joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45f630
Capabilities:
Check if file exists
Delete directory
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x4f8
mov ebx, edx
mov edi, ecx
mov eax, dword [0x587040]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea esi, [ebp - 0x2a4]
push 0x294
push 0xff
push esi
call fcn.004f0940
add esp, 0xc
mov ecx, esi
mov dword [ebp - 0x504], ebx
push ebx
push 3
push 0
push edi
call fcn.0045f8e0
xor eax, eax
dec eax
lea edi, [ebp - 0x500]
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov ecx, esi
push edi
call fcn.0045fae0
movsx eax, byte [edi + 0xb]
test eax, eax
jns 0x45f69d
mov eax, dword [ebp - 0x4fc]
test eax, eax
je 0x45f798
xor edi, edi
lea ebx, [ebp - 0x4f4]
push 0x250
push 0xff
push ebx
call fcn.004f0940
add esp, 0xc
lea ecx, [ebp - 0x2a4]
push ebx
call fcn.0045faa0
mov eax, dword [ebp - 0x4f4]
test al, 1
jne 0x45f7ef
mov ecx, ebx
call fcn.0045f850
test al, al
jne 0x45f79c
cmp byte [ebp - 0x4f5], 0
lea eax, [ebp - 0x500]
jns 0x45f6fe
mov eax, dword [ebp - 0x500]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x45f794
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
and ecx, 0xfffffffe
xor esi, esi
cmp ecx, 2
je 0x45f721
mov esi, eax
test edi, edi
cmovne esi, edi
mov ecx, ebx
call fcn.00411550
lea ecx, [ebp - 0x2a4]
push ebx
call fcn.0045fae0
lea ecx, [ebp - 0x500]
push ebx
call fcn.004b97a0
mov ecx, ebx
call fcn.004b9720
movsx eax, byte [ebp - 0x4f5]
test eax, eax
jns 0x45f75d
mov eax, dword [ebp - 0x4fc]
mov edi, esi
test eax, eax
jne 0x45f6ad
lea ecx, [ebp - 0x500]
call fcn.004b9720
lea ecx, [ebp - 0x2a4]
call fcn.0045fa30
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ecef0
mov eax, esi
add esp, 0x4f8
pop esi
pop edi
pop ebx
pop ebp
ret
xor esi, esi
jmp 0x45f721
xor esi, esi
jmp 0x45f767
xor esi, esi
cmp byte [ebp + 8], 0
je 0x45f721
lea ecx, [ebp - 0x500]
mov edx, dword [ebp - 0x504]
push 1
call fcn.0045f630
add esp, 4
test eax, eax
jne 0x45f71f
cmp byte [ebp - 0x4f5], 0
lea eax, [ebp - 0x500]
jns 0x45f7db
mov eax, dword [ebp - 0x500]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x45f721
jmp 0x45f70d
cmp byte [ebp + 8], 0
jne 0x45f822
lea ecx, [ebp - 0x4f4]
call fcn.0045f850
test al, al
je 0x45f81c
lea ecx, [ebp - 0x4f4]
call fcn.0045f850
test al, al
je 0x45f6e9
jmp 0x45f794
mov eax, dword [ebp - 0x4f4]
cmp byte [ebp - 0x4f5], 0
js 0x45f833
lea ecx, [ebp - 0x500]
jmp 0x45f839
mov ecx, dword [ebp - 0x500]
and eax, 0xfffffffe
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
jmp 0x45f6da
Function at 0x460e40
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xb0
mov dword [esp + 0xc], edx
mov eax, dword [0x587040]
xor eax, ebp
mov dword [esp + 0xa8], eax
xor ebx, ebx
test ecx, ecx
je 0x460fba
push ebx
push ebx
push ecx
mov dword [esp + 0x1c], ecx
call fcn.00505b99
add esp, 0xc
pcmpeqd xmm0, xmm0
lea esi, [esp + 0x70]
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
lea edi, [esp + 0x30]
push 0x48
push str....._base_files_file_util.cc
push str.ReadStreamToSpanWithMaxSize
push edi
call fcn.004b8ac0
add esp, 0x10
mov ecx, esi
push ebx
push edi
call fcn.004aac50
mov dword [edi + 0x30], ebx
pxor xmm0, xmm0
movdqa xmmword [edi + 0x20], xmm0
movdqa xmmword [edi + 0x10], xmm0
movdqa xmmword [edi], xmm0
push dword [esp + 0x10]
call fcn.004feb26
add esp, 4
push eax
call fcn.004feb7a
add esp, 4
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
je 0x460fd2
mov eax, dword [esp + 0x54]
xor ecx, ecx
mov edx, eax
neg edx
sbb ecx, dword [esp + 0x50]
mov edi, 0xffff
cmovl edi, eax
mov eax, dword [esp + 0xc]
cmp edi, eax
cmovae edi, eax
inc edi
xor eax, eax
dec eax
lea ebx, [esp + 0x28]
mov dword [ebx], eax
mov dword [ebx + 4], eax
lea ecx, [ebp + 8]
mov eax, dword [ecx]
mov ecx, dword [ecx + 4]
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], eax
call dword [0x580f64]
mov eax, dword [esp + 0x20]
push edi
push eax
push ebx
mov dword [esp + 0x24], ecx
call ecx
add esp, 0xc
xor esi, esi
mov eax, dword [ebx]
add eax, esi
push dword [esp + 0x10]
push edi
push 1
push eax
call fcn.005058a9
add esp, 0x10
test eax, eax
je 0x460f78
mov ebx, eax
mov eax, dword [esp + 0xc]
sub eax, esi
cmp eax, ebx
jb 0x460fdc
add ebx, esi
push dword [esp + 0x10]
call fcn.0050521f
add esp, 4
test eax, eax
je 0x460fe4
mov esi, ebx
push dword [esp + 0x10]
call fcn.0050524b
add esp, 4
test eax, eax
sete bl
mov eax, dword [esp + 0x14]
mov dword [esp + 0xa4], eax
mov ecx, dword [esp + 0x18]
call dword [0x580f64]
mov eax, dword [esp + 0xa4]
lea edx, [esp + 0x20]
push esi
push eax
push edx
call ecx
add esp, 0xc
lea ecx, [esp + 0x70]
call fcn.004aacc0
mov ecx, dword [esp + 0xa8]
xor ecx, ebp
call fcn.004ecef0
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov edi, 0xffff
jmp 0x460f02
xor ebx, ebx
mov esi, dword [esp + 0xc]
jmp 0x460f89
test esi, esi
mov eax, 0x10000
cmove edi, eax
lea eax, [ebx + edi]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0xa4], eax
mov ecx, dword [esp + 0x18]
call dword [0x580f64]
mov eax, dword [esp + 0xa4]
lea esi, [esp + 0x20]
push dword [esp + 0x1c]
push eax
push esi
call ecx
add esp, 0xc
mov eax, dword [esi]
mov ecx, dword [esi + 4]
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x28], eax
mov esi, ebx
jmp 0x460f42
Function at 0x466f60
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov edx, dword [ebp + 0xc]
movsx edi, byte [edx + 0xb]
test edi, edi
jns 0x466f79
mov edi, dword [edx + 4]
mov edx, dword [edx]
mov eax, edi
mov dword [ebp - 0x1c], edx
mov esi, edi
mov dword [ebp - 0x14], edi
cmp edi, 4
jb 0x466fb6
mov eax, dword [ebp - 0x14]
mov esi, eax
mov edx, dword [ebp - 0x1c]
imul edi, dword [edx], 0x5bd1e995
mov ebx, edi
shr ebx, 0x18
xor ebx, edi
imul edi, ebx, 0x5bd1e995
imul eax, eax, 0x5bd1e995
xor eax, edi
add edx, 4
add esi, 0xfffffffc
cmp esi, 3
ja 0x466f90
mov ebx, dword [ebp + 8]
cmp esi, 2
je 0x466feb
cmp esi, 3
je 0x466fe2
cmp esi, 1
mov edi, dword [ebp - 0x14]
je 0x466ff7
mov esi, dword [ecx + 4]
xor edx, edx
test esi, esi
jne 0x467004
mov dword [ebx], edx
mov eax, ebx
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret 8
movzx esi, byte [edx + 2]
shl esi, 0x10
xor eax, esi
movzx esi, byte [edx + 1]
shl esi, 8
xor eax, esi
mov edi, dword [ebp - 0x14]
movzx edx, byte [edx]
xor edx, eax
imul eax, edx, 0x5bd1e995
jmp 0x466fcb
mov edx, eax
shr edx, 0xd
xor edx, eax
imul eax, edx, 0x5bd1e995
mov edx, eax
shr edx, 0xf
xor edx, eax
mov dword [ebp - 0x18], edx
mov edx, esi
shr edx, 1
and edx, 0x55555555
mov eax, esi
sub eax, edx
mov edx, eax
and edx, 0x33333333
shr eax, 2
and eax, 0x33333333
add eax, edx
mov edx, eax
shr edx, 4
add edx, eax
and edx, 0xf0f0f0f
imul eax, edx, 0x1010101
shr eax, 0x18
mov dword [ebp - 0x28], eax
cmp eax, 1
mov eax, dword [ebp - 0x18]
ja 0x467114
lea edx, [esi - 1]
and edx, eax
mov eax, dword [ecx]
mov eax, dword [eax + edx*4]
test eax, eax
je 0x46710d
mov ecx, dword [eax]
test ecx, ecx
je 0x46710d
lea eax, [esi - 1]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], edx
mov eax, dword [ecx + 4]
cmp eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], ecx
jne 0x4670e3
movzx eax, byte [ecx + 0x13]
test al, al
mov ecx, dword [ecx + 0xc]
mov edx, eax
cmovs edx, ecx
cmp edx, edi
jne 0x467100
test al, al
jns 0x4670c4
push ecx
push dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
push dword [eax + 8]
call fcn.004eed3d
add esp, 0xc
test eax, eax
jne 0x467100
mov edx, dword [ebp - 0x10]
jmp 0x466fd4
test eax, eax
je 0x4670bc
xor ecx, ecx
mov edx, dword [ebp - 0x10]
mov dl, byte [edx + ecx + 8]
mov edi, dword [ebp - 0x1c]
cmp dl, byte [edi + ecx]
mov edi, dword [ebp - 0x14]
jne 0x467100
inc ecx
cmp eax, ecx
jne 0x4670ca
jmp 0x4670bc
cmp dword [ebp - 0x28], 1
jbe 0x4670f5
cmp eax, esi
jb 0x4670f8
xor edx, edx
div esi
mov eax, edx
jmp 0x4670f8
and eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x24]
mov edi, dword [ebp - 0x14]
jne 0x46710d
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx]
test ecx, ecx
jne 0x467085
xor edx, edx
jmp 0x466fd4
mov edx, eax
cmp eax, esi
jb 0x467065
mov eax, dword [ebp - 0x18]
xor edx, edx
div esi
jmp 0x467065
Function at 0x469310
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov edi, dword [ebp + 8]
mov eax, dword [0x587040]
xor eax, ebp
mov dword [ebp - 0x10], eax
call fcn.00469490
mov eax, dword [edi]
mov dword [0x589218], eax
mov bl, 1
test al, 1
jne 0x46934c
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ecef0
mov eax, ebx
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [0x58df3c]
test eax, eax
je 0x469376
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x58df3c], 0
cmp dword [0x58df40], 0
jne 0x469376
and byte [0x589218], 0xfe
mov eax, dword [edi + 0x18]
test eax, eax
je 0x469393
movsx ecx, byte [edi + 0xf]
test ecx, ecx
jns 0x469388
mov ecx, dword [edi + 8]
test ecx, ecx
jne 0x4693fe
mov dword [0x58df3c], eax
jmp 0x469338
movsx eax, byte [edi + 0xf]
test eax, eax
jns 0x46939e
mov eax, dword [edi + 8]
test eax, eax
je 0x46943f
lea esi, [edi + 4]
mov ecx, dword [0x58df40]
test ecx, ecx
jne 0x4693d2
push 0xc
call fcn.004ec94e
add esp, 4
mov ecx, eax
xorps xmm0, xmm0
movsd qword [eax], xmm0
mov dword [eax + 8], 0
mov dword [0x58df40], eax
push esi
call fcn.0049fc60
cmp dword [edi + 0x14], 0
jne 0x4693f2
mov eax, dword [0x58df40]
cmp byte [eax + 0xb], 0
jns 0x4693eb
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
call fcn.0053d280
mov ebx, eax
jmp 0x469338
lea eax, [ebp - 0x24]
push 0x22b
push str....._baselogging.cc
push str.BaseInitLoggingImpl_built_with_NDEBUG
push eax
call fcn.004b8ac0
add esp, 0x10
lea esi, [ebp - 0x14]
lea eax, [ebp - 0x24]
push eax
push 0x7f
push str.settings.log_file_path.empty__
push esi
call fcn.0053f530
add esp, 0x10
mov ecx, esi
call fcn.0053f790
mov eax, dword [edi + 0x18]
jmp 0x46938c
lea ebx, [ebp - 0x24]
push 0x231
push str....._baselogging.cc
push str.BaseInitLoggingImpl_built_with_NDEBUG
push ebx
call fcn.004b8ac0
add esp, 0x10
lea esi, [ebp - 0x28]
push ebx
push 0x7f
push str._settings.log_file_path.empty__
push esi
call fcn.0053f530
add esp, 0x10
mov ecx, esi
push str.LOG_TO_FILE_set_but_no_log_file_path_
call fcn.0053d250
mov ecx, esi
call fcn.0053f790
jmp 0x4693a6
Function at 0x46d050
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x10010
call fcn.004edcb0
mov esi, dword [ebp + 8]
mov eax, dword [0x587040]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor eax, eax
dec eax
lea ebx, [ebp - 0x1001c]
mov dword [ebx], eax
mov dword [ebx + 4], eax
mov dword [ebx + 8], eax
push edx
push ecx
push ebx
call fcn.004ad230
add esp, 0xc
test esi, esi
je 0x46d109
lea edi, [ebp - 0x1000e]
push 0xfffe
push 0xff
push edi
call fcn.004f0940
add esp, 0xc
cmp byte [ebp - 0x10011], 0
jns 0x46d0b5
mov ebx, dword [ebp - 0x1001c]
push 0x7fff
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
setne bl
je 0x46d0db
cmp eax, 0x7fff
jae 0x46d132
push esi
push eax
push edi
call fcn.00464890
add esp, 0xc
cmp byte [ebp - 0x10011], 0
jns 0x46d0f2
push dword [ebp - 0x1001c]
call fcn.004ec97e
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ecef0
mov eax, ebx
add esp, 0x10010
pop esi
pop edi
pop ebx
pop ebp
ret
cmp byte [ebp - 0x10011], 0
js 0x46d11a
lea eax, [ebp - 0x1001c]
jmp 0x46d120
mov eax, dword [ebp - 0x1001c]
xor ecx, ecx
push ecx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
setne bl
jmp 0x46d0db
int3

Function at 0x46d530
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ebx, dword [0x58dfbc]
test ebx, ebx
jne 0x46d5b4
push 0x28
call fcn.004ec94e
add esp, 4
mov esi, eax
xor edi, edi
mov dword [eax], edi
mov dword [eax + 4], edi
mov byte [eax + 8], 0
push 0xc
call fcn.004ec94e
add esp, 4
mov dword [esi + 0xc], eax
lea ecx, [eax + 0xc]
mov dword [esi + 0x14], ecx
test eax, eax
je 0x46d5be
mov dword [eax + 8], edi
xorps xmm0, xmm0
movsd qword [eax], xmm0
mov dword [esi + 0x10], ecx
mov eax, esi
add eax, 0x1c
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x18], eax
mov dword [esi + 0x24], 1
mov dword [0x58dfbc], esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
test eax, eax
je 0x46d5c5
mov edi, eax
push eax
call fcn.00507e54
add esp, 4
mov ecx, esi
push eax
push edi
call fcn.0046d5e0
test ebx, ebx
sete al
pop esi
pop edi
pop ebx
pop ebp
ret
push str....._third_partylibc_srcinclude__memoryconstruct_at.h:40:_assertion___location___nullptr_failed:_null_pointer_given_to_construct_at_n
jmp 0x46d5ca
push str....._third_partylibc_srcinclude_string_view:268:_assertion___s___nullptr_failed:_null_pointer_passed_to_non_null_argument_of_char_traits_..._::length_n
push 0x565ab5
call fcn.0051c8d0
int3
Function at 0x473090
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x38
mov ebx, dword [ebp + 8]
mov eax, dword [0x587040]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp ebx, 0x30
ja 0x4731bc
mov edi, edx
mov esi, ecx
pcmpeqd xmm0, xmm0
lea eax, [ebp - 0x20]
movdqu xmmword [eax], xmm0
movdqu xmmword [eax - 0x10], xmm0
movdqu xmmword [eax - 0x20], xmm0
mov ecx, dword [ecx + 0xf4]
mov eax, dword [esi + 0x108]
bswap eax
inc eax
bswap eax
mov dword [esi + 0x108], eax
lea eax, [esi + 0xfc]
mov dword [ebp - 0x44], eax
call dword [0x580f64]
lea eax, [ebp - 0x40]
push esi
push eax
push dword [ebp - 0x44]
call ecx
add esp, 0xc
mov ecx, dword [esi + 0xf4]
mov eax, dword [esi + 0x108]
bswap eax
inc eax
bswap eax
mov dword [esi + 0x108], eax
call dword [0x580f64]
push esi
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0x44]
call ecx
add esp, 0xc
mov ecx, dword [esi + 0xf4]
mov eax, dword [esi + 0x108]
bswap eax
inc eax
bswap eax
mov dword [esi + 0x108], eax
call dword [0x580f64]
push esi
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x44]
call ecx
add esp, 0xc
test ebx, ebx
je 0x473161
xor eax, eax
mov cl, byte [edi + eax]
xor byte [ebp + eax - 0x40], cl
inc eax
cmp ebx, eax
jne 0x473155
push 1
call fcn.004bfa80
add esp, 4
bt eax, 0x19
jae 0x4731c0
push esi
push 0x100
lea eax, [ebp - 0x40]
push eax
call fcn.00403500
add esp, 0xc
mov eax, 0x401d10
mov ecx, 0x401180
lea edx, [ebp - 0x20]
mov edi, dword [ebp - 0x44]
mov dword [esi + 0xf4], ecx
mov dword [esi + 0xf8], eax
movups xmm0, xmmword [edx]
movups xmmword [edi], xmm0
xor esi, esi
inc esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ecef0
mov eax, esi
add esp, 0x38
pop esi
pop edi
pop ebx
pop ebp
ret
xor esi, esi
jmp 0x4731a8
bt eax, 9
jae 0x4731e1
push esi
push 0x100
lea eax, [ebp - 0x40]
push eax
call fcn.00404020
add esp, 0xc
xor eax, eax
mov ecx, 0x4040d0
jmp 0x47318d
push esi
push 0x100
lea eax, [ebp - 0x40]
push eax
call fcn.005436d0
add esp, 0xc
mov eax, 0x543e60
mov ecx, 0x5435e0
jmp 0x47318d
Function at 0x473410
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
mov edi, dword [ebp + 8]
cmp dword [ecx + 8], 0
jne 0x4734ec
cmp dword [esi], 0
jne 0x4734ec
cmp dword [esi + 0xc], 0
jne 0x4734ec
xor eax, eax
cmp dword [esi + 4], 0
jne 0x4734ec
mov ebx, dword [edi]
cmp eax, ebx
je 0x473473
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jae 0x4734d2
lea eax, [ebx + 1]
cmp eax, 2
jb 0x473469
mov dword [esi], ebx
call fcn.004b8af0
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [ebp + 8]
mov ebx, dword [edi + 4]
cmp dword [esi + 4], ebx
je 0x4734a6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi + 4]
inc eax
cmp eax, 2
jae 0x4734b9
lea eax, [ebx + 1]
cmp eax, 2
jb 0x47349c
mov dword [esi + 4], ebx
call fcn.004b8af0
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [ebp + 8]
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
pop esi
pop edi
pop ebx
pop ebp
ret 4
call fcn.004b8af0
push dword [esi + 4]
call fcn.004a4810
add esp, 4
mov dword [esi + 4], 0
jmp 0x47348c
call fcn.004b8af0
push dword [esi]
call fcn.004a4810
add esp, 4
mov dword [esi], 0
jmp 0x47345a
mov ecx, esi
call fcn.0049eee0
lea ecx, [esi + 4]
call fcn.0049eee0
xor eax, eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov eax, dword [esi]
jmp 0x473444
Function at 0x481990
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [ebp + 0xc]
mov ecx, dword [0x587040]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
cmp eax, 3
je 0x4819c0
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ecef0
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
lea eax, [ebp - 0x14]
mov dword [eax], 0x481ad0
push 0
push eax
push 0x481970
push 0x59b344
call dword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x481ac8
cmp dword [0x59b348], 0
jne 0x4819ac
push dword [0x59b34c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4819ac
mov esi, eax
mov eax, 0x59b350
push eax
call dword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
mov edi, dword [0x59b354]
mov ebx, dword [0x59b358]
mov eax, dword [0x59b35c]
mov dword [ebp - 0x1c], eax
mov eax, dword [0x59b360]
mov dword [ebp - 0x20], eax
mov eax, dword [0x59b364]
mov dword [ebp - 0x24], eax
mov eax, 0x59b350
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
test edi, edi
jne 0x481aae
test ebx, ebx
jne 0x481a9b
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
jne 0x481a66
mov ecx, dword [ebp - 0x20]
test ecx, ecx
mov ebx, dword [ebp - 0x24]
jne 0x481a77
test ebx, ebx
jne 0x481a88
push esi
call fcn.004bd690
add esp, 4
jmp 0x4819ac
mov edi, dword [esi + 8]
call dword [0x580f64]
push edi
call ecx
add esp, 4
jmp 0x481a4a
mov edi, dword [esi + 0xc]
call dword [0x580f64]
push edi
call ecx
add esp, 4
jmp 0x481a54
mov edi, dword [esi + 0x10]
mov ecx, ebx
call dword [0x580f64]
push edi
call ebx
add esp, 4
jmp 0x481a58
mov edi, dword [esi + 4]
mov ecx, ebx
call dword [0x580f64]
push edi
call ebx
add esp, 4
jmp 0x481a43
mov eax, dword [esi]
mov dword [ebp - 0x18], eax
mov ecx, edi
call dword [0x580f64]
push dword [ebp - 0x18]
call edi
add esp, 4
jmp 0x481a3f
call fcn.00500e00
int3
Function at 0x481af0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [0x587040]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
mov dword [eax], 0x481ad0
push 0
push eax
push 0x481970
push 0x59b344
call dword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x481bb8
mov esi, dword [ebp + 0xc]
cmp dword [0x59b348], 0
jne 0x481bc6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push dword [0x59b34c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
test edi, edi
jne 0x481b7b
push 0x14
push 1
call fcn.004bd730
add esp, 8
test eax, eax
je 0x481bc6
mov edi, eax
push eax
push dword [0x59b34c]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x481bbd
mov ebx, dword [ebp + 8]
mov esi, 0x59b350
push esi
call dword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
mov eax, dword [ebp + 0x10]
mov dword [ebx*4 + 0x59b354], eax
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov eax, dword [ebp + 0xc]
mov dword [edi + ebx*4], eax
xor esi, esi
inc esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ecef0
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.00500e00
push edi
call fcn.004bd690
add esp, 4
mov ecx, dword [ebp + 0x10]
call dword [0x580f64]
push esi
call ecx
add esp, 4
xor esi, esi
jmp 0x481ba4
Function at 0x4824b0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
mov eax, dword [0x58a2ec]
cmp eax, 0xffffffff
je 0x482571
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
je 0x482571
mov eax, dword [0x59c394]
mov ecx, dword [0x58a36c]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x48257b
mov edi, dword [0x59c390]
push edi
call dword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x4825c3
mov ecx, dword [0x59b388]
inc ecx
xor edx, edx
lea eax, [ecx + edx]
movzx eax, al
mov ebx, eax
shl ebx, 4
cmp dword [ebx + 0x59b38c], 0
jne 0x4825cf
lea ecx, [ebx + 0x59b38c]
mov dword [ecx], 1
mov edx, dword [ebp + 8]
mov dword [ecx + 4], edx
mov edx, dword [0x59c38c]
inc edx
mov dword [0x59c38c], edx
mov dword [ecx + 0xc], edx
mov dword [0x59b388], eax
mov dword [esi], eax
mov eax, dword [ecx + 8]
mov dword [esi + 4], eax
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
cmp dword [esi], 0x100
jae 0x4825c0
pop esi
pop edi
pop ebx
pop ebp
ret 4
call fcn.004825f0
jmp 0x4824d5
push 0x59c394
call fcn.004ec9c1
add esp, 4
cmp dword [0x59c394], 0xffffffff
jne 0x4824f6
push 4
call fcn.004ec94e
add esp, 4
mov edi, eax
mov ecx, eax
call fcn.004a5a70
mov dword [0x59c390], edi
push 0x59c394
call fcn.004eca3b
add esp, 4
jmp 0x4824f6
int3
mov ecx, edi
call fcn.004a5a80
jmp 0x48250b
inc edx
cmp edx, 0x100
jne 0x482514
jmp 0x48255b

Function at 0x4825f0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x808
mov eax, dword [0x587040]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x814], 0xffffffff
mov ecx, dword [0x58a2ec]
mov dword [ebp - 0x814], ecx
cmp ecx, 0xffffffff
je 0x48269d
push ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
jne 0x4826e6
mov edi, 0x800
lea ebx, [ebp - 0x810]
push edi
push 0
push ebx
call fcn.004f0940
add esp, 0xc
lea eax, [ebp - 0x80d]
push eax
push dword [ebp - 0x814]
call fcn.00490610
add esp, 8
push edi
call fcn.004ec9b3
add esp, 4
mov esi, eax
push edi
push ebx
push eax
call fcn.004f03c0
add esp, 0xc
mov eax, esi
or eax, 3
push eax
push dword [ebp - 0x814]
call fcn.00490610
add esp, 8
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ecef0
mov eax, esi
add esp, 0x808
pop esi
pop edi
pop ebx
pop ebp
ret
lea esi, [ebp - 0x814]
push esi
call fcn.004905f0
add esp, 4
test al, al
je 0x4826e9
mov ecx, dword [ebp - 0x814]
cmp ecx, 0xffffffff
je 0x4826ec
xor eax, eax
dec eax
lock cmpxchg dword [0x58a2ec], ecx
je 0x482621
push ecx
call fcn.00555390
add esp, 4
mov ecx, dword [0x58a2ec]
mov dword [ebp - 0x814], ecx
jmp 0x482621
int3
int3
push esi
call fcn.004905f0
add esp, 4
test al, al
je 0x482714
cmp dword [ebp - 0x814], 0xffffffff
je 0x482714
push 0xffffffffffffffff
call fcn.00555390
add esp, 4
mov ecx, dword [ebp - 0x814]
jmp 0x4826bb
int3