joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001bc0
Capabilities:
Receive data
Receive data on socket
Set socket configuration

Disassembly:
sub esp, 0x6c
mov al, byte [0x1000c648]
push esi
push edi
mov byte [esp + 0xc], al
mov ecx, 0x19
xor eax, eax
lea edi, [esp + 0xd]
mov dword [esp + 8], eax
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x7c]
and ecx, 8
cmp cl, 8
jne 0x10001c24
mov esi, dword [esp + 0x78]
lea edx, [esp + 8]
push edx
push 0x4004667f
push esi
call sub.WS2_32.dll_ioctlsocket
cmp eax, 0xffffffff
je 0x10001c24
mov eax, dword [esp + 8]
test eax, eax
je 0x10001c24
push 0
lea eax, [esp + 0x10]
push 0x64
push eax
push esi
call sub.WS2_32.dll_recv
cmp eax, 0xffffffff
je 0x10001c24
test eax, eax
jne 0x10001bef
pop edi
mov eax, 1
pop esi
add esp, 0x6c
ret

Function at 0x10001c30
Capabilities:
Check for time delay via gettickcount
Receive data
Receive data on socket
Set socket configuration

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0x18]
push ebp
mov ebp, dword [esp + 0x18]
push esi
xor esi, esi
lea eax, [ebp + ebp + 0x1388]
push edi
mov dword [esp + 0x20], eax
mov dword [ebx], esi
mov dword [esp + 0x24], esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, dword [esp + 0x1c]
mov ecx, ebp
mov edx, ecx
mov dword [esp + 0x10], eax
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, dword [esp + 0x20]
xor eax, eax
cdq
xor eax, edx
sub eax, edx
cmp eax, ecx
jae 0x10001d3e
cmp dword [ebx], ebp
jae 0x10001d2c
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x24]
push eax
push 0x4004667f
push ecx
call sub.WS2_32.dll_ioctlsocket
cmp eax, 0xffffffff
je 0x10001d31
mov edx, dword [esp + 0x24]
test edx, edx
je 0x10001d07
mov ecx, dword [ebx]
mov eax, ebp
sub eax, ecx
xor edi, edi
cmp edx, eax
jb 0x10001cc4
mov edx, eax
mov dword [esp + 0x24], edx
jmp 0x10001cc9
mov edi, 1
mov eax, dword [esp + 0x18]
push 0
push edx
mov edx, dword [esp + 0x24]
add ecx, edx
push ecx
push eax
call sub.WS2_32.dll_recv
mov esi, eax
cmp esi, 0xffffffff
je 0x10001d31
test esi, esi
je 0x10001d2c
mov ecx, dword [ebx]
add ecx, esi
test edi, edi
mov dword [ebx], ecx
je 0x10001d0f
mov ecx, dword [esp + 0x20]
push 0x1f4
add ecx, 0x1388
mov dword [esp + 0x24], ecx
jmp 0x10001d09
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x20]
sub eax, edx
cdq
xor eax, edx
sub eax, edx
cmp eax, ecx
jb 0x10001c83
cmp esi, 0xffffffff
jne 0x10001d3e
cmp dword [ebx], 0
jne 0x10001d3e
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
pop ecx
ret

Function at 0x10001d50
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
push 0
push eax
push ecx
push edx
call sub.WS2_32.dll_send
cmp eax, 0xffffffff
jne 0x10001d6e
xor eax, eax
ret
mov ecx, dword [esp + 0x10]
mov dword [ecx], eax
mov eax, 1
ret
Function at 0x10001d80
Capabilities:
Get thread local storage value
Read file on windows

Disassembly:
mov eax, dword [0x1000b678]
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x10001d97
pop edi
pop esi
ret
mov edi, dword [esp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x10001dc6
cmp eax, 3
je 0x10001dc6
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
push 0
push ecx
push edx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
pop edi
pop esi
ret
mov eax, dword [esi + 0x120c]
test eax, eax
je 0x10001df7
mov ecx, dword [esi + 0x1210]
test ecx, ecx
je 0x10001df7
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x18]
push edx
mov edx, dword [esp + 0x18]
push ecx
push edx
push edi
call eax
add esp, 0x14
pop edi
pop esi
ret
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
push 0
push eax
push ecx
push edx
push edi
call fcn.10001c30
add esp, 0x14
pop edi
pop esi
ret

Function at 0x10001e20
Capabilities:
Get thread local storage value
Write file on windows

Disassembly:
mov eax, dword [0x1000b678]
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x10001e37
pop edi
pop esi
ret
mov edi, dword [esp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x10001e66
cmp eax, 3
je 0x10001e66
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
push 0
push ecx
push edx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
pop esi
ret
mov eax, dword [esi + 0x120c]
test eax, eax
je 0x10001e97
mov eax, dword [esi + 0x1210]
test eax, eax
je 0x10001e97
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x18]
push edx
mov edx, dword [esp + 0x18]
push ecx
push edx
push edi
call eax
add esp, 0x14
pop edi
pop esi
ret
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
push 0
push eax
push ecx
push edx
push edi
call fcn.10001d50
add esp, 0x14
pop edi
pop esi
ret

Function at 0x10001ec0
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x1000b678]
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x10001ed7
pop edi
pop esi
ret
mov edi, dword [esp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x10001efa
cmp eax, 3
je 0x10001efa
mov ecx, dword [esp + 0x10]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_PurgeComm]
pop edi
pop esi
ret
mov eax, dword [esi + 0x120c]
test eax, eax
je 0x10001f16
mov eax, dword [esi + 0x1210]
test eax, eax
je 0x10001f16
pop edi
mov eax, 1
pop esi
ret
mov edx, dword [esp + 0x10]
push edx
push edi
call fcn.10001bc0
add esp, 8
pop edi
pop esi
ret
Function at 0x10001f30
Capabilities:
Get file size
Write file on windows

Disassembly:
mov eax, 0x1004
call fcn.100029e0
mov eax, dword [0x1000c640]
push esi
test eax, eax
je 0x10001ffd
mov ecx, dword [esp + 0x1010]
lea eax, [esp + 0x1014]
push eax
lea edx, [esp + 0xc]
push ecx
push edx
call fcn.10002981
mov eax, dword [esp + 0x1018]
add esp, 0xc
push 0
push 0x80
push 4
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
test esi, esi
je 0x10001ffd
push edi
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x10001fb7
cmp eax, 0x100000
jbe 0x10001fb7
push 0
push 0
push 0
push esi
call edi
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push 2
push 0
push 0
push esi
call edi
lea ecx, [esp + 8]
push 0
push ecx
lea edi, [esp + 0x14]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
lea edx, [esp + 0x14]
not ecx
dec ecx
push ecx
push edx
push esi
call edi
lea eax, [esp + 8]
push 0
push eax
push 2
push 0x1000b67c
push esi
call edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
add esp, 0x1004
ret
Function at 0x10002080
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
mov eax, dword [esp + 8]
push esi
cmp eax, 3
push edi
ja case.default.0x1000208f
jmp dword [eax*4 + 0x10002208]
cmp dword [0x1000b678], 0xffffffff
jne 0x100020aa
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x1000b678], eax
push 0x1214
call fcn.10002b17
mov edx, eax
xor esi, esi
add esp, 4
cmp edx, esi
je 0x10002197
mov ecx, 0x400
xor eax, eax
lea edi, [edx + 4]
mov dword [edx], 0xffffffff
mov dword [edx + 0x1004], esi
push edx
rep stosd dword es:[edi], eax
mov ecx, 0x40
lea edi, [edx + 0x1008]
rep stosd dword es:[edi], eax
mov ecx, 0x40
lea edi, [edx + 0x1108]
rep stosd dword es:[edi], eax
mov dword [edx + 0x1208], 1
mov dword [edx + 0x120c], esi
mov dword [edx + 0x1210], esi
mov eax, dword [0x1000b678]
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop edi
mov eax, 1
pop esi
ret 0xc
push 0x1214
call fcn.10002b17
mov edx, eax
xor esi, esi
add esp, 4
cmp edx, esi
je 0x10002197
mov ecx, 0x400
xor eax, eax
lea edi, [edx + 4]
mov dword [edx], 0xffffffff
mov dword [edx + 0x1004], esi
push edx
rep stosd dword es:[edi], eax
mov ecx, 0x40
lea edi, [edx + 0x1008]
rep stosd dword es:[edi], eax
mov ecx, 0x40
lea edi, [edx + 0x1108]
rep stosd dword es:[edi], eax
mov dword [edx + 0x1208], 1
mov dword [edx + 0x120c], esi
mov dword [edx + 0x1210], esi
mov ecx, dword [0x1000b678]
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop edi
mov eax, 1
pop esi
ret 0xc
pop edi
xor eax, eax
pop esi
ret 0xc
mov edx, dword [0x1000b678]
push edx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
xor esi, esi
cmp eax, esi
je 0x100021ba
push eax
call fcn.10002b0c
add esp, 4
mov eax, dword [0x1000b678]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop edi
mov eax, 1
pop esi
ret 0xc
mov eax, dword [0x1000b678]
cmp eax, 0xffffffff
je case.default.0x1000208f
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x100021ef
push eax
call fcn.10002b0c
add esp, 4
mov ecx, dword [0x1000b678]
push ecx
call dword [sym.imp.KERNEL32.dll_TlsFree]
pop edi
mov eax, 1
pop esi
ret 0xc
Function at 0x10002240
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 0x804
push esi
call fcn.10002220
mov esi, eax
test esi, esi
jge 0x1000228a
mov eax, dword [esp + 0x81c]
mov ecx, dword [esp + 0x818]
mov edx, dword [esp + 0x814]
push eax
mov eax, dword [esp + 0x814]
push ecx
mov ecx, dword [esp + 0x814]
push edx
push eax
push ecx
call fcn.10001e20
add esp, 0x14
pop esi
add esp, 0x804
ret
mov edx, dword [0x1000b678]
push edx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x100022a5
mov dword [eax + 0x1004], 0
mov eax, dword [esp + 0x814]
lea ecx, [esp + 8]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x810]
push ecx
lea edx, [esp + 8]
push esi
push edx
push eax
call fcn.10002360
add esp, 0x10
test eax, eax
jne 0x100022d7
pop esi
add esp, 0x804
ret
mov ecx, dword [esp + 0x81c]
mov edx, dword [esp + 0x818]
mov eax, dword [esp + 4]
push ecx
push edx
mov edx, dword [esp + 0x814]
lea ecx, [esp + 0x10]
push eax
push ecx
push edx
call fcn.10001e20
add esp, 0x14
pop esi
add esp, 0x804
ret
Function at 0x10002440
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 0x808
mov eax, dword [0x1000b678]
push ebx
push ebp
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebp, dword [eax + 0x1004]
mov esi, dword [esp + 0x824]
cmp ebp, esi
mov dword [esp + 0x14], eax
lea ebx, [eax + 4]
jge 0x10002581
mov ecx, dword [esp + 0x82c]
lea edx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x820]
push edx
lea eax, [esp + 0x20]
push 0xd
push eax
push ecx
call fcn.10001d80
mov eax, dword [esp + 0x24]
add esp, 0x14
cmp eax, 0xd
jb 0x100025d4
cmp byte [esp + 0x18], 0x7e
jne 0x100025d4
lea edx, [esp + 0x1f]
push edx
call fcn.10002650
add esp, 4
test al, al
jne 0x100025d4
lea eax, [esp + 0x21]
push eax
call fcn.10002730
mov esi, eax
add esp, 4
cmp esi, 0xffffffff
je 0x100025d4
mov ecx, dword [esp + 0x82c]
lea edx, [esp + 0x10]
lea edi, [esi + 5]
push ecx
mov ecx, dword [esp + 0x820]
push edx
lea eax, [esp + 0x2d]
push edi
push eax
push ecx
call fcn.10001d80
mov eax, dword [esp + 0x24]
add esp, 0x14
cmp eax, edi
jl 0x100025d4
lea edx, [esp + 0x18]
lea eax, [esp + 0x418]
push edx
push eax
mov byte [esp + esi + 0x32], 0
call fcn.10002b30
lea edi, [esi + 0xd]
lea ecx, [esp + 0x20]
push edi
push ecx
call fcn.10002600
lea edx, [esp + 0x28]
lea eax, [esp + 0x428]
push edx
push eax
call fcn.10002c20
add esp, 0x18
test eax, eax
jne 0x100025d4
mov esi, 0xd
cmp edi, esi
jle 0x10002570
lea ecx, [esp + esi + 0x18]
push ecx
call fcn.10002650
add esp, 4
mov byte [ebx + ebp], al
add esi, 2
inc ebp
cmp esi, edi
jl 0x10002558
mov eax, dword [esp + 0x824]
cmp ebp, eax
jl 0x10002472
mov esi, eax
test esi, esi
jbe 0x100025a0
mov eax, dword [esp + 0x820]
mov ecx, ebx
sub ecx, eax
mov dl, byte [ecx + eax]
mov byte [eax], dl
inc eax
dec esi
jne 0x10002590
mov esi, dword [esp + 0x824]
mov eax, dword [esp + 0x828]
sub ebp, esi
mov dword [eax], esi
je 0x100025ba
mov eax, ebx
mov ecx, ebp
mov dl, byte [eax + esi]
mov byte [eax], dl
inc eax
dec ecx
jne 0x100025b1
mov eax, dword [esp + 0x14]
pop edi
pop esi
mov dword [eax + 0x1004], ebp
pop ebp
mov eax, 1
pop ebx
add esp, 0x808
ret
mov ecx, dword [esp + 0x828]
mov edx, dword [esp + 0x14]
pop edi
pop esi
mov dword [ecx], 0
pop ebp
mov dword [edx + 0x1004], 0
xor eax, eax
pop ebx
add esp, 0x808
ret
Function at 0x401431
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov edx, 0x8f
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x401437
call fcn.004044c0
mov edx, dword [esp + 0x244]
lea ecx, [esp]
call fcn.00403000
mov edx, dword [esp + 0x248]
lea ecx, [esp + 4]
call fcn.00403000
mov edx, dword [esp + 0x254]
lea ecx, [esp + 8]
call fcn.00403000
call fcn.00404590
push eax
push eax
call fcn.00404590
push eax
push eax
call fcn.00404590
push eax
push eax
push dword [esp + 0x20]
call fcn.00403070
call fcn.004045c2
add dword [esp], edx
call fcn.00403dd5
call fcn.004045c2
add dword [esp], edx
call fcn.004031a0
lea eax, [esp + 0xc]
push eax
call fcn.004045e0
mov dword [0x407c6c], 0
push 0
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [esp + 0xc], eax
cmp dword [esp + 0xc], 0
je 0x40160b
lea eax, [esp + 0x10]
lea ebp, [esp + 0x10]
mov dword [ebp], 0x224
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x10]
call sub.KERNEL32.dll_Module32First
and eax, eax
je 0x401602
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x10]
call sub.KERNEL32.dll_Module32Next
and eax, eax
je 0x401602
lea ebp, [esp + 0x10]
cmp dword [ebp + 0x1c], 0
je 0x4015fd
lea ebp, [esp + 0x10]
movzx eax, byte [ebp + 0x20]
mov dword [esp + 0x234], eax
mov edx, 0x40700d
lea ecx, [esp + 0x238]
call fcn.00403008
cmp dword [esp + 0x234], 0
je 0x4015b1
call fcn.00404590
push eax
push eax
call fcn.00404590
push eax
push eax
call fcn.00404590
push eax
push eax
call fcn.00404590
push eax
push eax
push dword [esp + 0x254]
call fcn.00403d90
call fcn.004045c2
add dword [esp], edx
call fcn.00403070
call fcn.004045c2
add dword [esp], edx
call fcn.00403dd5
call fcn.004045c2
add dword [esp], edx
call fcn.004031a0
lea eax, [esp + 0x23c]
push eax
call fcn.004045e0
cmp dword [esp + 0x250], 0
jne 0x4015d0
push dword [esp + 0x238]
mov edx, dword [esp + 0xc]
pop ecx
call fcn.00404670
jne 0x4015d0
jmp 0x4015d7
mov eax, 1
jmp 0x4015d9
xor eax, eax
and eax, eax
je 0x4015fd
push dword [esp + 0x24c]
push dword [esp + 8]
push dword [esp + 8]
lea ebp, [esp + 0x1c]
push dword [ebp + 0x1c]
call fcn.004016dc
mov dword [0x407c6c], eax
jmp 0x401507
push dword [esp + 0xc]
call sub.KERNEL32.dll_CloseHandle
push dword [esp + 8]
call fcn.00404590
push eax
push eax
call fcn.00404590
push eax
push eax
call fcn.00404590
push eax
push eax
call fcn.00404590
push eax
push eax
call fcn.004038d3
call fcn.004045c2
add dword [esp], edx
call fcn.00403dd5
call fcn.004045c2
add dword [esp], edx
call fcn.00403070
call fcn.004045c2
add dword [esp], edx
call fcn.004031a0
call fcn.004046a0
mov edx, eax
pop ecx
call fcn.00404670
jne 0x401672
cmp dword [esp + 0x250], 0
jne 0x401672
jmp 0x401679
mov eax, 1
jmp 0x40167b
xor eax, eax
and eax, eax
je 0x4016a3
push dword [esp + 0x24c]
push dword [esp + 8]
push dword [esp + 8]
push 0
call sub.KERNEL32.dll_GetModuleHandleA
push eax
call fcn.004016dc
mov dword [0x407c6c], eax
mov eax, dword [0x407c6c]
jmp 0x4016ac
push dword [esp]
call fcn.00404560
push dword [esp + 4]
call fcn.00404560
push dword [esp + 8]
call fcn.00404560
push dword [esp + 0x238]
call fcn.00404560
add esp, 0x23c
pop ebp
ret 0x14
Function at 0x4037f1
Capabilities:
Enumerate gui resources

Disassembly:
cmp dword [esp + 4], 0
je 0x403809
push dword [esp + 4]
push 0x40378a
call dword [sym.imp.USER32.DLL_EnumWindows]
jmp 0x403846
push esi
mov esi, dword [0x407db4]
test esi, esi
je 0x403845
push ebx
push edi
mov ebx, dword [esi]
lea edi, [esi + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [edi], eax
jne 0x40383d
push 1
push dword [esi + 0xc]
call dword [sym.imp.USER32.DLL_EnableWindow]
push edi
push 0x407db4
call fcn.00404192
pop ecx
pop ecx
test ebx, ebx
mov esi, ebx
jne 0x403816
pop edi
pop ebx
pop esi
ret 4

Function at 0x403c74
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x130
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
push 0x64
pop ebx
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x1c], 0x94
call edi
test eax, eax
je 0x403d4b
mov eax, dword [ebp - 0xc]
dec eax
je 0x403d2e
dec eax
jne 0x403d4b
lea eax, [ebp - 0xb8]
push eax
xor esi, esi
mov dword [ebp - 0xb8], 0x9c
call edi
test eax, eax
je 0x403cd1
cmp byte [ebp - 0x1e], 1
jne 0x403cd1
inc esi
mov eax, dword [ebp - 0x18]
sub eax, 3
je 0x403d2a
dec eax
je 0x403d26
dec eax
je 0x403d04
dec eax
jne 0x403d4b
mov eax, dword [ebp - 0x14]
sub eax, 0
je 0x403cf6
dec eax
jne 0x403d4b
neg esi
sbb esi, esi
and esi, 5
jmp 0x403cfd
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x4b
mov ebx, esi
jmp 0x403d4b
mov eax, dword [ebp - 0x14]
sub eax, 0
je 0x403d22
dec eax
je 0x403d1e
dec eax
jne 0x403d4b
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x41
jmp 0x403d00
push 0x3c
jmp 0x403d4a
push 0x32
jmp 0x403d4a
push 0x14
jmp 0x403d4a
push 5
jmp 0x403d4a
cmp dword [ebp - 0x14], 0
je 0x403d48
cmp dword [ebp - 0x14], 0xa
je 0x403d44
cmp dword [ebp - 0x14], 0x5a
jne 0x403d4b
push 0x28
jmp 0x403d4a
push 0x1e
jmp 0x403d4a
push 0xa
pop ebx
pop edi
pop esi
mov eax, ebx
pop ebx
add ebp, 0x78
leave
ret

Function at 0x404041
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push dword [0x407dc0]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
test edi, edi
jne 0x4040a2
push esi
push dword [0x407dc8]
push 8
push dword [0x407c54]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
push edi
push dword [0x407dc0]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov esi, dword [0x407dc4]
jmp 0x404092
mov eax, dword [esi + 0xc]
test eax, eax
je 0x404090
mov ecx, dword [esi + 8]
add ecx, edi
push ecx
call eax
pop ecx
mov esi, dword [esi]
test esi, esi
jne 0x404080
push edi
push 0x404006
call fcn.00404d83
pop esi
mov eax, dword [esp + 8]
add eax, edi
pop edi
ret 4
Function at 0x4040ac
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push ebx
mov ebx, dword [esp + 8]
mov eax, ebx
and eax, 3
push esi
push edi
je 0x4040c1
push 4
pop ecx
sub ecx, eax
add ebx, ecx
cmp dword [0x407dc8], 0
mov esi, dword [sym.imp.KERNEL32.dll_TlsSetValue]
jne 0x4040f3
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
push ebx
push 8
push dword [0x407c54]
mov dword [0x407dc0], eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push eax
push dword [0x407dc0]
call esi
mov edi, dword [0x407dc8]
add dword [0x407dc8], ebx
push dword [0x407dc8]
push dword [0x407dc0]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push eax
push 8
push dword [0x407c54]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov ebx, eax
push ebx
push dword [0x407dc0]
call esi
mov esi, dword [esp + 0x14]
test esi, esi
jne 0x404139
cmp dword [esp + 0x18], esi
je 0x40415d
push 0x14
push 0x407dc4
call fcn.00404165
test esi, esi
pop ecx
pop ecx
mov ecx, dword [esp + 0x18]
mov dword [eax], edi
mov dword [eax + 4], esi
mov dword [eax + 8], ecx
je 0x40415d
add ebx, edi
push ebx
call esi
pop ecx
mov eax, edi
pop edi
pop esi
pop ebx
ret 0xc

Function at 0x4045e0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x4074dc]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 8]
sub edx, dword [ebp + 0xc]
mov dword [ebp - 4], edx
mov eax, dword [ebp + 8]
cmp dword [eax], 0
jne 0x404626
mov ecx, dword [ebp - 4]
add ecx, 5
push ecx
push 0
mov edx, dword [0x407e40]
push edx
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
jmp 0x404647
mov edx, dword [ebp - 4]
add edx, 5
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
push 0
mov edx, dword [0x407e40]
push edx
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
add ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
call fcn.004049f0
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 0xc]
mov dword [ecx + 8], edx
mov esp, ebp
pop ebp
ret 8

Function at 0x4046a0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push edx
mov eax, dword [0x4074dc]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 8]
mov dword [ecx + 8], edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
mov edx, dword [ebp - 8]
add ecx, dword [edx + 8]
mov dword [ebp - 4], ecx
pop edx
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 4

Function at 0x4046e0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x4074dc]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 8]
add edx, 1
mov eax, dword [ebp - 4]
mov dword [eax + 8], edx
mov esp, ebp
pop ebp
ret
Function at 0x4047a0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x4074dc]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov eax, dword [ecx]
mov edx, dword [ebp - 4]
add eax, dword [edx + 8]
mov esp, ebp
pop ebp
ret

Function at 0x4048d0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x4074dc]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
cmp edx, dword [ecx]
jb 0x40490e
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
mov edx, dword [ebp - 4]
add ecx, dword [edx + 8]
cmp dword [ebp + 8], ecx
ja 0x40490e
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
sub ecx, dword [eax]
add ecx, 1
mov eax, ecx
jmp 0x404910
xor eax, eax
mov esp, ebp
pop ebp
ret 4

Function at 0x404920
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x4074dc]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 0xc], eax
cmp dword [ebp + 0xc], 0xffffffff
jne 0x404944
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 8]
mov dword [ebp + 0xc], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 8]
add ecx, dword [ebp + 8]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 4]
sub eax, 4
cmp dword [ebp - 8], eax
jl 0x404991
mov ecx, dword [ebp - 8]
add ecx, 0x4000
mov edx, dword [ebp - 0xc]
mov dword [edx + 4], ecx
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 4]
add ecx, 5
push ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [edx]
push eax
push 0
mov ecx, dword [0x407e40]
push ecx
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov edx, dword [ebp - 0xc]
mov dword [edx], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
add ecx, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 0xc]
add edx, dword [ebp + 8]
mov eax, dword [ebp - 0xc]
mov dword [eax + 8], edx
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 8