte [eax + 0x39], ch
jmp 0x43b17e
mov eax, dword [ecx]
mov ecx, dword [ecx + 4]
mov eax, dword [eax + 8]
mov byte [esi + 3], 1
push ecx
call eax
add esp, 4
mov eax, dword [esi + 0xc]
mov dword [eax], 2
mov eax, dword [esi + 0x30]
mov dword fs:[0], eax
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43b230
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
mov esi, esp
mov dword [esi + 0x28], ebp
mov dword [esi + 0x2c], esp
mov dword [esi + 0x38], 0xffffffff
mov dword [esi + 0x34], 0x7027e0
mov dword [esi + 0xc], ecx
lea eax, [esi + 0x30]
mov dword [esi + 8], edx
mov ecx, dword fs:[0]
mov dword [esi + 0x30], ecx
mov dword fs:[0], eax
mov dword [esi + 0x10], 2
mov byte [esi + 3], 1
mov dword [esi + 0x38], 0
call fcn.0044c130
mov ecx, dword [ebp + 8]
test eax, eax
je 0x43b2a5
movzx edx, byte [eax + 0x39]
cmp byte [eax + 0x38], 0
je 0x43b299
test dl, dl
je 0x43b313
dec dl
movzx edi, word [eax + 0x38]
mov byte [eax + 0x39], dl
mov dword [esi + 4], edi
jmp 0x43b2ac
xor eax, eax
mov ah, al
mov dword [esi + 4], eax
mov edi, dword [esi + 8]
lea edx, [esi + 0x10]
mov eax, dword [edi + 8]
mov eax, dword [eax + 0xc]
mov dword [esi + 0x38], 1
push ecx
push edx
push edi
call eax
add esp, 0xc
cmp dword [esi + 0x10], 2
movsd xmm0, qword [esi + 0x20]
mov eax, dword [esi + 0xc]
movsd xmm2, qword [esi + 0x10]
movsd xmm1, qword [esi + 0x18]
movsd qword [eax + 0x10], xmm0
movsd qword [eax + 8], xmm1
movsd qword [eax], xmm2
jne 0x43b32e
cmp byte [esi + 4], 0
je 0x43b32e
mov byte [esi + 3], 0
mov dword [esi + 0x38], 0
call fcn.006d1060
test eax, eax
je 0x43b32e
mov ecx, dword [esi + 4]
mov byte [eax + 0x38], 1
mov byte [eax + 0x39], ch
jmp 0x43b32e
mov eax, dword [ecx]
mov ecx, dword [ecx + 4]
mov eax, dword [eax + 8]
mov byte [esi + 3], 1
push ecx
call eax
add esp, 4
mov eax, dword [esi + 0xc]
mov dword [eax], 2
mov eax, dword [esi + 0x30]
mov dword fs:[0], eax
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x44c130
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x78
mov esi, esp
mov dword [esi + 0x60], ebp
mov dword [esi + 0x64], esp
mov dword [esi + 0x70], 0xffffffff
mov dword [esi + 0x6c], 0x702b90
lea eax, [esi + 0x68]
mov ecx, dword fs:[0]
mov dword [esi + 0x68], ecx
mov dword fs:[0], eax
mov eax, dword [0x919434]
test eax, eax
je 0x44c28e
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jbe 0x44c194
mov ecx, dword [eax]
mov edx, eax
xor edi, edi
add edx, 8
or ecx, dword [eax + 4]
cmovne edi, edx
jne 0x44c2c9
mov eax, dword [0x919434]
test eax, eax
je 0x44c2ad
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x44c2c7
mov edi, eax
test eax, eax
jne 0x44c22a
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x58], 0x919434
movzx eax, byte [0x919aa5]
mov eax, dword [0x919820]
test eax, eax
jne 0x44c1f0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
test eax, eax
je 0x44c2eb
mov dword [0x919820], eax
push 0x50
push 0
push eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
test eax, eax
je 0x44c2eb
mov edi, eax
lea eax, [esi + 0x10]
push 0x50
push eax
push edi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov eax, dword [0x919434]
test eax, eax
je 0x44c2dc
dec eax
push edi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov eax, dword [edi]
mov ebx, dword [edi + 4]
mov dword [esi + 0xc], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 8], eax
mov eax, dword [edi + 0x10]
mov dword [edi], 1
mov dword [edi + 4], 0
add edi, 8
mov dword [esi + 4], eax
push 0x40
push 0x8cc570
push edi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
or ebx, dword [esi + 0xc]
je 0x44c2c9
mov edx, dword [esi + 8]
cmp edx, 2
je 0x44c2c9
mov ecx, dword [esi + 4]
lock dec dword [ecx]
sete al
test edx, edx
je 0x44c283
test al, al
je 0x44c2c9
call fcn.00442490
jmp 0x44c2c9
test al, al
je 0x44c2c9
call fcn.00443d50
jmp 0x44c2c9
mov ecx, 0x919434
call fcn.00721c80
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
ja 0x44c17f
jmp 0x44c194
mov ecx, 0x919434
call fcn.00721c80
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jne 0x44c1b2
xor edi, edi
mov eax, dword [esi + 0x68]
mov dword fs:[0], eax
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, 0x919434
call fcn.00721c80
jmp 0x44c222
mov ecx, 8
mov edx, 0x50
mov dword [esi + 0x70], 0
call fcn.00709d20
ud2
Function at 0x46d040
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x98
mov esi, esp
mov dword [esi + 0x80], ebp
mov dword [esi + 0x84], esp
mov dword [esi + 0x90], 0xffffffff
mov dword [esi + 0x8c], 0x703130
mov edi, ecx
lea eax, [esi + 0x88]
mov ecx, dword fs:[0]
mov dword [esi + 0x88], ecx
mov dword fs:[0], eax
movzx ecx, byte [edi + 0x24]
mov eax, dword [edi + 0x25]
test cl, cl
je 0x46d0ae
test eax, eax
jne 0x46d0ae
mov ecx, dword [edi + 0x20]
mov edx, edi
push edi
call fcn.0045bad0
add esp, 4
jmp 0x46d16a
movsd xmm1, qword [edx + 8]
mov dword [esi + 8], edi
movsd xmm0, qword [edx]
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
test cl, cl
movsd qword [esi + 0x18], xmm1
movaps xmm1, xmmword [0x725b40]
movsd qword [esi + 0x10], xmm0
movups xmmword [esi + 0x20], xmm1
mov dword [esi + 0x34], edi
mov dword [esi + 0x30], ebx
mov dword [esi + 0x38], 0
mov byte [esi + 0x3c], 7
je 0x46d10c
lea ecx, [esi + 0xc]
lea edx, [esi + 0x40]
mov dword [esi + 0xc], eax
mov byte [esi + 7], 1
mov dword [esi + 0x90], 0
mov dword [esi + 0x40], ecx
lea ecx, [esi + 0x10]
call fcn.00549360
movsd xmm1, qword [esi + 0x30]
movsd xmm2, qword [esi + 0x28]
mov eax, dword [esi + 8]
movsd xmm0, qword [esi + 0x38]
lea edx, [esi + 0x40]
mov byte [esi + 7], 0
mov dword [esi + 0x90], 0
movsd qword [esi + 0x60], xmm1
movsd xmm1, qword [esi + 0x20]
movsd qword [esi + 0x58], xmm2
movsd xmm2, qword [esi + 0x10]
mov ecx, dword [eax + 0x20]
movsd qword [esi + 0x68], xmm0
movsd qword [esi + 0x50], xmm1
movsd xmm1, qword [esi + 0x18]
movsd qword [esi + 0x40], xmm2
movsd qword [esi + 0x48], xmm1
mov dword [esi + 0x70], eax
mov dword [esi + 0x78], eax
call fcn.0045be10
mov eax, dword [esi + 0x88]
mov dword fs:[0], eax
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x490da0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x740
mov esi, esp
mov dword [esi + 0x728], ebp
mov dword [esi + 0x72c], esp
mov dword [esi + 0x738], 0xffffffff
mov dword [esi + 0x734], 0x703680
mov dword [esi + 0x1bc], ecx
mov eax, dword fs:[0]
mov dword [esi + 0x730], eax
lea eax, [esi + 0x730]
mov dword fs:[0], eax
call fcn.00490df4

Function at 0x4954b0
Capabilities:
Access peb ldr_data
Check for peb ntglobalflag flag

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x80
mov esi, esp
mov dword [esi + 0x68], ebp
mov dword [esi + 0x6c], esp
mov dword [esi + 0x78], 0xffffffff
mov dword [esi + 0x74], 0x703690
mov dword [esi + 4], ecx
lea eax, [esi + 0x70]
mov ecx, dword fs:[0]
mov dword [esi + 0x70], ecx
mov dword fs:[0], eax
mov dword [esi + 0x78], 0
call fcn.004ff0b0
mov ecx, dword [eax + 4]
push dword [eax]
call dword [ecx + 0xc]
add esp, 4
lea edi, [0x89c390]
lea ecx, [esi + 8]
mov edx, 0x85a308d3
push eax
push edi
push 0x13198a2e
push 0x3707344
push 0x243f6a88
call fcn.00410e80
add esp, 0x14
mov dword [esi + 0x78], 1
call fcn.004ff0b0
mov ecx, dword [eax + 4]
push dword [eax]
call dword [ecx + 0xc]
add esp, 4
lea ecx, [esi + 0x28]
mov edx, 0x85a308d3
push eax
lea eax, [0x89c390]
push eax
push 0x13198a2e
push 0x3707344
push 0x243f6a88
call fcn.00410e80
add esp, 0x14
mov dword [esi + 0x78], 2
call fcn.004ff0b0
mov ecx, dword [eax + 4]
push dword [eax]
call dword [ecx + 0xc]
add esp, 4
lea ecx, [esi + 0x48]
mov edx, 0x85a308d3
push eax
lea eax, [0x89c390]
push eax
push 0x13198a2e
push 0x3707344
push 0x243f6a88
call fcn.00410e80
add esp, 0x14
mov eax, dword [esi + 4]
movsd xmm1, qword [esi + 0x50]
movsd xmm0, qword [esi + 0x48]
movsd xmm2, qword [esi + 0x58]
movsd xmm3, qword [esi + 8]
mov ecx, dword [esi + 0x70]
mov dword [eax + 0x70], 0x8cdfe0
mov dword [eax + 0x74], 0
mov dword [eax + 0x78], 0
mov dword [eax + 0x7c], 0
movsd qword [eax + 0x88], xmm1
movsd xmm1, qword [esi + 0x60]
movsd qword [eax + 0x90], xmm2
movsd qword [eax + 0x80], xmm0
movsd xmm2, qword [esi + 0x18]
movsd qword [eax + 0x98], xmm1
movsd xmm1, qword [esi + 0x10]
mov dword [eax], 0x8cdfe0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
mov dword [eax + 0xa0], 8
mov dword [eax + 0xa4], 0
mov dword [eax + 0xa8], 0
mov dword [eax + 0x10], 0x8cdfe0
mov dword [eax + 0x14], 0
mov dword [eax + 0x18], 0
mov dword [eax + 0x1c], 0
movsd qword [eax + 0x30], xmm2
movsd xmm2, qword [esi + 0x40]
movsd qword [eax + 0x20], xmm3
movsd qword [eax + 0x28], xmm1
movsd xmm1, qword [esi + 0x20]
movsd qword [eax + 0x38], xmm1
movsd xmm1, qword [esi + 0x38]
mov dword [eax + 0x40], 0x8cdfe0
mov dword [eax + 0x44], 0
mov dword [eax + 0x48], 0
mov dword [eax + 0x4c], 0
movsd qword [eax + 0x68], xmm2
movsd xmm2, qword [esi + 0x28]
movsd qword [eax + 0x60], xmm1
movsd xmm1, qword [esi + 0x30]
movsd qword [eax + 0x50], xmm2
movsd qword [eax + 0x58], xmm1
mov dword fs:[0], ecx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x497090
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
mov eax, 0x1010
call fcn.007082a0
mov esi, esp
mov dword [esi + 0xff8], ebp
mov dword [esi + 0xffc], esp
mov dword [esi + 0x1008], 0xffffffff
mov dword [esi + 0x1004], 0x7036b0
mov edi, edx
mov dword [esi + 0xcc], ecx
mov eax, dword fs:[0]
mov dword [esi + 0x1000], eax
lea eax, [esi + 0x1000]
mov dword fs:[0], eax
call fcn.004970ea