joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4beb48
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.004b27af
xor ebx, ebx
cmp dword [0x9508dc], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x4bec1d
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x4beb88
xor eax, eax
jmp 0x4bece1
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x91fc8c
push edi
call esi
cmp eax, ebx
je 0x4beb81
push eax
call fcn.004b274c
mov dword [esp], 0x91fc7c
push edi
mov dword [0x9508dc], eax
call esi
push eax
call fcn.004b274c
mov dword [esp], 0x91fc68
push edi
mov dword [0x9508e0], eax
call esi
push eax
call fcn.004b274c
mov dword [0x9508e4], eax
lea eax, [ebp - 8]
push eax
call fcn.004b0f5c
test eax, eax
pop ecx
pop ecx
je 0x4bebeb
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.004b6bbc
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x4bec1d
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.004b274c
cmp eax, ebx
pop ecx
mov dword [0x9508ec], eax
je 0x4bec1d
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004b274c
pop ecx
mov dword [0x9508e8], eax
mov eax, dword [0x9508e8]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x4bec96
cmp dword [0x9508ec], esi
je 0x4bec96
push eax
call fcn.004b27b8
pop ecx
call eax
cmp eax, ebx
je 0x4bec63
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x9508ec]
call fcn.004b27b8
pop ecx
call eax
test eax, eax
je 0x4bec63
test byte [ebp - 0x18], 1
jne 0x4bec96
lea eax, [ebp - 0xc]
push eax
call fcn.004b0f93
test eax, eax
pop ecx
je 0x4bec7e
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.004b6bbc
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x4bec8d
or dword [ebp + 0x10], 0x200000
jmp 0x4becc7
or dword [ebp + 0x10], 0x40000
jmp 0x4becc7
mov eax, dword [0x9508e0]
cmp eax, esi
je 0x4becc7
push eax
call fcn.004b27b8
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x4becc7
mov eax, dword [0x9508e4]
cmp eax, esi
je 0x4becc7
push dword [ebp - 4]
push eax
call fcn.004b27b8
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x9508dc]
call fcn.004b27b8
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4c6f15
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4c6f4d
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004c4fa2
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004c4f7a
jmp 0x4c6f59
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4
Function at 0x4c8603
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4c8645
call fcn.004ce202
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4c8645
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4c863c
xor eax, eax
jmp 0x4c864d
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004c8653
pop edi
pop esi
pop ebx
ret 4

Function at 0x4ce732
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4ce760
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4ce77e
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004ce698
jmp 0x4ce77e
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4ce77e
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004ce698
test edi, edi
mov eax, edi
jne 0x4ce768
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x4080d0
Capabilities:
Encode data using base64
Get hostname
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x200
lea esi, [esp + 0x170]
call fcn.004080eb
Function at 0x4241b0
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
vmovdqu ymm0, ymmword [edx]
vpmovsxbd ymm3, qword [0x457a20]
vpmovzxdq ymm1, xmmword [edx + 0x10]
vpand ymm0, ymm0, ymmword [0x457940]
vmovdqa ymmword [ecx], ymm1
vpsllvd ymm2, ymm0, ymmword [0x457960]
vpsrlvd ymm0, ymm0, ymmword [0x457980]
vpermd ymm0, ymm3, ymm0
vpmovsxbd ymm3, qword [0x457a28]
vpor ymm0, ymm0, ymm2
vpbroadcastd ymm2, dword [0x4579e0]
vpand ymm0, ymm0, ymmword [0x4579c0]
vpmulld ymm2, ymm0, ymm2
vpermd ymm2, ymm3, ymm2
vpblendd ymm0, ymm0, ymm2, 0xe0
vpbroadcastq ymm2, xmm2
vmovdqa ymmword [ecx + 0x20], ymm0
vmovdqa ymmword [ecx + 0x40], ymm2
pop ebp
vzeroupper
ret
Function at 0x428be0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, dword [0x456018]
mov edi, ecx
test esi, esi
je 0x428c86
dec esi
push esi
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
ja 0x428c7e
je 0x428c2e
test edi, edi
je 0x428c32
mov eax, dword [edi]
xor ecx, ecx
mov ebx, 0
mov dword [edi], 0
or eax, dword [edi + 4]
mov dword [edi + 4], 0
je 0x428c2a
mov ecx, dword [edi + 0xc]
mov ebx, dword [edi + 8]
mov edi, ecx
jmp 0x428c36
xor eax, eax
jmp 0x428c7e
xor ebx, ebx
xor edi, edi
movzx eax, byte [0x4af0d4]
xor ecx, ecx
mov edx, 0x10
call fcn.0042bb70
test eax, eax
je 0x428ca3
mov dword [eax], ebx
mov dword [eax + 4], edi
mov dword [eax + 8], esi
push esi
mov ebx, eax
call sub.kernel32.dll_TlsGetValue
mov edi, eax
mov dword [ebp - 0x10], ebx
push ebx
push esi
call sub.kernel32.dll_TlsSetValue
test edi, edi
je 0x428c7b
push edi
push 0
push dword [0x4af0c0]
call sub.kernel32.dll_HeapFree
mov eax, dword [ebp - 0x10]
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, 0x456018
call fcn.00429970
mov esi, eax
push esi
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
jbe 0x428c03
jmp 0x428c7e
ud2

Function at 0x428cb0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, dword [0x456028]
test esi, esi
je 0x428d36
dec esi
push esi
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
ja 0x428d2e
je 0x428d2c
movzx eax, byte [0x4af0d4]
xor ecx, ecx
mov edx, 8
call fcn.0042bb70
test eax, eax
je 0x428d4f
mov dword [eax], 0
mov dword [eax + 4], esi
push esi
mov ebx, eax
call sub.kernel32.dll_TlsGetValue
mov edi, eax
mov dword [ebp - 0x10], ebx
push ebx
push esi
call sub.kernel32.dll_TlsSetValue
test edi, edi
je 0x428d27
mov eax, dword [edi]
test eax, eax
je 0x428d19
lock dec dword [eax]
jne 0x428d19
mov ecx, dword [edi]
call fcn.00428330
push edi
push 0
push dword [0x4af0c0]
call sub.kernel32.dll_HeapFree
mov eax, dword [ebp - 0x10]
jmp 0x428d2e
xor eax, eax
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, 0x456028
call fcn.00429970
mov esi, eax
push esi
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
jbe 0x428ccd
jmp 0x428d2e
ud2
Function at 0x429970
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
cmp dword [ecx + 4], 0
mov esi, ecx
je 0x4299de
lea ebx, [esi + 0xc]
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x10]
push 0
push eax
push 0
push ebx
call sub.kernel32.dll_InitOnceBeginInitialize
cmp eax, 1
jne 0x429a0f
cmp dword [ebp - 0x10], 0
je 0x429a02
call sub.kernel32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x429a11
mov edi, eax
mov eax, dword [entry1]
mov eax, dword [0x4af0c4]
nop dword [eax + eax]
mov dword [esi + 8], eax
lock cmpxchg dword [0x4af0c4], esi
jne 0x4299c0
mov eax, edi
inc eax
mov dword [esi], eax
push 0
push 0
push ebx
call sub.kernel32.dll_InitOnceComplete
jmp 0x429a05
call sub.kernel32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x429a0f
mov ecx, eax
mov edi, eax
xor eax, eax
inc ecx
lock cmpxchg dword [esi], ecx
je 0x429a05
mov esi, eax
push edi
call sub.kernel32.dll_TlsFree
dec esi
mov edi, esi
jmp 0x429a05
mov edi, dword [esi]
dec edi
mov eax, edi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
ud2
push 0
push 4
push ebx
call sub.kernel32.dll_InitOnceComplete
ud2
Function at 0x429a20
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov eax, dword [ebp + 0xc]
cmp eax, 3
je 0x429a37
test eax, eax
jne 0x429bb1
mov esi, dword [0x4af0c4]
xor ecx, ecx
nop
test esi, esi
je 0x429a7d
mov ebx, dword [esi]
mov edi, dword [esi + 4]
test edi, edi
je 0x429bbb
mov esi, dword [esi + 8]
test ebx, ebx
je 0x429a40
dec ebx
push ebx
mov dword [ebp - 0x10], ecx
call sub.kernel32.dll_TlsGetValue
mov ecx, dword [ebp - 0x10]
test eax, eax
je 0x429a40
push 0
push ebx
mov ebx, eax
call sub.kernel32.dll_TlsSetValue
push ebx
call edi
add esp, 4
mov cl, 1
jmp 0x429a40
test cl, 1
je 0x429bb1
mov esi, dword [0x4af0c4]
xor ecx, ecx
nop
test esi, esi
je 0x429acd
mov ebx, dword [esi]
mov edi, dword [esi + 4]
test edi, edi
je 0x429bbb
mov esi, dword [esi + 8]
test ebx, ebx
je 0x429a90
dec ebx
push ebx
mov dword [ebp - 0x10], ecx
call sub.kernel32.dll_TlsGetValue
mov ecx, dword [ebp - 0x10]
test eax, eax
je 0x429a90
push 0
push ebx
mov ebx, eax
call sub.kernel32.dll_TlsSetValue
push ebx
call edi
add esp, 4
mov cl, 1
jmp 0x429a90
test cl, 1
je 0x429bb1
mov esi, dword [0x4af0c4]
xor ecx, ecx
nop
test esi, esi
je 0x429b1d
mov ebx, dword [esi]
mov edi, dword [esi + 4]
test edi, edi
je 0x429bbb
mov esi, dword [esi + 8]
test ebx, ebx
je 0x429ae0
dec ebx
push ebx
mov dword [ebp - 0x10], ecx
call sub.kernel32.dll_TlsGetValue
mov ecx, dword [ebp - 0x10]
test eax, eax
je 0x429ae0
push 0
push ebx
mov ebx, eax
call sub.kernel32.dll_TlsSetValue
push ebx
call edi
add esp, 4
mov cl, 1
jmp 0x429ae0
test cl, 1
je 0x429bb1
mov esi, dword [0x4af0c4]
xor ecx, ecx
nop
test esi, esi
je 0x429b69
mov ebx, dword [esi]
mov edi, dword [esi + 4]
test edi, edi
je 0x429bbb
mov esi, dword [esi + 8]
test ebx, ebx
je 0x429b30
dec ebx
push ebx
mov dword [ebp - 0x10], ecx
call sub.kernel32.dll_TlsGetValue
mov ecx, dword [ebp - 0x10]
test eax, eax
je 0x429b30
push 0
push ebx
mov ebx, eax
call sub.kernel32.dll_TlsSetValue
push ebx
call edi
add esp, 4
mov cl, 1
jmp 0x429b30
test cl, 1
je 0x429bb1
mov edi, dword [0x4af0c4]
nop word cs:[eax + eax]
nop
test edi, edi
je 0x429bb1
mov esi, dword [edi]
mov ebx, dword [edi + 4]
test ebx, ebx
je 0x429bbb
mov edi, dword [edi + 8]
test esi, esi
je 0x429b80
dec esi
push esi
call sub.kernel32.dll_TlsGetValue
test eax, eax
je 0x429b80
push 0
push esi
mov esi, eax
call sub.kernel32.dll_TlsSetValue
push esi
call ebx
add esp, 4
jmp 0x429b80
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
ud2
Function at 0x42a450
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
movzx eax, byte [edx + 0x1c]
mov dword [ebp - 0x20], ecx
xor ebx, ebx
mov ecx, 0
mov byte [ebp - 0x18], al
cmp al, 1
mov eax, 0
ja 0x42a510
movzx ebx, byte [edx + 0x1e]
xor eax, eax
mov dword [ebp - 0x14], ebx
test bl, 1
mov ebx, 0
jne 0x42a501
movzx ecx, byte [edx + 8]
xor ebx, ebx
mov ch, cl
add ch, 0xfb
cmp ch, 1
ja 0x42a501
cmp cl, 6
mov esi, dword [edx]
mov edi, dword [edx + 4]
mov dword [ebp - 0x10], edx
sete cl
cmp byte [ebp - 0x18], 0
setne ch
or ch, cl
jne 0x42a4c1
mov ebx, 2
cmp edi, 1
jbe 0x42a684
cmp ebx, edi
jne 0x42a4c9
xor ebx, ebx
jmp 0x42a4fe
lea edx, [esi + ebx + 1]
movzx ebx, byte [esi + ebx]
add edi, esi
cmp edx, edi
sete ch
cmp bl, 0x2e
setne bh
or bh, ch
je 0x42a4ee
cmp bl, 0x2e
sete bl
and ch, bl
mov bl, ch
jmp 0x42a4fe
mov ch, byte [edx]
cmp ch, 0x5c
sete cl
cmp ch, 0x2f
sete bl
or bl, cl
mov edx, dword [ebp - 0x10]
cmp byte [ebp - 0x18], 0
mov ecx, ebx
je 0x42a621
mov ebx, dword [ebp - 0x14]
movzx ecx, cl
movzx esi, bl
mov dword [ebp - 0x10], ecx
add ecx, esi
mov dword [ebp - 0x1c], esi
mov esi, dword [edx + 4]
add ecx, eax
cmp ecx, esi
ja 0x42a684
mov ebx, dword [edx]
cmp ecx, esi
lea edi, [ebx + ecx]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], edi
jne 0x42a579
movzx edx, byte [edx + 8]
mov edi, dword [ebp - 0x14]
xor eax, eax
sub esi, ecx
je 0x42a5f6
mov cl, 9
cmp esi, 2
je 0x42a5fa
cmp esi, 1
jne 0x42a609
cmp byte [edi], 0x2e
jne 0x42a609
xor ecx, ecx
cmp dl, 3
setae cl
lea ecx, [ecx + ecx*2 + 7]
jmp 0x42a609
movzx edx, byte [edx + 8]
cmp dl, 3
jae 0x42a5ab
add eax, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x18]
add eax, dword [ebp - 0x10]
lea edi, [esi + edi - 1]
sub eax, esi
nop word cs:[eax + eax]
nop dword [eax + eax]
cmp byte [edi], 0x5c
je 0x42a5d6
dec edi
inc eax
jne 0x42a5a0
jmp 0x42a53e
add eax, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x18]
add eax, dword [ebp - 0x10]
lea edi, [esi + edi - 1]
sub eax, esi
nop word [eax + eax]
movzx ebx, byte [edi]
cmp ebx, 0x2f
je 0x42a5d6
cmp ebx, 0x5c
je 0x42a5d6
dec edi
inc eax
jne 0x42a5c0
jmp 0x42a53e
not eax
lea ecx, [ecx + eax + 1]
cmp ecx, esi
ja 0x42a684
mov edi, dword [ebp - 0x18]
mov eax, 1
add edi, ecx
sub esi, ecx
jne 0x42a54b
mov cl, 0xa
jmp 0x42a609
cmp byte [edi], 0x2e
jne 0x42a609
cmp byte [edi + 1], 0x2e
sete cl
xor cl, 9
mov edx, dword [ebp - 0x20]
add eax, esi
mov dword [edx], eax
mov byte [edx + 4], cl
mov dword [edx + 8], edi
mov dword [edx + 0xc], esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
movzx esi, byte [edx + 8]
call fcn.0042a62a
ud2
Function at 0x42b510
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, dword [0x456008]
test esi, esi
je 0x42b596
dec esi
push esi
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
ja 0x42b58e
je 0x42b58c
movzx eax, byte [0x4af0d4]
xor ecx, ecx
mov edx, 8
call fcn.0042bb70
test eax, eax
je 0x42b5af
mov dword [eax], 0
mov dword [eax + 4], esi
push esi
mov ebx, eax
call sub.kernel32.dll_TlsGetValue
mov edi, eax
mov dword [ebp - 0x10], ebx
push ebx
push esi
call sub.kernel32.dll_TlsSetValue
test edi, edi
je 0x42b587
mov eax, dword [edi]
test eax, eax
je 0x42b579
lock dec dword [eax]
jne 0x42b579
mov ecx, dword [edi]
call fcn.00425960
push edi
push 0
push dword [0x4af0c0]
call sub.kernel32.dll_HeapFree
mov eax, dword [ebp - 0x10]
jmp 0x42b58e
xor eax, eax
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, 0x456008
call fcn.00429970
mov esi, eax
push esi
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
jbe 0x42b52d
jmp 0x42b58e
ud2
Function at 0x42c990
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, dword [0x456038]
test esi, esi
je 0x42ca04
dec esi
push esi
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
ja 0x42c9fc
je 0x42c9fa
movzx eax, byte [0x4af0d4]
xor ecx, ecx
mov edx, 8
call fcn.0042bb70
test eax, eax
je 0x42ca1d
mov dword [eax], 0
mov dword [eax + 4], esi
push esi
mov ebx, eax
call sub.kernel32.dll_TlsGetValue
mov edi, eax
mov dword [ebp - 0x10], ebx
push ebx
push esi
call sub.kernel32.dll_TlsSetValue
test edi, edi
je 0x42c9f5
push edi
push 0
push dword [0x4af0c0]
call sub.kernel32.dll_HeapFree
mov eax, dword [ebp - 0x10]
jmp 0x42c9fc
xor eax, eax
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, 0x456038
call fcn.00429970
mov esi, eax
push esi
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
jbe 0x42c9ad
jmp 0x42c9fc
ud2

Function at 0x42cc70
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x410
mov esi, dword [0x456058]
test esi, esi
je 0x42cdf1
dec esi
push esi
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
ja 0x42cde9
je 0x42cde7
mov eax, dword [0x4af038]
cmp eax, 3
jne 0x42ce0e
mov edi, dword [0x4af03c]
lock inc dword [edi]
jle 0x42ce22
movsd xmm0, qword [0x4a7d00]
movsd xmm1, qword [0x4a7cf8]
mov eax, 0xfffffc00
nop word cs:[eax + eax]
nop
movsd qword [esp + eax + 0x410], xmm0
movsd qword [esp + eax + 0x408], xmm1
add eax, 0x10
jne 0x42cce0
mov dword [esp + 4], esi
xor ecx, ecx
mov edx, 0x4c0
movzx eax, byte [0x4af0d4]
call fcn.0042bb70
test eax, eax
je 0x42ce22
mov esi, eax
lea ecx, [esp + 8]
and esi, 0xffffffc0
mov dword [esi + 0x3c], eax
lea ebx, [esi + 0x40]
lea eax, [esi + 0x48]
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], edi
push 0x400
push ecx
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
movaps xmm0, xmmword [0x457ad0]
movups xmmword [esi + 0x448], xmm0
mov dword [esi + 0x480], 0
mov eax, dword [edi + 0x100]
mov dword [esi + 0x40], eax
lock cmpxchg dword [edi + 0x100], ebx
je 0x42cd7c
nop dword [eax]
mov dword [ebx], eax
lock cmpxchg dword [edi + 0x100], ebx
jne 0x42cd70
movzx eax, byte [0x4af0d4]
xor ecx, ecx
mov edx, 8
call fcn.0042bb70
test eax, eax
je 0x42ce22
mov dword [eax], ebx
mov ebx, dword [esp + 4]
mov dword [eax + 4], ebx
push ebx
mov esi, eax
call sub.kernel32.dll_TlsGetValue
mov edi, eax
mov dword [esp], esi
push esi
push ebx
call sub.kernel32.dll_TlsSetValue
test edi, edi
je 0x42cde2
mov ecx, dword [edi]
mov eax, dword [ecx + 0x410]
lea edx, [eax - 1]
xor eax, 1
mov dword [ecx + 0x410], edx
or eax, dword [ecx + 0x40c]
je 0x42ce24
push edi
push 0
push dword [0x4af0c0]
call sub.kernel32.dll_HeapFree
mov eax, dword [esp]
jmp 0x42cde9
xor eax, eax
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, 0x456058
call fcn.00429970
mov esi, eax
push esi
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
jbe 0x42cc9d
jmp 0x42cde9
call fcn.00420a90
mov edi, dword [0x4af03c]
lock inc dword [edi]
jg 0x42ccc0
ud2
call fcn.00420040
jmp 0x42cdd4
Function at 0x42ce70
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, dword [0x456048]
test esi, esi
je 0x42ceeb
dec esi
push esi
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
ja 0x42cee3
je 0x42cee1
movzx eax, byte [0x4af0d4]
xor ecx, ecx
mov edx, 0xc
call fcn.0042bb70
test eax, eax
je 0x42cf04
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 8], esi
push esi
mov ebx, eax
call sub.kernel32.dll_TlsGetValue
mov edi, eax
mov dword [ebp - 0x10], ebx
push ebx
push esi
call sub.kernel32.dll_TlsSetValue
test edi, edi
je 0x42cedc
push edi
push 0
push dword [0x4af0c0]
call sub.kernel32.dll_HeapFree
mov eax, dword [ebp - 0x10]
jmp 0x42cee3
xor eax, eax
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, 0x456048
call fcn.00429970
mov esi, eax
push esi
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
jbe 0x42ce8d
jmp 0x42cee3
ud2
Function at 0x432c20
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x30
mov esi, ecx
lea eax, [ebp - 0x2c]
push eax
push edx
call sub.shell32.dll_CommandLineToArgvW
test eax, eax
mov dword [ebp - 0x10], eax
je 0x432ce8
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 4
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x18], 0
test eax, eax
je 0x432ccc
shl eax, 2
xor edi, edi
xor ebx, ebx
mov dword [ebp - 0x14], 4
jmp 0x432c97
movsd xmm0, qword [ebp - 0x3c]
movsd xmm1, qword [ebp - 0x34]
mov eax, dword [ebp - 0x14]
inc ebx
movsd qword [eax + edi + 8], xmm1
movsd qword [eax + edi], xmm0
mov eax, dword [ebp - 0x28]
add edi, 0x10
mov dword [ebp - 0x18], ebx
add eax, 0xfffffffc
je 0x432ccc
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x10]
mov esi, dword [eax + ebx*4]
push esi
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
add esp, 4
lea ecx, [ebp - 0x3c]
mov edx, esi
push eax
call fcn.00429d70
add esp, 4
cmp ebx, dword [ebp - 0x20]
jne 0x432c70
lea ecx, [ebp - 0x20]
call fcn.00432e30
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x14], eax
jmp 0x432c70
push dword [ebp - 0x10]
call sub.kernel32.dll_LocalFree
movsd xmm0, qword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x18]
movsd qword [ecx], xmm0
mov dword [ecx + 8], eax
jmp 0x432cfc
mov dword [esi], 0
mov dword [esi + 4], 4
mov dword [esi + 8], 0
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4346f0
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xf0
mov esi, ecx
call fcn.0042cfb0
test eax, eax
je 0x4348dc
movdqu xmm0, xmmword [eax]
mov edx, 0x3c420
movd ecx, xmm0
movdqa xmmword [esp + 0xd0], xmm0
add ecx, 1
mov dword [eax], ecx
adc dword [eax + 4], 0
xor ecx, ecx
movzx eax, byte [0x4af0d4]
call fcn.0042bb70
test eax, eax
je 0x4348dc
mov edi, eax
and edi, 0xfffffff0
mov dword [edi + 0xc], eax
add edi, 0x3c010
push 0x410
push 0xff
push edi
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
movaps xmm1, xmmword [esp + 0xd0]
pxor xmm0, xmm0
movq qword [esp + 0x88], xmm0
movq qword [esp + 0x90], xmm0
movq qword [esp + 0x98], xmm0
movq qword [esp + 0xa0], xmm0
mov dword [esp + 0x48], 0
mov dword [esp + 0x4c], 8
mov dword [esp + 0x50], 0
mov dword [esp + 0x54], 0x80000000
mov dword [esp + 0x60], 0
mov byte [esp + 0x64], 0
mov dword [esp + 0x68], edi
mov dword [esp + 0x6c], 0x3ff
mov dword [esp + 0x70], 0x380
mov dword [esp + 0x74], 0
mov edi, esp
movups xmmword [esp + 0x78], xmm1
xorps xmm1, xmm1
mov dword [esp + 0xa8], 0
movaps xmmword [esp], xmm1
movaps xmmword [esp + 0x30], xmm1
movaps xmmword [esp + 0x20], xmm1
movaps xmmword [esp + 0x10], xmm1
mov dword [esp], 0x40
push edi
call sub.kernel32.dll_GlobalMemoryStatusEx
test eax, eax
jne 0x43481b
call sub.kernel32.dll_GetLastError
movups xmm0, xmmword [esp + 8]
movups xmmword [esp + 0x88], xmm0
xorps xmm0, xmm0
movsd qword [esp + 0x30], xmm0
xorps xmm0, xmm0
movaps xmmword [esp + 0x20], xmm0
movaps xmmword [esp + 0x10], xmm0
movaps xmmword [esp], xmm0
push 0x38
push edi
call sub.kernel32.dll_K32GetPerformanceInfo
test eax, eax
je 0x434898
mov ebx, dword [esp + 0x10]
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x28]
xor edi, edi
mov edx, 0
sub eax, ebx
sbb edx, edx
cmovb eax, edi
mul ecx
mov dword [esp + 0x98], eax
mov eax, dword [esp + 4]
mov dword [esp + 0x9c], edx
mov edx, 0
sub eax, ebx
sbb edx, edx
cmovb eax, edi
mul ecx
mov dword [esp + 0xa4], edx
mov dword [esp + 0xa0], eax
lea edi, [esp + 0x48]
mov edx, 1
mov ecx, edi
call fcn.0042d6f0
mov edx, esp
mov ecx, edi
mov byte [esp], 1
mov dword [esp + 5], 0x2020202
mov dword [esp + 1], 0x2020101
call fcn.0042da60
push 0x88
push edi
push esi
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
ud2