joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40dd60
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42d7d9
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x43e028]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], ebx
mov word [esi], ax
mov eax, 1
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x28], vtable.ES_CMN_FUNCS::BUFFER::CESHeapBuffer.0
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], eax
call dword [0x434990]
mov edx, dword [ebp - 0x28]
mov eax, dword [edx + 0x4c]
push 0x20a
lea ecx, [ebp - 0x28]
call eax
mov edi, eax
mov dword [ebp - 0x24], edi
cmp edi, ebx
je 0x40de98
push 1
push 0x23
mov eax, 0x20a
push edi
push ebx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov edi, dword [ebp - 0x24]
cmp eax, 1
jne 0x40de4f
cmp edi, ebx
je 0x40de1e
lea esi, [ebp - 0x10]
mov edx, edi
call fcn.0040c0e0
mov esi, dword [ebp + 8]
cmp eax, ebx
jge 0x40de27
xor ecx, ecx
jmp 0x40de2a
mov eax, 0x80070057
xor ecx, ecx
jmp 0x40de2a
mov ecx, dword [ebp - 0x10]
cmp eax, ebx
jne 0x40de32
cmp ecx, ebx
jne 0x40de4f
cmp edi, ebx
je 0x40de98
mov edx, dword [ebp - 0x28]
mov eax, dword [edx + 0x50]
push edi
lea ecx, [ebp - 0x28]
call eax
xor edi, edi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
jmp 0x40de98
cmp edi, ebx
je 0x40de98
mov eax, edi
lea edx, [eax + 2]
jmp 0x40de60
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x40de60
sub eax, edx
sar eax, 1
push eax
mov eax, edi
call fcn.00401590
mov edi, dword [ebp - 0x24]
cmp edi, ebx
je 0x40de95
mov edx, dword [ebp - 0x28]
mov eax, dword [edx + 0x50]
push edi
lea ecx, [ebp - 0x28]
call eax
xor edi, edi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov esi, dword [ebp + 8]
cmp dword [esi + 0x10], ebx
je 0x40deae
push 0x11
mov eax, str.EPSONEPSONSCAN2
mov ecx, esi
call fcn.0040b2b0
mov edi, dword [ebp - 0x24]
mov dword [ebp - 0x28], vtable.ES_CMN_FUNCS::BUFFER::CESHeapBuffer.0
mov dword [ebp - 4], 2
cmp edi, ebx
je 0x40deca
push edi
lea ecx, [ebp - 0x28]
call dword [0x4349bc]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x419af0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42bd73
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x43e028]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
xor edi, edi
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], edi
mov dword [ebp - 4], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], 0x400
mov byte [ebp - 4], 1
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
cmp dword [esi + 0x18], edi
jne 0x419b82
push 0x14
call dword [sym.imp.mfc100u.dll_new]
add esp, 4
cmp eax, edi
je 0x419b7a
mov dword [eax], edi
mov dword [eax + 4], 0x10000
mov dword [eax + 8], edi
mov dword [eax + 0xc], edi
mov dword [eax + 0x10], edi
jmp 0x419b7c
xor eax, eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x42a370
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
cmp dword [esi + 4], 0
jne 0x42a467
xor eax, eax
mov dword [ebp - 0x1f], eax
mov dword [ebp - 0x1b], eax
mov dword [ebp - 0x17], eax
mov dword [ebp - 0x13], eax
mov word [ebp - 0xf], ax
mov byte [ebp - 0xd], al
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
push 1
lea eax, [ebp - 0x20]
push eax
mov byte [ebp - 0x20], 0
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test eax, eax
je 0x42a3da
push 0
push 0
push 1
lea ecx, [ebp - 0x20]
push ecx
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
test eax, eax
je 0x42a3da
lea edx, [ebp - 0x20]
mov dword [ebp - 0xc], 0xc
mov dword [ebp - 8], edx
mov dword [ebp - 4], 1
push str.ES2Launcher.exe
push 0
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi + 4], eax
test eax, eax
je 0x42a408
test edi, edi
je 0x42a408
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
cmp eax, 0xb7
sete cl
mov dword [edi], ecx
mov eax, dword [esi + 4]
push str.ES2Launcher.exe
test eax, eax
jne 0x42a442
push 0x434850
push str...CommonUtilityutilsESMutex.cpp
lea edx, [eax + 0x2b]
lea ecx, [eax + 5]
push str.CESMutex::InitMutex
mov eax, 0x441928
call fcn.0040dee0
xor eax, eax
add esp, 0x10
cmp dword [esi + 4], eax
setne al
mov esp, ebp
pop ebp
ret
push eax
push str.CreateMutexSuccess__08X___s_
mov edx, 0x2d
push str...CommonUtilityutilsESMutex.cpp
push str.CESMutex::InitMutex
lea ecx, [edx - 0x2b]
mov eax, 0x441928
call fcn.0040dee0
add esp, 0x14
xor eax, eax
cmp dword [esi + 4], eax
setne al
mov esp, ebp
pop ebp
ret

Function at 0x42b091
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x43e028]
jne 0x42b09b
repz ret
jmp fcn.0042b5d4
Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..text
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x36ee2f72
nop
nop
test eax, eax
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x430024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x197c4730
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x42e006
Capabilities:
Encode data using xor

Disassembly:
call 0x42e00c
nop
nop
nop
pop eax
nop
nop
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
cmp ebx, ecx
nop
nop
nop
nop
jl 0x42e030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
jne 0x42e01e
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp loc.00401219

Function at 0x710c81
Capabilities:
Encode data using xor

Disassembly:
mov ebx, 0x7109ec
or edx, edx
mov edx, esi
add edx, 0x740bdd72
call fcn.00710cb9
and esi, esi
dec edx
xor dword [eax], ebx
mov edx, edx
add eax, 1
inc esi
and esi, esi
and esi, esi
cmp eax, ecx
jne fcn.00710c81
inc edx
add edx, 0xdb854ff
inc esi
ret
Function at 0x406864
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x406888
xor eax, eax
test eax, eax
je 0x40689b
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x40689b
xor ecx, ecx
jmp 0x40689e
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x4069c1
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x427dac], 0
push esi
jne 0x4069f8
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4069d2
mov dword [ecx*4 + 0x427da8], eax
inc ecx
cmp ecx, 0x100
jl 0x4069cd
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406a29
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x427da8]
xor eax, esi
inc ecx
dec edx
jne 0x406a0b
pop edi
not eax
pop esi
ret 0xc

Function at 0x10003bf0
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xbc
mov dword [ebp - 0x4c], 5
mov eax, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0xa4], eax
push 0x10019044
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
mov dword [ebp - 0xb8], eax
push 0
mov ecx, dword [ebp - 0xb8]
push ecx
push 0x30
mov edx, dword [ebp - 0xbc]
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [0x10019040]
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov ecx, dword [ebp - 0xb8]
mov dword [0x10019040], ecx
lea edx, [ebp - 0xb4]
push edx
mov eax, dword [ebp - 0xbc]
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
push 1
lea ecx, [ebp - 0xb4]
push ecx
mov edx, dword [ebp - 0xbc]
push edx
call dword [sym.imp.USER32.dll_InvalidateRect]
mov eax, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x54], eax
lea ecx, [ebp - 0x50]
push ecx
push 1
push 0
push str.softwareclasseswordpad.document.1_shellprint
push 0x80000002
call dword [ebp - 0x54]
test eax, eax
je 0x10003c9e
call fcn.10003bf0
jmp 0x10003cbf
push 0x5148
push 0
call dword [sym.imp.USER32.dll_LoadIconA]
test eax, eax
je 0x10003cb3
xor eax, eax
jmp 0x10003cbf
mov edx, dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [0x10019098], edx
mov esp, ebp
pop ebp
ret
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40de38
nop
mov ecx, 0x3bd906bf
nop
nop
nop
test eax, eax
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x433024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x483809c8
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x1004373
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc dword [eax]
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x22f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x12c], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x12b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x654], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x653]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x504], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x503]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.0100348e
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
mov byte [ebp - 0x358], 0x27
mov byte [ebp - 0x357], 0x2c
mov byte [ebp - 0x356], 0x14
mov byte [ebp - 0x355], 0x55
lea eax, [ebp - 0x36c]
push eax
call fcn.010034c0
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.01003475
add esp, 0xc
mov dword [ebp - 0x3d4], eax
call fcn.010034b0
test byte [ebx + 0x468c4ca], bl
add dword [eax], eax
add byte [ebp - 0x12b7b], cl
call dword [eax - 1]
xchg ebp, eax
sub al, 0xfc
invalid

Function at 0x1005d91
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100a028]
jne 0x1005d9a
ret
jmp 0x1005d9f
push ebp
lea ebp, [esp - 0x2a8]
sub esp, 0x328
mov eax, dword [0x100a028]
mov dword [ebp + 0x2a4], eax
mov eax, dword [0x101b0cc]
test eax, eax
je 0x1005dc3
call eax
cmp dword [0x101b0d0], 0
je 0x1005e0a
push edi
xor eax, eax
and dword [ebp - 0x28], eax
push 0x13
pop ecx
lea edi, [ebp - 0x7c]
rep stosd dword es:[edi], eax
mov ecx, 0xb2
lea edi, [ebp - 0x24]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x80]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x28]
push 0
mov dword [ebp - 0x80], 0xc0000409
mov dword [ebp - 0x2c], eax
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea eax, [ebp - 0x30]
push eax
call dword [0x101b0d0]
pop edi
push 0x502
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp + 0x2a4]
call fcn.01005d91
add ebp, 0x2a8
leave
ret
Function at 0x100702b
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
mov eax, esi
shr eax, 2
test eax, eax
push edi
mov edi, dword [esp + 0x14]
jle 0x1007066
push ebx
movzx edx, byte [ecx]
xor ebx, ebx
inc ecx
mov bh, byte [ecx]
or edx, ebx
inc ecx
movzx ebx, byte [ecx]
shl ebx, 0x10
or edx, ebx
inc ecx
movzx ebx, byte [ecx]
shl ebx, 0x18
or edx, ebx
inc ecx
xor edi, edx
dec eax
jne 0x1007043
pop ebx
and esi, 3
xor eax, eax
dec esi
je 0x1007082
dec esi
je 0x100707b
dec esi
jne 0x1007087
movzx eax, byte [ecx]
shl eax, 0x10
inc ecx
xor edx, edx
mov dh, byte [ecx]
or eax, edx
inc ecx
movzx ecx, byte [ecx]
or eax, ecx
xor eax, edi
pop edi
pop esi
ret 0xc
Function at 0x4037c0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x4b7134]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0
push 0
push 1
mov esi, ecx
push 0
mov dword [ebp - 0x18], esi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov edi, eax
mov dword [ebx + 4], edi
test edi, edi
jne 0x403828
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [ebx]
mov ecx, ebx
push 1
mov esi, eax
call dword [edx]
test esi, esi
mov dword [ebp - 8], edi
xorps xmm0, xmm0
mov dword [ebp - 8], 0x4a6fd0
movq qword [ebp - 0x10], xmm0
setne byte [ebp - 0xc]
mov dword [ebp - 0x10], esi
test esi, esi
jne 0x403916
mov esi, dword [ebp - 0x18]
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 8], eax
mov dword [ebx + 8], eax
cmp dword [esi + 8], 0
jne 0x40387c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [ebx]
mov ecx, ebx
push 1
mov esi, eax
call dword [edx]
test esi, esi
mov dword [ebp - 8], 0
xorps xmm0, xmm0
mov dword [ebp - 8], 0x4a6fd0
movq qword [ebp - 0x10], xmm0
setne byte [ebp - 0xc]
mov dword [ebp - 0x10], esi
test esi, esi
jne 0x403923
mov esi, dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
push 0
push ebx
push 0x403940
push 0
push 0
call fcn.00468df8
add esp, 0x18
mov dword [esi + 4], eax
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x4038f3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [ebx]
mov ecx, ebx
push 1
mov dword [ebp - 0x1c], eax
call dword [edx]
test edi, edi
je 0x4038c0
push edi
call esi
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 8]
test eax, eax
je 0x4038cd
push eax
call esi
mov eax, dword [ebp - 0x1c]
xorps xmm0, xmm0
test eax, eax
movq qword [ebp - 0x10], xmm0
mov dword [ebp - 8], 0
setne byte [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], 0x4a6fd0
test eax, eax
jne 0x403930
test edi, edi
je 0x403903
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push edi
call esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0045d1c0
mov esp, ebp
pop ebp
ret 8
mov edx, str.thread.entry_event
lea ecx, [ebp - 0x10]
call fcn.00403480
mov edx, str.thread.exit_event
lea ecx, [ebp - 0x10]
call fcn.00403480
mov edx, str.thread
lea ecx, [ebp - 0x10]
call fcn.00403480
int3

Function at 0x4039c0
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x4b7134]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov esi, eax
cmp esi, 0xffffffff
jne 0x403a07
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov dword [ebp - 8], 0
xorps xmm0, xmm0
mov dword [ebp - 8], 0x4a6fd0
movq qword [ebp - 0x10], xmm0
setne byte [ebp - 0xc]
mov dword [ebp - 0x10], eax
test eax, eax
jne 0x403a18
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0045d1c0
mov esp, ebp
pop ebp
ret
mov edx, 0x4a4874
lea ecx, [ebp - 0x10]
call fcn.00403480
int3
Function at 0x403d20
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x4b7134]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
mov esi, ecx
push edi
mov edi, dword [esi + 0x68]
mov dword [esi], vtable.boost::asio::detail::scheduler.0
test edi, edi
je 0x403db3
mov eax, dword [edi + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [edi + 4]
push 0xffffffffffffffff
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push 0
push eax
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
push dword [edi + 8]
call ebx
xor eax, eax
mov ecx, 0x4beef4
lock xadd dword [ecx], eax
mov ecx, dword [edi + 4]
push 0
push ecx
test eax, eax
je 0x403d86
call dword [sym.imp.KERNEL32.dll_TerminateThread]
jmp 0x403d9c
push fcn.00403670
call dword [sym.imp.KERNEL32.dll_QueueUserAPC]
push 0xffffffffffffffff
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edi, dword [esi + 0x68]
test edi, edi
je 0x403db3
push dword [edi + 4]
call ebx
push 0xc
push edi
call fcn.0045d669
add esp, 8
lea ecx, [esi + 0x58]
call fcn.00415c10
push dword [esi + 0x34]
call ebx
push dword [esi + 0x38]
call ebx
lea eax, [esi + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
test byte [ebp + 8], 1
mov dword [esi], vtable.boost::asio::execution_context::service.0
je 0x403de6
push 0x6c
push esi
call fcn.0045d669
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0045d1c0
mov esp, ebp
pop ebp
ret 4
Function at 0x403e10
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x483dad
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x4b7134]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp byte [esi + 0x30], 0
lea edi, [esi + 0x18]
mov dword [ebp - 0x28], edi
je 0x403e54
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov bl, 1
jmp 0x403e56
xor bl, bl
mov byte [ebp - 0x24], bl
mov dword [ebp - 4], 0
cmp dword [esi + 0x68], 0
mov byte [esi + 0x61], 1
je 0x403e91
mov byte [esi + 0x60], 1
cmp byte [edi + 0x18], 0
je 0x403e81
push dword [esi + 0x34]
or dword [esi + 0x3c], 1
call dword [sym.imp.KERNEL32.dll_SetEvent]
cmp byte [esi + 0x50], 0
jne 0x403e91
cmp dword [esi + 0x40], 0
je 0x403e91
mov byte [esi + 0x50], 1
test bl, bl
je 0x403ea7
cmp byte [edi + 0x18], 0
je 0x403ea2
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor bl, bl
mov byte [ebp - 0x24], bl
mov ecx, dword [esi + 0x68]
mov dword [ebp - 0x20], ecx
test ecx, ecx
je 0x403f3d
mov eax, dword [ecx + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ecx + 4]
push 0xffffffffffffffff
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x18]
push 0
push eax
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov eax, dword [ebp - 0x20]
push dword [eax + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, 0x4beef4
lock xadd dword [ecx], eax
mov ecx, dword [ebp - 0x20]
push 0
mov ecx, dword [ecx + 4]
push ecx
test eax, eax
je 0x403efd
call dword [sym.imp.KERNEL32.dll_TerminateThread]
jmp 0x403f16
push fcn.00403670
call dword [sym.imp.KERNEL32.dll_QueueUserAPC]
mov eax, dword [ebp - 0x20]
push 0xffffffffffffffff
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esi + 0x68]
mov dword [ebp - 0x20], eax
test eax, eax
je 0x403f36
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xc
push dword [ebp - 0x20]
call fcn.0045d669
add esp, 8
mov dword [esi + 0x68], 0
mov eax, dword [esi + 0x58]
test eax, eax
je 0x403f8a
lea edx, [esi + 0x44]
mov ecx, dword [eax]
mov dword [esi + 0x58], ecx
test ecx, ecx
jne 0x403f53
mov dword [esi + 0x5c], ecx
mov dword [eax], 0
cmp eax, edx
je 0x403f83
push 0
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0
push ecx
push eax
mov eax, dword [eax + 4]
push 0
mov byte [ebp - 0x18], 0
mov dword [ebp - 0x14], 0x4a6fd0
call eax
add esp, 0x10
lea edx, [esi + 0x44]
mov eax, dword [esi + 0x58]
test eax, eax
jne 0x403f47
mov dword [esi + 0x40], 0
test bl, bl
je 0x403f9c
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045d1c0
mov esp, ebp
pop ebp
ret
Function at 0x403fc0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x483dfd
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x4b7134]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x48], 0
mov byte [ebp - 0x44], 0
movq xmm0, qword [ebp - 0x48]
movq qword [ebx], xmm0
mov dword [ebx + 8], 0x4a6fd0
mov eax, dword [esi + 0x54]
lea edi, [esi + 0x18]
test eax, eax
jne 0x404060
cmp byte [edi + 0x18], al
je 0x404025
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov bl, 1
jmp 0x404027
xor bl, bl
mov byte [esi + 0x60], 1
cmp byte [edi + 0x18], 0
je 0x40403e
push dword [esi + 0x34]
or dword [esi + 0x3c], 1
call dword [sym.imp.KERNEL32.dll_SetEvent]
cmp byte [esi + 0x50], 0
jne 0x40404e
cmp dword [esi + 0x40], 0
je 0x40404e
mov byte [esi + 0x50], 1
test bl, bl
je 0x404059
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
jmp 0x404165
xorps xmm0, xmm0
mov dword [ebp - 0x2c], 0
movups xmmword [ebp - 0x3c], xmm0
mov ecx, esi
mov dword [ebp - 4], 0
push dword [0x4bef7c]
neg ecx
movq qword [ebp - 0x24], xmm0
lea eax, [esi + 0x14]
mov dword [ebp - 0x28], 0
sbb ecx, ecx
mov dword [ebp - 0x1c], 0
and ecx, eax
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x24]
push eax
push dword [0x4bef7c]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
cmp byte [edi + 0x18], 0
mov dword [ebp - 0x18], edi
je 0x4040d1
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [ebp - 0x14], 1
jmp 0x4040d5
mov byte [ebp - 0x14], 0
push ebx
lea eax, [ebp - 0x3c]
mov byte [ebp - 4], 2
push eax
lea eax, [ebp - 0x18]
mov ecx, esi
push eax
xor edi, edi
call fcn.004041c0
test eax, eax
je 0x404129
nop
cmp edi, 0xffffffff
lea eax, [edi + 1]
cmove eax, edi
mov edi, eax
mov eax, dword [ebp - 0x18]
cmp byte [eax + 0x18], 0
je 0x404115
cmp byte [ebp - 0x14], 0
jne 0x404115
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [ebp - 0x14], 1
push ebx
lea eax, [ebp - 0x3c]
mov ecx, esi
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.004041c0
test eax, eax
jne 0x4040f0
cmp byte [ebp - 0x14], 0
je 0x404138
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push dword [ebp - 0x1c]
push dword [0x4bef7c]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
lea ecx, [ebp - 0x30]
call fcn.00415c10
xor esi, esi
push dword [ebp + esi*4 - 0x3c]
call fcn.0044ac60
inc esi
add esp, 4
cmp esi, 3
jl 0x404151
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045d1c0
mov esp, ebp
pop ebp
ret 4