joyce8/EMBER2024-capa huggingface dataset:
Function at 0x412a97
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
push eax
mov eax, 0x2828
call fcn.00459430
mov dword [ebp - 0x2838], edx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x101c], 0
mov dword [ebp - 0x202c], 0
mov edi, eax
mov eax, dword [edi + 0x4c4]
test eax, eax
je 0x412ae8
cmp dword [eax + 0x14], 0
jne 0x412b1e
mov eax, dword [eax + 0xc]
test eax, eax
je 0x412ae8
mov edx, dword [ebp - 0x2838]
cmp dword [eax], edx
jne 0x412b1e
cmp dword [ebp - 0x101c], 0x3ff
ja 0x412b1e
lea eax, [ebp - 0x101c]
push eax
push dword [edi + 8]
call sub.WS2_32.DLL___WSAFDIsSet
test eax, eax
jne 0x412b1e
mov eax, dword [ebp - 0x101c]
mov edx, dword [edi + 8]
mov dword [ebp + eax*4 - 0x1018], edx
inc eax
mov dword [ebp - 0x101c], eax
cmp dword [ebp - 0x202c], 0x3ff
ja 0x412b54
lea eax, [ebp - 0x202c]
push eax
push dword [edi + 8]
call sub.WS2_32.DLL___WSAFDIsSet
test eax, eax
jne 0x412b54
mov eax, dword [ebp - 0x202c]
mov edx, dword [edi + 8]
mov dword [ebp + eax*4 - 0x2028], edx
inc eax
mov dword [ebp - 0x202c], eax
mov eax, dword [edi + 0x4d0]
test eax, eax
je 0x412b63
push edi
call dword [eax + 4]
pop ecx
push 0
lea eax, [ebp - 0x202c]
push 0
push eax
lea eax, [ebp - 0x101c]
push eax
push 0
call sub.WS2_32.DLL_select
mov edx, dword [edi + 0x4c4]
mov ebx, eax
test edx, edx
je 0x412b9b
xor eax, eax
cmp dword [ebp - 0x2838], 0
setne al
push eax
push edi
call dword [edx + 0x4c]
pop eax
pop edx
test ebx, ebx
jns 0x412bb0
call sub.WS2_32.DLL_WSAGetLastError
cmp eax, 4
je 0x412bb0
push edi
call fcn.00412485
pop eax
test ebx, ebx
jle 0x412b54
lea eax, [ebp - 0x101c]
push eax
push dword [edi + 8]
call sub.WS2_32.DLL___WSAFDIsSet
test eax, eax
je 0x412c9d
lea eax, [ebp - 0x2830]
push eax
push dword [edi + 0x534]
call fcn.0041ad58
pop ebx
test eax, eax
pop esi
jns 0x412bea
push edi
call fcn.00412485
pop ecx
mov esi, dword [ebp - 0x2830]
cmp esi, 0x1f
jle 0x412bfe
cmp dword [edi + 0x4c8], 0
je 0x412c05
mov esi, 0x20
jmp 0x412c12
cmp esi, 0x800
jle 0x412c12
mov esi, 0x800
mov eax, esi
mov edx, 0x20
mov ecx, edx
cdq
lea ebx, [ebp - 0x282c]
idiv ecx
mov esi, eax
shl esi, 5
push esi
push ebx
push edi
call fcn.0041285c
add esp, 0xc
test esi, esi
jle 0x412c86
movzx eax, byte [ebx]
cmp al, 1
jne 0x412c68
push 1
lea eax, [ebp - 0x2834]
mov edx, ebx
push eax
mov eax, edi
push ebx
mov dword [ebp - 0x2834], esi
call fcn.0041296e
mov esi, dword [ebp - 0x2834]
mov ebx, eax
mov dword [ebp - 0x2830], esi
jmp 0x412c31
test al, al
jne 0x412c75
push ebx
push edi
call fcn.00412385
jmp 0x412c7c
push ebx
push edi
call fcn.004124c2
pop eax
add ebx, 0x20
sub esi, 0x20
pop edx
jmp 0x412c34
mov eax, dword [edi + 0x4c4]
test eax, eax
je 0x412c9d
mov edx, dword [eax + 0x14]
test edx, edx
je 0x412c9d
push dword [edx]
call dword [eax + 0x50]
pop esi
lea eax, [ebp - 0x202c]
push eax
push dword [edi + 8]
call sub.WS2_32.DLL___WSAFDIsSet
test eax, eax
je 0x412ac7
mov eax, dword [edi + 0x4c4]
test eax, eax
je 0x412cc5
push dword [eax + 0x34]
call dword [eax + 0x54]
pop ebx
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x413ecb
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
sub esp, 0x11c
push dword [ebp + 0xc]
mov dword [ebp - 0x120], edx
push dword [ebp + 8]
call fcn.00413e65
pop edx
test eax, eax
mov edx, 1
pop ecx
jne 0x41408c
push str._XBASEDRIVE
call sub.msvcrt.dll_getenv
mov ebx, eax
test ebx, ebx
pop eax
jne 0x413f0f
mov ebx, 0x46ac28
cld
xor edx, edx
mov al, dl
or ecx, 0xffffffff
mov edi, ebx
repne scasb al, byte es:[edi]
not ecx
mov edi, esi
mov dword [ebp - 0x128], ecx
mov edx, dword [ebp - 0x128]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
lea edi, [ebp - 0x11c]
lea eax, [ecx + edx - 2]
cmp eax, 0x103
jle 0x413f4d
inc eax
push eax
call sub.msvcrt.dll_malloc
mov edi, eax
pop eax
push ebx
push edi
call sub.msvcrt.dll_strcpy
push esi
push edi
call sub.msvcrt.dll_strcat
push dword [ebp + 0xc]
mov eax, edi
mov edx, dword [ebp - 0x120]
push dword [ebp + 8]
call fcn.00413e65
add esp, 0x18
test eax, eax
jne 0x414068
push str.HOMEDRIVE
call sub.msvcrt.dll_getenv
mov ebx, eax
test ebx, ebx
pop eax
je 0x413ff0
cld
xor edx, edx
mov al, dl
or ecx, 0xffffffff
mov edi, ebx
repne scasb al, byte es:[edi]
not ecx
mov edi, esi
mov dword [ebp - 0x128], ecx
mov edx, dword [ebp - 0x128]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
lea edi, [ebp - 0x11c]
lea eax, [ecx + edx - 2]
cmp eax, 0x103
jle 0x413fc8
inc eax
push eax
call sub.msvcrt.dll_malloc
mov edi, eax
pop eax
push ebx
push edi
call sub.msvcrt.dll_strcpy
push esi
push edi
call sub.msvcrt.dll_strcat
push dword [ebp + 0xc]
mov eax, edi
mov edx, dword [ebp - 0x120]
push dword [ebp + 8]
call fcn.00413e65
add esp, 0x18
test eax, eax
jne 0x414068
call sub.msvcrt.dll__getdrives
mov dword [ebp - 0x124], eax
mov ebx, 2
mov eax, 1
mov cl, bl
shl eax, cl
test dword [ebp - 0x124], eax
je 0x414080
cld
xor eax, eax
or ecx, 0xffffffff
mov edi, esi
repne scasb al, byte es:[edi]
not ecx
lea edi, [ebp - 0x11c]
lea eax, [ecx + 1]
cmp eax, 0x103
jle 0x414039
lea eax, [ecx + 2]
push eax
call sub.msvcrt.dll_malloc
mov edi, eax
pop eax
mov byte [edi + 1], 0x3a
mov al, bl
add al, 0x41
mov byte [edi], al
mov byte [edi + 2], 0
push esi
push edi
call sub.msvcrt.dll_strcat
push dword [ebp + 0xc]
mov eax, edi
mov edx, dword [ebp - 0x120]
push dword [ebp + 8]
call fcn.00413e65
add esp, 0x10
test eax, eax
je 0x414080
lea eax, [ebp - 0x11c]
cmp edi, eax
je 0x414079
push edi
call sub.msvcrt.dll_free
pop esi
mov edx, 1
jmp 0x41408c
inc ebx
cmp ebx, 0x19
jle 0x414000
xor edx, edx
lea esp, [ebp - 0xc]
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x41517e
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x30
push 0
push eax
call fcn.00414096
pop ebx
mov esi, eax
xor eax, eax
cmp esi, 0xffffffff
pop edi
je 0x4151f4
lea eax, [ebp - 0x3c]
or edi, 0xffffffff
push eax
push esi
call sub.msvcrt.dll__fstat
pop edx
inc eax
pop ecx
je 0x4151af
mov edi, dword [ebp - 0x28]
lea eax, [edi + 1]
push eax
call sub.msvcrt.dll_malloc
mov ebx, eax
test ebx, ebx
pop eax
jne 0x4151c7
push esi
call sub.msvcrt.dll__close
jmp 0x4151e4
push edi
push ebx
push esi
call sub.msvcrt.dll__read
add esp, 0xc
test eax, eax
mov edi, eax
jns 0x4151e8
push esi
call sub.msvcrt.dll__close
push ebx
call sub.msvcrt.dll_free
xor eax, eax
jmp 0x4151f4
push esi
call sub.msvcrt.dll__close
mov byte [ebx + edi], 0
mov eax, ebx
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x41a8ed
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, edx
push esi
push ebx
mov ebx, eax
push ecx
push 0x2c
push 1
call sub.msvcrt.dll_calloc
mov esi, eax
test esi, esi
pop eax
pop edx
jne 0x41a966
call sub.msvcrt.dll__errno
mov ebx, dword [eax]
mov eax, dword [sym.imp.msvcrt.dll__iob]
push dword [0x465118]
add eax, 0x40
push eax
call sub.msvcrt.dll_fprintf
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
push eax
call sub.msvcrt.dll_fflush
push 0
mov eax, dword [sym.imp.msvcrt.dll__iob]
push 0
push 0
add eax, 0x40
push 0x46b063
push eax
call sub.msvcrt.dll_fprintf
mov eax, dword [sym.imp.msvcrt.dll__iob]
add esp, 0x20
add eax, 0x40
push eax
call sub.msvcrt.dll_fflush
call sub.msvcrt.dll__errno
mov dword [eax], ebx
pop esi
jmp 0x41a998
imul ebx, ebx, 0x14
push dword [ebx + 0x465130]
push edi
push dword [ebx + 0x465124]
call sub.WS2_32.DLL_socket
mov dword [esi + 0x10], eax
test eax, eax
mov edx, eax
jns 0x41a99c
call sub.WS2_32.DLL_WSAGetLastError
mov ebx, eax
call sub.msvcrt.dll__errno
mov dword [eax], ebx
push esi
call sub.msvcrt.dll_free
xor eax, eax
jmp 0x41a9be
cmp dword [ebx + 0x465124], 2
jne 0x41a9bc
push 4
lea eax, [ebp - 0x10]
push eax
push 1
push 6
push edx
mov dword [ebp - 0x10], 1
call sub.WS2_32.DLL_setsockopt
mov eax, esi
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x41c000
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x20c
mov esi, dword [ebp + 0x1c]
test esi, esi
je 0x41c165
cmp dword [0x4b0600], 0
jne 0x41c096
call fcn.004142b0
push str.XERRORDB
call sub.msvcrt.dll_getenv
pop edx
test eax, eax
jne 0x41c039
mov eax, str.XErrorDB
push eax
call fcn.00415dcd
mov edx, dword [0x465058]
mov edi, eax
pop eax
cmp dword [edx], 0
je 0x41c057
mov eax, dword [0x465050]
push dword [eax]
call dword [edx]
pop eax
cmp dword [0x4b0600], 0
mov ebx, 1
jne 0x41c06d
mov dword [0x4b0600], edi
xor bl, bl
mov edx, dword [0x465054]
cmp dword [edx], 0
je 0x41c082
mov eax, dword [0x465050]
push dword [eax]
call dword [edx]
pop eax
test ebx, ebx
je 0x41c08d
push edi
call fcn.004183ed
pop ecx
cmp dword [0x4b0600], 0
je 0x41c114
cld
mov edi, dword [ebp + 0xc]
xor edx, edx
mov al, dl
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov edi, dword [ebp + 0x10]
mov ebx, ecx
or ecx, 0xffffffff
not ebx
repne scasb al, byte es:[edi]
not ecx
lea edi, [ebp - 0x20c]
lea eax, [ecx + ebx]
cmp eax, 0x200
jbe 0x41c0ca
push eax
call sub.msvcrt.dll_malloc
pop edx
mov edi, eax
test edi, edi
je 0x41c114
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0x46b59a
push edi
call sub.msvcrt.dll_sprintf
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x218]
push eax
push str.ErrorType.ErrorNumber
push edi
push dword [0x4b0600]
call fcn.00418305
lea eax, [ebp - 0x20c]
add esp, 0x24
cmp edi, eax
je 0x41c11e
push edi
call sub.msvcrt.dll_free
pop eax
jmp 0x41c11e
mov dword [ebp - 0x210], 0
cmp dword [ebp - 0x210], 0
jne 0x41c143
cld
mov eax, dword [ebp + 0x14]
or ecx, 0xffffffff
mov edi, dword [ebp + 0x14]
mov dword [ebp - 0x210], eax
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
mov dword [ebp - 0x214], ecx
push esi
push dword [ebp - 0x210]
push dword [ebp + 0x18]
call sub.msvcrt.dll_strncpy
add esp, 0xc
cmp dword [ebp - 0x214], esi
jbe 0x41c165
mov ecx, dword [ebp + 0x18]
mov byte [ecx + esi - 1], 0
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x41ea70
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
push eax
push eax
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
cmp eax, 2
setne dl
test eax, eax
setne al
movzx eax, al
xor ecx, ecx
test edx, eax
jne 0x41eb86
test ebx, ebx
jne 0x41eab3
mov eax, dword [0x4b06a0]
test eax, eax
mov ecx, eax
jne 0x41eb86
mov ecx, 0x46b610
jmp 0x41eb86
cmp byte [ebx], 0
jne 0x41eac5
push str.LC_CTYPE
call sub.msvcrt.dll_getenv
mov ebx, eax
pop eax
test ebx, ebx
je 0x41eace
cmp byte [ebx], 0
jne 0x41eadb
push str.LANG
call sub.msvcrt.dll_getenv
pop edi
mov ebx, eax
test ebx, ebx
je 0x41eb01
cld
or ecx, 0xffffffff
xor eax, eax
mov edi, ebx
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 0x3f
ja 0x41eb01
cmp byte [ebx], 0
je 0x41eb01
push ebx
call fcn.0041ca3b
pop esi
test eax, eax
jne 0x41eb06
mov ebx, 0x46b610
lea eax, [ebp - 0x10]
mov esi, dword [0x4b06a0]
push eax
mov dword [0x4b06a0], ebx
call fcn.0041cbfe
pop ecx
xor ecx, ecx
test eax, eax
mov dword [ebp - 0x14], eax
mov dword [0x4b06a0], esi
je 0x41eb86
push dword [ebp - 0x10]
call dword [eax + 0xc]
cld
or ecx, 0xffffffff
mov ebx, eax
mov edi, ebx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
call sub.msvcrt.dll_malloc
pop edi
test eax, eax
mov dword [0x4b06a0], eax
pop edx
jne 0x41eb63
push dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov dword [0x4b06a0], esi
call dword [eax + 0x10]
xor ecx, ecx
jmp 0x41eb86
push ebx
push eax
call sub.msvcrt.dll_strcpy
pop edx
test esi, esi
pop ecx
je 0x41eb77
push esi
call sub.msvcrt.dll_free
pop eax
push dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
call dword [edx + 0x10]
mov ecx, dword [0x4b06a0]
lea esp, [ebp - 0xc]
mov eax, ecx
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x422090
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, eax
lea eax, [ebp - 6]
push ecx
push edx
push 1
push 2
push eax
call sub.msvcrt.dll_fread
add esp, 0x10
xor edx, edx
dec eax
jne 0x4220c3
movzx eax, byte [ebp - 6]
movzx dx, byte [ebp - 5]
shl eax, 8
add eax, edx
mov word [ebx], ax
mov edx, 1
mov ebx, dword [ebp - 4]
mov eax, edx
leave
ret

Function at 0x4220ca
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, edx
push ebx
push ecx
push ecx
mov edi, dword [ebp + 8]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0xe]
mov edx, edi
call fcn.00422090
xor edx, edx
test eax, eax
je 0x422142
movzx eax, word [ebp - 0xe]
xor ebx, ebx
test ax, ax
je 0x422131
movzx eax, ax
push eax
call sub.msvcrt.dll_malloc
mov ebx, eax
xor edx, edx
test ebx, ebx
pop eax
je 0x422142
movzx eax, word [ebp - 0xe]
push edi
push eax
push 1
push ebx
call sub.msvcrt.dll_fread
movzx ecx, word [ebp - 0xe]
add esp, 0x10
cmp eax, ecx
je 0x422131
cld
xor eax, eax
mov edi, ebx
rep stosb byte es:[edi], al
push ebx
call sub.msvcrt.dll_free
xor edx, edx
jmp 0x422142
movzx eax, word [ebp - 0xe]
mov dword [esi], ebx
mov edx, dword [ebp - 0x14]
mov word [edx], ax
mov edx, 1
lea esp, [ebp - 0xc]
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x422260
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
push str.XAUTHORITY
call sub.msvcrt.dll_getenv
pop edi
test eax, eax
mov edi, eax
jne 0x422307
push 0x46c64b
call sub.msvcrt.dll_getenv
pop ebx
test eax, eax
mov esi, eax
je 0x422307
cld
xor edx, edx
mov edi, eax
or ecx, 0xffffffff
mov al, dl
repne scasb al, byte es:[edi]
mov ebx, ecx
mov edi, 0x46c651
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ebx
not ecx
lea ebx, [ecx + ebx]
cmp ebx, dword [0x4b06c0]
jle 0x4222db
mov eax, dword [0x4b06b0]
test eax, eax
je 0x4222c3
push eax
call sub.msvcrt.dll_free
pop ecx
push ebx
xor edi, edi
call sub.msvcrt.dll_malloc
mov dword [0x4b06b0], eax
test eax, eax
pop edx
je 0x422307
mov dword [0x4b06c0], ebx
push esi
push dword [0x4b06b0]
call sub.msvcrt.dll_strcpy
xor eax, eax
cmp byte [esi + 1], 0
sete al
add eax, str._Xauthority
push eax
push dword [0x4b06b0]
call sub.msvcrt.dll_strcat
mov edi, dword [0x4b06b0]
lea esp, [ebp - 0xc]
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x43451c
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
xor edi, edi
push esi
mov esi, edx
push ebx
mov ebx, eax
push ecx
push str.XLOCALEDIR
mov dword [ebp - 0x10], eax
call sub.msvcrt.dll_getenv
mov edx, eax
test edx, edx
pop eax
je 0x43456d
cld
xor eax, eax
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
push esi
mov ebx, ecx
not ebx
push edx
lea edi, [ebx - 1]
push dword [ebp - 0x10]
call sub.msvcrt.dll_strncpy
add esp, 0xc
cmp edi, esi
jge 0x434584
mov eax, dword [ebp - 0x10]
mov edi, ebx
mov byte [ebx + eax - 1], 0x3a
mov ebx, eax
add ebx, edi
cmp edi, esi
jge 0x434584
mov eax, esi
sub eax, edi
push eax
push str._usr_X11R6_lib_X11_locale
push ebx
call sub.msvcrt.dll_strncpy
add esp, 0xc
mov eax, dword [ebp - 0x10]
mov byte [eax + esi - 1], 0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4511bd
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, edx
push esi
push ebx
mov ebx, eax
push ecx
push 0x2c
push 1
call sub.msvcrt.dll_calloc
mov esi, eax
test esi, esi
pop eax
pop edx
jne 0x451236
call sub.msvcrt.dll__errno
mov ebx, dword [eax]
mov eax, dword [sym.imp.msvcrt.dll__iob]
push dword [0x467be8]
add eax, 0x40
push eax
call sub.msvcrt.dll_fprintf
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
push eax
call sub.msvcrt.dll_fflush
push 0
mov eax, dword [sym.imp.msvcrt.dll__iob]
push 0
push 0
add eax, 0x40
push str.SocketOpen:_malloc_failed_n
push eax
call sub.msvcrt.dll_fprintf
mov eax, dword [sym.imp.msvcrt.dll__iob]
add esp, 0x20
add eax, 0x40
push eax
call sub.msvcrt.dll_fflush
call sub.msvcrt.dll__errno
mov dword [eax], ebx
pop esi
jmp 0x451268
imul ebx, ebx, 0x14
push dword [ebx + 0x467c00]
push edi
push dword [ebx + 0x467bf4]
call sub.WS2_32.DLL_socket
mov dword [esi + 0x10], eax
test eax, eax
mov edx, eax
jns 0x45126c
call sub.WS2_32.DLL_WSAGetLastError
mov ebx, eax
call sub.msvcrt.dll__errno
mov dword [eax], ebx
push esi
call sub.msvcrt.dll_free
xor eax, eax
jmp 0x45128e
cmp dword [ebx + 0x467bf4], 2
jne 0x45128c
push 4
lea eax, [ebp - 0x10]
push eax
push 1
push 6
push edx
mov dword [ebp - 0x10], 1
call sub.WS2_32.DLL_setsockopt
mov eax, esi
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x4588e0
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov ebx, dword [0x4b4e50]
call sub.KERNEL32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x458920
mov dword [ebx + 0x30], eax
xor eax, eax
mov dword [esp + 4], eax
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
call fcn.0045a010
test eax, eax
sete al
movzx eax, al
mov dword [ebx + 0x2c], eax
add esp, 0x14
pop ebx
pop ebp
ret
call fcn.00459e60
test eax, eax
sete al
movzx eax, al
mov dword [ebx + 0x2c], eax
add esp, 0x14
pop ebx
pop ebp
ret
Function at 0x458cc0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov eax, dword [0x4b4e50]
mov edi, dword [ebp + 8]
test eax, eax
je 0x458d99
mov ecx, dword [eax + 0x2c]
test ecx, ecx
js 0x458dae
mov edx, dword [eax + 0x2c]
test edx, edx
jne 0x458d70
mov eax, dword [eax + 0x28]
mov dword [ebp - 0x10], eax
lea ebx, [ebp - 0x14]
mov dword [ebp - 0x14], eax
jmp 0x458d08
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
xor ecx, ecx
test eax, eax
mov edx, 5
je 0x458d18
mov ecx, dword [eax + 0x18]
xor edx, edx
cmp edx, 5
je 0x458d63
test edx, edx
jne 0x458d56
test ecx, ecx
je 0x458d00
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], edi
mov eax, dword [edi]
mov edx, dword [edi + 4]
mov dword [esp], 1
mov dword [esp + 8], eax
mov eax, 1
mov dword [esp + 0xc], edx
mov dword [esp + 4], eax
call ecx
cmp eax, 6
je 0x458dbd
cmp eax, 8
je 0x458d00
mov eax, 3
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea esp, [ebp - 0xc]
mov eax, 5
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebx, dword [eax + 0x30]
call fcn.00459e60
mov esi, eax
mov dword [esp], ebx
call sub.KERNEL32.dll_TlsGetValue
sub esp, 4
mov ebx, eax
mov dword [esp], esi
call sub.KERNEL32.dll_SetLastError
sub esp, 4
mov eax, ebx
jmp 0x458cf2
call fcn.00458670
mov eax, dword [0x4b4e50]
mov ecx, dword [eax + 0x2c]
test ecx, ecx
jns 0x458ce4
call fcn.00458940
mov eax, dword [0x4b4e50]
jmp 0x458ce4
mov dword [edi + 0xc], 0
mov eax, dword [ebp - 0x14]
mov edx, ebx
mov dword [edi + 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, edi
call fcn.00458c30
cmp eax, 7
jne 0x458d5b
mov eax, dword [0x4b4e50]
mov ebx, dword [ebp - 0x14]
test eax, eax
je 0x458e10
mov edi, dword [eax + 0x2c]
test edi, edi
js 0x458e39
mov esi, dword [eax + 0x2c]
test esi, esi
jne 0x458e1c
mov dword [eax + 0x28], ebx
mov eax, dword [ebp - 0x14]
lea edx, [eax + 0x20]
mov ecx, dword [edx + 4]
mov ebp, dword [eax + 0x20]
mov esp, dword [edx + 8]
jmp ecx
call fcn.00458670
mov eax, dword [0x4b4e50]
jmp 0x458dee
mov eax, dword [eax + 0x30]
mov dword [esp + 4], ebx
mov dword [esp], eax
call sub.KERNEL32.dll_TlsSetValue
sub esp, 8
test eax, eax
jne 0x458dff
call fcn.00459e60
jmp 0x458dff
call fcn.00458940
mov eax, dword [0x4b4e50]
jmp 0x458df5
Function at 0x4590a0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov eax, dword [0x4b4e50]
mov edi, dword [ebp + 8]
test eax, eax
je 0x459134
mov esi, dword [eax + 0x2c]
test esi, esi
js 0x459150
mov ebx, dword [eax + 0x2c]
test ebx, ebx
jne 0x459170
mov eax, dword [eax + 0x28]
mov dword [ebp - 0x10], eax
mov ecx, dword [edi + 0xc]
mov dword [ebp - 0x14], eax
test ecx, ecx
jne 0x459128
lea edx, [ebp - 0x14]
mov eax, edi
call fcn.00458c30
cmp eax, 7
jne 0x4591ef
mov eax, dword [0x4b4e50]
mov ebx, dword [ebp - 0x14]
test eax, eax
je 0x4591c4
mov edx, dword [eax + 0x2c]
test edx, edx
js 0x4591e0
mov edi, dword [eax + 0x2c]
test edi, edi
jne 0x4591a0
mov dword [eax + 0x28], ebx
mov eax, dword [ebp - 0x14]
lea edx, [eax + 0x20]
mov ecx, dword [edx + 4]
mov ebp, dword [eax + 0x20]
mov esp, dword [edx + 8]
jmp ecx
lea edx, [ebp - 0x14]
mov eax, edi
call fcn.00458e50
jmp 0x4590e5
call fcn.00458670
mov eax, dword [0x4b4e50]
mov esi, dword [eax + 0x2c]
test esi, esi
jns 0x4590c0
lea esi, [esi]
call fcn.00458940
mov eax, dword [0x4b4e50]
mov ebx, dword [eax + 0x2c]
test ebx, ebx
je 0x4590cb
lea esi, [esi]
lea edi, [edi]
mov ebx, dword [eax + 0x30]
call fcn.00459e60
mov esi, eax
mov dword [esp], ebx
call sub.KERNEL32.dll_TlsGetValue
sub esp, 4
mov ebx, eax
mov dword [esp], esi
call sub.KERNEL32.dll_SetLastError
sub esp, 4
mov eax, ebx
jmp 0x4590ce
mov eax, dword [eax + 0x30]
mov dword [esp + 4], ebx
mov dword [esp], eax
call sub.KERNEL32.dll_TlsSetValue
sub esp, 8
test eax, eax
jne 0x459117
call fcn.00459e60
jmp 0x459117
call fcn.00458670
mov eax, dword [0x4b4e50]
mov edx, dword [eax + 0x2c]
test edx, edx
jns 0x459109
lea esi, [esi]
call fcn.00458940
mov eax, dword [0x4b4e50]
jmp 0x459109
call sub.msvcrt.dll_abort
lea esi, [esi]
lea edi, [edi]
Function at 0x459200
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 4], edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], esi
mov esi, dword [edi + 0xc]
test esi, esi
je 0x459292
mov eax, dword [0x4b4e50]
test eax, eax
je 0x459286
mov ebx, dword [eax + 0x2c]
test ebx, ebx
js 0x4592ff
mov ecx, dword [eax + 0x2c]
test ecx, ecx
jne 0x4592a7
mov eax, dword [eax + 0x28]
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x14]
mov dword [ebp - 0x14], eax
mov eax, edi
call fcn.00458e50
cmp eax, 7
jne 0x45931d
mov eax, dword [0x4b4e50]
mov ebx, dword [ebp - 0x14]
test eax, eax
je 0x4592f0
mov edx, dword [eax + 0x2c]
test edx, edx
js 0x45930e
mov edi, dword [eax + 0x2c]
test edi, edi
jne 0x4592d0
mov dword [eax + 0x28], ebx
mov eax, dword [ebp - 0x14]
lea edx, [eax + 0x20]
mov ecx, dword [edx + 4]
mov ebp, dword [eax + 0x20]
mov esp, dword [edx + 8]
jmp ecx
call fcn.00458670
mov eax, dword [0x4b4e50]
jmp 0x459222
mov dword [esp], edi
call fcn.00458cc0
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov ebx, dword [eax + 0x30]
call fcn.00459e60
mov esi, eax
mov dword [esp], ebx
call sub.KERNEL32.dll_TlsGetValue
sub esp, 4
mov ebx, eax
mov dword [esp], esi
call sub.KERNEL32.dll_SetLastError
sub esp, 4
mov eax, ebx
jmp 0x459237
mov eax, dword [eax + 0x30]
mov dword [esp + 4], ebx
mov dword [esp], eax
call sub.KERNEL32.dll_TlsSetValue
sub esp, 8
test eax, eax
jne 0x459275
call fcn.00459e60
jmp 0x459275
call fcn.00458670
mov eax, dword [0x4b4e50]
jmp 0x459260
call fcn.00458940
mov eax, dword [0x4b4e50]
jmp 0x45922d
call fcn.00458940
mov eax, dword [0x4b4e50]
jmp 0x45926b
call sub.msvcrt.dll_abort
lea esi, [esi]
lea edi, [edi]

Function at 0x459500
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
call sub.KERNEL32.dll_TlsAlloc
cmp eax, 0xffffffff
mov edx, eax
je 0x459528
mov eax, dword [ebp + 8]
mov dword [eax], edx
mov eax, dword [ebp + 0xc]
mov dword [esp], edx
mov dword [esp + 4], eax
call fcn.0045a010
leave
ret
call fcn.00459e60
leave
ret