joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4761a0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5fad79
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x6b7e40]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
push 0x63bfdc
lea ecx, [edi + 4]
mov dword [edi], 0
call fcn.004021e0
mov dword [ebp - 4], 0
push 0x63bfdc
lea ecx, [edi + 0xc]
mov byte [edi + 8], 1
call fcn.004021e0
mov byte [ebp - 4], 1
xorps xmm0, xmm0
lea ecx, [edi + 0x30]
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
movsd qword [edi + 0x28], xmm0
call fcn.00476100
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 2
call fcn.00416ef0
push eax
lea ecx, [edi + 4]
mov byte [ebp - 4], 3
call fcn.00404570
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x10]
add edx, 0xfffffff0
or ecx, 0xffffffff
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x47626f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4768a0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5fad31
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x6b7e40]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov edi, dword [ebp + 8]
mov eax, dword [edi]
mov dword [ebx], eax
mov eax, dword [edi + 4]
sub eax, 0x10
push eax
call fcn.004046f0
add eax, 0x10
mov dword [ebx + 4], eax
mov dword [ebp - 4], 0
movzx eax, byte [edi + 8]
mov byte [ebx + 8], al
mov eax, dword [edi + 0xc]
sub eax, 0x10
push eax
call fcn.004046f0
add eax, 0x10
mov dword [ebx + 0xc], eax
mov byte [ebp - 4], 1
movq xmm0, qword [edi + 0x10]
movq qword [ebx + 0x10], xmm0
movq xmm0, qword [edi + 0x18]
movq qword [ebx + 0x18], xmm0
movq xmm0, qword [edi + 0x20]
movq qword [ebx + 0x20], xmm0
movq xmm0, qword [edi + 0x28]
movq qword [ebx + 0x28], xmm0
movzx eax, byte [edi + 0x30]
lea esi, [ebx + 0x30]
mov dword [ebp + 8], esi
mov byte [esi], al
mov eax, dword [edi + 0x34]
sub eax, 0x10
push eax
call fcn.004046f0
add eax, 0x10
add esp, 0xc
mov dword [esi + 4], eax
lea eax, [edi + 0x38]
push eax
lea ecx, [esi + 8]
mov byte [ebp - 4], 2
call fcn.00476980
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x47b3b0
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x6bb524]
push esi
push edi
xor edi, edi
test eax, eax
je 0x47b40d
mov eax, dword [0x6c24b8]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
je 0x47b40d
push 0x18950
push esi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x47b405
push esi
call fcn.004863b0
push esi
call fcn.0047cec0
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_GlobalHandle]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
mov eax, 1
pop esi
ret
mov eax, edi
pop edi
pop esi
ret

Function at 0x47b4f0
Capabilities:
Get disk information
Get thread local storage value

Disassembly:
push ecx
mov ecx, dword [0x6c24b8]
mov eax, dword [0x683014]
push ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je case.0x47b54e.3
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x47b519
mov eax, 1
pop ecx
ret
mov eax, dword [esp + 8]
test eax, eax
jl case.0x47b54e.3
cmp eax, 0x1a
jg case.0x47b54e.3
test eax, eax
jne 0x47b52f
call fcn.0047b4e0
mov cl, byte [esp]
dec al
lea edx, [esp]
add cl, al
push edx
mov byte [esp + 4], cl
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
add eax, 0xfffffffe
cmp eax, 3
ja case.0x47b54e.3
jmp dword [eax*4 + 0x47b560]
mov eax, 1
pop ecx
ret
xor eax, eax
pop ecx
ret

Function at 0x47b600
Capabilities:
Get thread local storage value

Disassembly:
push ecx
mov eax, dword [0x6c24b8]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x47b662
mov ecx, dword [eax + 0x3d10]
push ebx
push 0
push 0
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
call fcn.004825d0
mov bl, al
call fcn.004825d0
mov byte [esp + 6], al
call fcn.004825d0
mov byte [esp + 7], al
call fcn.004825d0
cmp bl, 0x50
pop ebx
jne 0x47b662
cmp byte [esp + 2], 0x4b
jne 0x47b662
cmp byte [esp + 3], 1
jne 0x47b662
cmp al, 2
jne 0x47b662
mov eax, 1
pop ecx
ret
xor eax, eax
pop ecx
ret
Function at 0x47bf90
Capabilities:
Get thread local storage value
Read file on windows

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
cmp ebp, 0x7ff
jle 0x47bfa4
mov ebp, 0x7ff
mov eax, dword [0x6c24b8]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test ebx, ebx
je 0x47c028
lea esi, [ebx + 0x16000]
push edi
mov ecx, 0x200
xor eax, eax
mov edi, esi
push eax
rep stosd dword es:[edi], eax
mov edx, dword [ebx + 0x3d10]
lea ecx, [esp + 0x18]
push ecx
push ebp
push esi
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
pop edi
je 0x47c028
cmp dword [esp + 0x10], ebp
jne 0x47c028
test byte [ebx + 0x4ea6], 8
je 0x47c019
push 0x2e
push esi
call fcn.005c0bd0
add esp, 8
test eax, eax
je 0x47c012
push 0x2e
push esi
mov byte [eax], 0x20
call fcn.005c0bd0
add esp, 8
test eax, eax
jne 0x47c000
mov byte [ebx + 0x1600b], 0
mov eax, dword [ebx + 0x38]
test eax, eax
jne 0x47c028
push esi
push esi
call dword [sym.imp.USER32.dll_OemToCharA]
pop esi
pop ebp
pop ebx
ret

Function at 0x47c030
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
mov esi, dword [esp + 0x1c]
push edi
lea edi, [ebp + 0x45ea]
mov edx, 1
mov ecx, 8
xor eax, eax
mov dword [esp + 0x14], edi
cmp esi, 4
mov dword [esp + 0x10], edx
rep stosd dword es:[edi], eax
jle 0x47c120
push esi
call fcn.005c0a37
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x47c116
mov ecx, dword [ebp + 0x3d10]
lea eax, [esp + 0x1c]
push 0
push eax
push esi
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x47c0f9
cmp dword [esp + 0x1c], esi
jne 0x47c0f9
add esi, 0xfffffffc
xor edx, edx
mov dword [esp + 0x20], esi
xor ebp, ebp
test ebp, ebp
jne 0x47c101
cmp dx, word [esp + 0x20]
ja 0x47c101
mov eax, edx
and eax, 0xffff
add eax, ebx
cmp word [eax], 1
jne 0x47c0ed
mov ax, word [eax + 2]
mov ebp, 1
add ax, 4
cmp ax, 0x20
ja 0x47c0f9
mov edi, dword [esp + 0x14]
mov ecx, eax
and ecx, 0xffff
mov esi, ebx
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x47c0a2
mov cx, word [eax + 2]
add cx, 4
add edx, ecx
jmp 0x47c0a2
mov dword [esp + 0x10], 0
push ebx
call fcn.005c0ac9
mov eax, dword [esp + 0x14]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret
pop edi
pop esi
pop ebp
mov eax, edx
pop ebx
add esp, 8
ret

Function at 0x47c170
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x6c24b8]
push ebx
push esi
push eax
mov ebx, 5
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x47c18f
pop esi
or eax, 0xffffffff
pop ebx
ret
push edi
call fcn.0047c130
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [esi + 0x3d10], 0xffffffff
test ebx, ebx
jle 0x47c1d2
push 0
push 0x8000080
push 3
push 0
push 3
lea ecx, [esi + 0x14fac]
push SysReAllocStringLen
push ecx
call edi
cmp eax, 0xffffffff
mov dword [esi + 0x3d10], eax
jne 0x47c1d2
dec ebx
jmp 0x47c1a5
mov eax, dword [esi + 0x3d10]
pop edi
pop esi
pop ebx
ret
Function at 0x47c1e0
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x6c24b8]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x47c1fa
mov eax, 9
pop esi
ret
mov eax, dword [esi + 0x54]
mov dword [esi + 0x16810], 0
test eax, eax
mov dword [esi + 0x16814], 0
jne 0x47c282
push ebx
push edi
push 0
push 0x80
push 3
push 0
lea ebx, [esi + 0x14fac]
push 3
push SysReAllocStringLen
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x47c269
push edi
call fcn.00487af0
add esp, 4
mov dword [esi + 0x16810], eax
mov dword [esi + 0x16814], edx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esi + 0x15fac]
push ecx
push ebx
call fcn.00484b60
add esp, 8
mov edx, dword [esi + 0x16810]
mov eax, dword [esi + 0x16814]
or edx, eax
pop edi
pop ebx
jne 0x47c282
mov eax, 9
pop esi
ret
xor eax, eax
pop esi
ret

Function at 0x47c290
Capabilities:
Get thread local storage value

Disassembly:
push ecx
mov eax, dword [0x6c24b8]
push ebx
push eax
mov dword [esp + 8], 1
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test ebx, ebx
jne 0x47c2af
pop ebx
pop ecx
ret
push ebp
mov ebp, dword [esp + 0x14]
push esi
push edi
lea edi, [ebx + 0x16000]
push ebp
mov byte [edi], 0
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov esi, eax
test esi, esi
je 0x47c332
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x18]
push ecx
push edx
call fcn.0047c340
lea eax, [esi + eax + 0x2e]
xor esi, esi
mov si, word [ebx + 0x4e9c]
add esp, 8
cmp esi, 0x104
jge 0x47c323
lea ecx, [esi + 1]
push ecx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov byte [esi + edi], 0
mov eax, dword [ebx + 0x38]
test eax, eax
jne 0x47c32b
push edi
push edi
call dword [sym.imp.USER32.dll_OemToCharA]
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov dword [esp + 0x10], 0
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x47c560
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x6c24b8]
push ebx
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
xor edi, edi
cmp esi, edi
jne 0x47c587
mov ecx, dword [esp + 0x10]
mov eax, 4
mov dword [ecx + 0x4c], edi
pop edi
pop esi
pop ebx
ret
lea edx, [esi + 0x350]
mov dword [esi + 0x3d20], edi
push edx
call fcn.00481dd0
mov ebx, eax
add esp, 4
cmp ebx, edi
je 0x47c5c9
mov esi, dword [esp + 0x10]
mov eax, dword [esi + 0x28]
push eax
push 2
push 0x66
call fcn.00486400
add esp, 8
push eax
push ebx
call fcn.0047b420
add esp, 0xc
mov dword [esi + 0x4c], edi
mov eax, ebx
pop edi
pop esi
pop ebx
ret
push edi
call fcn.00481f80
add esp, 4
mov dword [esi + 0x3d08], edi
cmp eax, edi
mov dword [esi + 0x3d1c], eax
mov dword [esi + 0x3d0c], edi
je 0x47c647
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 0x28]
mov dword [eax + 0x4c], edi
push ecx
push 2
push 0x67
call fcn.00486400
mov edx, dword [esi + 0x3d1c]
add esp, 8
push eax
push edx
call fcn.0047b420
mov eax, dword [esi + 0x14f90]
add esp, 0xc
mov dword [esi + 0x3d08], edi
cmp eax, edi
mov dword [esi + 0x3d0c], edi
je 0x47c634
push eax
call fcn.005c0ac9
add esp, 4
mov dword [esi + 0x14f90], edi
mov eax, dword [esi + 0x15ff4]
cmp eax, edi
je 0x47c6e5
jmp 0x47c6d6
cmp dword [esi + 0x44], edi
je 0x47c69a
mov ebx, dword [esp + 0x10]
mov dword [ebx + 0x4c], edi
call fcn.0047cbd0
cmp eax, edi
mov dword [esi + 0x3d1c], eax
jne 0x47c689
push ebp
lea ebp, [esi + 0x16000]
push ebp
call fcn.00483100
add esp, 4
test eax, eax
jne 0x47c679
inc dword [ebx + 0x4c]
call fcn.0047cbd0
cmp eax, edi
mov dword [esi + 0x3d1c], eax
je 0x47c669
pop ebp
cmp dword [esi + 0x3d1c], 2
jne 0x47c6a7
mov dword [esi + 0x3d1c], edi
jmp 0x47c6a7
mov ecx, dword [esp + 0x10]
mov eax, dword [esi + 0x4e4a]
mov dword [ecx + 0x4c], eax
mov eax, dword [esi + 0x14f90]
mov dword [esi + 0x3d08], edi
cmp eax, edi
mov dword [esi + 0x3d0c], edi
je 0x47c6cc
push eax
call fcn.005c0ac9
add esp, 4
mov dword [esi + 0x14f90], edi
mov eax, dword [esi + 0x15ff4]
cmp eax, edi
je 0x47c6e5
push eax
call fcn.005c0ac9
add esp, 4
mov dword [esi + 0x15ff4], edi
mov eax, dword [esi + 0x3d1c]
pop edi
pop esi
pop ebx
ret
Function at 0x47c6f0
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x6c24b8]
sub esp, 0x868
push ebx
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0x47c722
mov ecx, dword [esp + 0x878]
pop edi
pop esi
pop ebx
mov dword [ecx + 0x4c], eax
mov eax, 4
add esp, 0x868
ret
mov esi, dword [esp + 0x878]
add eax, 0x350
test eax, eax
mov edi, dword [esi + 0x10]
je 0x47c826
test edi, edi
je 0x47c826
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
call ebx
test eax, eax
je 0x47c7fc
push edi
call ebx
test eax, eax
je 0x47c7fc
push esi
call fcn.0047c560
add esp, 4
test eax, eax
jne 0x47c846
mov eax, dword [esi + 0x4c]
test eax, eax
jne 0x47c781
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x868
ret
xor ebx, ebx
lea edx, [esp + 0xc]
push esi
mov dword [esi + 0xc], ebx
mov dword [esi + 0x8e], edx
call fcn.0047d800
mov edi, eax
add esp, 4
test edi, edi
jne 0x47c7af
push esi
inc ebx
call fcn.0047d800
mov edi, eax
add esp, 4
test edi, edi
je 0x47c79f
cmp edi, 0x30
je 0x47c7e3
cmp edi, 2
push esi
jne 0x47c7db
call fcn.0047c560
add esp, 4
mov edi, eax
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x8e], 0
pop edi
pop esi
pop ebx
add esp, 0x868
ret
call fcn.0047c560
add esp, 4
mov eax, edi
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x8e], 0
pop edi
pop esi
pop ebx
add esp, 0x868
ret
mov eax, dword [esi + 0x28]
push eax
push 2
push 0x69
call fcn.00486400
add esp, 8
push eax
push 0xb
call fcn.0047b420
add esp, 0xc
mov eax, 0x2f
pop edi
pop esi
pop ebx
add esp, 0x868
ret
mov ecx, dword [esi + 0x28]
push ecx
push 2
push 0x68
call fcn.00486400
add esp, 8
push eax
push 0xb
call fcn.0047b420
add esp, 0xc
mov eax, 0xb
pop edi
pop esi
pop ebx
add esp, 0x868
ret
Function at 0x47e170
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x6c24b8]
push ebx
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
xor ebx, ebx
cmp esi, ebx
jne 0x47e190
pop edi
pop esi
mov eax, 4
pop ebx
ret
lea eax, [esi + 0x350]
cmp eax, ebx
jne 0x47e1c5
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 0x28]
mov dword [eax + 0x4c], ebx
push ecx
push 2
push 0x71
call fcn.00486400
add esp, 8
push eax
push 0x2f
call fcn.0047b420
add esp, 0xc
mov eax, 0x2f
pop edi
pop esi
pop ebx
ret
push eax
call fcn.00481dd0
mov edi, eax
add esp, 4
cmp edi, ebx
je 0x47e1fb
mov esi, dword [esp + 0x10]
mov edx, dword [esi + 0x28]
push edx
push 2
push 0x6c
call fcn.00486400
add esp, 8
push eax
push edi
call fcn.0047b420
add esp, 0xc
mov eax, edi
mov dword [esi + 0x4c], ebx
pop edi
pop esi
pop ebx
ret
mov eax, dword [esi + 0x14f90]
cmp eax, ebx
je 0x47e214
push eax
call fcn.005c0ac9
add esp, 4
mov dword [esi + 0x14f90], ebx
mov eax, dword [esi + 0x15ff4]
cmp eax, ebx
je 0x47e22d
push eax
call fcn.005c0ac9
add esp, 4
mov dword [esi + 0x15ff4], ebx
push 1
call fcn.00481f80
add esp, 4
cmp eax, ebx
mov dword [esi + 0x3d1c], eax
je 0x47e272
mov eax, dword [esp + 0x10]
mov dword [eax + 0x4c], ebx
mov eax, dword [eax + 0x28]
push eax
push 2
push 0x72
call fcn.00486400
mov ecx, dword [esi + 0x3d1c]
add esp, 8
push eax
push ecx
call fcn.0047b420
mov eax, dword [esi + 0x3d1c]
add esp, 0xc
pop edi
pop esi
pop ebx
ret
mov eax, dword [esp + 0x10]
xor edx, edx
mov dx, word [esi + 0x4e28]
pop edi
mov dword [eax + 0x4c], edx
pop esi
xor eax, eax
pop ebx
ret
Function at 0x47eae0
Capabilities:
Encode data using xor
Get thread local storage value

Disassembly:
mov eax, dword [0x6c24b8]
push ebx
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test ebx, ebx
jne 0x47eafc
pop edi
pop esi
or eax, 0xffffffff
pop ebx
ret
lea ecx, [ebx + 0x4ef0]
push ebp
push ecx
call fcn.00487f70
mov ebp, dword [esp + 0x18]
add esp, 4
xor edi, edi
call fcn.00487ec0
xor edx, edx
mov esi, eax
mov dl, byte [edi + ebp]
xor esi, edx
push esi
call fcn.00487ef0
add esp, 4
inc edi
cmp edi, 0xc
jl 0x47eb12
mov al, byte [ebx + 0x45d2]
pop ebp
test al, 8
je 0x47eb48
xor eax, eax
mov ax, word [ebx + 0x45d6]
shr eax, 8
jmp 0x47eb5d
mov eax, dword [ebx + 0x4e90]
xor ecx, ecx
shr eax, 0x10
mov cl, ah
and ecx, 0xff
mov eax, ecx
and esi, 0xffff
cmp esi, eax
je 0x47eb6e
pop edi
pop esi
or eax, 0xffffffff
pop ebx
ret
mov edx, dword [ebx + 0x4554]
mov eax, dword [ebx + 0x14f98]
xor ecx, ecx
cmp ecx, edx
jl 0x47eb90
jg 0x47eb8a
cmp eax, dword [ebx + 0x4550]
jbe 0x47eb90
mov eax, dword [ebx + 0x4550]
mov esi, dword [ebx + 0x14f94]
mov edx, eax
dec eax
test edx, edx
je 0x47ebbc
lea edi, [eax + 1]
call fcn.00487ec0
mov ebx, eax
xor eax, eax
mov al, byte [esi]
xor ebx, eax
push ebx
call fcn.00487ef0
add esp, 4
mov byte [esi], bl
inc esi
dec edi
jne 0x47eba0
pop edi
pop esi
xor eax, eax
pop ebx
ret

Function at 0x47ebd0
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x6c24b8]
sub esp, 0x10
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
test edi, edi
jne 0x47ebf0
mov eax, 4
pop edi
add esp, 0x10
ret
push esi
mov dword [edi + 0x4eec], 0
xor esi, esi
lea ecx, [esp + 0xa]
push edi
push ecx
call fcn.004869a0
mov dl, byte [esp + 0x12]
add esp, 8
mov byte [esp + esi + 0xc], dl
inc esi
cmp esi, 0xc
jl 0x47ebfd
mov al, byte [edi + 0x4ef0]
mov dword [edi + 0x4eec], 1
test al, al
pop esi
je 0x47ec44
lea eax, [esp + 8]
push eax
call fcn.0047eae0
add esp, 4
test eax, eax
jne 0x47ec44
pop edi
add esp, 0x10
ret
mov eax, 0x2c
pop edi
add esp, 0x10
ret
Function at 0x47eef0
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x6c24b8]
push ebx
push ebp
push esi
push edi
push eax
mov ebp, 5
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x47ef15
pop edi
pop esi
pop ebp
mov eax, 9
pop ebx
ret
mov edi, dword [esp + 0x14]
mov ebx, dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0
push 0x8000080
push 3
push 0
push 3
push SysReAllocStringLen
push edi
call ebx
cmp eax, 0xffffffff
mov dword [esi + 0x14fa8], eax
jne 0x47ef4e
dec ebp
test ebp, ebp
jg 0x47ef1f
pop edi
pop esi
pop ebp
mov eax, 9
pop ebx
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
Function at 0x481dd0
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x6c24b8]
push ebx
push ebp
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebp, eax
xor ebx, ebx
cmp ebp, ebx
je 0x481f69
cmp dword [ebp + 0x1d4], ebx
jne 0x481f23
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [ebp + 0x3d4c]
push 0x6bb520
mov dword [ebp + 0x3cf8], ebx
mov dword [ebp + 0x3d40], ebx
push ecx
mov dword [ebp + 0x3d30], ebx
mov dword [ebp + 0x3d28], ebx
mov dword [ebp + 0x3cfc], ebx
mov dword [ebp + 0x3d44], ebx
mov dword [ebp + 0x3d48], ebx
mov dword [ebp + 0x15ffc], ebx
mov dword [ebp + 0x14f98], ebx
mov dword [ebp + 0x14f9c], ebx
mov dword [ebp + 0x14fa0], ebx
mov byte [ebp + 0x14fa4], bl
mov dword [ebp + 0x16800], ebx
mov dword [ebp + 0x16804], ebx
mov dword [ebp + 0x1680c], ebx
mov dword [ebp + 0x3d14], ebx
mov dword [ebp + 0x3d18], ebx
mov dword [ebp + 0x3d1c], ebx
call esi
mov edx, dword [esp + 0x14]
lea eax, [ebp + 0x14fac]
push edx
push eax
call esi
call fcn.0047c1e0
test eax, eax
je 0x481e99
pop edi
pop esi
pop ebp
mov eax, 9
pop ebx
ret
cmp dword [ebp + 0x54], ebx
jne 0x481ea6
cmp dword [ebp + 0x4ee4], ebx
je 0x481eb9
lea esi, [ebp + 0x15fac]
lea edi, [ebp + 0x15fd0]
mov ecx, 9
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp + 0x14fac]
lea esi, [ebp + 0x157ac]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x481ef1
mov eax, dword [ebp + 0x15fc0]
mov ecx, dword [ebp + 0x15fe4]
cmp eax, ecx
jne 0x481ef1
mov ecx, dword [ebp + 0x15fc8]
mov eax, dword [ebp + 0x15fec]
cmp ecx, eax
je 0x481f23
push ebp
mov dword [ebp + 0x4e14], ebx
call fcn.0047cec0
add esp, 4
mov dword [ebp + 0x3d08], ebx
mov ecx, 9
xor eax, eax
lea edi, [ebp + 0x15fd0]
mov dword [ebp + 0x4e7c], ebx
mov dword [ebp + 0x3d0c], ebx
mov byte [esi], bl
rep stosd dword es:[edi], eax
mov edx, dword [ebp + 0xa0]
add edx, 4
push edx
call fcn.005c0a37
mov dword [ebp + 0x14f90], eax
mov eax, dword [ebp + 0xa4]
inc eax
push eax
call fcn.005c0a37
mov ecx, dword [ebp + 0x14f90]
add esp, 8
cmp ecx, ebx
mov dword [ebp + 0x15ff4], eax
mov dword [ebp + 0x15ffc], eax
je 0x481f69
cmp eax, ebx
je 0x481f69
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
pop edi
pop esi
pop ebp
mov eax, 4
pop ebx
ret
Function at 0x4825d0
Capabilities:
Get thread local storage value
Read file on windows

Disassembly:
mov eax, dword [0x6c24b8]
sub esp, 8
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x482617
mov eax, dword [eax + 0x3d10]
lea ecx, [esp]
push 0
push ecx
lea edx, [esp + 0xc]
push 1
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x482617
mov eax, dword [esp]
test eax, eax
je 0x482617
mov eax, dword [esp + 4]
and eax, 0xff
add esp, 8
ret
or eax, 0xffffffff
add esp, 8
ret
Function at 0x482620
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x6c24b8]
push ebx
push ebp
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
je 0x482817
mov eax, dword [esi + 0x54]
test eax, eax
jne 0x48280e
mov eax, dword [esi + 0x50]
test eax, eax
jne 0x48280e
mov eax, dword [esi + 0x4c]
test eax, eax
je 0x48266d
mov edi, dword [esi + 0x90]
mov ecx, dword [esi + 0x70]
mov ebx, dword [esi + 0x94]
mov eax, dword [esi + 0x74]
add edi, ecx
jmp 0x482687
mov edi, dword [esi + 0x4558]
mov ecx, dword [esi + 0x90]
mov ebx, dword [esi + 0x455c]
mov eax, dword [esi + 0x94]
add edi, ecx
mov edx, dword [esp + 0x18]
mov ecx, edi
adc ebx, eax
add ecx, 0x3e8
mov eax, ebx
adc eax, 0
cmp edx, eax
mov eax, dword [esp + 0x14]
jl 0x4826b5
jg 0x4826a8
cmp eax, ecx
jbe 0x4826b5
mov dword [esi], 1
mov dword [esi + 0x24], 1
mov ebp, dword [esi + 0x28]
test ebp, ebp
jne 0x4826ca
mov ecx, dword [esi + 0x460c]
test ecx, ecx
je 0x482817
mov ecx, edi
or ecx, ebx
jne 0x4826d8
xor edi, edi
mov dword [esp + 0x18], edi
jmp 0x48270e
push 0
push 0x64
push edx
push eax
call fcn.005c1160
push ebx
push edi
push edx
push eax
call fcn.005c10b0
mov edi, eax
add edi, 1
adc edx, 0
mov dword [esp + 0x18], edx
js 0x48270e
jg 0x482701
cmp edi, 0x64
jbe 0x48270e
mov edi, 0x64
mov dword [esp + 0x18], 0
mov eax, edi
cdq
mov dword [esi + 0x3cf8], eax
mov dword [esi + 0x3cfc], edx
test ebp, ebp
je 0x4827b9
lea edx, [esi + 0x3d4c]
lea eax, [esi + 0x1e4]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esi + 0x1e0]
lea ecx, [esi + 0x344]
mov dword [esi + 0x34c], eax
mov dword [esi + 0x348], 0x164
mov dword [eax], edi
mov eax, dword [esi + 0x1dc]
cmp eax, 0xc8
mov dword [ecx], 1
jl 0x48279c
mov eax, dword [esi + 0xc]
test eax, eax
je 0x48279c
push ecx
mov ecx, dword [esi + 0x30]
push 0
push 0x4a
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
test eax, eax
je 0x48280e
push esi
mov dword [esi], 1
call fcn.00484d90
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
ret
mov edx, dword [esi + 0x30]
push ecx
push 0
push 0x4a
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
push esi
call fcn.00484d90
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
ret
cmp dword [esi + 0x1dc], 0xc8
jl 0x4827f9
mov eax, dword [esi + 0xc]
test eax, eax
je 0x4827f9
mov eax, dword [esi + 0x4610]
lea ecx, [esi + 0x3d4c]
push eax
push edi
push ecx
call dword [esi + 0x460c]
test eax, eax
je 0x48280e
push esi
mov dword [esi], 1
call fcn.00484d90
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
ret
mov edx, dword [esi + 0x4610]
lea eax, [esi + 0x3d4c]
push edx
push edi
push eax
call dword [esi + 0x460c]
push esi
call fcn.00484d90
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
ret