joyce8/EMBER2024-capa huggingface dataset:
Function at 0x50fe24
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x50ff50
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, esi
call fcn.0050e7f4
xor eax, eax
push ebp
push 0x50ff29
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x2c]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0050edfc
test al, al
je 0x50ff0b
mov eax, dword [ebp + 8]
push eax
xor ecx, ecx
mov edx, dword [ebp - 8]
mov eax, esi
call fcn.0050fcfc
pop ecx
mov ecx, dword [ebp - 0x20]
inc ecx
lea eax, [ebp - 4]
xor edx, edx
call fcn.0040ac1c
mov ebx, dword [ebp - 0x24]
dec ebx
test ebx, ebx
jl 0x50ff0b
inc ebx
xor edi, edi
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0xc], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.0040b860
push eax
push edi
push esi
call sub.advapi32.dll_RegEnumValueW
mov edx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0050e754
test al, al
je 0x50ff07
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 4]
call fcn.0040b860
mov edx, eax
lea eax, [ebp - 0x30]
call fcn.0040b8c4
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 8]
mov eax, esi
call fcn.0050fcfc
pop ecx
inc edi
dec ebx
jne 0x50feaf
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50ff30
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 0x10]
call fcn.0050e7f4
pop eax
jmp eax
Function at 0x50ff60
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
xor ecx, ecx
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x48], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x5101b8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 8]
call fcn.0050e7f4
xor eax, eax
push ebp
push 0x51018c
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x44]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0050edfc
test al, al
je 0x51016e
mov ecx, dword [ebp - 0x40]
inc ecx
lea eax, [ebp - 4]
xor edx, edx
call fcn.0040ac1c
mov eax, dword [ebp - 0x44]
dec eax
test eax, eax
jl 0x51016e
inc eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x10], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
call fcn.0040b860
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegEnumKeyExW
mov edx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0050e754
test al, al
je 0x510162
mov eax, dword [ebp - 4]
call fcn.0040b860
mov edx, eax
lea eax, [ebp - 0x48]
call fcn.0040b8c4
mov edx, dword [ebp - 0x48]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0050f85c
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x510162
xor eax, eax
push ebp
push 0x51015b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 0xc]
call fcn.0050e7f4
xor eax, eax
push ebp
push 0x51013b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0040b860
mov edx, eax
lea eax, [ebp - 0x4c]
call fcn.0040b8c4
mov edx, dword [ebp - 0x4c]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0050e7f8
mov eax, dword [ebp - 4]
call fcn.0040b860
mov edx, eax
lea eax, [ebp - 0x50]
call fcn.0040b8c4
mov edx, dword [ebp - 0x50]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0050f85c
mov dword [ebp - 0x24], eax
xor eax, eax
push ebp
push 0x510116
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
push eax
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
call fcn.0050fe24
pop ecx
mov eax, dword [ebp + 8]
push eax
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
call fcn.0050ff60
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51011d
mov eax, dword [ebp - 0x24]
push eax
call sub.advapi32.dll_RegCloseKey
pop eax
jmp eax
inc dword [ebp - 0x14]
dec dword [ebp - 0x28]
jne 0x50ffeb
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x510193
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 0x18]
call fcn.0050e7f4
pop eax
jmp eax
Function at 0x535480
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
push edi
push ebp
mov edi, ecx
mov esi, edx
mov ebx, eax
test esi, esi
je 0x535492
test edi, edi
jne 0x5354a6
mov ecx, 0x3e3
mov edx, 0x535504
mov eax, 0x5355b4
call fcn.0040a8e0
push 0x40
push 0x1000
push 0x20
push 0
call sub.kernel32.dll_VirtualAlloc
mov ebp, eax
mov eax, dword [ebx]
xor ecx, ecx
mov edx, esi
call fcn.005355d8
mov esi, eax
mov eax, dword [ebx]
xor ecx, ecx
mov edx, edi
call fcn.005355d8
mov edi, eax
push edi
mov ecx, ebp
mov edx, esi
mov eax, ebx
call fcn.00535704
test al, al
jne 0x5354f1
push 0x8000
push 0x20
push ebp
call sub.kernel32.dll_VirtualFree
xor ebp, ebp
mov eax, ebp
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x797308
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x797400
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebx + 0xc], 1
push 0
push 5
call fcn.004fb650
push 0
push 3
call fcn.004fb650
mov eax, dword [ebx + 0x1c]
call fcn.00408c84
mov eax, dword [ebx + 0x18]
call fcn.00408c84
mov eax, dword [ebx + 8]
call fcn.00408c84
mov eax, dword [ebx + 0x10]
call fcn.00408c84
lea edx, [ebp - 0xc]
xor eax, eax
call fcn.00407514
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
call fcn.0042473c
mov eax, dword [ebp - 8]
call fcn.0040b860
push eax
call sub.kernel32.dll_SetCurrentDirectoryW
mov eax, dword [ebx + 0x88]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x7973e3
inc eax
mov dword [ebp - 4], eax
xor esi, esi
lea ecx, [ebp - 0x10]
mov eax, dword [ebx + 0x88]
mov edx, esi
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x10]
mov dl, 1
call fcn.004245a0
test al, al
je 0x7973dd
lea ecx, [ebp - 0x18]
mov eax, dword [ebx + 0x88]
mov edx, esi
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x18]
call fcn.0040b860
mov edx, eax
lea eax, [ebp - 0x14]
call fcn.0040b8c4
mov eax, dword [ebp - 0x14]
call fcn.004246e0
inc esi
dec dword [ebp - 4]
jne 0x797395
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x797407
lea eax, [ebp - 0x18]
mov edx, 5
call fcn.0040aaf4
pop eax
jmp eax
Function at 0x797784
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x797943
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
push 0
push 0
push 1
push 0
push 1
push 0x40000000
mov eax, dword [ebp - 4]
call fcn.0040b860
push eax
call fcn.004fb5ec
mov esi, eax
cmp esi, 0xffffffff
je 0x797926
mov ecx, esi
mov dl, 1
mov eax, dword [0x497878]
call fcn.004bc3a8
mov dword [ebp - 8], eax
mov dl, 1
mov eax, dword [0x494a2c]
call fcn.004ba448
mov ebx, eax
call sub.kernel32.dll_GetCurrentThreadId
xor edx, edx
push edx
push eax
lea eax, [ebp - 0xc]
call fcn.00423bb4
mov edx, dword [ebp - 0xc]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x3c]
mov eax, dword [0x7cf100]
mov edx, dword [eax + 0x4c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x3c]
mov eax, dword [0x7cf100]
mov edx, dword [eax + 0x44]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x3c]
mov edx, 0x797960
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x3c]
lea eax, [ebp - 0x14]
push eax
mov eax, dword [0x7cf100]
mov eax, dword [eax + 0x5c]
xor ecx, ecx
mov edx, 0x797978
mov edi, dword [eax]
call dword [edi + 0x164]
mov edx, dword [ebp - 0x14]
lea ecx, [ebp - 0x10]
mov eax, dword [0x7cf100]
call fcn.00794724
mov edx, dword [ebp - 0x10]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x3c]
lea edx, [ebp - 0x18]
mov eax, dword [0x7cf100]
movzx eax, byte [eax + 0x90]
call fcn.00423b8c
mov edx, dword [ebp - 0x18]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x3c]
mov eax, dword [0x7cf100]
mov edx, dword [eax + 0x74]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x3c]
mov edx, 0x79798c
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x3c]
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [0x7cf100]
mov eax, dword [eax + 0x5c]
xor ecx, ecx
mov edx, 0x79799c
mov edi, dword [eax]
call dword [edi + 0x164]
mov edx, dword [ebp - 0x1c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x3c]
lea eax, [ebp - 0x20]
push eax
mov eax, dword [0x7cf100]
mov eax, dword [eax + 0x5c]
xor ecx, ecx
mov edx, 0x7979b0
mov edi, dword [eax]
call dword [edi + 0x164]
mov edx, dword [ebp - 0x20]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x3c]
call fcn.00430c00
mov ecx, eax
mov edx, dword [ebp - 8]
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0x8c]
mov eax, ebx
call fcn.00408c84
mov eax, dword [ebp - 8]
call fcn.00408c84
push esi
call sub.kernel32.dll_CloseHandle
push 2
mov eax, dword [ebp - 4]
call fcn.0040b860
push eax
call sub.kernel32.dll_SetFileAttributesW
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x79794a
lea eax, [ebp - 0x20]
mov edx, 6
call fcn.0040aaf4
pop eax
jmp eax
Function at 0x47f9a0
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x34
push ebx
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
push esi
push edi
mov esi, ecx
mov eax, dword [esi + 0x14]
mov ecx, dword [esi + 0xc]
push eax
push 0
push 0x1109
push ecx
call ebx
mov eax, dword [esp + 0x48]
test eax, eax
mov dword [esp + 0x10], 0xffff0002
mov dword [esp + 0x14], 0x27
mov dword [esp + 0xc], 0xffff0000
je 0x47f9e5
mov dword [esp + 0x24], eax
jmp 0x47f9ec
mov edx, dword [esi + 0x1c]
mov dword [esp + 0x24], edx
mov eax, dword [0x7c9770]
mov ecx, dword [esi + 0xc]
mov edi, dword [esp + 0x44]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
lea eax, [esp + 0xc]
push eax
push 0
push 0x1100
push ecx
mov dword [esp + 0x48], edi
call ebx
push edi
push eax
mov ecx, esi
mov dword [esi + 0x10], eax
call fcn.0047fa40
mov edx, dword [esi + 8]
push 0xa
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi + 8]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
pop edi
pop esi
pop ebx
add esp, 0x34
ret 8

Function at 0x480190
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x2c
push esi
mov esi, dword [esp + 0x34]
push edi
xor eax, eax
mov ecx, 0xb
lea edi, [esp + 8]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x3c]
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push eax
push 4
push 0x110a
push esi
mov dword [esp + 0x18], 0xd
mov dword [esp + 0x28], 0x7c9624
mov dword [esp + 0x2c], 0x104
call edi
test eax, eax
mov dword [esp + 0xc], eax
je 0x48025a
push ebx
mov ebx, dword [esp + 0x44]
push ebp
mov ebp, dword [sym.imp.MSVCRT.dll__strnicmp]
lea ecx, [esp + 0x10]
push ecx
push 0
push 0x110c
push esi
call edi
test eax, eax
je 0x480241
mov edx, dword [esp + 0x20]
push 6
push str.NiNode
push edx
call ebp
add esp, 0xc
test eax, eax
je 0x480224
mov eax, dword [esp + 0x20]
push 6
push str.NiBone
push eax
call ebp
add esp, 0xc
test eax, eax
jne 0x480241
mov ecx, dword [esp + 0x14]
push ecx
push ebx
push 0x1102
push esi
call edi
mov edx, dword [esp + 0x14]
push ebx
push edx
push esi
call fcn.00480190
add esp, 0xc
mov eax, dword [esp + 0x14]
push eax
push 1
push 0x110a
push esi
call edi
test eax, eax
mov dword [esp + 0x14], eax
jne 0x4801e7
pop ebp
pop ebx
pop edi
pop esi
add esp, 0x2c
ret
Function at 0x480c40
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x72b203
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.004ee8d0
xor ebx, ebx
lea ecx, [esi + 0x60]
mov dword [esp + 0x18], ebx
call fcn.0047e1e0
xor eax, eax
mov dword [esi], 0x7477bc
mov dword [esi + 4], 0x4e474552
mov ecx, 8
lea edi, [esi + 0x10]
rep stosd dword es:[edi], eax
mov ecx, 8
lea edi, [esi + 0x30]
rep stosd dword es:[edi], eax
mov al, 5
push 1
mov ecx, esi
mov byte [esp + 0x1c], 1
mov byte [esi + 0x50], al
mov byte [esi + 0x51], 0x19
mov byte [esi + 0x52], 0x23
mov byte [esi + 0x53], 0x14
mov byte [esi + 0x54], 0xa
mov byte [esi + 0x55], al
mov byte [esi + 0x56], bl
mov byte [esi + 0x57], bl
mov byte [esi + 0x58], bl
mov byte [esi + 0x59], bl
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x74], 0xffffffff
call fcn.004eed40
mov ecx, dword [esp + 0x10]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x482870
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x72b258
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
call fcn.004ee8d0
xor eax, eax
xor edx, edx
mov dword [esi], 0x747810
mov ecx, 8
lea edi, [esi + 0x10]
rep stosd dword es:[edi], eax
push 1
mov ecx, esi
mov dword [esp + 0x18], edx
mov dword [esi + 4], 0x52435353
mov dword [esi + 0x30], edx
call fcn.004eed40
mov ecx, dword [esp + 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x401010
Capabilities:
Parse pe header

Disassembly:
sub esp, 0x1c
xor eax, eax
cmp word [0x400000], 0x5a4d
mov dword [0x58a3e8], 1
mov dword [0x58a3e4], 1
mov dword [0x58a3e0], 1
jne 0x401056
mov edx, dword [0x40003c]
cmp dword [edx + 0x400000], 0x4550
lea ecx, [edx + 0x400000]
je 0x4010b0
mov dword [0x550014], eax
mov eax, dword [0x58a3f4]
test eax, eax
je 0x4010a0
mov dword [esp], 2
call sym.___set_app_type
call sym.___p__fmode
mov edx, dword [0x58a408]
mov dword [eax], edx
call sym.___p__commode
mov edx, dword [0x58a3f0]
mov dword [eax], edx
call dbg._setargv
cmp dword [0x4e97ac], 1
je 0x4010e0
xor eax, eax
add esp, 0x1c
ret
mov dword [esp], 1
call sym.___set_app_type
jmp 0x401070
movzx edx, word [ecx + 0x18]
cmp dx, 0x10b
je 0x4010f8
cmp dx, 0x20b
jne 0x401056
cmp dword [ecx + 0x84], 0xe
jbe 0x401056
mov edx, dword [ecx + 0xf8]
xor eax, eax
test edx, edx
setne al
jmp 0x401056
mov dword [esp], dbg._matherr
call dbg.__mingw_setusermatherr
xor eax, eax
add esp, 0x1c
ret
cmp dword [ecx + 0x74], 0xe
jbe 0x401056
mov ecx, dword [ecx + 0xe8]
xor eax, eax
test ecx, ecx
setne al
jmp 0x401056

Function at 0x4047f0
Capabilities:
Contain obfuscated stackstrings
Print debug messages

Disassembly:
push edi
xor eax, eax
mov ecx, 0x10
sub esp, 0x88
lea edi, [esp + 0x40]
mov dword [esp + 0x15], 0x6f727245
mov dword [esp + 0x19], 0x6c632072
mov dword [esp + 0x1d], 0x696e6165
mov dword [esp + 0x21], 0x7520676e
mov dword [esp + 0x25], 0x70732070
mov dword [esp + 0x29], 0x6b5f6e69
mov dword [esp + 0x2d], 0x20737965
mov dword [esp + 0x31], 0x20726f66
mov dword [esp + 0x35], 0x65726874
mov dword [esp + 0x39], 0x206461
mov dword [esp + 0x3d], 0
mov dword [esp + 0x7c], 0
rep stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea edx, [esp + 0x3c]
mov dword [esp + 8], 0xa
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll__ultoa]
cmp byte [esp + 0x3c], 0
je 0x4048cb
mov eax, 0x27
lea edx, [esp + 0x15]
jmp 0x40489d
cmp eax, 0x6a
je 0x4048ba
mov ecx, eax
add eax, 1
cmp byte [edx + eax], 0
jne 0x404898
cmp eax, 0x6a
je 0x4048ba
add ecx, 2
mov byte [esp + eax + 0x15], 0xa
mov byte [esp + ecx + 0x15], 0
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
sub esp, 4
call sym._abort
mov ecx, 0x28
mov eax, 0x27
lea edx, [esp + 0x15]
jmp 0x4048b0
Function at 0x404c20
Capabilities:
Allocate thread local storage

Disassembly:
push edi
mov eax, 0x550084
push esi
push ebx
sub esp, 0x10
call dbg.enterOnceObject
lea esi, [eax + 4]
mov ebx, eax
mov dword [esp], esi
call dbg.pthread_mutex_lock
mov edi, dword [0x550084]
test edi, edi
jne 0x404c88
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x4e9024], eax
cmp eax, 0xffffffff
je sym.__pthread_once_raw.part.0.constprop.0.cold
mov dword [0x550084], 1
mov dword [esp], esi
call dbg.pthread_mutex_unlock
test ebx, ebx
je 0x404c78
mov eax, ebx
call sym._leaveOnceObject.part.0
add esp, 0x10
xor eax, eax
pop ebx
pop esi
pop edi
ret
cmp edi, 1
je 0x404c65
mov dword [esp], 2
call dword [0x4e9838]
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0x550084
mov dword [esp + 4], str._once__p_is__d_n
mov dword [esp], eax
call sym._fprintf_17
jmp 0x404c65

Function at 0x404cc0
Capabilities:
Set thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
call sym._pop_pthread_mem
mov edx, dword [entry3]
test edx, edx
je 0x404df0
mov ebx, eax
test eax, eax
je 0x404df0
mov dword [eax + 0x24], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebx + 0x3c], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [ebx + 0x1c], 0xffffffff
mov dword [ebx + 0x18], eax
sub esp, 0x10
lea eax, [ebx + 0x38]
mov dword [esp], eax
call dbg.pthread_spin_destroy
cmp eax, 1
je 0x404dfc
mov ebp, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebx + 0x38], 0xffffffff
mov dword [ebx + 0x64], 0
mov dword [ebx + 0x14], 0
call ebp
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov esi, eax
call ebp
lea edx, [ebx + 0x14]
mov dword [esp + 8], edi
mov dword [esp + 0x18], 2
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edx
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
sub esp, 0x1c
test eax, eax
je sym.___pthread_self_lite.part.0.cold
mov eax, dword [ebx + 0x14]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [ebx + 0x68], 0
mov dword [ebx + 0x6c], eax
movzx eax, byte [ebx + 0x20]
sub esp, 4
and eax, 0xffffffcf
or eax, 0x10
mov byte [ebx + 0x20], al
mov eax, dword [0x4e9024]
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
je 0x404e01
add esp, 0x2c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
add esp, 0x2c
xor ebx, ebx
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
call sym._replace_spin_keys.part.0
jmp sym.___pthread_self_lite.part.0.cold

Function at 0x404e10
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
sub esp, 0x1c
cmp dword [0x550084], 1
je 0x404e21
call sym.__pthread_once_raw.part.0.constprop.0
mov eax, dword [0x4e9024]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x404e40
add esp, 0x1c
ret
add esp, 0x1c
jmp sym.___pthread_self_lite.part.0
Function at 0x404f8a
Capabilities:
Set thread local storage value

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x28
mov eax, dword [ecx]
mov esi, eax
mov dword [ebp - 0x1c], eax
call dbg._fpreset
mov dword [esp], 0x4e901c
lea ebx, [esi + 0x1c]
call dbg.pthread_mutex_lock
mov dword [esp], ebx
call dbg.pthread_mutex_lock
cmp dword [0x550084], 1
je 0x404fc5
call sym.__pthread_once_raw.part.0.constprop.0
mov esi, dword [ebp - 0x1c]
mov eax, dword [0x4e9024]
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push edi
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [esi + 0x3c], eax
mov dword [esp], ebx
call dbg.pthread_mutex_unlock
lea eax, [esi + 0x70]
mov dword [esp + 4], 0
mov dword [esp], eax
call sym.__setjmp3
test eax, eax
je 0x40508f
mov dword [esp], 0x4e901c
call dbg.pthread_mutex_lock
mov esi, dword [ebp - 0x1c]
lea ebx, [esi + 0x1c]
mov dword [esp], ebx
call dbg.pthread_mutex_lock
mov eax, esi
mov esi, dword [esi + 4]
mov eax, dword [eax + 0x18]
test eax, eax
je 0x405038
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
mov eax, dword [ebp - 0x1c]
cmp dword [eax + 0x14], 0
mov dword [eax + 0x18], 0
je 0x4050e2
mov dword [esp], ebx
call dbg.pthread_mutex_unlock
mov dword [esp], ebx
call dbg.pthread_mutex_destroy
mov eax, dword [ebp - 0x1c]
mov dword [eax + 0x1c], 0xffffffff
mov dword [eax + 0x68], 1
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [esp], 0x4e901c
call dbg.pthread_mutex_unlock
test eax, eax
jne 0x4050d9
mov dword [esp], 0
call ebx
push eax
jmp 0x405073
mov dword [esp], 0x4e901c
call dbg.pthread_mutex_unlock
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 8]
test eax, eax
je 0x40511f
mov edx, dword [edx + 4]
mov dword [esp], edx
call eax
mov ebx, eax
mov dword [esp], 0x4e901c
call dbg.pthread_mutex_lock
mov eax, dword [ebp - 0x1c]
mov dword [eax + 4], ebx
mov eax, dword [eax + 0xb4]
test eax, eax
je 0x405014
call sym.__pthread_cleanup_dest.part.0
jmp 0x405014
mov dword [esp], esi
call dword [sym.imp.msvcrt.dll__endthreadex]
mov edi, dword [ebp - 0x1c]
mov dword [edi], 0xdeadbeef
mov dword [esp], ebx
call dbg.pthread_mutex_unlock
mov dword [esp], ebx
call dbg.pthread_mutex_destroy
mov eax, edi
call sym._push_pthread_mem
mov eax, dword [0x4e9024]
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push edx
push edx
jmp 0x40506d
mov ebx, pe_nt_image_headers32
jmp 0x4050af