joyce8/EMBER2024-capa huggingface dataset:
Function at 0x430710
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x00460ad8]
jne 0x4306ca
ret
jmp 0x430710
sub rsp, 0x5a8
mov qword [rsp + 0x5b0], rcx
mov qword [rsp + 0x5b8], rdx
lea rcx, [rsp + 0xd0]
mov qword [rcx + 0x78], rax
call fcn.004275d0
test rax, rax
jne 0x4307cc
lea rcx, [rsp + 0xd0]
mov rax, qword [rcx + 0x78]
call sub.KERNEL32.dll_RtlCaptureContext
lea rax, [rsp + 0xd0]
mov rcx, 0x100001
mov qword [rax + 0x30], rcx
mov rcx, qword [rsp + 0x5b0]
mov qword [rax + 0x80], rcx
mov rdx, qword [rsp + 0x5b8]
mov qword [rax + 0x88], rdx
lea rcx, [rsp + 0x5a8]
mov qword [rax + 0x98], rcx
mov rcx, qword [rsp + 0x5a8]
mov qword [rax + 0xf8], rcx
lea rdx, [rsp + 0x30]
mov qword [rdx + 0x10], rcx
mov dword [rdx], 0xc0000409
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x28], rax
xor rcx, rcx
call sub.KERNEL32.dll_SetUnhandledExceptionFilter
lea rcx, [rsp + 0x20]
call sub.KERNEL32.dll_UnhandledExceptionFilter
call sub.KERNEL32.dll_GetCurrentProcess
movabs rdx, 0xc0000409
mov rcx, rax
call sub.KERNEL32.dll_TerminateProcess
add rsp, 0x5a8
ret
Function at 0x4335d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x88
mov qword [rsp + 0x70], 0xfffffffffffffffe
mov rdi, rcx
mov rsi, qword [rcx + 0xc0]
mov qword [rsp + 0x50], rsi
mov r13, qword [rcx + 0xb8]
mov qword [rsp + 0x60], r13
call fcn.00441358
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x58], rax
cmp qword [rdi + 0xb0], 0
je 0x43365a
call fcn.00441358
mov r12, qword [rax + 0x18]
mov qword [rsp + 0x58], r12
mov r8d, 5
mov rdx, qword [rdi + 0xb0]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rdx, rax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r13, rax
mov qword [rsp + 0x60], rax
test r13, r13
je 0x433670
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rsi, rax
mov qword [rsp + 0x50], rax
test rsi, rsi
jne 0x43367e
lea rax, [rsi - 1]
jmp 0x433848
mov rcx, rdi
call fcn.00432f24
mov rsi, rax
mov qword [rsp + 0x68], rax
call fcn.004363c4
xor r15d, r15d
mov dword [rsp + 0x44], r15d
xor r12d, r12d
mov qword [rsp + 0x48], r12
xor r14d, r14d
mov dword [rsp + 0x40], r14d
test rsi, rsi
je 0x43373a
call qword [sym.imp.USER32.dll_GetDesktopWindow]
cmp rsi, rax
je 0x43373a
mov rcx, rsi
call qword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x43373a
xor edx, edx
mov rcx, rsi
call qword [sym.imp.USER32.dll_EnableWindow]
lea r15d, [r12 + 1]
mov dword [rsp + 0x44], r15d
call fcn.00431c88
test rax, rax
je 0x433701
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0xe8]
mov r12, rax
mov qword [rsp + 0x48], rax
jmp 0x433706
mov qword [rsp + 0x48], r12
test r12, r12
je 0x43373a
mov rax, qword [r12]
mov rcx, r12
call qword [rax + 0x240]
test eax, eax
je 0x43373a
mov rcx, r12
call fcn.00439858
test eax, eax
je 0x43373a
xor edx, edx
mov rcx, r12
call fcn.00439888
mov r14d, r15d
mov dword [rsp + 0x40], r15d
mov rcx, rdi
call fcn.00437d40
mov rcx, rsi
call fcn.004362c0
mov r9, qword [rsp + 0x58]
mov r8, rax
mov rdx, qword [rsp + 0x50]
mov rcx, rdi
call fcn.004332d8
test eax, eax
je 0x4337b8
test byte [rdi + 0x78], 0x10
je 0x433788
mov rcx, rdi
call fcn.004396ac
bt eax, 8
mov edx, 4
lea ecx, [rdx + 1]
cmovb edx, ecx
mov rcx, rdi
call fcn.00435b70
cmp qword [rdi + 0x40], 0
je 0x4337b8
mov dword [rsp + 0x30], 0x97
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call fcn.00439a1c
nop
jmp 0x4337db
test r14d, r14d
je 0x4337ed
mov edx, 1
mov rcx, r12
call fcn.00439888
test r15d, r15d
je 0x433800
mov edx, 1
mov rcx, rsi
call qword [sym.imp.USER32.dll_EnableWindow]
test rsi, rsi
je 0x43381a
call qword [sym.imp.USER32.dll_GetActiveWindow]
cmp rax, qword [rdi + 0x40]
jne 0x43381a
mov rcx, rsi
call qword [sym.imp.USER32.dll_SetActiveWindow]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0xc0]
mov rcx, rdi
call fcn.00432f7c
cmp qword [rdi + 0xb0], 0
je 0x433841
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FreeResource]
movsxd rax, dword [rdi + 0x88]
add rsp, 0x88
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x4338f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x30
mov rsi, rcx
mov rcx, rdx
mov rbx, r9
mov rdi, r8
call qword [sym.imp.KERNEL32.dll_LockResource]
xor r9d, r9d
mov r8, rdi
mov rcx, rsi
mov rdx, rax
mov qword [rsp + 0x20], rbx
call fcn.00433898
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret

Function at 0x434638
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
push rdi
sub rsp, 0x28
mov edi, ecx
call fcn.0044139c
mov rbx, rax
mov rax, qword [rax + 0x78]
test rax, rax
je 0x43466c
mov rcx, qword [rax + 0x40]
test rcx, rcx
je 0x43466c
xor r9d, r9d
xor r8d, r8d
mov edx, 0x401
call qword [sym.imp.USER32.dll_SendMessageA]
test edi, edi
mov rbx, qword [rbx + 0xe0]
je 0x43469f
test rbx, rbx
je 0x43469f
mov ecx, 1
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x43469f
mov rax, qword [rbx]
mov rdx, 0xffffffffffffffff
mov rcx, rbx
call qword [rax + 0x2d0]
add rsp, 0x28
pop rdi
pop rbx
ret

Function at 0x439240
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x20
xor edi, edi
xor ebx, ebx
test rdx, rdx
mov rsi, rdx
mov rbp, rcx
je 0x43929a
call fcn.00441358
mov r8d, 0xf0
mov rdx, rsi
mov r12, qword [rax + 0x18]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FindResourceA]
test rax, rax
je 0x43929a
mov rdx, rax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
mov rbx, rax
je 0x4392bc
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
mov rdx, rdi
mov rcx, rbp
call fcn.004390dc
test rdi, rdi
mov esi, eax
je 0x4392ba
test rbx, rbx
je 0x4392ba
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
add rsp, 0x20
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x439d50
Capabilities:
Get graphical window text

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x30
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov esi, r8d
mov rdi, rdx
mov rbx, rcx
cmp qword [rcx + 0xa0], 0
jne 0x439d80
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x439ded
call fcn.0043a268
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rsp + 0x20], rax
mov rcx, qword [rbx + 0xa0]
mov rax, qword [rcx]
lea rdx, [rsp + 0x20]
call qword [rax + 0x118]
mov r8d, esi
mov rdx, qword [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcpynA]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov ebx, eax
mov rdx, qword [rsp + 0x20]
add rdx, 0xffffffffffffffe8
mov ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x439deb
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.oledlg.dll_OleUIBusyA + 8]
mov eax, ebx
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
Function at 0x43acc4
Capabilities:
Get disk information

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x1c0
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov rax, qword [0x00460ad8]
mov qword [rsp + 0x1b0], rax
mov rsi, rdx
mov rdi, rcx
test rcx, rcx
jne 0x43acf8
call fcn.00430914
int3
test rdx, rdx
jne 0x43ad03
call fcn.00430914
int3
lea r9, [rsp + 0x50]
mov r8, rcx
mov edx, 0x104
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFullPathNameA]
test eax, eax
jne 0x43ad36
mov r8d, 0x104
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcpynA]
xor eax, eax
jmp 0x43aeb9
cmp eax, 0x104
jb 0x43ad44
xor eax, eax
jmp 0x43aeb9
call fcn.0043a268
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rsp + 0x48], rax
lea rdx, [rsp + 0x48]
mov rcx, rdi
call fcn.0043aa6c
mov rbx, qword [rsp + 0x48]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathIsUNCA]
test eax, eax
jne 0x43ae97
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x30], 0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
jne 0x43add8
lea rdx, [rbx - 0x18]
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x43add1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.oledlg.dll_OleUIBusyA]
xor eax, eax
jmp 0x43aeb9
mov eax, dword [rsp + 0x40]
test al, 2
jne 0x43aded
mov rcx, rdi
call qword [sym.imp.USER32.dll_CharUpperA]
mov eax, dword [rsp + 0x40]
test al, 4
jne 0x43ae97
lea rdx, [rsp + 0x70]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp rax, 0xffffffffffffffff
je 0x43ae97
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindClose]
mov r11, qword [rsp + 0x50]
test r11, r11
je 0x43ae76
cmp r11, rdi
jbe 0x43ae76
lea rcx, [rsp + 0x9c]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov rcx, qword [rsp + 0x50]
mov edx, ecx
sub edx, edi
add eax, edx
cmp eax, 0x104
jge 0x43ae55
lea rdx, [rsp + 0x9c]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x43ae97
lea rdx, [rbx - 0x18]
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x43ae72
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.oledlg.dll_OleUIBusyA]
xor eax, eax
jmp 0x43aeb9
lea rdx, [rbx - 0x18]
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x43ae93
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.oledlg.dll_OleUIBusyA]
xor eax, eax
jmp 0x43aeb9
lea rdx, [rbx - 0x18]
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x43aeb4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.oledlg.dll_OleUIBusyA]
mov eax, 1
mov rcx, qword [rsp + 0x1b0]
call fcn.004306c0
add rsp, 0x1c0
pop rdi
pop rsi
pop rbx
ret
Function at 0x43c008
Capabilities:
Get file attributes
Get file size

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x58
mov rbx, rdx
mov rdi, rcx
mov r8d, 0x128
mov rcx, rbx
xor edx, edx
call fcn.00418b40
mov rdx, qword [rdi + 0x18]
lea rcx, [rbx + 0x22]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_lstrcpynA]
mov rcx, qword [rdi + 8]
cmp rcx, qword [0x0044ab30]
je 0x43c19d
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x28]
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileTime]
xor esi, esi
cmp eax, esi
je 0x43c084
mov rcx, qword [rdi + 8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebp, 0xffffffff
mov r11d, eax
cmp r11, rbp
mov qword [rbx + 0x18], r11
jne 0x43c08b
xor eax, eax
jmp 0x43c1a2
mov rcx, qword [rdi + 0x18]
cmp dword [rcx - 0x10], esi
jne 0x43c09a
mov byte [rbx + 0x20], sil
jmp 0x43c0ab
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
movzx ecx, al
cmp eax, ebp
cmove ecx, esi
mov byte [rbx + 0x20], cl
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
mov edi, 0xffffffff
cmp eax, esi
je 0x43c0f2
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
cmp eax, esi
je 0x43c0f2
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x38]
mov r8d, edi
call fcn.00416d08
mov rcx, qword [rax]
mov qword [rbx], rcx
jmp 0x43c0f5
mov qword [rbx], rsi
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
cmp eax, esi
je 0x43c138
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
cmp eax, esi
je 0x43c138
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x38]
mov r8d, edi
call fcn.00416d08
mov rax, qword [rax]
mov qword [rbx + 0x10], rax
jmp 0x43c13c
mov qword [rbx + 0x10], rsi
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
cmp eax, esi
je 0x43c17f
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
cmp eax, esi
je 0x43c17f
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x38]
mov r8d, edi
call fcn.00416d08
mov rax, qword [rax]
mov qword [rbx + 8], rax
jmp 0x43c183
mov qword [rbx + 8], rsi
cmp qword [rbx], rsi
jne 0x43c18f
mov rax, qword [rbx + 8]
mov qword [rbx], rax
cmp qword [rbx + 0x10], rsi
jne 0x43c19d
mov rax, qword [rbx + 8]
mov qword [rbx + 0x10], rax
mov eax, 1
add rsp, 0x58
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x43d11c
Capabilities:
Get graphical window text

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x130
mov rax, qword [0x00460ad8]
mov qword [rsp + 0x120], rax
test rcx, rcx
mov rbx, rdx
mov rdi, rcx
jne 0x43d147
call fcn.00430914
int3
test rdx, rdx
jne 0x43d152
call fcn.00430914
int3
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_lstrlenA]
lea rcx, [rsp + 0x21]
xor edx, edx
mov r8d, 0xff
mov byte [rsp + 0x20], 0
mov esi, eax
call fcn.00418b40
mov r8d, 0x100
cmp esi, r8d
ja 0x43d1a3
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetWindowTextA]
cmp eax, esi
jne 0x43d1a3
lea rcx, [rsp + 0x20]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x43d1af
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.USER32.dll_SetWindowTextA]
mov rcx, qword [rsp + 0x120]
call fcn.004306c0
add rsp, 0x130
pop rdi
pop rsi
pop rbx
ret

Function at 0x43f120
Capabilities:
Set registry value

Disassembly:
mov dword [rsp + 0x20], r9d
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x58
mov rax, qword [0x00460ad8]
mov qword [rsp + 0x40], rax
xor esi, esi
mov rbp, r8
mov rdi, rdx
cmp qword [rcx + 0xa8], rsi
mov rbx, rcx
je 0x43f19a
call fcn.004416c4
cmp rax, rsi
mov rdi, rax
jne 0x43f15e
xor eax, eax
jmp 0x43f1c7
lea rax, [rsp + 0x98]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], r9d
mov rdx, rbp
mov rcx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebx, esi
sete sil
mov eax, esi
jmp 0x43f1c7
lea rdx, [0x0044a210]
lea rcx, [rsp + 0x30]
mov r8d, r9d
call qword [sym.imp.USER32.dll_wsprintfA]
mov r9, qword [rbx + 0xd0]
lea r8, [rsp + 0x30]
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov rcx, qword [rsp + 0x40]
call fcn.004306c0
add rsp, 0x58
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x4407b4
Capabilities:
Query or enumerate registry key

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x180
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov rax, qword [0x00460ad8]
mov qword [rsp + 0x170], rax
mov rsi, rdx
mov rdi, rcx
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], rdx
lea r8, [rsp + 0x30]
mov rdx, qword [rdx]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov ebx, eax
test eax, eax
jne 0x4408a9
mov r9d, 0x104
lea r8, [rsp + 0x60]
xor edx, edx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov ebx, eax
test eax, eax
jne 0x440880
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x28]
call fcn.00403350
nop
lea rdx, [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
call fcn.004407b4
mov ebx, eax
test eax, eax
setne byte [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x440867
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.oledlg.dll_OleUIBusyA]
cmp byte [rsp + 0x20], 0
je 0x440870
jmp 0x440880
jmp 0x4407ff
cmp ebx, 0x103
je 0x440890
cmp ebx, 0x3f2
jne 0x44089e
mov rdx, qword [rsi]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov ebx, eax
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x170]
call fcn.004306c0
add rsp, 0x180
pop rdi
pop rsi
pop rbx
ret

Function at 0x44139c
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
call fcn.00441358
lea rdx, [0x00405d9c]
lea rcx, [rax + 0x10b8]
add rsp, 0x28
jmp fcn.00441e30

Function at 0x4418b8
Capabilities:
Get thread local storage value

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x28
movsxd rdi, dword [rcx]
xor ebx, ebx
cmp edi, ebx
je 0x441912
mov rsi, qword [0x00465a40]
cmp rsi, rbx
je 0x441912
lea rcx, [rsi + 0x28]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp edi, ebx
jle 0x441903
cmp edi, dword [rsi + 0xc]
jge 0x441903
mov ecx, dword [rsi]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp rax, rbx
je 0x441903
cmp edi, dword [rax + 0x10]
jge 0x441903
mov rax, qword [rax + 0x18]
mov rbx, qword [rax + rdi*8]
lea rcx, [rsi + 0x28]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rax, rbx
jmp 0x441914
xor eax, eax
add rsp, 0x28
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x441a78
Capabilities:
Allocate thread local storage

Disassembly:
push rbx
sub rsp, 0x20
xor eax, eax
mov rbx, rcx
mov qword [rcx + 0x18], rax
mov qword [rcx + 0x20], 8
mov dword [rcx + 4], eax
mov dword [rcx + 8], 1
mov dword [rcx + 0xc], eax
mov qword [rcx + 0x10], rax
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [rbx], eax
jne 0x441ab3
call fcn.004308cc
int3
lea rcx, [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov rax, rbx
add rsp, 0x20
pop rbx
ret
Function at 0x441ce8
Capabilities:
Set thread local storage value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x20
mov esi, 1
mov r14, r8
mov rdi, rdx
cmp dword [rdx + 0x10], esi
mov r12, rcx
mov ebp, esi
jle 0x441d69
lea ebx, [rsi + 7]
lea r13d, [rsi + 0xf]
test r14, r14
je 0x441d33
mov rax, qword [r12 + 0x10]
cmp qword [rax + r13 + 8], r14
je 0x441d33
mov rax, qword [rdi + 0x18]
cmp qword [rbx + rax], 0
je 0x441d56
xor esi, esi
jmp 0x441d56
mov rax, qword [rdi + 0x18]
mov rcx, qword [rbx + rax]
test rcx, rcx
je 0x441d4a
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
mov rax, qword [rdi + 0x18]
mov qword [rbx + rax], 0
inc ebp
add r13, 0x10
add rbx, 8
cmp ebp, dword [rdi + 0x10]
jl 0x441d13
test esi, esi
je 0x441db0
lea rcx, [r12 + 0x28]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rcx, [r12 + 0x18]
mov rdx, rdi
call fcn.004419fc
lea rcx, [r12 + 0x28]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, qword [rdi + 0x18]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov r11, qword [rdi]
mov edx, 1
mov rcx, rdi
call qword [r11]
mov ecx, dword [r12]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
add rsp, 0x20
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x441dc0
Capabilities:
Get thread local storage value

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x28
mov rdi, rcx
add rcx, 0x28
mov ebx, r8d
mov rbp, rdx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
test ebx, ebx
jne 0x441dfd
mov ecx, dword [rdi]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x441e1d
mov r8, rbp
mov rdx, rax
mov rcx, rdi
call fcn.00441ce8
jmp 0x441e1d
mov rdx, qword [rdi + 0x18]
test rdx, rdx
je 0x441e1d
mov rbx, qword [rdx + 8]
mov r8, rbp
mov rcx, rdi
call fcn.00441ce8
test rbx, rbx
mov rdx, rbx
jne 0x441e06
lea rcx, [rdi + 0x28]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
add rsp, 0x28
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x441e30
Capabilities:
Get thread local storage value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov r12, rdx
mov rdi, rcx
test rdx, rdx
jne 0x441e55
call fcn.00430914
int3
cmp dword [rcx], 0
jne 0x441e9e
mov rax, qword [0x00465a40]
test rax, rax
jne 0x441e8a
lea rcx, [0x00465a50]
mov qword [rsp + 0x28], rcx
call fcn.00441a78
nop
mov qword [0x00465a40], rax
test rax, rax
jne 0x441e8a
call fcn.00430914
int3
mov rcx, rax
call fcn.00441770
mov dword [rdi], eax
test eax, eax
jne 0x441e9e
call fcn.00430914
int3
movsxd rbx, dword [rdi]
mov rbp, qword [0x00465a40]
lea rcx, [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
test ebx, ebx
jle 0x441eee
cmp ebx, dword [rbp + 0xc]
jge 0x441eee
mov ecx, dword [rbp]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x441ee2
cmp ebx, dword [rax + 0x10]
jge 0x441ee2
mov rax, qword [rax + 0x18]
mov rbx, qword [rax + rbx*8]
lea rcx, [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x441efa
lea rcx, [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x441eff
lea rcx, [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor ebx, ebx
test rbx, rbx
jne 0x441f16
call r12
mov rbx, rax
mov r8, rax
mov edx, dword [rdi]
mov rcx, qword [0x00465a40]
call fcn.00441b48
mov rax, rbx
add rsp, 0x30
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x45e200
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rdi
cmp word [0x00400000], 0x5a4d
je 0x45e221
xor ebx, ebx
mov dword [rsp + 0x60], ebx
jmp 0x45e29d
movsxd rax, dword [0x0040003c]
lea rcx, [0x00400000]
add rax, rcx
cmp dword [rax], 0x4550
je 0x45e242
xor ebx, ebx
mov dword [rsp + 0x60], ebx
jmp 0x45e29d
movzx ecx, word [rax + 0x18]
cmp ecx, 0x10b
je 0x45e280
cmp ecx, 0x20b
je 0x45e25e
xor ebx, ebx
mov dword [rsp + 0x60], ebx
jmp 0x45e29d
cmp dword [rax + 0x84], 0xe
ja 0x45e26f
xor ebx, ebx
mov dword [rsp + 0x60], ebx
jmp 0x45e29d
xor ebx, ebx
cmp dword [rax + 0xf8], ebx
setne bl
mov dword [rsp + 0x60], ebx
jmp 0x45e29d
cmp dword [rax + 0x74], 0xe
ja 0x45e28e
xor ebx, ebx
mov dword [rsp + 0x60], ebx
jmp 0x45e29d
xor ebx, ebx
cmp dword [rax + 0xe8], ebx
setne bl
mov dword [rsp + 0x60], ebx
mov ecx, 1
call qword [sym.imp.msvcrt.dll___set_app_type]
mov qword [0x00483dc8], 0xffffffffffffffff
mov qword [0x00483dd0], 0xffffffffffffffff
mov rcx, qword [sym.imp.msvcrt.dll__fmode]
mov eax, dword [0x00481da4]
mov dword [rcx], eax
mov rcx, qword [sym.imp.msvcrt.dll__commode]
mov eax, dword [0x00481da0]
mov dword [rcx], eax
call fcn.0045d2e0
cmp dword [0x004817b0], 0
jne 0x45e2f7
lea rcx, [fcn.0045d2e0]
call qword [sym.imp.msvcrt.dll___setusermatherr]
lea rdx, [0x00460498]
lea rcx, [0x00460490]
call fcn.005fb000
mov r11d, dword [0x00481d9c]
mov dword [rsp + 0x68], r11d
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, dword [0x00481d98]
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x30]
call qword [sym.imp.msvcrt.dll___getmainargs]
lea rdx, [0x00460488]
lea rcx, [0x00460430]
call sub.msvcrt.dll__initterm
mov r11, qword [rsp + 0x38]
mov rax, qword [sym.imp.msvcrt.dll___initenv]
mov qword [rax], r11
mov r8, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x40]
mov ecx, dword [rsp + 0x30]
call fcn.0045ae04
mov edi, eax
mov dword [rsp + 0x34], eax
test ebx, ebx
jne 0x45e383
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
call qword [sym.imp.msvcrt.dll__cexit]
jmp 0x45e3a4
mov eax, edi
mov rbx, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x58
ret