joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41ec46
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ecx
push ebp
push esi
call fcn.0041a785
mov esi, eax
xor ebp, ebp
cmp dword [esi + 0xa8], ebp
je 0x41eb8b
push ebp
push 0xffffe8d5
call sym.AdobeCollabSync.exe_PR_SetError
pop ecx
pop ecx
or eax, 0xffffffff
jmp 0x41ece2
push ebx
push edi
push 0x14
lea eax, [esi + 0xac]
push ebp
push eax
call sub.MSVCR80.dll_memset
mov ebx, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
add esp, 0xc
lea edi, [esi + 0x3c]
push edi
call ebx
mov eax, dword [esi + 0x8c]
test ax, 0x1000
jne 0x41ebdd
test al, 2
je 0x41ebdd
and eax, 0xfffffffd
push ebp
push 0xffffe897
mov dword [esi + 0x8c], eax
call sym.AdobeCollabSync.exe_PR_SetError
pop ecx
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x41ed08
mov ebp, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push edi
mov dword [esi + 0xa0], 1
mov dword [esi], 6
call ebp
lea eax, [esi + 0xac]
push eax
push 0
push accept
push 0
push 2
push dword [esp + 0x2c]
call dword [sym.imp.KERNEL32.dll_LockFileEx]
cmp dword [0x4a8e34], 0
mov dword [esp + 0x10], eax
je 0x41ec5c
push edi
call ebx
mov eax, dword [esi + 0x8c]
xor ebx, ebx
test ax, 0x1000
mov dword [esi + 0xa0], ebx
mov dword [esi], 2
jne 0x41ec43
test al, 2
je 0x41ec43
push ebx
jmp 0x41ec93
push edi
call ebp
cmp dword [esp + 0x10], ebx
jne 0x41ecde
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
jmp 0x41ed1c
test eax, eax
jne 0x41ecb9
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
mov dword [esp + 0x10], eax
je 0x41ece6
push edi
call ebx
mov eax, dword [esi + 0x8c]
and dword [esi + 0xa0], 0
test ax, 0x1000
mov dword [esi], 2
jne 0x41ecaa
test al, 2
je 0x41ecaa
push 0
and eax, 0xfffffffd
push 0xffffe897
mov dword [esi + 0x8c], eax
call sym.AdobeCollabSync.exe_PR_SetError
pop ecx
pop ecx
jmp 0x41ed05
push edi
call ebp
push dword [esp + 0x10]
call fcn.00429849
pop ecx
jmp 0x41ed08
cmp dword [0x4a9fd8], 0
jne 0x41ece6
push dword [esp + 0x18]
call fcn.0041ce88
cmp eax, 1
pop ecx
jne 0x41ece6
and dword [esi + 0xa0], 0
mov dword [esi], 2
xor eax, eax
pop edi
pop ebx
pop esi
pop ebp
pop ecx
ret
push 0xffffffffffffffff
mov eax, esi
call fcn.0041b343
cmp eax, 0xffffffff
pop ecx
jne 0x41ed0d
push edi
call ebx
and dword [esi + 0xa0], 0
mov dword [esi], 2
push edi
call ebp
or eax, 0xffffffff
jmp 0x41ece0
cmp dword [esi + 0xe8], 0
jne 0x41ecde
push dword [esi + 0xf0]
call fcn.00429849
or eax, 0xffffffff
pop ecx
jmp 0x41ece0
Function at 0x41ec8f
Capabilities:
Send data
Send data on socket

Disassembly:
push ecx
push ebp
push esi
call fcn.0041a785
mov esi, eax
xor ebp, ebp
cmp dword [esi + 0xa8], ebp
je 0x41eb8b
push ebp
push 0xffffe8d5
call sym.AdobeCollabSync.exe_PR_SetError
pop ecx
pop ecx
or eax, 0xffffffff
jmp 0x41ece2
push ebx
push edi
push 0x14
lea eax, [esi + 0xac]
push ebp
push eax
call sub.MSVCR80.dll_memset
mov ebx, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
add esp, 0xc
lea edi, [esi + 0x3c]
push edi
call ebx
mov eax, dword [esi + 0x8c]
test ax, 0x1000
jne 0x41ebdd
test al, 2
je 0x41ebdd
and eax, 0xfffffffd
push ebp
push 0xffffe897
mov dword [esi + 0x8c], eax
call sym.AdobeCollabSync.exe_PR_SetError
pop ecx
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x41ed08
mov ebp, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push edi
mov dword [esi + 0xa0], 1
mov dword [esi], 6
call ebp
lea eax, [esi + 0xac]
push eax
push 0
push accept
push 0
push 2
push dword [esp + 0x2c]
call dword [sym.imp.KERNEL32.dll_LockFileEx]
cmp dword [0x4a8e34], 0
mov dword [esp + 0x10], eax
je 0x41ec5c
push edi
call ebx
mov eax, dword [esi + 0x8c]
xor ebx, ebx
test ax, 0x1000
mov dword [esi + 0xa0], ebx
mov dword [esi], 2
jne 0x41ec43
test al, 2
je 0x41ec43
push ebx
jmp 0x41ec93
push edi
call ebp
cmp dword [esp + 0x10], ebx
jne 0x41ecde
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
jmp 0x41ed1c
test eax, eax
jne 0x41ecb9
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
mov dword [esp + 0x10], eax
je 0x41ece6
push edi
call ebx
mov eax, dword [esi + 0x8c]
and dword [esi + 0xa0], 0
test ax, 0x1000
mov dword [esi], 2
jne 0x41ecaa
test al, 2
je 0x41ecaa
push 0
and eax, 0xfffffffd
push 0xffffe897
mov dword [esi + 0x8c], eax
call sym.AdobeCollabSync.exe_PR_SetError
pop ecx
pop ecx
jmp 0x41ed05
push edi
call ebp
push dword [esp + 0x10]
call fcn.00429849
pop ecx
jmp 0x41ed08
cmp dword [0x4a9fd8], 0
jne 0x41ece6
push dword [esp + 0x18]
call fcn.0041ce88
cmp eax, 1
pop ecx
jne 0x41ece6
and dword [esi + 0xa0], 0
mov dword [esi], 2
xor eax, eax
pop edi
pop ebx
pop esi
pop ebp
pop ecx
ret
push 0xffffffffffffffff
mov eax, esi
call fcn.0041b343
cmp eax, 0xffffffff
pop ecx
jne 0x41ed0d
push edi
call ebx
and dword [esi + 0xa0], 0
mov dword [esi], 2
push edi
call ebp
or eax, 0xffffffff
jmp 0x41ece0
cmp dword [esi + 0xe8], 0
jne 0x41ecde
push dword [esi + 0xf0]
call fcn.00429849
or eax, 0xffffffff
pop ecx
jmp 0x41ece0
Function at 0x41ed1d
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ecx
push ebp
push esi
call fcn.0041a785
mov esi, eax
xor ebp, ebp
cmp dword [esi + 0xa8], ebp
je 0x41eb8b
push ebp
push 0xffffe8d5
call sym.AdobeCollabSync.exe_PR_SetError
pop ecx
pop ecx
or eax, 0xffffffff
jmp 0x41ece2
push ebx
push edi
push 0x14
lea eax, [esi + 0xac]
push ebp
push eax
call sub.MSVCR80.dll_memset
mov ebx, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
add esp, 0xc
lea edi, [esi + 0x3c]
push edi
call ebx
mov eax, dword [esi + 0x8c]
test ax, 0x1000
jne 0x41ebdd
test al, 2
je 0x41ebdd
and eax, 0xfffffffd
push ebp
push 0xffffe897
mov dword [esi + 0x8c], eax
call sym.AdobeCollabSync.exe_PR_SetError
pop ecx
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x41ed08
mov ebp, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push edi
mov dword [esi + 0xa0], 1
mov dword [esi], 6
call ebp
lea eax, [esi + 0xac]
push eax
push 0
push accept
push 0
push 2
push dword [esp + 0x2c]
call dword [sym.imp.KERNEL32.dll_LockFileEx]
cmp dword [0x4a8e34], 0
mov dword [esp + 0x10], eax
je 0x41ec5c
push edi
call ebx
mov eax, dword [esi + 0x8c]
xor ebx, ebx
test ax, 0x1000
mov dword [esi + 0xa0], ebx
mov dword [esi], 2
jne 0x41ec43
test al, 2
je 0x41ec43
push ebx
jmp 0x41ec93
push edi
call ebp
cmp dword [esp + 0x10], ebx
jne 0x41ecde
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
jmp 0x41ed1c
test eax, eax
jne 0x41ecb9
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
mov dword [esp + 0x10], eax
je 0x41ece6
push edi
call ebx
mov eax, dword [esi + 0x8c]
and dword [esi + 0xa0], 0
test ax, 0x1000
mov dword [esi], 2
jne 0x41ecaa
test al, 2
je 0x41ecaa
push 0
and eax, 0xfffffffd
push 0xffffe897
mov dword [esi + 0x8c], eax
call sym.AdobeCollabSync.exe_PR_SetError
pop ecx
pop ecx
jmp 0x41ed05
push edi
call ebp
push dword [esp + 0x10]
call fcn.00429849
pop ecx
jmp 0x41ed08
cmp dword [0x4a9fd8], 0
jne 0x41ece6
push dword [esp + 0x18]
call fcn.0041ce88
cmp eax, 1
pop ecx
jne 0x41ece6
and dword [esi + 0xa0], 0
mov dword [esi], 2
xor eax, eax
pop edi
pop ebx
pop esi
pop ebp
pop ecx
ret
push 0xffffffffffffffff
mov eax, esi
call fcn.0041b343
cmp eax, 0xffffffff
pop ecx
jne 0x41ed0d
push edi
call ebx
and dword [esi + 0xa0], 0
mov dword [esi], 2
push edi
call ebp
or eax, 0xffffffff
jmp 0x41ece0
cmp dword [esi + 0xe8], 0
jne 0x41ecde
push dword [esi + 0xf0]
call fcn.00429849
or eax, 0xffffffff
pop ecx
jmp 0x41ece0
Function at 0x41ee29
Capabilities:
Initialize winsock library

Disassembly:
push ecx
push esi
call fcn.0041a785
mov esi, eax
xor ecx, ecx
cmp dword [esi + 0xa8], ecx
je 0x41ed4f
push ecx
push 0xffffe8d5
call sym.AdobeCollabSync.exe_PR_SetError
pop ecx
pop ecx
or eax, 0xffffffff
jmp 0x41ef26
push ebx
push ebp
push edi
push 0x14
lea eax, [esi + 0xac]
push ecx
push eax
call sub.MSVCR80.dll_memset
mov ebp, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
add esp, 0xc
lea edi, [esi + 0x3c]
push edi
call ebp
mov eax, dword [esi + 0x8c]
mov ebx, 0x1000
test ebx, eax
jne 0x41ed87
test al, 2
jne 0x41ee3d
push edi
mov dword [esi + 0xa0], 1
mov dword [esi], 6
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea eax, [esi + 0xac]
push eax
push 0
push accept
push 0
push 3
push dword [esp + 0x2c]
call dword [sym.imp.KERNEL32.dll_LockFileEx]
cmp dword [0x4a8e34], 0
mov dword [esp + 0x10], eax
je 0x41ee06
push edi
call ebp
mov eax, dword [esi + 0x8c]
xor ebp, ebp
test ebx, eax
mov dword [esi + 0xa0], ebp
mov dword [esi], 2
jne 0x41ede9
test al, 2
je 0x41ede9
push ebp
jmp 0x41ee3f
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [esp + 0x10], ebp
jne 0x41ef21
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
jmp 0x41ef16
test eax, eax
jne 0x41ee76
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
mov dword [esp + 0x10], eax
je 0x41eed5
push edi
call ebp
mov eax, dword [esi + 0x8c]
and dword [esi + 0xa0], 0
test ebx, eax
mov dword [esi], 2
jne 0x41ee5d
test al, 2
je 0x41ee5d
push 0
and eax, 0xfffffffd
push 0xffffe897
mov dword [esi + 0x8c], eax
call sym.AdobeCollabSync.exe_PR_SetError
pop ecx
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x41ee6e
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push dword [esp + 0x10]
call fcn.00429849
pop ecx
or eax, 0xffffffff
jmp 0x41ef23
cmp dword [0x4a9fd8], 0
jne 0x41eed5
push dword [esp + 0x18]
call fcn.0041ce88
cmp eax, 1
pop ecx
jne 0x41eed5
push edi
call ebp
mov eax, dword [esi + 0x8c]
and dword [esi + 0xa0], 0
test ebx, eax
mov dword [esi], 2
jne 0x41eed1
test al, 2
je 0x41eed1
and eax, 0xfffffffd
push 0
push 0xffffe897
or ebx, 0xffffffff
mov dword [esi + 0x8c], eax
call sym.AdobeCollabSync.exe_PR_SetError
pop ecx
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, ebx
jmp 0x41ef23
xor ebx, ebx
jmp 0x41eec6
push 0xffffffffffffffff
mov eax, esi
call fcn.0041b343
cmp eax, 0xffffffff
pop ecx
jne 0x41ef07
push edi
call ebp
mov eax, dword [esi + 0x8c]
and dword [esi + 0xa0], 0
test ebx, eax
mov dword [esi], 2
jne 0x41ef02
test al, 2
jne 0x41eeac
or ebx, 0xffffffff
jmp 0x41eec6
cmp dword [esi + 0xe8], 0
jne 0x41ef21
push dword [esi + 0xf0]
call fcn.00429849
or eax, 0xffffffff
pop ecx
jmp 0x41ef23
xor eax, eax
pop edi
pop ebp
pop ebx
pop esi
pop ecx
ret
Function at 0x41ef66
Capabilities:
Connect socket
Set socket configuration

Disassembly:
push esi
xor esi, esi
cmp dword [0x4a9fd0], esi
push edi
mov dword [0x4a9fd4], 1
jbe 0x41ef50
push 0
call fcn.0041b473
inc esi
cmp esi, dword [0x4a9fd0]
pop ecx
jb 0x41ef3f
mov esi, dword [0x4a7c40]
mov edi, 0x4a7c40
jmp 0x41ef6e
mov eax, dword [esi + 0x18]
add eax, 0xac
push eax
call fcn.0041a469
mov esi, dword [esi]
pop ecx
cmp esi, edi
jne 0x41ef5d
pop edi
pop esi
ret

Function at 0x41eff6
Capabilities:
Set socket configuration

Disassembly:
push esi
push 0x2c
push 1
call sym.AdobeCollabSync.exe_PR_Calloc
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x41f011
call fcn.0041ef75
test eax, eax
mov dword [esi + 0x24], eax
jne 0x41f011
push esi
call sym.AdobeCollabSync.exe_PR_Free
pop ecx
xor eax, eax
pop esi
ret
mov eax, esi
pop esi
ret

Function at 0x41f5a5
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x94], 0
je 0x41f5e2
push ebx
push ebp
push edi
push dword [0x4aa0b8]
call sym.AdobeCollabSync.exe_PR_Lock
mov edi, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
pop ecx
lea ebp, [esi + 0x3c]
push ebp
call edi
test byte [esi + 0x8c], 0x80
mov ebx, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [esi], 5
jne 0x41f5bb
mov eax, dword [esi + 0x98]
mov eax, dword [eax + 0x24]
add eax, 0x30
push eax
call edi
mov eax, dword [esi + 0x98]
mov dword [esi + 0x54], 4
mov edx, dword [eax + 0x24]
lea ecx, [esi + 0x64]
add edx, 0x88
mov dword [ecx], edx
mov edx, dword [eax + 0x24]
mov edx, dword [edx + 0x8c]
mov dword [esi + 0x68], edx
mov eax, dword [eax + 0x24]
mov eax, dword [eax + 0x8c]
mov dword [eax], ecx
mov eax, dword [esi + 0x98]
mov eax, dword [eax + 0x24]
mov dword [eax + 0x8c], ecx
mov eax, dword [esi + 0x98]
mov eax, dword [eax + 0x24]
add eax, 0x30
push eax
call ebx
push ebp
call ebx
push dword [esi + 0x94]
call sym.AdobeCollabSync.exe_PR_NotifyCondVar
push dword [0x4aa0b8]
call sym.AdobeCollabSync.exe_PR_Unlock
push 0xffffffffffffffff
push esi
call fcn.0041b0c9
add esp, 0x10
pop edi
pop ebp
pop ebx
pop esi
ret
Function at 0x420bad
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call sym.AdobeCollabSync.exe__PR_CreateThread
add esp, 0x20
pop ebp
ret
Function at 0x420e3e
Capabilities:
Get number of processors
Get thread local storage value
Set thread local storage value

Disassembly:
mov ecx, dword [esp + 8]
cmp ecx, 3
jle 0x420e4c
push 3
pop ecx
jmp 0x420e52
test ecx, ecx
jge 0x420e52
xor ecx, ecx
mov eax, dword [esp + 4]
test byte [eax + 0x8c], 0x80
push ecx
je 0x420e70
mov dword [eax + 4], ecx
add eax, 0xac
push eax
call fcn.0041a48c
jmp 0x420e76
push eax
call fcn.0041fb26
pop ecx
pop ecx
ret

Function at 0x420e79
Capabilities:
Get number of processors
Get thread local storage value
Set thread local storage value

Disassembly:
push ebx
push ebp
push esi
push edi
call fcn.0041a785
push dword [0x4a9fc0]
mov ebx, eax
call sym.AdobeCollabSync.exe_PR_Lock
pop ecx
mov dword [0x4a9720], 1
call fcn.0041a785
mov esi, dword [0x4a7c30]
mov dword [0x4a9724], eax
mov ebp, 0x400
mov edi, 0x4a7c30
jmp 0x420ecc
lea eax, [esi - 0x5c]
cmp ebx, eax
je 0x420eca
test dword [esi + 0x30], ebp
je 0x420eca
lea eax, [esi - 0x5c]
call fcn.0041fdfb
mov esi, dword [esi]
cmp esi, edi
jne 0x420eb6
mov esi, dword [0x4a7c38]
mov edi, 0x4a7c38
jmp 0x420ef5
lea eax, [esi - 0x5c]
cmp ebx, eax
je 0x420ef3
test dword [esi + 0x30], ebp
je 0x420ef3
lea eax, [esi - 0x5c]
push eax
call fcn.0041a751
pop ecx
mov esi, dword [esi]
cmp esi, edi
jne 0x420edd
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x420efe
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebx
push ebp
push esi
push edi
call fcn.0041a785
mov esi, dword [0x4a7c30]
mov ebx, eax
mov ebp, 0x400
mov edi, 0x4a7c30
jmp 0x420f31
lea eax, [esi - 0x5c]
cmp ebx, eax
je 0x420f2f
test dword [esi + 0x30], ebp
je 0x420f2f
lea eax, [esi - 0x5c]
call fcn.00420021
mov esi, dword [esi]
cmp esi, edi
jne 0x420f1b
mov esi, dword [0x4a7c38]
mov edi, 0x4a7c38
jmp 0x420f5a
lea eax, [esi - 0x5c]
cmp ebx, eax
je 0x420f58
test dword [esi + 0x30], ebp
je 0x420f58
lea eax, [esi - 0x5c]
push eax
call fcn.0041a76b
pop ecx
mov esi, dword [esi]
cmp esi, edi
jne 0x420f42
push dword [0x4a9fc0]
and dword [0x4a9724], 0
and dword [0x4a9720], 0
call sym.AdobeCollabSync.exe_PR_Unlock
pop ecx
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x420f7d
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x4a7c30]
and dword [ebp - 4], 0
push ebx
push esi
mov esi, 0x4a7c30
cmp eax, esi
push edi
mov ebx, 0x400
je 0x420fc2
mov edi, dword [eax]
add eax, 0xffffffa4
test dword [eax + 0x8c], ebx
je 0x420fbc
push dword [ebp + 0xc]
push dword [ebp - 4]
push eax
call dword [ebp + 8]
add esp, 0xc
test eax, eax
jne 0x420ff9
inc dword [ebp - 4]
cmp edi, esi
mov eax, edi
jne 0x420f9b
mov eax, dword [0x4a7c38]
mov edi, 0x4a7c38
cmp eax, edi
je 0x420ff7
mov esi, dword [eax]
add eax, 0xffffffa4
test dword [eax + 0x8c], ebx
je 0x420ff1
push dword [ebp + 0xc]
push dword [ebp - 4]
push eax
call dword [ebp + 8]
add esp, 0xc
test eax, eax
jne 0x420ff9
inc dword [ebp - 4]
cmp esi, edi
mov eax, esi
jne 0x420fd0
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4210bf
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [eax + 0x8c]
test dl, 0x30
mov ecx, dword [eax + 0x98]
je 0x42112f
test dl, 0x10
je 0x421115
mov edx, dword [eax + 0x64]
push esi
mov esi, dword [ecx + 0x24]
push edi
lea edi, [esi + 0x6c]
cmp edx, edi
je 0x4210f7
cmp dword [esp + 0x10], 1
jne 0x4210fc
mov ecx, dword [eax + 0x7c]
add dword [edx + 0x18], ecx
jmp 0x42110a
cmp dword [eax + 0x68], edi
je 0x421106
mov edx, dword [eax + 0x7c]
mov ecx, esi
sub dword [ecx + 0x74], edx
jmp 0x42110a
and dword [esi + 0x74], 0
and dword [eax + 0x8c], 0xffffffef
pop edi
pop esi
jmp 0x42111e
and edx, 0xffffffdf
mov dword [eax + 0x8c], edx
mov ecx, dword [eax + 0x68]
mov edx, dword [eax + 0x64]
mov dword [ecx], edx
mov ecx, dword [eax + 0x64]
mov eax, dword [eax + 0x68]
mov dword [ecx + 4], eax
ret
Function at 0x421647
Capabilities:
Get thread local storage value
Resolve function by parsing pe exports
Set thread local storage value

Disassembly:
call sym.AdobeCollabSync.exe_PR_GetCurrentThread
mov ecx, dword [esp + 4]
and dword [eax + 0x30], 0
mov dword [eax + 0x28], ecx
mov ecx, dword [esp + 8]
mov dword [eax + 0x2c], ecx
ret

Function at 0x42185a
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
jne 0x421873
push eax
push 0xffffe891
call sym.AdobeCollabSync.exe_PR_SetError
pop ecx
or eax, 0xffffffff
pop ecx
ret
mov ecx, dword [eax + 4]
push eax
mov dword [ecx], 0x55555555
call fcn.0042a4e0
xor eax, eax
pop ecx
ret

Function at 0x42197a
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0
push dword [esi]
call sym.AdobeCollabSync.exe_PR_GetIdentitiesLayer
test eax, eax
pop ecx
pop ecx
jne 0x42199e
push eax
push 0xffffe89d
call sym.AdobeCollabSync.exe_PR_SetError
or eax, 0xffffffff
jmp 0x4219a9
movzx ecx, word [esi + 6]
push ecx
push eax
call fcn.004218df
pop ecx
pop ecx
pop esi
ret

Function at 0x422304
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov eax, dword [esp + 8]
mov edx, dword [eax]
xor ecx, ecx
test edx, edx
jbe 0x422306
push esi
lea esi, [eax + 4]
push edi
mov edi, dword [esi]
cmp edi, dword [esp + 0xc]
je 0x4222e7
inc ecx
add esi, 4
cmp ecx, edx
jb 0x4222d5
jmp 0x422304
dec edx
cmp ecx, edx
mov esi, ecx
jae 0x422302
lea ecx, [eax + ecx*4 + 4]
mov edx, dword [ecx + 4]
mov dword [ecx], edx
mov edx, dword [eax]
inc esi
add ecx, 4
dec edx
cmp esi, edx
jb 0x4222f2
dec dword [eax]
pop edi
pop esi
ret

Function at 0x422307
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [eax]
xor edx, edx
test ecx, ecx
push esi
jbe 0x422327
add eax, 4
mov esi, dword [eax]
cmp esi, dword [esp + 8]
je 0x42232b
inc edx
add eax, 4
cmp edx, ecx
jb 0x422317
xor eax, eax
pop esi
ret
xor eax, eax
inc eax
pop esi
ret

Function at 0x422330
Capabilities:
Get thread local storage value

Disassembly:
mov ecx, dword [esp + 8]
lea eax, [ecx + 0x1004]
mov edx, dword [eax]
push esi
mov esi, dword [esp + 8]
mov dword [ecx + edx*4 + 0x1008], esi
inc dword [eax]
pop esi
ret

Function at 0x42234c
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov eax, dword [esp + 8]
mov edx, dword [eax + 0x1004]
xor ecx, ecx
test edx, edx
jbe 0x4223a0
push esi
lea esi, [eax + 0x1008]
push edi
mov edi, dword [esi]
cmp edi, dword [esp + 0xc]
je 0x422376
inc ecx
add esi, 4
cmp ecx, edx
jb 0x422364
jmp 0x42239e
dec edx
cmp ecx, edx
mov esi, ecx
jae 0x422398
lea ecx, [eax + ecx*4 + 0x1008]
mov edx, dword [ecx + 4]
mov dword [ecx], edx
mov edx, dword [eax + 0x1004]
inc esi
add ecx, 4
dec edx
cmp esi, edx
jb 0x422384
dec dword [eax + 0x1004]
pop edi
pop esi
ret
Function at 0x4223a1
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [eax + 0x1004]
xor edx, edx
test ecx, ecx
push esi
jbe 0x4223c7
add eax, 0x1008
mov esi, dword [eax]
cmp esi, dword [esp + 8]
je 0x4223cb
inc edx
add eax, 4
cmp edx, ecx
jb 0x4223b7
xor eax, eax
pop esi
ret
xor eax, eax
inc eax
pop esi
ret

Function at 0x4248c0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi + 0x10]
mov ebx, dword [edi + 4]
sar esi, 5
lea ecx, [esi + eax + 1]
mov eax, dword [edi + 8]
mov dword [ebp - 4], ecx
jmp 0x4248dc
inc ebx
add eax, eax
cmp ecx, eax
jg 0x4248d9
call fcn.004243ed
test esi, esi
mov dword [ebp - 0xc], eax
lea edx, [eax + 0x14]
jle 0x4248fd
mov edi, edx
mov ecx, esi
xor eax, eax
rep stosd dword es:[edi], eax
mov edi, dword [ebp + 8]
lea edx, [edx + esi*4]
and dword [ebp + 0xc], 0x1f
mov ecx, dword [edi + 0x10]
lea eax, [edi + 0x14]
lea ecx, [eax + ecx*4]
mov dword [ebp - 8], ecx
je 0x424946
push 0x20
pop esi
sub esi, dword [ebp + 0xc]
and dword [ebp + 8], 0
mov ebx, dword [eax]
mov ecx, dword [ebp + 0xc]
shl ebx, cl
mov ecx, esi
or ebx, dword [ebp + 8]
mov dword [edx], ebx
mov ebx, dword [eax]
shr ebx, cl
add eax, 4
add edx, 4
cmp eax, dword [ebp - 8]
mov ecx, ebx
mov dword [ebp + 8], ecx
jb 0x424919
test ecx, ecx
mov dword [edx], ecx
je 0x424954
inc dword [ebp - 4]
jmp 0x424954
mov esi, dword [eax]
mov dword [edx], esi
add eax, 4
add edx, 4
cmp eax, ecx
jb 0x424946
mov eax, dword [ebp - 4]
mov ebx, dword [ebp - 0xc]
dec eax
mov esi, edi
mov dword [ebx + 0x10], eax
call fcn.00424446
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret
Function at 0x427cad
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
or dword [ebp - 4], 0xffffffff
push esi
push edi
mov esi, eax
xor edi, edi
cmp byte [esi], 0x3a
jne 0x427cba
cmp byte [esi + 1], 0x3a
je 0x427ca9
xor eax, eax
jmp 0x427e95
mov ecx, dword [ebp + 8]
mov word [ecx], di
xor edi, edi
add esi, 2
inc edi
mov dword [ebp - 4], edi
jmp 0x427cbd
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp - 4]
jmp 0x427d32
cmp edi, 8
je 0x427e9e
cmp al, 0x3a
jne 0x427ce6
cmp dword [ebp - 4], 0xffffffff
jne 0x427e9e
and word [ecx + edi*2], 0
inc edi
mov dword [ebp - 4], edi
inc esi
jmp 0x427d32
xor ebx, ebx
xor edx, edx
movzx eax, byte [esi]
mov al, byte [eax + 0x48cbd8]
cmp al, 0x7f
je 0x427d06
shl ebx, 4
movzx eax, al
add ebx, eax
inc esi
inc edx
cmp edx, 4
jl 0x427cea
mov al, byte [esi]
cmp al, 0x2e
je 0x427d3a
cmp al, 0x3a
jne 0x427d1c
inc esi
cmp byte [esi], 0
je 0x427e9e
jmp 0x427d24
test al, al
jne 0x427e9e
push ebx
call sub.WS2_32.dll_htons
mov ecx, dword [ebp + 8]
mov word [ecx + edi*2], ax
inc edi
mov al, byte [esi]
test al, al
jne 0x427cc3
jmp 0x427d42
test edx, edx
je 0x427e9e
cmp byte [esi], 0x2e
jne 0x427e63
cmp edi, 6
jg 0x427e9e
cmp ebx, 0x255
ja 0x427e9e
mov eax, ebx
and eax, 0xf0
cmp eax, 0x90
ja 0x427e9e
mov eax, ebx
and eax, 0xf
cmp al, 9
ja 0x427e9e
mov eax, ebx
shr eax, 8
mov dl, 0xa
imul dl
mov ecx, ebx
shr ecx, 4
and cl, 0xf
add al, cl
mov cl, dl
mov edx, dword [ebp + 8]
imul cl
and bl, 0xf
add al, bl
inc esi
mov byte [edx + edi*2], al
movzx eax, byte [esi]
movzx eax, byte [eax + 0x48cbd8]
inc esi
cmp eax, 9
ja 0x427e9e
mov ebx, 0xff
jmp 0x427dd5
cmp cl, 0x39
ja 0x427ddc
imul eax, eax, 0xa
movzx ecx, cl
lea eax, [eax + ecx - 0x30]
inc esi
cmp eax, ebx
ja 0x427e9e
mov cl, byte [esi]
cmp cl, 0x30
jae 0x427dbd
cmp byte [esi], 0x2e
jne 0x427e9e
mov byte [edx + edi*2 + 1], al
inc edi
inc esi
movzx eax, byte [esi]
movzx eax, byte [eax + 0x48cbd8]
inc esi
cmp eax, 9
jbe 0x427e18
jmp 0x427e9e
cmp cl, 0x39
ja 0x427e1f
imul eax, eax, 0xa
movzx ecx, cl
lea eax, [eax + ecx - 0x30]
inc esi
cmp eax, ebx
ja 0x427e9e
mov cl, byte [esi]
cmp cl, 0x30
jae 0x427e00
cmp byte [esi], 0x2e
jne 0x427e9e
inc esi
lea ecx, [edx + edi*2]
mov byte [ecx], al
movzx eax, byte [esi]
movzx eax, byte [eax + 0x48cbd8]
inc esi
cmp eax, 9
jbe 0x427e50
jmp 0x427e9e
cmp dl, 0x39
ja 0x427e57
imul eax, eax, 0xa
movzx edx, dl
lea eax, [eax + edx - 0x30]
inc esi
cmp eax, ebx
ja 0x427e9e
mov dl, byte [esi]
cmp dl, 0x30
jae 0x427e3c
cmp byte [esi], 0
jne 0x427e9e
mov byte [ecx + 1], al
mov ecx, dword [ebp + 8]
inc edi
mov edx, dword [ebp - 4]
cmp edx, 0xffffffff
je 0x427e99
sub edi, edx
push 7
pop eax
je 0x427e8c
add edx, edi
lea edx, [ecx + edx*2]
dec edx
dec edx
mov si, word [edx]
mov word [ecx + eax*2], si
dec eax
dec edi
jne 0x427e77
jmp 0x427e8c
and word [ecx + eax*2], 0
dec eax
cmp eax, dword [ebp - 4]
jge 0x427e86
xor eax, eax
inc eax
pop ebx
pop edi
pop esi
leave
ret
cmp edi, 8
je 0x427e91
xor eax, eax
jmp 0x427e94