joyce8/EMBER2024-capa huggingface dataset:
Function at 0x479e79
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
je 0x479ebf
call fcn.004701ac
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x479ebf
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
mov dword [ebp - 4], eax
je 0x479f02
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], 1
je 0x479eeb
push dword [ebp + 0x10]
mov eax, dword [edi]
push ebx
push esi
mov ecx, edi
call dword [eax + 0x20]
cmp dword [ebp - 4], 0
mov dword [ebp + 0xc], eax
je 0x479eeb
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [esi + 0x4c], 0
je 0x479eff
mov ecx, dword [esi + 0x4c]
push dword [ebp + 0x10]
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x47b384
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x4d4684]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0x800
push ebx
push esi
mov esi, ecx
mov ebx, edx
lea eax, [ebp - 0x11c]
jne 0x47b3c4
push 0x4af608
push 4
push eax
call fcn.0048c444
push eax
call fcn.00403337
add esp, 0x10
jmp 0x47b3d6
push 4
push eax
push 3
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x47b444
push edi
call fcn.0048b947
mov edi, dword [eax]
call fcn.0048b947
and dword [eax], 0
lea eax, [ebp - 0x11c]
push eax
push ebx
push esi
push 0x111
mov esi, 0x112
lea eax, [ebp - 0x118]
push esi
push eax
call fcn.0048acb1
add esp, 0x18
mov ebx, eax
call fcn.0048b947
cmp dword [eax], 0
je 0x47b424
call fcn.0048b947
push dword [eax]
call fcn.0046631d
pop ecx
jmp 0x47b42b
call fcn.0048b947
mov dword [eax], edi
cmp ebx, 0xffffffff
pop edi
je 0x47b444
cmp ebx, esi
jae 0x47b444
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
jmp 0x47b446
xor eax, eax
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00486793
leave
ret
Function at 0x486793
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4d4684]
jne 0x48679d
repz ret
jmp fcn.0048e927

Function at 0x491d36
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x4d5040]
je 0x491d51
inc edi
cmp edi, 0x17
jb 0x491d42
cmp edi, 0x17
jae 0x491ed1
push ebp
push 3
call fcn.004976fd
cmp eax, 1
pop ecx
je 0x491e9d
push 3
call fcn.004976fd
test eax, eax
pop ecx
jne 0x491d85
cmp dword [0x4d4680], 1
je 0x491e9d
cmp ebx, 0xfc
je 0x491ed0
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x4d87d0
push ebp
call fcn.0048c444
add esp, 0xc
test eax, eax
je 0x491dbb
push esi
push esi
push esi
push esi
push esi
call fcn.0048d2c2
add esp, 0x14
push 0x104
mov esi, 0x4d87e9
push esi
push 0
mov byte [0x4d88ed], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x491dff
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.0048c444
add esp, 0xc
test eax, eax
je 0x491dff
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.0048d2c2
add esp, 0x14
push esi
call fcn.00486310
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x491e44
push esi
call fcn.00486310
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x4d8ae4
push 0x4b531c
sub ecx, eax
push ecx
push eax
call fcn.0048be5c
add esp, 0x14
test eax, eax
je 0x491e44
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.0048d2c2
add esp, 0x14
jmp 0x491e46
xor esi, esi
push 0x4b13b0
push ebx
push ebp
call fcn.0048c9f4
add esp, 0xc
test eax, eax
je 0x491e66
push esi
push esi
push esi
push esi
push esi
call fcn.0048d2c2
add esp, 0x14
push dword [edi*8 + 0x4d5044]
push ebx
push ebp
call fcn.0048c9f4
add esp, 0xc
test eax, eax
je 0x491e88
push esi
push esi
push esi
push esi
push esi
call fcn.0048d2c2
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.00497540
add esp, 0xc
jmp 0x491ed0
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x491ed0
cmp ebp, 0xffffffff
je 0x491ed0
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x4d5044]
push dword [esi]
call fcn.00486310
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x497540
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.0048f4c8
xor ebx, ebx
cmp dword [0x4d8c6c], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x497616
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x4976f6
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4b23a0
push edi
call esi
cmp eax, ebx
je 0x4976f6
push eax
call fcn.0048f45a
mov dword [esp], 0x4b2390
push edi
mov dword [0x4d8c6c], eax
call esi
push eax
call fcn.0048f45a
mov dword [esp], 0x4b237c
push edi
mov dword [0x4d8c70], eax
call esi
push eax
call fcn.0048f45a
mov dword [0x4d8c74], eax
lea eax, [ebp - 0xc]
push eax
call fcn.0048c6fa
test eax, eax
pop ecx
pop ecx
je 0x4975e4
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0048d2c2
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x497616
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.0048f45a
cmp eax, ebx
pop ecx
mov dword [0x4d8c7c], eax
je 0x497616
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0048f45a
pop ecx
mov dword [0x4d8c78], eax
mov eax, dword [0x4d8c78]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x49769b
cmp dword [0x4d8c7c], ecx
je 0x49769b
push eax
call fcn.0048f4d1
push dword [0x4d8c7c]
mov esi, eax
call fcn.0048f4d1
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x49769b
cmp edi, ebx
je 0x49769b
call esi
cmp eax, ebx
je 0x497668
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x497668
test byte [ebp - 0x18], 1
jne 0x49769b
lea eax, [ebp - 0x10]
push eax
call fcn.0048c731
test eax, eax
pop ecx
je 0x497683
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0048d2c2
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x497692
or dword [ebp + 0x10], 0x200000
jmp 0x4976d6
or dword [ebp + 0x10], 0x40000
jmp 0x4976d6
mov eax, dword [0x4d8c70]
cmp eax, dword [ebp - 8]
je 0x4976d6
push eax
call fcn.0048f4d1
cmp eax, ebx
pop ecx
je 0x4976d6
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x4976d6
mov eax, dword [0x4d8c74]
cmp eax, dword [ebp - 8]
je 0x4976d6
push eax
call fcn.0048f4d1
cmp eax, ebx
pop ecx
je 0x4976d6
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4d8c6c]
call fcn.0048f4d1
cmp eax, ebx
pop ecx
je 0x4976f6
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4976f8
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x49b90e
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x4d4684]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.0049b8a3
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.00486c70
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x49b95d
cmp dword [ebp - 0x1c], 5
jb 0x49b975
jmp 0x49b971
cmp dword [ebp - 0x10], 1
jne 0x49b975
cmp dword [ebp - 0x1c], 4
ja 0x49b971
jne 0x49b975
cmp dword [ebp - 0x18], 0
jbe 0x49b975
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x4b2ca8
call fcn.0049b777
test eax, eax
jge 0x49b996
mov byte [0x4d8d09], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00486793
add ebp, 0x78
leave
ret
Function at 0x52cebe
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov edx, 0x1d9a6d2e
xchg edx, eax
lea edx, [esp + edx]
btr ax, si
xchg ch, dh
jmp 0x52cee6
push cx
sete dh
lea esp, [esp + 2]
lea ebx, [ebx + 0xde]
jmp 0x52ce90
seto ch
sub esp, 8
mov ecx, esi
mov word [esp], bp
xchg dword [esp + 8], ebx
jmp 0x52cea6
xchg dword [esp + 8], ebx
call fcn.0052ced0
cli
push 0x7b39fa0f
fisttp word [edi + 0x2a]
fldenv [eax - 0x4e]
lodsd eax, dword [esi]
mov esp, 0xf781168f
salc

Function at 0x52da77
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg dword [esp], eax
pop word [esp]
lea esp, [esp + 2]
jmp fcn.0052da13

Function at 0x53b015
Capabilities:
Check for trap flag exception

Disassembly:
push ebx
jmp 0x521cae
pushfd
or dword [esp], reloc.MSVCRT.dll_strncpy
popfd
cpuid
nop
jmp 0x521cc5
pop ebx
ret
jmp 0x521ca2

Function at 0x61c203
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov eax, dword [esp + 0x12]
jmp 0x61c20d
mov ch, al
xchg dword [esp + 2], edi
pushal
xchg edx, edi
rdtsc
mov bx, bp
jmp 0x61c251
mov dx, di

Function at 0x61c31e
Capabilities:
Execute anti-debugging instructions

Disassembly:
inc cx
xchg word [esp + 9], cx
lea edx, reloc.MSVCRT.dll_strncpy
mov eax, edi
jmp 0x61c340
xchg edi, ecx
bswap eax
xchg dh, ch
xchg bx, ax
mov word [esp + 0x22], sp
mov bp, cx
jmp 0x61c36f
pop dx
not bx
rdtsc
shl dx, 2
push word [esp + 0xa]
add esp, 0x2c
jmp 0x61c3a2
push dword [esp + 3]
xchg ebx, eax
not bh
cmp cx, 0xd9a0
mov esi, ebx
pop bp
jmp 0x61c430
pushal
pop dword [esp + 0x26]
std
xchg dword [esp + 0x18], eax
lea esp, [esp + 0x15]
jmp 0x61c412
lea ecx, [esi + 5]
push word [esp + 7]
push dword [esp + 9]
bswap ebx
bsf di, ax
cld
jmp 0x61c3d1
mov ecx, dword [esp]
mov ax, word [esp]
xchg dh, bh
rdtsc
setnp cl
jmp 0x61c49b
lea edi, [eax + eax]
pop eax
rdtsc
mov dword [esp + 0xa], ecx
mov word [esp + 8], bx
add esp, 0x12
jmp 0x61c3fc
push word [esp + 4]
bswap ebx
btc cx, cx
sbb si, 0x3a46
bswap edi
ror bp, cl
jmp 0x61c3e7
and bx, 0x34c6
shl ebp, 0x1f
shl dx, cl
call fcn.0061c469
push si
mov eax, esi
xchg bl, bh
mov dh, 0xcb
xchg bh, ch
mov bx, 0xb1bd
jmp 0x61ca24
push word [esp + 2]
cld
neg ch
pop cx
push word [esp + 4]
mov word [esp + 7], dx
call fcn.0061c4f8
rcr byte [edx + esi*8 - 0x6b], 1
invalid
mov cx, word [esp + 2]
pop word [esp + 7]
mov edi, 0xf2f869cb
mov di, word [esp + 6]
xchg word [esp + 1], cx
bsf ecx, edx
jmp 0x61c515
lea ebx, [eax*4]
lea esp, [esp]
sub eax, 0xe1f262a5
xchg dword [esp + 6], edi
lea ebp, [edx + edi]
bsr di, dx
jmp 0x61c541
mov si, 0xafaf
setne cl
sub dl, cl
bsr bp, dx
pop bp
mov dword [esp + 8], eax
jmp 0x61c59e
Function at 0x10002c00
Capabilities:
Check for time delay via gettickcount
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov ecx, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
lea eax, [ecx + 1]
cmp eax, 1
ja 0x10002c27
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x10002da1
mov ecx, dword [0x10044e0c]
test ecx, ecx
je 0x10002c46
call dword [0x10039230]
call ecx
mov esi, eax
xor edi, edi
mov dword [esp], 0
jmp 0x10002cc0
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x10002caa
mov edi, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
cmp edi, 1
mov dword [esp], eax
sbb eax, 0
jl 0x10002cb6
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x10002cb6
mov eax, dword [esp + 8]
mov dword [esp + 4], eax
mov esi, dword [esp + 0xc]
push 0
push 0x3e8
push dword [esp + 8]
push edi
call fcn.100089d8
add esp, 0x10
push edx
push eax
push esi
push dword [esp + 0x10]
call fcn.100088d8
add esp, 0x10
mov esi, eax
jmp 0x10002cc0
mov edi, 0xffffffff
mov dword [esp], 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
xor edx, edx
mov eax, dword [ebp + 0xc]
add esi, eax
adc edx, 0
mov dword [esp + 4], edx
push eax
nop dword [eax]
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x10002da1
mov ecx, dword [0x10044e0c]
test ecx, ecx
je 0x10002d00
call dword [0x10039230]
call ecx
jmp 0x10002d88
mov eax, edi
mov ecx, dword [esp]
or eax, ecx
jne 0x10002d20
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x10002d70
mov edi, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
cmp edi, 1
mov dword [esp], ecx
mov eax, ecx
sbb eax, 0
jl 0x10002d80
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x10002d80
mov eax, dword [esp + 8]
mov dword [esp + 0x18], eax
mov ebx, dword [esp + 0xc]
push 0
push 0x3e8
push dword [esp + 8]
push edi
call fcn.100089d8
add esp, 0x10
push edx
push eax
push ebx
push dword [esp + 0x24]
mov ebx, dword [ebp + 8]
call fcn.100088d8
add esp, 0x10
jmp 0x10002d88
mov edi, 0xffffffff
mov dword [esp], 0xffffffff
nop dword [eax]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor edx, edx
mov ecx, dword [esp + 4]
cmp eax, esi
sbb edx, ecx
jae 0x10002d9c
mov ecx, esi
sub ecx, eax
push ecx
jmp 0x10002cd0
mov eax, 0x102
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10002db0
Capabilities:
Check for time delay via gettickcount
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov ecx, dword [ebp + 0x14]
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
lea eax, [ecx + 1]
cmp eax, 1
ja 0x10002dde
push ecx
push dword [ebp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
jmp 0x10002f84
mov ecx, dword [0x10044e0c]
test ecx, ecx
je 0x10002e06
call dword [0x10039230]
call ecx
mov esi, eax
mov dword [esp + 4], 0
mov dword [esp], 0
jmp 0x10002e88
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x10002e6f
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov dword [esp + 4], eax
cmp eax, 1
mov dword [esp], ecx
mov eax, ecx
sbb eax, 0
jl 0x10002e7e
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x10002e7e
mov esi, dword [esp + 8]
mov edi, dword [esp + 0xc]
push 0
push 0x3e8
push dword [esp + 8]
push dword [esp + 0x10]
call fcn.100089d8
add esp, 0x10
push edx
push eax
push edi
mov edi, dword [ebp + 0xc]
push esi
call fcn.100088d8
add esp, 0x10
mov esi, eax
jmp 0x10002e88
mov dword [esp + 4], 0xffffffff
mov dword [esp], 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
xor edx, edx
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x14]
add esi, ecx
adc edx, 0
mov dword [esp + 0x18], edx
push ecx
push eax
nop dword [eax]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
cmp eax, 0x102
jne 0x10002f84
mov ecx, dword [0x10044e0c]
test ecx, ecx
je 0x10002ed0
call dword [0x10039230]
call ecx
jmp 0x10002f68
mov ecx, dword [esp + 4]
mov eax, ecx
mov edx, dword [esp]
or eax, edx
jne 0x10002ef4
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x10002f47
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov dword [esp + 4], ecx
cmp ecx, 1
mov dword [esp], edx
mov eax, edx
sbb eax, 0
jl 0x10002f60
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x10002f60
mov ebx, dword [esp + 8]
mov edi, dword [esp + 0xc]
push 0
push 0x3e8
push dword [esp + 8]
push dword [esp + 0x10]
call fcn.100089d8
add esp, 0x10
push edx
push eax
push edi
mov edi, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
call fcn.100088d8
add esp, 0x10
jmp 0x10002f68
mov dword [esp + 4], 0xffffffff
mov dword [esp], 0xffffffff
nop word cs:[eax + eax]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor edx, edx
mov ecx, dword [esp + 0x18]
cmp eax, esi
sbb edx, ecx
jae 0x10002f7f
mov ecx, esi
sub ecx, eax
push ecx
push dword [ebp + 0x10]
jmp 0x10002ea0
mov eax, 0x102
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10003f70
Capabilities:
Get thread local storage value
Print debug messages
Set thread local storage value

Disassembly:
push esi
sub esp, 0x38
mov eax, dword [esp + 0x44]
cmp eax, 3
je 0x10003fec
cmp eax, 1
je 0x10003fc2
test eax, eax
jne 0x10004098
cmp dword [esp + 0x48], 0
jne 0x10004098
mov esi, dword [0x10044e44]
test esi, esi
je 0x10004098
mov ecx, dword [0x10044e1c]
test ecx, ecx
je 0x1000408e
call dword [0x10039230]
push esi
call ecx
add esp, 4
jmp 0x1000408e
mov ecx, dword [0x10044e18]
test ecx, ecx
je 0x1000408e
call dword [0x10039230]
push 0x10006600
push 1
call ecx
add esp, 8
mov dword [0x10044e44], eax
jmp 0x10004098
mov eax, dword [0x1003a01c]
cmp eax, 0xffffffff
je 0x10004098
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x10004098
mov esi, eax
test byte [eax + 0x20], 0x30
je 0x1000409f
push dword [esi + 0xb4]
call fcn.10004c40
add esp, 4
mov eax, dword [esi + 0x14]
test eax, eax
je 0x1000404d
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi + 0x18]
test eax, eax
je 0x1000403f
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x18], 0
mov dword [esi + 0x14], 0
lea eax, [esi + 0x1c]
push eax
call fcn.10003280
add esp, 4
mov eax, esi
add eax, 0x38
push eax
call fcn.10003e40
add esp, 4
cmp eax, 1
je 0x10004137
mov dword [esi + 0x38], 0xffffffff
mov ecx, esi
call fcn.10004f70
push 0
push dword [0x1003a01c]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
jmp 0x10004098
mov dword [0x10044e44], 0
add esp, 0x38
pop esi
ret 0xc
cmp dword [esi + 0x68], 0
mov eax, dword [esi + 0x18]
je 0x100040bc
test eax, eax
je 0x100040b3
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x18], 0
jmp 0x100040e9
test eax, eax
je 0x100040c7
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x18], 0
mov dword [esi + 0x68], 1
push dword [esi + 0xb4]
call fcn.10004c40
add esp, 4
test byte [esi + 0x24], 4
jne 0x10004101
lea eax, [esi + 0x1c]
push eax
call fcn.10003280
add esp, 4
add esi, 0x38
mov ecx, esi
call fcn.10005e40
jmp 0x10004098
mov dword [esi], 0xdeadbeef
mov eax, dword [esi + 0x14]
test eax, eax
je 0x10004115
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x14], 0
lea eax, [esi + 0x1c]
push eax
call fcn.10003280
add esp, 4
mov ecx, esi
add ecx, 0x38
call fcn.10005e40
jmp 0x10004077
xorps xmm0, xmm0
movsd qword [esp + 0x2d], xmm0
xorps xmm0, xmm0
movups xmmword [esp + 0x20], xmm0
movups xmmword [esp + 0x10], xmm0
movups xmmword [esp], xmm0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
sub esp, 0x10
mov dword [esp + 0xc], eax
lea esi, [esp + 0x10]
mov dword [esp], esi
call fcn.10006790
add esp, 0x10
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call sub.msvcrt.dll_abort
nop dword [eax]
mov eax, dword [esp + 4]
mov dword [0x10044e20], eax
ret
Function at 0x100043f0
Capabilities:
Get thread local storage value
Print debug messages
Set thread local storage value

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x3c
call fcn.10005980
push dword [0x1003a01c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test eax, eax
jne 0x100044de
call fcn.10005da0
test eax, eax
je 0x100044dc
mov esi, eax
mov dword [eax + 0x24], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [esi + 0x3c], eax
sub esp, 0x10
movaps xmm0, xmmword [0x100331f0]
movups xmmword [esp], xmm0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], 0xffffffff
lea eax, [esi + 0x38]
push eax
call fcn.10003e40
add esp, 4
cmp eax, 1
je 0x100044e8
mov dword [esi + 0x38], 0xffffffff
mov dword [esi + 0x64], 0
mov ebp, esi
add ebp, 0x14
mov dword [esi + 0x14], 0
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call edi
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov ebx, eax
call edi
push 2
push 0
push 0
push ebp
push eax
push ebx
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x10004526
push dword [esi + 0x14]
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], 0
mov eax, dword [esi + 0x20]
and eax, 0xffffffcf
or eax, 0x10
mov dword [esi + 0x20], eax
push esi
push dword [0x1003a01c]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x100044de
jmp 0x10004526
xor esi, esi
mov eax, esi
add esp, 0x3c
pop esi
pop edi
pop ebx
pop ebp
ret
xorps xmm0, xmm0
movsd qword [esp + 0x31], xmm0
xorps xmm0, xmm0
movups xmmword [esp + 0x24], xmm0
movups xmmword [esp + 0x14], xmm0
movups xmmword [esp + 4], xmm0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
sub esp, 0x10
mov dword [esp + 0xc], eax
lea esi, [esp + 0x14]
mov dword [esp], esi
call fcn.10006790
add esp, 0x10
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call sub.msvcrt.dll_abort
nop dword [eax + eax]
Function at 0x10004eb0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
mov edi, dword [esp + 0xc]
call fcn.100043f0
mov esi, eax
mov dword [eax + 4], edi
push dword [eax + 0xb4]
call fcn.10004c40
add esp, 4
test byte [esi + 0x20], 0x30
jne 0x10004ee0
add esi, 0x70
push 1
push esi
call dword [sym.imp.msvcrt.dll_longjmp]
push dword [0x1003a01c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x10004f68
mov esi, eax
cmp dword [eax + 0x14], 0
jne 0x10004f18
mov dword [esi], 0xdeadbeef
mov eax, dword [esi + 0x18]
test eax, eax
je 0x10004f0c
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x18], 0
mov edi, dword [esi + 4]
jmp 0x10004f53
mov edi, dword [esi + 4]
mov eax, dword [esi + 0x18]
mov dword [esi + 0x68], 1
test eax, eax
je 0x10004f30
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x18], 0
test byte [esi + 0x24], 4
je 0x10004f68
mov dword [esi], 0xdeadbeef
push dword [esi + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x14], 0
mov ecx, esi
call fcn.10004f70
push 0
push dword [0x1003a01c]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push edi
call dword [sym.imp.msvcrt.dll__endthreadex]
nop