joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10008340
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.100252c0

Function at 0x10028510
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x1002851f
pop dword [ebp - 0x38]
mov eax, 0x5a35ef15
add eax, 0xb5cc960a
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0xfbc57713
add dword [ebp - 0x48], 0x528cce38
mov dword [ebp - 0x44], 0xae8edb63
sub dword [ebp - 0x44], 0x7c5b8f1e
mov dword [ebp - 0x40], 0x77329dbb
add dword [ebp - 0x40], 0xd519a673
mov dword [ebp - 0x3c], 0x8c351f8b
add dword [ebp - 0x3c], 0x73cae075
lea eax, [ebp - 0x48]
push eax
mov eax, 0x98619917
sub eax, 0x885a980b
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0x224c31e7
sub dword [ebp - 0x48], 0xadd9c891
mov dword [ebp - 0x44], 0xcc11a3d9
add dword [ebp - 0x44], 0x755abd9c
mov dword [ebp - 0x40], 0xda6daf27
add dword [ebp - 0x40], 0x8901bd45
mov dword [ebp - 0x3c], 0xc0aa12a9
add dword [ebp - 0x3c], 0x3f55ed57
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x69de6
push 0
call eax
mov ecx, 0x954a217c
sub ecx, 0x9549cf42
xor edx, edx
add edx, eax
mov ebx, 0x8e7a1967
sub ebx, 0x7e71cd67
add ebx, dword [ebp - 0x38]
mov edi, 0xcc20d165
add edi, 0x484840fb
mov dword [ebp - 0x24], 0xdd999a47
mov esi, dword [ebx]
mov dword [ebp - 0x10], 0xc1039539
xor esi, edi
xor dword [ebp - 8], edx
mov dword [edx], esi
add dword [ebp - 0x30], edx
add edx, 0x8dd904c5
add edx, 0x7226fb3f
add ebx, 0xf5b14ad1
sub ebx, 0xf5b14acd
loop 0x1002863e
add eax, 0x4460e9a0
add eax, 0xbba0521b
mov ebx, eax
add eax, 0x4e7d2ce6
add eax, 0xb182d31f
mov ecx, 0x5ef7715d
sub ecx, 0x4ef7715d
add ecx, dword [ebp - 0x38]
call ebx
leave
ret
Function at 0x4043c0
Capabilities:
Create thread
Inject dll
Inject thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push eax
xor ebx, ebx
push ebx
push 0x1fffff
mov dword [ebp - 4], 1
xor esi, esi
mov dword [ebp - 8], ebx
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
jne 0x4043f6
mov dword [ebp - 4], 0xffffffff
jmp 0x404562
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0x10]
push 4
push 0x1000
inc eax
push eax
push 0
push edi
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 8], eax
test eax, eax
jne 0x404424
mov dword [ebp - 4], 0xfffffffe
jmp 0x404562
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp + 8]
push 0
push edx
call fcn.00405040
push eax
mov eax, dword [ebp - 8]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x40444e
mov dword [ebp - 4], 0xfffffffd
jmp 0x404562
push 0x4a7b10
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ebx, eax
push 0x4a7c0c
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test ebx, ebx
je 0x40455b
test eax, eax
je 0x40455b
mov edx, dword [ebp - 8]
lea ecx, [ebp - 0x10]
push ecx
push 0
push edx
push eax
push 0
push 0
push edi
mov dword [ebp - 0x10], esi
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov esi, eax
test esi, esi
jne 0x4044a2
mov dword [ebp - 4], 0xfffffffb
jmp 0x404562
mov dword [ebp - 0xc], 0
lea esp, [esp]
push 0x2710
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0xc]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov eax, dword [ebp - 0xc]
cmp eax, 0x103
je 0x4044b0
test eax, eax
jne 0x4044e1
mov dword [ebp - 4], 0xfffffffa
jmp 0x404562
mov ecx, dword [ebp - 8]
push 0x8000
push 0
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 8]
call fcn.00405040
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
push str.GetAddrCtrl
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test ebx, ebx
je 0x404552
test eax, eax
je 0x404552
mov edx, dword [ebp - 0xc]
sub edx, ebx
lea ecx, [ebp - 0x10]
push ecx
push 0
add eax, edx
mov edx, dword [ebp + 0xc]
push edx
push eax
push 0
push 0
push edi
mov dword [ebp - 0x10], 0
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov esi, eax
test esi, esi
jne 0x404562
mov dword [ebp - 4], 0xfffffff8
jmp 0x404562
mov dword [ebp - 4], 0xfffffff9
jmp 0x404562
mov dword [ebp - 4], 0xfffffffc
mov eax, dword [ebp - 8]
push 0x8000
push 0
push eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push esi
call edi
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x404ab0
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a2340
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x4bf6bc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, dword [edi + 4]
sub ecx, dword [edi]
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
jne 0x404afc
or eax, 0xffffffff
jmp 0x404c09
call fcn.00404c30
mov esi, dword [edi]
xor ebx, ebx
cmp esi, dword [edi + 4]
je 0x404bc1
mov edi, edi
xor ecx, ecx
push ebx
mov word [ebp - 0x2c], cx
push esi
or eax, 0xffffffff
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], ebx
call fcn.00407860
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x1c], ebx
jne 0x404b56
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x18], 8
jb 0x404b4e
mov edx, dword [ebp - 0x2c]
push edx
call fcn.0047bd91
add esp, 4
xor eax, eax
mov word [ebp - 0x2c], ax
jmp 0x404bab
cmp dword [esi + 0x10], ebx
je 0x404b8c
cmp dword [esi + 0x14], 8
jb 0x404b65
mov eax, dword [esi]
jmp 0x404b67
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
je 0x404b83
push esi
call fcn.0045e820
add esp, 4
push esi
call fcn.0045e500
jmp 0x404b89
push ebx
call fcn.0045ebe0
add esp, 4
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x18], 8
jb 0x404ba5
mov ecx, dword [ebp - 0x2c]
push ecx
call fcn.0047bd91
add esp, 4
xor edx, edx
mov word [ebp - 0x2c], dx
add esi, 0x1c
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], 7
cmp esi, dword [edi + 4]
jne 0x404b10
lea ecx, [ebp - 0x2c]
call fcn.00467210
mov dword [ebp - 4], 1
push 1
lea esi, [ebp - 0x2c]
call fcn.0045ebe0
add esp, 4
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x18], 8
jb 0x404bf6
mov eax, dword [ebp - 0x2c]
push eax
call fcn.0047bd91
add esp, 4
xor ecx, ecx
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], ebx
mov word [ebp - 0x2c], cx
lea eax, [ecx + 1]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0047bd9c
mov esp, ebp
pop ebp
ret
Function at 0x404c30
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a1f08
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x4bf6bc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, 7
xor edi, edi
xor eax, eax
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x1c], edi
mov word [ebp - 0x2c], ax
mov dword [ebp - 4], edi
lea ecx, [ebp - 0x30]
lea ebx, [ebp - 0x2c]
mov dword [ebp - 0x30], edi
call fcn.00467d30
mov eax, dword [ebp - 0x30]
cmp eax, edi
jne 0x404cb0
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x18], 8
jb 0x404c9f
mov ecx, dword [ebp - 0x2c]
push ecx
call fcn.0047bd91
add esp, 4
xor edx, edx
mov dword [ebp - 0x18], esi
mov word [ebp - 0x2c], dx
or eax, 0xffffffff
jmp 0x404d37
push eax
push edi
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
cmp esi, edi
jne 0x404ce7
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x18], 8
jb 0x404cdc
mov eax, dword [ebp - 0x2c]
push eax
call fcn.0047bd91
add esp, 4
xor ecx, ecx
mov word [ebp - 0x2c], cx
lea eax, [ecx - 2]
jmp 0x404d30
push 0xbb8
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x404d05
push str.CUninstBridge::WaitParentProcess_WAIT_TIMEOUT.
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x18], 8
jb 0x404d25
mov edx, dword [ebp - 0x2c]
push edx
call fcn.0047bd91
add esp, 4
xor eax, eax
mov word [ebp - 0x2c], ax
mov eax, 1
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0047bd9c
mov esp, ebp
pop ebp
ret
Function at 0x408370
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49cba3
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x4bf6bc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.0047b495
mov dword [ebp - 4], 0
push 4
call fcn.0047c586
mov edi, eax
add esp, 4
test edi, edi
je 0x4083f8
call fcn.0047b290
mov dword [edi], eax
call fcn.0047b04f
push 0
lea ecx, [ebp - 0x10]
mov ebx, eax
call fcn.0047b456
mov byte [ebp - 4], 1
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x4083ea
inc eax
mov dword [ebx + 4], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.0047b47e
jmp 0x4083fa
xor edi, edi
mov dword [esi + 0x38], edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x408470
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49cb73
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x4bf6bc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__.0
call fcn.0047b495
mov dword [ebp - 4], 0
push 4
call fcn.0047c586
mov edi, eax
add esp, 4
test edi, edi
je 0x4084f4
call fcn.0047b290
mov dword [edi], eax
call fcn.0047b04f
push 0
lea ecx, [ebp - 0x10]
mov ebx, eax
call fcn.0047b456
mov byte [ebp - 4], 1
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x4084e6
inc eax
mov dword [ebx + 4], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.0047b47e
jmp 0x4084f6
xor edi, edi
mov dword [esi + 0x38], edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40df60
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49fd02
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x4bf6bc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x10], ebx
lea eax, [edi + 0x68]
mov dword [edi], 0x4a827c
mov dword [ebp - 0x14], eax
mov dword [eax], vtable.std::ios_base.0
mov dword [ebp - 4], ebx
mov dword [eax], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
mov eax, 1
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], eax
mov eax, dword [edi]
mov ecx, dword [eax + 4]
mov dword [edi + ecx], vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov edx, dword [edi]
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
mov esi, dword [edx + 4]
add esi, edi
mov ecx, esi
call fcn.004021a0
lea eax, [edi + 0x10]
push 0x20
mov ecx, esi
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], ebx
call fcn.00408b30
mov byte [esi + 0x40], al
cmp dword [esi + 0x38], ebx
jne 0x40e002
mov eax, dword [esi + 0xc]
or eax, 4
or eax, 4
push ebx
push eax
mov ecx, esi
call fcn.00402030
mov dword [ebp - 4], 4
mov eax, dword [edi]
mov ecx, dword [eax + 4]
lea esi, [edi + 0x10]
mov dword [edi + ecx], vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov ecx, esi
mov dword [ebp - 0x14], esi
call fcn.00408370
mov byte [ebp - 4], 5
lea edx, [esi + 8]
mov dword [esi + 0x10], edx
mov dword [esi], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov byte [esi + 0x50], bl
mov byte [esi + 0x49], bl
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], ebx
mov eax, dword [esi + 0x24]
mov dword [eax], ebx
mov ecx, dword [esi + 0x34]
mov dword [ecx], ebx
mov edx, dword [esi + 0x10]
mov dword [edx], ebx
mov eax, dword [esi + 0x20]
mov dword [eax], ebx
mov ecx, dword [esi + 0x30]
mov dword [ecx], ebx
mov dword [esi + 0x54], ebx
mov edx, dword [0x4c388c]
mov dword [esi + 0x4c], edx
mov dword [esi + 0x44], ebx
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40eb00
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49df08
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x4bf6bc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x44], ebx
je 0x40ec2d
cmp byte [edi + 0x49], bl
je 0x40ec2d
mov eax, dword [edi]
mov edx, dword [eax + 0xc]
push 0xffffffffffffffff
call edx
cmp eax, 0xffffffff
je 0x40ebbf
mov ecx, 0xf
mov dword [ebp - 0x18], ecx
xor eax, eax
mov byte [ebp - 0x2c], bl
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x1c], 8
cmp ecx, 0x10
jae 0x40eb74
lea eax, [ebp - 0x2c]
mov byte [eax + 8], bl
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x2c]
mov ebx, dword [ebp - 0x18]
mov edx, eax
cmp ebx, 0x10
jae 0x40eb8c
lea edx, [ebp - 0x2c]
mov eax, edx
add edx, dword [ebp - 0x1c]
mov ecx, dword [edi + 0x44]
mov esi, dword [ecx]
lea ebx, [ebp - 0x30]
push ebx
push edx
push eax
lea eax, [edi + 0x4c]
push eax
mov eax, dword [esi + 0x18]
call eax
sub eax, 0
je 0x40ebc3
dec eax
je 0x40ebc7
sub eax, 2
je 0x40ec1e
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.00404fe0
xor al, al
jmp 0x40ec2f
mov byte [edi + 0x49], 0
mov ebx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov ecx, eax
cmp ebx, 0x10
jae 0x40ebd7
lea ecx, [ebp - 0x2c]
mov esi, dword [ebp - 0x30]
sub esi, ecx
je 0x40ec00
cmp ebx, 0x10
jae 0x40ebe6
lea eax, [ebp - 0x2c]
mov ecx, dword [edi + 0x54]
push ecx
push esi
push 1
push eax
call fcn.0047dbab
add esp, 0x10
cmp esi, eax
jne 0x40ebb0
mov ebx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
cmp byte [edi + 0x49], 0
je 0x40ec1e
test esi, esi
jne 0x40eb80
push esi
push 8
lea ecx, [ebp - 0x2c]
call fcn.0040e470
jmp 0x40eb7a
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.00404fe0
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0047bd9c
mov esp, ebp
pop ebp
ret
Function at 0x419470
Capabilities:
Allocate thread local storage
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
cmp dword [0x4c3c48], 0
push ebx
push esi
mov ebx, 1
jne 0x4194aa
add dword [0x4c3c44], ebx
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
sub dword [0x4c3c44], ebx
mov dword [0x4c38a4], eax
cmp eax, 0xffffffff
je 0x4194ba
mov dword [0x4c3c48], ebx
jmp 0x4194af
mov eax, dword [0x4c38a4]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0x4194bf
mov eax, 0x4ae50c
cmp byte [eax + 4], 0
je 0x4194f5
mov eax, dword [ebp + 8]
mov esi, dword [eax + 4]
test esi, esi
je 0x4194f5
nop
cmp esi, dword [ebp + 0xc]
je 0x4194ee
test edi, edi
je 0x4194de
cmp dword [esi + 0x14], edi
jne 0x4194ee
cmp byte [esi + 0x41], bl
jne 0x4194ee
mov eax, esi
call fcn.004193e0
test eax, eax
jne 0x4194f7
mov esi, dword [esi + 4]
test esi, esi
jne 0x4194d0
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x419560
Capabilities:
Allocate thread local storage
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x4c3c48], 0
push esi
mov esi, dword [edi + 4]
jne 0x4195a1
inc dword [0x4c3c44]
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x4c38a4], eax
cmp eax, 0xffffffff
jne 0x41958e
dec dword [0x4c3c44]
jmp 0x4195b1
mov ecx, 1
sub dword [0x4c3c44], ecx
mov dword [0x4c3c48], ecx
jmp 0x4195a6
mov eax, dword [0x4c38a4]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0x4195b6
mov eax, 0x4ae50c
cmp byte [eax + 4], 0
je 0x4195d8
mov eax, dword [edi]
test eax, eax
je 0x4195dd
test dword [eax + 8], 0x4000
je 0x4195dd
cmp bl, 2
je 0x4195dd
mov ecx, dword [ebp + 8]
cmp ecx, 1
je 0x4195e0
xor eax, eax
pop esi
pop ebp
ret
mov ecx, dword [ebp + 8]
mov eax, dword [esi + 0x40]
test eax, eax
je 0x4195d8
cmp dword [eax], edi
je 0x4195fa
cmp dword [eax + 4], ecx
jne 0x4195fa
cmp byte [eax + 8], bl
jne 0x419604
cmp bl, 1
jne 0x419604
mov eax, dword [eax + 0xc]
test eax, eax
jne 0x4195e7
pop esi
pop ebp
ret
mov eax, 6
pop esi
pop ebp
ret
Function at 0x419610
Capabilities:
Allocate thread local storage
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x4c3c48], 0
push edi
mov edi, dword [esi + 4]
jne 0x419651
inc dword [0x4c3c44]
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x4c38a4], eax
cmp eax, 0xffffffff
jne 0x41963e
dec dword [0x4c3c44]
jmp 0x419661
mov ecx, 1
sub dword [0x4c3c44], ecx
mov dword [0x4c3c48], ecx
jmp 0x419656
mov eax, dword [0x4c38a4]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0x419666
mov eax, 0x4ae50c
cmp byte [eax + 4], 0
je 0x419706
mov eax, dword [esi]
test eax, eax
je 0x41968a
test dword [eax + 8], 0x4000
je 0x41968a
cmp byte [ebp + 8], 1
jne 0x41968a
cmp ebx, 1
jne 0x419706
mov eax, dword [edi + 0x40]
test eax, eax
je 0x4196a1
cmp dword [eax + 4], ebx
jne 0x41969a
cmp dword [eax], esi
je 0x4196fb
mov eax, dword [eax + 0xc]
test eax, eax
jne 0x419691
xor eax, eax
cmp dword [0x4c3c38], eax
je 0x4196b3
cmp dword [0x4c3c44], eax
jg 0x4196e1
push 0x10
call fcn.0047e6d7
add esp, 4
test eax, eax
jne 0x4196d4
mov ecx, 1
add dword [0x4c3c44], ecx
mov dword [0x4c3c38], ecx
jmp 0x4196e1
xor ecx, ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
test eax, eax
jne 0x4196ed
mov eax, 7
pop edi
pop ebp
ret
mov dword [eax + 4], ebx
mov dword [eax], esi
mov ecx, dword [edi + 0x40]
mov dword [eax + 0xc], ecx
mov dword [edi + 0x40], eax
mov cl, byte [ebp + 8]
cmp cl, byte [eax + 8]
jbe 0x419706
mov byte [eax + 8], cl
xor eax, eax
pop edi
pop ebp
ret
Function at 0x41a850
Capabilities:
Allocate thread local storage
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 4]
push edi
mov edi, dword [ebx + 4]
test edi, edi
je 0x41a87a
mov eax, edi
mov edi, dword [edi + 4]
cmp dword [eax], esi
jne 0x41a876
mov esi, eax
call fcn.0041bb40
mov esi, dword [ebp + 8]
test edi, edi
jne 0x41a863
push esi
call fcn.0041b7d0
add esp, 4
push esi
call fcn.0047c501
add esp, 4
dec dword [ebx + 0x30]
jne 0x41a93a
cmp dword [0x4c3c48], 0
jne 0x41a8c7
mov esi, 1
add dword [0x4c3c44], esi
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
sub dword [0x4c3c44], esi
mov dword [0x4c38a4], eax
cmp eax, 0xffffffff
je 0x41a8d9
mov dword [0x4c3c48], esi
jmp 0x41a8cc
mov eax, dword [0x4c38a4]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, eax
test eax, eax
jne 0x41a8de
mov ecx, 0x4ae50c
mov eax, dword [ecx + 8]
cmp eax, ebx
jne 0x41a8ed
mov eax, dword [ebx + 0x44]
mov dword [ecx + 8], eax
jmp 0x41a906
test eax, eax
je 0x41a906
mov ecx, dword [eax + 0x44]
cmp ecx, ebx
je 0x41a900
mov eax, ecx
test eax, eax
jne 0x41a8f1
jmp 0x41a906
mov ecx, dword [ebx + 0x44]
mov dword [eax + 0x44], ecx
mov esi, dword [ebx]
call fcn.00439ac0
mov ecx, dword [ebx + 0x3c]
test ecx, ecx
je 0x41a921
mov eax, dword [ebx + 0x38]
test eax, eax
je 0x41a921
push eax
call ecx
add esp, 4
mov eax, dword [ebx + 0x38]
test eax, eax
je 0x41a931
push eax
call fcn.0047c501
add esp, 4
push ebx
call fcn.0047c501
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret

Function at 0x41fe60
Capabilities:
Allocate thread local storage
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x4c3c48], 0
push ebx
push esi
mov esi, eax
mov ebx, dword [esi + 4]
jne 0x41fea5
inc dword [0x4c3c44]
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x4c38a4], eax
cmp eax, 0xffffffff
jne 0x41fe92
dec dword [0x4c3c44]
jmp 0x41feb5
mov ecx, 1
sub dword [0x4c3c44], ecx
mov dword [0x4c3c48], ecx
jmp 0x41feaa
mov eax, dword [0x4c38a4]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0x41feba
mov eax, 0x4ae50c
cmp byte [eax + 4], 0
je 0x41fede
mov eax, dword [ebx + 0x40]
test eax, eax
je 0x41fede
cmp dword [eax], esi
je 0x41fed7
cmp dword [eax + 4], 1
jne 0x41fed7
cmp byte [eax + 8], 1
jne 0x41ff37
mov eax, dword [eax + 0xc]
test eax, eax
jne 0x41fec7
lea eax, [ebp - 4]
push eax
mov eax, dword [ebx]
push 1
call fcn.00439e90
add esp, 8
test eax, eax
jne 0x41ff31
mov edx, dword [ebp - 4]
movzx ecx, byte [edx + edi*4 + 0x24]
movzx eax, byte [edx + edi*4 + 0x25]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + edi*4 + 0x26]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + edi*4 + 0x27]
shl ecx, 8
or ecx, eax
mov eax, dword [ebp + 8]
mov dword [eax], ecx
call fcn.0043a350
push 1
mov ebx, 1
call fcn.00419610
add esp, 4
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop esi
mov eax, 6
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x420ff0
Capabilities:
Allocate thread local storage
Get thread local storage value

Disassembly:
cmp dword [0x4c3c48], 0
push ebx
push esi
mov esi, dword [edi + 4]
mov ebx, 1
jne 0x421027
add dword [0x4c3c44], ebx
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
sub dword [0x4c3c44], ebx
mov dword [0x4c38a4], eax
cmp eax, 0xffffffff
je 0x421037
mov dword [0x4c3c48], ebx
jmp 0x42102c
mov eax, dword [0x4c38a4]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0x42103c
mov eax, 0x4ae50c
cmp byte [eax + 4], 0
je 0x421065
mov eax, dword [esi + 0x40]
test eax, eax
je 0x421065
lea esp, [esp]
cmp dword [eax], edi
je 0x42105e
cmp dword [eax + 4], ebx
jne 0x42105e
cmp byte [eax + 8], bl
jne 0x421073
mov eax, dword [eax + 0xc]
test eax, eax
jne 0x421050
xor eax, eax
xor ecx, ecx
test eax, eax
setne cl
pop esi
pop ebx
mov eax, ecx
ret
mov eax, 6
xor ecx, ecx
test eax, eax
setne cl
pop esi
pop ebx
mov eax, ecx
ret