joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45b200
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x45b233
push esi
call fcn.0045e2f0
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x45b22c
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x45b2b9
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x45b2a2
mov eax, dword [esi + 8]
test eax, eax
je 0x45b257
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x45b29e
cmp eax, 2
je 0x45b2a2
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x45b24a
cmp eax, 3
je 0x45b27d
cmp eax, 1
jne 0x45b24a
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x45b24a
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x45b24a
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.0045b2e0
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x45b2c8
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.0045b2e0
add esp, 4
pop esi
ret

Function at 0x479997
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4799cf
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00477a4b
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00477a23
jmp 0x4799db
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x47b085
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x47b0c7
call fcn.00480b3e
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x47b0c7
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x47b0be
xor eax, eax
jmp 0x47b0cf
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0047b0d5
pop edi
pop esi
pop ebx
ret 4

Function at 0x48106e
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x48109c
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4810ba
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00480fd4
jmp 0x4810ba
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4810ba
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00480fd4
test edi, edi
mov eax, edi
jne 0x4810a4
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x6b081bc0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x6b081c1b
cmp byte [esi + ebx - 1], 0xa
je 0x6b081bef
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x6b0870c4], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x435cb0
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
push esi
push edi
mov edi, eax
mov esi, edx
jne 0x435cbf
pop edi
xor eax, eax
pop esi
ret
cmp edi, 8
not esi
jb 0x435da7
push ebp
mov ebp, edi
shr ebp, 3
movzx edx, byte [ecx]
xor edx, esi
and edx, 0xff
add ecx, 1
mov eax, esi
shr eax, 8
xor eax, dword [edx*4 + fcn.00433780]
movzx edx, byte [ecx]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + fcn.00433780]
movzx edx, byte [ecx + 1]
xor edx, eax
and edx, 0xff
add ecx, 1
shr eax, 8
xor eax, dword [edx*4 + fcn.00433780]
movzx edx, byte [ecx + 1]
xor edx, eax
add ecx, 1
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + fcn.00433780]
movzx edx, byte [ecx + 1]
xor edx, eax
add ecx, 1
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + fcn.00433780]
movzx edx, byte [ecx + 1]
xor edx, eax
add ecx, 1
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + fcn.00433780]
movzx edx, byte [ecx + 1]
add ecx, 1
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + fcn.00433780]
movzx edx, byte [ecx + 1]
add ecx, 1
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + fcn.00433780]
add ecx, 1
sub edi, 8
sub ebp, 1
mov esi, eax
jne 0x435cd0
pop ebp
test edi, edi
je 0x435dcc
jmp 0x435db0
movzx eax, byte [ecx]
xor eax, esi
and eax, 0xff
shr esi, 8
xor esi, dword [eax*4 + fcn.00433780]
add ecx, 1
sub edi, 1
jne 0x435db0
mov eax, esi
pop edi
not eax
pop esi
ret
Function at 0x437240
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xc
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push edi
mov edi, eax
xor ebx, ebx
cmp edi, ebx
jne 0x43725e
pop edi
pop ebp
mov eax, 0xffffff9a
pop ebx
add esp, 0xc
ret
cmp dword [edi + 0x18], ebx
je 0x437252
cmp dword [edi + 0x7c], ebx
je 0x43726d
call fcn.00437630
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x1c]
push edx
call fcn.00436fb0
add esp, 0xc
test eax, eax
je 0x437294
pop edi
pop ebp
mov eax, 0xffffff99
pop ebx
add esp, 0xc
ret
push esi
push 0x84
call fcn.0044a06f
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x4372d5
push 0x4000
call fcn.0044a06f
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
add esp, 4
cmp eax, ebx
mov dword [esi], eax
mov dword [esi + 0x44], ecx
mov dword [esi + 0x48], edx
mov dword [esi + 0x4c], ebx
jne 0x4372e2
push esi
call fcn.00449f92
add esp, 4
pop esi
pop edi
pop ebp
mov eax, 0xffffff98
pop ebx
add esp, 0xc
ret
mov dword [esi + 0x40], ebx
mov ecx, dword [edi + 0x3c]
xor eax, eax
cmp dword [edi + 0x34], ebx
mov dword [esi + 0x54], ecx
mov dword [esi + 0x50], ebx
mov edx, dword [edi + 0x34]
sete al
mov dword [esi + 0x64], edx
mov ecx, dword [edi]
mov dword [esi + 0x60], ecx
mov edx, dword [edi + 0xc]
mov dword [esi + 0x68], edx
mov dword [esi + 0x18], ebx
cmp eax, ebx
jne 0x43732a
lea eax, [esi + 4]
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
call fcn.004360f0
test eax, eax
jne 0x43732a
mov dword [esi + 0x40], 1
mov eax, dword [edi + 0x40]
mov dword [esi + 0x58], eax
mov ecx, dword [edi + 0x44]
mov dword [esi + 0x5c], ecx
mov dl, byte [edi + 0x30]
and dl, 1
mov byte [esi + 0x6c], dl
mov eax, dword [edi + 0x30]
shr eax, 3
test al, 1
je 0x437354
mov cl, byte [edi + 0x39]
mov byte [esi + 0x80], cl
jmp 0x43735d
mov dl, byte [edi + 0x3f]
mov byte [esi + 0x80], dl
mov al, byte [esi + 0x6c]
neg al
lea edx, [esi + 0x70]
mov dword [edx], 0x12345678
mov dword [esi + 0x74], 0x23456789
mov dword [esi + 0x78], 0x34567890
sbb eax, eax
and eax, 0xc
cmp ebp, ebx
mov dword [esi + 0x7c], eax
je 0x437396
mov cl, byte [ebp]
cmp cl, bl
je 0x437396
call fcn.00435de0
add ebp, 1
jne 0x437385
mov ecx, dword [edi + 0x78]
mov edx, dword [esp + 0x18]
lea eax, [ecx + edx + 0x1e]
mov dword [esi + 0x3c], eax
mov dword [esi + 8], ebx
mov dword [edi + 0x7c], esi
pop esi
pop edi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
Function at 0x4297f4
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x429822
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x429840
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0042975e
jmp 0x429840
mov eax, dword [esi + 0x14]
test eax, eax
je 0x429840
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
push eax
mov ecx, esi
call fcn.0042975e
test edi, edi
mov eax, edi
jne 0x42982a
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
mov ecx, dword [0x43d05c]
test ecx, ecx
je 0x4298f3
jmp 0x4297f3
ret 8
Function at 0x403020
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
mov eax, dword [0x498030]
test eax, eax
je 0x403037
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 2
jae 0x40304f
jmp 0x403056
push 0x498030
call fcn.004088c0
add esp, 4
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 2
jb 0x403056
cmp dword [eax], 1
mov esi, eax
je 0x4030b9
mov eax, dword [0x498030]
test eax, eax
je 0x4030c0
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
je 0x4030d8
mov esi, eax
test eax, eax
jne 0x4030ac
push 4
push 0xc
call fcn.00459bd0
add esp, 8
test eax, eax
je 0x4030de
mov dword [eax], 0
mov dword [eax + 8], 0x498030
mov esi, eax
mov eax, dword [0x498030]
test eax, eax
jne 0x4030a5
push 0x498030
call fcn.004088c0
add esp, 4
push esi
push eax
call sub.KERNEL32.dll_TlsSetValue
mov dword [esi + 4], 0
mov dword [esi], 1
add esi, 4
mov eax, esi
pop esi
ret
push 0x498030
call fcn.004088c0
add esp, 4
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
jne 0x40306a
xor esi, esi
mov eax, esi
pop esi
ret
push 4
push 0xc
call fcn.00416b80
add esp, 8
ud2

Function at 0x4030f0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
sub esp, 8
mov eax, dword [0x49801c]
test eax, eax
je 0x403117
push eax
call sub.KERNEL32.dll_TlsGetValue
test eax, eax
je 0x40312e
xor edi, edi
mov esi, eax
cmp eax, 1
je 0x40319c
jmp 0x40316a
push 0x49801c
call fcn.004088c0
add esp, 4
push eax
call sub.KERNEL32.dll_TlsGetValue
test eax, eax
jne 0x403108
push 4
push 0xc
call fcn.00459bd0
add esp, 8
test eax, eax
je 0x4031a4
mov dword [eax], 0
mov dword [eax + 8], 0x49801c
mov esi, eax
mov eax, dword [0x49801c]
test eax, eax
jne 0x403163
push 0x49801c
call fcn.004088c0
add esp, 4
push esi
push eax
call sub.KERNEL32.dll_TlsSetValue
mov ecx, dword [esi]
mov eax, dword [esi + 4]
lea edi, [esi + 4]
mov dword [esi], 1
mov dword [esi + 4], 0
test ecx, ecx
mov dword [esp], ecx
mov dword [esp + 4], eax
je 0x40319c
test eax, eax
je 0x40319c
lock dec dword [eax]
jne 0x40319c
lea ecx, [esp + 4]
call fcn.00402c20
mov eax, edi
add esp, 8
pop esi
pop edi
ret
push 4
push 0xc
call fcn.00416b80
add esp, 8
ud2
Function at 0x4031c0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
sub esp, 0xc
mov eax, dword [0x498024]
test eax, eax
je 0x4031e7
push eax
call sub.KERNEL32.dll_TlsGetValue
test eax, eax
je 0x4031fe
xor edi, edi
mov esi, eax
cmp eax, 1
je 0x40327a
jmp 0x40323a
push 0x498024
call fcn.004088c0
add esp, 4
push eax
call sub.KERNEL32.dll_TlsGetValue
test eax, eax
jne 0x4031d8
push 4
push 0x10
call fcn.00459bd0
add esp, 8
test eax, eax
je 0x403282
mov dword [eax], 0
mov dword [eax + 0xc], 0x498024
mov esi, eax
mov eax, dword [0x498024]
test eax, eax
jne 0x403233
push 0x498024
call fcn.004088c0
add esp, 4
push esi
push eax
call sub.KERNEL32.dll_TlsSetValue
mov ecx, dword [esi]
mov edx, dword [esi + 4]
mov eax, dword [esi + 8]
lea edi, [esi + 4]
mov dword [esi], 1
mov dword [esi + 4], 0
mov dword [esi + 8], 0
test ecx, ecx
mov dword [esp], ecx
mov dword [esp + 4], edx
mov dword [esp + 8], eax
je 0x40327a
test eax, eax
je 0x40327a
lock dec dword [eax]
jne 0x40327a
lea ecx, [esp + 8]
call fcn.00402be0
mov eax, edi
add esp, 0xc
pop esi
pop edi
ret
push 4
push 0x10
call fcn.00416b80
add esp, 8
ud2

Function at 0x403620
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x498024]
test eax, eax
je 0x403636
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 2
jae 0x40364e
jmp 0x403658
push 0x498024
call fcn.004088c0
add esp, 4
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 2
jb 0x403658
cmp dword [eax], 1
jne 0x403658
add eax, 4
jmp 0x403661
call fcn.004031c0
test eax, eax
je 0x403668
mov ecx, eax
jmp fcn.00408750
push 0x461560
push 0x5e
push str.use_of_std::thread::current___is_not_possible_after_the_threads_local_data_has_been_destroyedlibrary_std_src_threadmod.rs
call fcn.00410b20
add esp, 0xc
ud2
Function at 0x403680
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x44
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x40d5c0
lea eax, [ebp - 0x18]
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
mov eax, dword [0x498024]
test eax, eax
je 0x4036c3
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 2
jae 0x4036db
jmp 0x4036e5
push 0x498024
call fcn.004088c0
add esp, 4
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 2
jb 0x4036e5
cmp dword [eax], 1
jne 0x4036e5
add eax, 4
jmp 0x4036f2
call fcn.004031c0
test eax, eax
je 0x403857
mov ecx, eax
call fcn.00408750
mov dword [ebp - 0x24], eax
lock dec byte [eax + 0x18]
je 0x4037a4
mov edx, eax
mov eax, dword [0x498210]
test eax, eax
je 0x403747
add edx, 0x18
cmp eax, 0x40c560
mov dword [ebp - 0x20], edx
jne 0x403770
mov edi, dword [0x49802c]
cmp edi, 0xffffffff
je 0x4037c5
mov ecx, dword [0x498220]
mov dword [ebp - 0x10], 0
test ecx, ecx
jne 0x403837
jmp 0x403827
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x20], edx
call fcn.0040c580
mov edx, dword [ebp - 0x20]
add edx, 0x18
cmp eax, 0x40c560
mov dword [ebp - 0x20], edx
je 0x40371e
nop word [eax + eax]
mov ecx, dword [0x498210]
mov dword [ebp - 0x10], 0
test ecx, ecx
jne 0x40378b
call fcn.0040c580
mov edx, dword [ebp - 0x20]
mov ecx, eax
push 0xffffffffffffffff
push 1
push 0x462278
push edx
call ecx
mov edx, dword [ebp - 0x20]
mov al, 1
xor ecx, ecx
lock cmpxchg byte [edx], cl
jne 0x403770
mov eax, dword [ebp - 0x24]
lock dec dword [eax]
jne 0x4037b4
lea ecx, [ebp - 0x24]
call fcn.00402be0
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x44
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x28], 0xffffffff
mov ecx, dword [0x498218]
mov dword [ebp - 0x10], 0
test ecx, ecx
jne 0x4037e4
call fcn.0040c610
mov ecx, eax
lea eax, [ebp - 0x28]
push 0
push 0
push 0xc0000000
push eax
call ecx
test eax, eax
jne 0x40386d
mov edi, dword [ebp - 0x28]
mov eax, 0xffffffff
lock cmpxchg dword [0x49802c], edi
je 0x403813
mov esi, eax
push edi
call sub.KERNEL32.dll_CloseHandle
mov edi, esi
mov edx, dword [ebp - 0x20]
mov ecx, dword [0x498220]
mov dword [ebp - 0x10], 0
test ecx, ecx
jne 0x403837
mov dword [ebp - 0x2c], edi
call fcn.0040c6b0
mov edx, dword [ebp - 0x20]
mov edi, dword [ebp - 0x2c]
mov ecx, eax
push 0
push 0
push edx
push edi
call ecx
mov ecx, dword [ebp - 0x20]
xor eax, eax
xchg byte [ecx], al
mov eax, dword [ebp - 0x24]
lock dec dword [eax]
je 0x4037ac
jmp 0x4037b4
push 0x461560
push 0x5e
push str.use_of_std::thread::current___is_not_possible_after_the_threads_local_data_has_been_destroyedlibrary_std_src_threadmod.rs
call fcn.00410b20
add esp, 0xc
ud2
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x30]
mov dword [ebp - 0x50], 0x462558
mov dword [ebp - 0x4c], 1
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x38]
mov dword [ebp - 0x34], 0x415d30
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], 1
lea eax, [ebp - 0x50]
push 0x46258c
push eax
call fcn.00409e80
add esp, 8
ud2
Function at 0x407610
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x40d6c0
mov ecx, dword [ebp + 8]
mov eax, dword fs:[0]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
mov dword fs:[0], eax
mov eax, dword [ecx]
jmp 0x407655
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov edx, 2
mov esi, eax
test eax, eax
je 0x40766f
cmp esi, 1
jne 0x407680
cmp byte [ebp + 0xc], 0
je 0x4077f7
mov ecx, dword [ebp + 8]
mov eax, esi
lock cmpxchg dword [ecx], edx
jne 0x40765a
jmp 0x407785
cmp esi, 3
je 0x4077d0
mov eax, esi
and eax, 3
cmp eax, 2
je 0x4076aa
jmp 0x407817
mov eax, esi
and eax, 3
cmp eax, 2
jne 0x407650
mov eax, dword [0x498024]
test eax, eax
je 0x4076c0
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 2
jae 0x4076df
jmp 0x4076f0
mov dword [ebp - 0x10], 0xffffffff
push 0x498024
call fcn.004088c0
add esp, 4
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 2
jb 0x4076f0
cmp dword [eax], 1
mov dword [ebp - 0x10], 0xffffffff
jne 0x4076f0
add eax, 4
jmp 0x407704
mov dword [ebp - 0x10], 0xffffffff
call fcn.004031c0
test eax, eax
je 0x4077e1
mov ecx, eax
call fcn.00408750
mov ecx, esi
mov dword [ebp - 0x28], eax
mov eax, esi
mov esi, dword [ebp + 8]
mov byte [ebp - 0x20], 0
lea edx, [ebp - 0x26]
and ecx, 0xfffffffc
mov dword [ebp - 0x24], ecx
lock cmpxchg dword [esi], edx
je 0x40775c
mov esi, eax
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x4076a0
lock dec dword [eax]
jne 0x4076a0
lea ecx, [ebp - 0x28]
call fcn.00402be0
jmp 0x4076a0
mov dword [ebp - 0x10], 0
call fcn.00403680
movzx eax, byte [ebp - 0x20]
test al, al
je 0x407750
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x407650
lock dec dword [eax]
jne 0x407650
lea ecx, [ebp - 0x28]
call fcn.00402be0
jmp 0x407650
mov eax, dword [ebp + 8]
cmp esi, 1
mov dword [ebp - 0x10], 1
sete byte [ebp - 0x24]
mov dword [ebp - 0x28], 3
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x28]
mov dword [ebp - 0x2c], 1
push eax
push dword [ebp + 0x10]
mov eax, dword [ebp + 0x14]
call dword [eax + 0xc]
add esp, 8
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x30]
push eax
call fcn.00407880
add esp, 4
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x461560
push 0x5e
push str.use_of_std::thread::current___is_not_possible_after_the_threads_local_data_has_been_destroyedlibrary_std_src_threadmod.rs
call fcn.00410b20
add esp, 0xc
ud2
mov dword [ebp - 0x10], 0xffffffff
mov ecx, str.Once_instance_has_previously_been_poisoned
mov edx, 0x2a
push 0x461b30
call fcn.0040a2a0
add esp, 4
ud2
mov dword [ebp - 0x10], 0xffffffff
push 0x461af4
push 0x39
push 0x461ab8
call fcn.00410cb0
add esp, 0xc
ud2
Function at 0x4088c0
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x40d730
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x18]
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
push 0x4981e0
call fcn.0040b860
add esp, 4
mov dword [ebp - 0x20], 0x4981e0
mov esi, dword [edi]
test esi, esi
jne 0x408965
mov ebx, dword [edi + 4]
call sub.KERNEL32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x4089c6
mov esi, eax
test ebx, ebx
je 0x40895d
push 4
push 0xc
call fcn.00459bd0
add esp, 8
test eax, eax
je 0x408a17
mov dword [eax], ebx
mov dword [eax + 4], esi
mov dword [eax + 8], 0
mov ecx, eax
mov eax, dword [0x4981fc]
nop dword [eax + eax]
mov dword [ecx + 8], eax
lock cmpxchg dword [0x4981fc], ecx
jne 0x408950
mov eax, esi
test esi, esi
xchg dword [edi], eax
je 0x4089e3
mov edi, dword [ebp - 0x20]
mov eax, dword [0x498200]
test eax, eax
je 0x408986
cmp eax, 0x40c420
jne 0x408999
mov eax, dword [edi]
mov byte [eax + 0x18], 0
push eax
call sub.KERNEL32.dll_LeaveCriticalSection
jmp 0x4089ac
mov dword [ebp - 0x10], 0xffffffff
call fcn.0040c440
cmp eax, 0x40c420
je 0x408978
mov eax, dword [0x498208]
mov dword [ebp - 0x10], 0xffffffff
test eax, eax
je 0x4089bf
push edi
call eax
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, esi
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.0040c4e0
jmp 0x4089a9
mov dword [ebp - 0x10], 0
push 0x46251c
push 0x2e
push 0x4624bc
call fcn.00410cb0
add esp, 0xc
jmp 0x408a15
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x38], 0x461cd4
mov dword [ebp - 0x34], 1
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x28], 0x461130
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x10], 0
call fcn.00408b20
ud2
push 4
push 0xc
call fcn.00416b80
add esp, 8
ud2
Function at 0x40ac70
Capabilities:
Generate random numbers via rtlgenrandom
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov esi, esp
mov dword [esi + 0x48], ebp
mov dword [esi + 0x4c], esp
mov dword [esi + 0x58], 0xffffffff
mov dword [esi + 0x54], 0x40d7b0
lea eax, [esi + 0x50]
mov ecx, dword fs:[0]
mov dword [esi + 0x50], ecx
mov dword fs:[0], eax
mov eax, dword [0x498014]
test eax, eax
je 0x40acbb
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 2
jae 0x40acd3
jmp 0x40ace5
push 0x498014
call fcn.004088c0
add esp, 4
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 2
jb 0x40ace5
mov ecx, dword [eax]
xor ecx, 1
or ecx, dword [eax + 4]
jne 0x40ace5
add eax, 8
jmp 0x40ad9c
mov eax, dword [0x498014]
test eax, eax
je 0x40ad7e
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
je 0x40ad9a
mov edi, eax
test eax, eax
jne 0x40ad4e
push 8
push 0x20
call fcn.00459bd0
add esp, 8
test eax, eax
je 0x40ae06
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 0x18], 0x498014
mov edi, eax
mov eax, dword [0x498014]
test eax, eax
jne 0x40ad47
push 0x498014
call fcn.004088c0
add esp, 4
push edi
push eax
call sub.KERNEL32.dll_TlsSetValue
xorps xmm0, xmm0
lea eax, [esi + 0x30]
movaps xmmword [esi + 0x30], xmm0
push 0x10
push eax
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x40adae
movaps xmm0, xmmword [esi + 0x30]
lea eax, [edi + 8]
mov dword [edi + 4], 0
mov dword [edi], 1
movups xmmword [edi + 8], xmm0
jmp 0x40ad9c
push 0x498014
call fcn.004088c0
add esp, 4
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
jne 0x40ad01
xor eax, eax
mov ecx, dword [esi + 0x50]
mov dword fs:[0], ecx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
call sub.KERNEL32.dll_GetLastError
mov dword [esi + 0xc], eax
lea eax, [esi + 8]
mov dword [esi + 0x18], 0x462480
mov dword [esi + 0x1c], 1
mov dword [esi + 8], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x58], 0
mov dword [esi + 0x10], eax
lea eax, [esi + 0x10]
mov dword [esi + 0x14], 0x4047d0
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], 1
lea eax, [esi + 0x18]
push 0x4624ac
push eax
call fcn.00409e80
add esp, 8
ud2
push 8
push 0x20
call fcn.00416b80
add esp, 8
ud2