joyce8/EMBER2024-capa huggingface dataset:
Function at 0x439390
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x408
push ebx
push ebp
push esi
mov esi, dword [esp + 0x418]
push edi
mov ebx, ecx
movzx edi, word [ebx]
sub edi, dword [esi + 0x654]
mov dword [esp + 0x14], ebx
push edi
push esi
call fcn.004374f0
mov dl, byte [esi + 0xa6c]
mov dword [esp + 0x10], eax
mov eax, dword [ebx + 4]
sub eax, 6
lea ebp, [esp + 0x18]
xor ecx, ecx
lea ecx, [ecx]
movzx ebx, byte [eax + 6]
add eax, 6
cmp byte [ebx + esi + 0x66c], dl
je 0x4393d0
movzx ebx, byte [eax + 1]
mov dword [ebp], eax
add ecx, ebx
add ebp, 4
sub edi, 1
jne 0x4393d0
add dword [esi + 0x4a84], ecx
mov eax, dword [esi + 0x4a78]
xor edx, edx
div dword [esi + 0x4a84]
xor edx, edx
mov edi, eax
mov eax, dword [esi + 0x4a74]
sub eax, dword [esi + 0x4a70]
mov dword [esi + 0x4a78], edi
div edi
mov ebx, dword [esi + 0x4a84]
cmp eax, ebx
jl 0x439436
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x408
ret 4
cmp eax, ecx
mov edx, dword [esp + 0x18]
lea edi, [esp + 0x18]
jge 0x4394b3
movzx ecx, byte [edx + 1]
cmp ecx, eax
jg 0x439460
lea ebx, [ebx]
mov edx, dword [edi + 4]
movzx ebx, byte [edx + 1]
add edi, 4
add ecx, ebx
cmp ecx, eax
jle 0x439450
mov edi, dword [esp + 0x10]
mov dword [esi + 0x4a80], ecx
movzx eax, byte [edx + 1]
sub ecx, eax
mov dword [esi + 0x4a7c], ecx
mov cl, byte [edi + 2]
cmp cl, 7
jae 0x439499
add byte [edi + 3], 0xff
jne 0x439499
mov ax, word [edi]
add ax, ax
mov word [edi], ax
mov al, 3
shl al, cl
inc cl
mov byte [edi + 2], cl
mov byte [edi + 3], al
mov ecx, dword [esp + 0x14]
push edx
push esi
call fcn.00439200
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x408
ret 4
mov edi, dword [esp + 0x14]
mov dword [esi + 0x4a7c], ecx
mov dword [esi + 0x4a80], ebx
movzx ecx, word [edi]
sub ecx, dword [esi + 0x654]
lea eax, [esp + 0x18]
sub eax, 4
mov edx, dword [eax + 4]
movzx edx, byte [edx]
mov bl, byte [esi + 0xa6c]
add eax, 4
sub ecx, 1
mov byte [edx + esi + 0x66c], bl
jne 0x4394d3
mov cx, word [esi + 0x4a84]
mov eax, dword [esp + 0x10]
add word [eax], cx
movzx edx, word [edi]
pop edi
mov dword [esi + 0x654], edx
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x408
ret 4

Function at 0x43e316
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4537b0]
jne 0x43e320
repz ret
jmp fcn.00441a28
Function at 0x440aff
Capabilities:
Accept command line arguments
Parse pe header
Terminate process

Disassembly:
push 0x14
push 0x44ffc8
call fcn.00441810
mov eax, 0x5a4d
cmp word [0x400000], ax
jne 0x4409ff
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x4409ff
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x4409ff
cmp dword [eax + 0x400074], 0xe
jbe 0x4409ff
xor ecx, ecx
cmp dword [eax + 0x4000e8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
jmp 0x440a03
and dword [ebp - 0x1c], 0
push 1
call fcn.00440b88
pop ecx
test eax, eax
jne 0x440a17
push 0x1c
call fcn.00440989
pop ecx
call fcn.00443d49
test eax, eax
jne 0x440a28
push 0x10
call fcn.00440989
pop ecx
call fcn.00445312
and dword [ebp - 4], 0
call fcn.004461e1
test eax, eax
jge 0x440a42
push 0x1b
call fcn.0043fb92
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x464504], eax
call fcn.004460ac
mov dword [0x462938], eax
call fcn.00445ff3
test eax, eax
jge 0x440a68
push 8
call fcn.0043fb92
pop ecx
call fcn.00445dad
test eax, eax
jge 0x440a79
push 9
call fcn.0043fb92
pop ecx
push 1
call fcn.0043fc3b
pop ecx
test eax, eax
je 0x440a8c
push eax
call fcn.0043fb92
pop ecx
mov eax, dword [0x46290c]
mov dword [0x462910], eax
push eax
push dword [0x462904]
push dword [0x462900]
call main
add esp, 0xc
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x1c], 0
jne 0x440aba
push eax
call fcn.0043fdf9
call fcn.0043fe1b
jmp 0x440aef
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x20]
call fcn.00441855
ret
call fcn.00446435
jmp 0x4409ad

Function at 0x442679
Capabilities:
Terminate process

Disassembly:
push ebp
lea ebp, [esp - 0x2a8]
sub esp, 0x328
mov eax, dword [0x4537b0]
xor eax, ebp
mov dword [ebp + 0x2a4], eax
and dword [ebp - 0x80], 0
push ebx
push 0x4c
lea eax, [ebp - 0x7c]
push 0
push eax
call fcn.0043e830
lea eax, [ebp - 0x80]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x28]
add esp, 0xc
mov dword [ebp - 0x2c], eax
mov dword [ebp + 0x88], eax
mov dword [ebp + 0x84], ecx
mov dword [ebp + 0x80], edx
mov dword [ebp + 0x7c], ebx
mov dword [ebp + 0x78], esi
mov dword [ebp + 0x74], edi
mov word [ebp + 0xa0], ss
mov word [ebp + 0x94], cs
mov word [ebp + 0x70], ds
mov word [ebp + 0x6c], es
mov word [ebp + 0x68], fs
mov word [ebp + 0x64], gs
pushfd
pop dword [ebp + 0x98]
mov eax, dword [ebp + 0x2ac]
lea ecx, [ebp + 0x2ac]
mov dword [ebp - 0x28], 0x10001
mov dword [ebp + 0x90], eax
mov dword [ebp + 0x9c], ecx
mov ecx, dword [ecx - 4]
mov dword [ebp + 0x8c], ecx
mov dword [ebp - 0x80], 0xc0000417
mov dword [ebp - 0x7c], 1
mov dword [ebp - 0x74], eax
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
push 0
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
test eax, eax
jne 0x442758
test ebx, ebx
jne 0x442758
push 2
call fcn.0044661f
pop ecx
push 0xc0000417
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp + 0x2a4]
xor ecx, ebp
pop ebx
call fcn.0043e316
add ebp, 0x2a8
leave
ret
Function at 0x442780
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push dword [0x462dcc]
call fcn.004439bd
pop ecx
test eax, eax
je 0x442796
pop ebp
jmp eax
push 2
call fcn.0044661f
pop ecx
pop ebp
jmp fcn.00442679

Function at 0x4427a4
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x453ab8]
je 0x4427bf
inc edi
cmp edi, 0x17
jb 0x4427b0
cmp edi, 0x17
jae 0x44293f
push ebp
push 3
call fcn.00447460
pop ecx
cmp eax, 1
je 0x44290b
push 3
call fcn.00447460
pop ecx
test eax, eax
jne 0x4427f3
cmp dword [0x453810], 1
je 0x44290b
cmp ebx, 0xfc
je 0x44293e
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x462dd0
push ebp
call fcn.00444e20
add esp, 0xc
test eax, eax
je 0x442829
push esi
push esi
push esi
push esi
push esi
call fcn.00442679
add esp, 0x14
push 0x104
mov esi, 0x462de9
push esi
push 0
mov byte [0x462eed], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x44286d
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.00444e20
add esp, 0xc
test eax, eax
je 0x44286d
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.00442679
add esp, 0x14
push esi
call fcn.00444d00
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4428b2
push esi
call fcn.00444d00
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x4630e4
push 0x44d33c
sub ecx, eax
push ecx
push eax
call fcn.004473ad
add esp, 0x14
test eax, eax
je 0x4428b2
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.00442679
add esp, 0x14
jmp 0x4428b4
xor esi, esi
push 0x44d338
push ebx
push ebp
call fcn.0044733c
add esp, 0xc
test eax, eax
je 0x4428d4
push esi
push esi
push esi
push esi
push esi
call fcn.00442679
add esp, 0x14
push dword [edi*8 + 0x453abc]
push ebx
push ebp
call fcn.0044733c
add esp, 0xc
test eax, eax
je 0x4428f6
push esi
push esi
push esi
push esi
push esi
call fcn.00442679
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.004471d5
add esp, 0xc
jmp 0x44293e
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x44293e
cmp ebp, 0xffffffff
je 0x44293e
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x453abc]
push dword [esi]
call fcn.00444d00
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x443d49
Capabilities:
Allocate thread local storage
Set thread local storage value

Disassembly:
push esi
push edi
mov esi, str.KERNEL32.DLL
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x443d62
push esi
call fcn.0043fb2d
pop ecx
mov edi, eax
test edi, edi
je 0x443eca
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.FlsAlloc
push edi
call esi
push str.FlsGetValue
push edi
mov dword [0x4630e4], eax
call esi
push str.FlsSetValue
push edi
mov dword [0x4630e8], eax
call esi
push str.FlsFree
push edi
mov dword [0x4630ec], eax
call esi
cmp dword [0x4630e4], 0
mov esi, dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [0x4630f0], eax
je 0x443dcb
cmp dword [0x4630e8], 0
je 0x443dcb
cmp dword [0x4630ec], 0
je 0x443dcb
test eax, eax
jne 0x443def
mov eax, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [0x4630e8], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsFree]
mov dword [0x4630e4], 0x443a2c
mov dword [0x4630ec], esi
mov dword [0x4630f0], eax
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x453b98], eax
cmp eax, 0xffffffff
je 0x443ecf
push dword [0x4630e8]
push eax
call esi
test eax, eax
je 0x443ecf
call fcn.0043fe39
push dword [0x4630e4]
call fcn.00443945
push dword [0x4630e8]
mov dword [0x4630e4], eax
call fcn.00443945
push dword [0x4630ec]
mov dword [0x4630e8], eax
call fcn.00443945
push dword [0x4630f0]
mov dword [0x4630ec], eax
call fcn.00443945
add esp, 0x10
mov dword [0x4630f0], eax
call fcn.00440bb2
test eax, eax
je 0x443eca
push 0x443c1a
push dword [0x4630e4]
call fcn.004439bd
pop ecx
call eax
mov dword [0x453b94], eax
cmp eax, 0xffffffff
je 0x443eca
push 0x214
push 1
call fcn.0044518c
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x443eca
push esi
push dword [0x453b94]
push dword [0x4630ec]
call fcn.004439bd
pop ecx
call eax
test eax, eax
je 0x443eca
push 0
push esi
call fcn.00443aa4
pop ecx
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
or dword [esi + 4], 0xffffffff
mov dword [esi], eax
xor eax, eax
inc eax
jmp 0x443ed1
call fcn.00443a67
xor eax, eax
pop edi
pop esi
ret

Function at 0x445380
Capabilities:
Parse pe header

Disassembly:
mov ecx, dword [esp + 4]
mov eax, 0x5a4d
cmp word [ecx], ax
je 0x445391
xor eax, eax
ret
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x44538e
xor edx, edx
mov ecx, 0x10b
cmp word [eax + 0x18], cx
sete dl
mov eax, edx
ret

Function at 0x4453b0
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
push ebx
push esi
movzx esi, word [ecx + 6]
xor edx, edx
push edi
lea eax, [eax + ecx + 0x18]
test esi, esi
jbe 0x4453ea
mov edi, dword [esp + 0x14]
mov ecx, dword [eax + 0xc]
cmp edi, ecx
jb 0x4453e2
mov ebx, dword [eax + 8]
add ebx, ecx
cmp edi, ebx
jb 0x4453ec
inc edx
add eax, 0x28
cmp edx, esi
jb 0x4453d2
xor eax, eax
pop edi
pop esi
pop ebx
ret
Function at 0x4460ac
Capabilities:
Query environment variable

Disassembly:
push ecx
push ecx
mov eax, dword [0x463278]
push ebx
push ebp
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebx, ebx
xor esi, esi
push 2
pop ebp
cmp eax, ebx
jne 0x4460f5
call edi
mov esi, eax
cmp esi, ebx
je 0x4460dc
mov dword [0x463278], 1
jmp 0x4460fe
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x4460f0
mov eax, ebp
mov dword [0x463278], eax
jmp 0x4460f5
mov eax, dword [0x463278]
cmp eax, 1
jne 0x446182
cmp esi, ebx
jne 0x446111
call edi
mov esi, eax
cmp esi, ebx
jne 0x446111
xor eax, eax
jmp 0x4461da
mov eax, esi
cmp word [esi], bx
je 0x446126
add eax, ebp
cmp word [eax], bx
jne 0x446118
add eax, ebp
cmp word [eax], bx
jne 0x446118
mov edi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push ebx
push ebx
push ebx
sub eax, esi
push ebx
sar eax, 1
inc eax
push eax
push esi
push ebx
push ebx
mov dword [esp + 0x34], eax
call edi
mov ebp, eax
cmp ebp, ebx
je 0x446177
push ebp
call fcn.0044514c
pop ecx
mov dword [esp + 0x10], eax
cmp eax, ebx
je 0x446177
push ebx
push ebx
push ebp
push eax
push dword [esp + 0x24]
push esi
push ebx
push ebx
call edi
test eax, eax
jne 0x446173
push dword [esp + 0x10]
call fcn.0043e06d
pop ecx
mov dword [esp + 0x10], ebx
mov ebx, dword [esp + 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
jmp 0x4461da
cmp eax, ebp
je 0x44618a
cmp eax, ebx
jne 0x44610a
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov esi, eax
cmp esi, ebx
je 0x44610a
cmp byte [esi], bl
je 0x4461a8
inc eax
cmp byte [eax], bl
jne 0x44619e
inc eax
cmp byte [eax], bl
jne 0x44619e
sub eax, esi
inc eax
mov ebp, eax
push ebp
call fcn.0044514c
mov edi, eax
pop ecx
cmp edi, ebx
jne 0x4461c6
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
jmp 0x44610a
push ebp
push esi
push edi
call fcn.0043e4c0
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
Function at 0x4471d5
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004439b4
and dword [ebp - 4], 0
cmp dword [0x463280], 0
mov ebx, eax
jne 0x447284
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x447335
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x447335
push eax
call fcn.00443945
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x463280], eax
call esi
push eax
call fcn.00443945
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x463284], eax
call esi
push eax
call fcn.00443945
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x463288], eax
call esi
push eax
call fcn.00443945
pop ecx
mov dword [0x463290], eax
test eax, eax
je 0x447284
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00443945
pop ecx
mov dword [0x46328c], eax
mov eax, dword [0x46328c]
cmp eax, ebx
je 0x4472dc
cmp dword [0x463290], ebx
je 0x4472dc
push eax
call fcn.004439bd
push dword [0x463290]
mov esi, eax
call fcn.004439bd
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4472dc
test edi, edi
je 0x4472dc
call esi
test eax, eax
je 0x4472d3
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4472d3
test byte [ebp - 0xc], 1
jne 0x4472dc
or dword [ebp + 0x10], 0x200000
jmp 0x447315
mov eax, dword [0x463284]
cmp eax, ebx
je 0x447315
push eax
call fcn.004439bd
pop ecx
test eax, eax
je 0x447315
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x447315
mov eax, dword [0x463288]
cmp eax, ebx
je 0x447315
push eax
call fcn.004439bd
pop ecx
test eax, eax
je 0x447315
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x463280]
call fcn.004439bd
pop ecx
test eax, eax
je 0x447335
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x447337
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40f197
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x419794]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.0040a16b
mov dword [ebp - 0x14], eax
cmp dword [0x430c5c], esi
jne 0x40f28a
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40f217
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40f36a
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40f36a
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40f36a
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x430c5c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x430c60], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x430c64], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x430c6c], eax
test eax, eax
je 0x40f287
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x430c68], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40f2af
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40f2a2
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40f2c4
push 4
pop eax
jmp 0x40f36c
cmp dword [ebp - 0x14], esi
je 0x40f2c4
push dword [0x430c5c]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40f2a9
mov eax, dword [0x430c68]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40f322
cmp dword [0x430c6c], edi
je 0x40f322
push eax
call ebx
push dword [0x430c6c]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40f322
test eax, eax
je 0x40f322
call ecx
test eax, eax
je 0x40f317
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40f317
test byte [ebp - 8], 1
jne 0x40f322
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40f352
mov eax, dword [0x430c60]
cmp eax, edi
je 0x40f34f
push eax
call ebx
test eax, eax
je 0x40f34f
call eax
mov esi, eax
test esi, esi
je 0x40f34f
mov eax, dword [0x430c64]
cmp eax, edi
je 0x40f34f
push eax
call ebx
test eax, eax
je 0x40f34f
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x430c5c]
call ebx
test eax, eax
je 0x40f36a
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40f36c
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040482b
mov esp, ebp
pop ebp
ret
Function at 0x11107dfa
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x111130b0]
jne 0x11107e04
repz ret
jmp fcn.111083ea
Function at 0x111177e0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 0xc], 0
jmp 0x11117805
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
cmp edx, dword [ebp + 0xc]
jae 0x11117878
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0xc]
movzx ecx, byte [eax]
movzx edx, byte [ebp - 8]
xor ecx, edx
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 8]
shr eax, 8
mov dword [ebp - 8], eax
mov dword [ebp - 0x14], 0
jmp 0x1111783a
mov ecx, dword [ebp - 0x14]
add ecx, 1
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 8
jge 0x1111786d
mov edx, dword [ebp - 0x10]
and edx, 1
neg edx
sbb edx, edx
neg edx
mov byte [ebp - 0x15], dl
mov eax, dword [ebp - 0x10]
shr eax, 1
mov dword [ebp - 0x10], eax
movzx ecx, byte [ebp - 0x15]
test ecx, ecx
je 0x1111786b
mov edx, dword [ebp - 0x10]
xor edx, 0xedb88320
mov dword [ebp - 0x10], edx
jmp 0x11117831
mov eax, dword [ebp - 8]
xor eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
jmp 0x111177fc
mov eax, dword [ebp - 8]
not eax
mov esp, ebp
pop ebp
ret
Function at 0x71a213bb
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push esi
mov esi, ecx
push dword [esi + 0x34]
and dword [esi + 0xc], 0
call fcn.71a2136d
push dword [esi + 0x38]
call fcn.71a2136d
push dword [esi + 0x54]
call fcn.71a2136d
add esp, 0xc
push 0
push dword [0x71a34048]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
push dword [esi + 0x10]
call dword [sym.imp.WS2HELP.dll_WahCloseThread]
and dword [esi + 0x10], 0
and dword [esi + 0x40], 0
pop esi
ret

Function at 0x71a22f51
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
xor edi, edi
cmp dword [0x71a34050], 0x71a22c29
jne 0x71a23cf2
cmp dword [0x71a34054], edi
je 0x71a23cf2
push dword [0x71a34048]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, edi
mov dword [ebp - 8], eax
je 0x71a23cf2
mov dword [ebp - 4], edi
push dword [ebp + 8]
call fcn.71a22e2e
mov esi, eax
cmp esi, edi
je 0x71a2b6c7
mov eax, dword [ebp + 0x10]
push ebx
lea ecx, [ebp - 4]
push ecx
push dword [ebp - 8]
lea ecx, [ebp + 8]
push edi
push edi
push dword [ebp + 0x1c]
mov dword [ebp - 0x10], eax
push dword [ebp + 0x18]
mov eax, dword [ebp + 0xc]
push dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [esi + 0xc]
push ecx
push 1
lea ecx, [ebp - 0x10]
push ecx
push dword [ebp + 8]
call dword [eax + 0x6c]
mov ecx, esi
mov ebx, eax
call fcn.71a22e13
cmp ebx, edi
pop ebx
jne 0x71a2b6b9
mov eax, dword [ebp + 8]
pop edi
pop esi
leave
ret 0x18
lea eax, [ebp - 8]
push eax
call fcn.71a23cb3
cmp eax, edi
mov dword [ebp - 4], eax
je 0x71a22f93
jmp 0x71a2b6ce
cmp dword [ebp - 4], edi
jne 0x71a2b6ce
mov dword [ebp - 4], 0x277b
jmp 0x71a2b6ce
mov dword [ebp - 4], 0x2736
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SetLastError]
or eax, 0xffffffff
jmp 0x71a22fec
Function at 0x71a22ff7
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [0x71a34050], 0x71a22c29
push esi
jne 0x71a2653f
cmp dword [0x71a34054], ebx
je 0x71a2653f
push dword [0x71a34048]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, ebx
mov dword [ebp - 8], eax
je 0x71a2653f
mov dword [ebp - 4], ebx
push dword [ebp + 8]
call fcn.71a22e2e
mov esi, eax
cmp esi, ebx
je 0x71a2b235
mov eax, dword [ebp + 0x10]
push edi
lea ecx, [ebp - 4]
push ecx
push dword [ebp - 8]
lea ecx, [ebp + 0x14]
push ebx
push ebx
push dword [ebp + 0x1c]
mov dword [ebp - 0x10], eax
push dword [ebp + 0x18]
mov eax, dword [ebp + 0xc]
push ecx
lea ecx, [ebp + 8]
push ecx
push 1
lea ecx, [ebp - 0x10]
push ecx
push dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [esi + 0xc]
call dword [eax + 0x5c]
mov ecx, esi
mov edi, eax
call fcn.71a22e13
cmp edi, ebx
pop edi
jne 0x71a2b227
test byte [ebp + 0x15], 0x80
jne 0x71a2b220
mov eax, dword [ebp + 8]
pop esi
pop ebx
leave
ret 0x18
lea eax, [ebp - 8]
push eax
call fcn.71a23cb3
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x71a23039
jmp 0x71a2b23c
mov dword [ebp - 4], 0x2738
cmp dword [ebp - 4], ebx
jne 0x71a2b23c
mov dword [ebp - 4], 0x277b
jmp 0x71a2b23c
mov dword [ebp - 4], 0x2736
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SetLastError]
or eax, 0xffffffff
jmp 0x71a2309d

Function at 0x71a23ec0
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
cmp dword [0x71a34050], 0x71a22c29
push esi
je 0x71a28a5a
lea eax, [ebp - 8]
push eax
call fcn.71a23cb3
test eax, eax
mov dword [ebp - 4], eax
jne 0x71a23f2d
push dword [ebp + 8]
call fcn.71a22e2e
mov esi, eax
test esi, esi
je 0x71a23f42
push edi
lea ecx, [ebp - 4]
push ecx
push dword [ebp - 8]
mov eax, dword [esi + 0xc]
push dword [ebp + 0x28]
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [eax + 0x48]
mov ecx, esi
mov edi, eax
call fcn.71a22e13
test edi, edi
pop edi
je 0x71a23f3e
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SetLastError]
or eax, 0xffffffff
pop esi
leave
ret 0x24
xor eax, eax
jmp 0x71a23f39
mov dword [ebp - 4], 0x2736
jmp 0x71a23f2d
cmp dword [0x71a34054], 0
je 0x71a23ed8
push dword [0x71a34048]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
mov dword [ebp - 8], eax
je 0x71a23ed8
and dword [ebp - 4], 0
jmp 0x71a23ee8

Function at 0x71a242ff
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [edi + 8]
push eax
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov dword [esi + 0x10], edi
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
push dword [0x71a34048]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x71a24338
cmp dword [eax + 0x50], 0
sete al
mov byte [esi + 0x16], al
pop edi
xor eax, eax
pop esi
pop ebp
ret 4