joyce8/EMBER2024-capa huggingface dataset:
Function at 0x479c20
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x6e1c7c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
mov dword [ebp - 0x10], eax
push edi
mov edi, dword [ebp + 0x1c]
mov eax, dword [esi + 4]
add eax, 0x18
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
cmp byte [ebp + 0x18], 0
push 0
je 0x479c74
mov ecx, dword [esi + 4]
push 0
push edi
call fcn.00477170
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006021fd
mov esp, ebp
pop ebp
ret 0x18
mov ecx, dword [ebx]
cmp ecx, 0xffffffff
jne 0x479c9c
mov ecx, dword [esi + 4]
push 0x2719
push edi
call fcn.00477170
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006021fd
mov esp, ebp
pop ebp
ret 0x18
mov eax, dword [ebp + 0x14]
push edi
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push dword [ebp + 0x10]
push dword [ebp - 0x10]
push ecx
call dword [sym.imp.WS2_32.dll_WSARecv]
mov ebx, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x40
jne 0x479cd3
mov eax, 0x2746
jmp 0x479ce0
cmp eax, 0x4d2
mov ecx, 0x274d
cmove eax, ecx
test ebx, ebx
je 0x479d0b
cmp eax, 0x3e5
je 0x479d0b
push dword [ebp - 8]
mov ecx, dword [esi + 4]
push eax
push edi
call fcn.00477170
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006021fd
mov esp, ebp
pop ebp
ret 0x18
mov ecx, dword [esi + 4]
push edi
call fcn.00477100
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.006021fd
mov esp, ebp
pop ebp
ret 0x18
Function at 0x47d990
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x648250
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x6c
mov eax, dword [0x6e1c7c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
xorps xmm0, xmm0
lea ecx, [ebp - 0x78]
push 0
movups xmmword [ebp - 0x78], xmm0
movq qword [ebp - 0x68], xmm0
call fcn.0056afa0
lea eax, [esi + 0x28]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0x30]
call fcn.0056aca0
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x78]
call fcn.0056ccd0
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0
call fcn.0056b440
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x28], 0x63726f66
mov dword [ebp - 0x24], 0x75615065
lea edx, [ecx + 1]
mov dword [ebp - 0x20], 0x6c416573
mov word [ebp - 0x1c], 0x6c
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0xf
mov byte [ebp - 0x48], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x47da47
sub ecx, edx
lea eax, [ebp - 0x28]
push ecx
push eax
lea ecx, [ebp - 0x48]
call fcn.0044e6d0
lea eax, [ebp - 0x78]
mov byte [ebp - 4], 2
push eax
lea eax, [ebp - 0x48]
mov ecx, esi
push eax
lea eax, [ebp - 0x60]
push eax
call fcn.0047ecf0
mov byte [ebp - 4], 3
lea edx, [ebp - 0x60]
cmp dword [ebp - 0x4c], 0x10
cmovae edx, dword [ebp - 0x60]
sub esp, 0x18
mov ecx, esp
call fcn.0044d9c0
mov ecx, esi
call fcn.0047efa0
mov edx, dword [ebp - 0x4c]
cmp edx, 0x10
jb 0x47dac8
mov ecx, dword [ebp - 0x60]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x47dabe
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x47db41
push edx
push ecx
call fcn.0060223e
add esp, 8
mov edx, dword [ebp - 0x34]
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x4c], 0xf
mov byte [ebp - 0x60], 0
cmp edx, 0x10
jb 0x47db0a
mov ecx, dword [ebp - 0x48]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x47db00
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x47db46
push edx
push ecx
call fcn.0060223e
add esp, 8
lea ecx, [ebp - 0x78]
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0xf
mov byte [ebp - 0x48], 0
call fcn.0056b440
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.006021fd
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.00621ffe
call fcn.00621ffe
int3
Function at 0x487ba0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x644850
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x6e1c7c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.0060220e
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.00600df5
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x34], esi
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x49e4d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x6e1c7c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 8], eax
cmp dword [edi + 0x14], 0x10
jb 0x49e4f4
mov edi, dword [edi]
mov esi, dword [ebp + 8]
mov ecx, esi
mov edx, dword [esi + 0x14]
cmp edx, 0x10
jb 0x49e503
mov ecx, dword [esi]
mov eax, dword [esi + 0x10]
add eax, ecx
cmp edx, 0x10
jb 0x49e50f
mov esi, dword [esi]
xor ecx, ecx
mov ebx, eax
sub ebx, esi
xor edx, edx
cmp esi, eax
cmova ebx, ecx
test ebx, ebx
je 0x49e533
mov al, byte [edx + esi]
xor al, byte [ebp + ecx - 8]
inc ecx
mov byte [edx + edi], al
and ecx, 3
inc edx
cmp edx, ebx
jne 0x49e520
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.006021fd
mov esp, ebp
pop ebp
ret 0xc

Function at 0x49e550
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x6e1c7c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
mov dword [ebp - 0x14], eax
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0xc], esi
cmp byte [esi + 0xd], 0
mov dword [ebp - 0x10], edi
jge 0x49e5b3
mov eax, dword [esi + 0x48]
xor ecx, ecx
mov edx, dword [eax + 8]
mov dword [ebp - 8], edx
test edi, edi
je 0x49e5a4
nop dword [eax]
mov eax, ecx
and eax, 3
mov al, byte [ebp + eax - 8]
xor byte [ebx + ecx], al
inc ecx
cmp ecx, edi
jb 0x49e590
mov eax, dword [esi + 0x48]
mov ecx, edi
and ecx, 3
je 0x49e5b0
shl ecx, 3
ror edx, cl
mov dword [eax + 8], edx
mov eax, dword [esi + 0x48]
push edi
push ebx
mov esi, dword [eax]
mov eax, dword [esi + 0x48]
add esi, 0x38
mov ecx, esi
mov dword [ebp - 8], eax
call fcn.0044e810
mov ebx, dword [ebp - 0xc]
mov ebx, dword [ebx + 0x48]
mov eax, dword [ebx]
cmp dword [eax + 0x50], 1
jne 0x49e64a
cmp dword [esi + 0x14], 0x10
mov ecx, esi
jb 0x49e5e2
mov ecx, dword [esi]
mov edx, dword [esi + 0x10]
add edx, ecx
cmp dword [esi + 0x14], 0x10
jb 0x49e5ef
mov esi, dword [esi]
mov eax, dword [ebp - 8]
add eax, esi
cmp eax, edx
je 0x49e64a
mov esi, dword [ebx + 0xc]
nop dword [eax + eax]
movzx edi, byte [eax]
movzx ecx, byte [edi + 0x6af320]
mov dword [ebp - 8], ecx
test esi, esi
je 0x49e61e
mov ecx, dword [ebx + 0x10]
and edi, 0x3f
shl ecx, 6
or edi, ecx
jmp 0x49e627
mov esi, 0xff
sar esi, cl
and edi, esi
mov esi, dword [ebp - 8]
mov dword [ebx + 0x10], edi
mov ecx, dword [ebx + 0xc]
add ecx, ecx
movzx esi, byte [esi + ecx*8 + 0x6af420]
mov dword [ebx + 0xc], esi
cmp esi, 1
je 0x49e665
inc eax
cmp eax, edx
jne 0x49e600
mov edi, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
sub dword [eax + 0x18], edi
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006021fd
mov esp, ebp
pop ebp
ret 0xc
call fcn.0047bd60
mov ecx, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov dword [ecx + 4], eax
xor eax, eax
mov dword [ecx], 0x10
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006021fd
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4a25c0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x64b64d
mov eax, dword fs:[0]
push eax
sub esp, 0x78
push ebx
push esi
push edi
mov eax, dword [0x6e1c7c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi + 8]
lea esi, [edi + 0x10]
push esi
lea ecx, [ebp - 0x7c]
mov dword [ebp - 0x84], eax
call fcn.004a3cd0
mov ecx, dword [esi + 0x3c]
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x40], 0
test ecx, ecx
je 0x4a261b
lock inc dword [ecx + 4]
mov ecx, dword [esi + 0x3c]
mov eax, dword [esi + 0x38]
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x40], ecx
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x44], eax
mov eax, dword [esi + 0x40]
mov dword [ebp - 0x3c], eax
mov eax, dword [ecx]
mov dword [ebp - 0x34], eax
mov eax, dword [ecx + 4]
mov ecx, dword [edx + 4]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
test ecx, ecx
je 0x4a2657
lock inc dword [ecx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [edx]
mov dword [ebp - 0x2c], eax
mov eax, dword [edx + 8]
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], eax
mov dword [ebp - 4], 0
lea ebx, [edi + 4]
push dword [0x6efacc]
mov edi, dword [edi]
mov esi, dword [ebx]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4a2692
cmp dword [eax], esi
je 0x4a2766
mov eax, dword [eax + 8]
test eax, eax
jne 0x4a2683
lea eax, [ebp - 0x84]
push eax
push 0x90
mov dword [ebp - 0x1c], eax
call fcn.00475b10
mov esi, eax
mov dword [ebp - 0x14], 0
add esp, 8
mov dword [ebp - 0x18], esi
mov byte [ebp - 4], 3
lea eax, [ebp - 0x84]
push eax
lea ecx, [esi + 0x20]
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0x4b09f0
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x1c], 0
call fcn.004b0ae0
push esi
mov byte [ebp - 4], 2
mov ecx, edi
push ebx
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
call fcn.0047a430
lea ecx, [ebp - 0x1c]
call fcn.004b0980
mov esi, dword [ebp - 0x28]
test esi, esi
je 0x4a274a
or edi, 0xffffffff
mov eax, edi
lock xadd dword [esi + 4], eax
jne 0x4a274a
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lock xadd dword [esi + 8], edi
dec edi
jne 0x4a274a
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
lea ecx, [ebp - 0x7c]
call fcn.00485550
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [eax + 4], 0
je 0x4a2692
lea eax, [ebp - 0x84]
mov byte [ebp - 4], 1
push eax
push eax
call fcn.004b3d20
add esp, 8
jmp 0x4a2722
Function at 0x4a4340
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x64b9e5
mov eax, dword fs:[0]
push eax
sub esp, 0x78
mov eax, dword [0x6e1c7c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
mov dword [ebp - 4], 0
lea eax, [ebp - 0x44]
xor edx, edx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x20], edx
mov byte [ebp - 4], 1
mov ecx, dword [ebp + 0x30]
test ecx, ecx
je 0x4a439a
mov eax, dword [ecx]
lea edx, [ebp - 0x44]
push edx
call dword [eax]
mov edx, eax
mov dword [ebp - 0x20], edx
mov ecx, dword [esi + 0x80]
mov eax, dword [ecx]
mov dword [ebp - 0x74], eax
mov eax, dword [ecx + 4]
mov dword [ebp - 0x70], eax
lea eax, [ebp - 0x6c]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x48], 0
mov byte [ebp - 4], 3
test edx, edx
je 0x4a4417
lea eax, [ebp - 0x44]
cmp edx, eax
jne 0x4a440d
mov eax, dword [edx]
lea ecx, [ebp - 0x6c]
push ecx
mov ecx, edx
call dword [eax + 4]
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x48], eax
test ecx, ecx
je 0x4a4417
mov edx, dword [ecx]
lea eax, [ebp - 0x44]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
xor ecx, ecx
mov dword [ebp - 0x20], 0
test ecx, ecx
je 0x4a4417
mov edx, dword [ecx]
lea eax, [ebp - 0x44]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
jmp 0x4a4410
mov dword [ebp - 0x48], edx
mov dword [ebp - 0x20], 0
mov byte [ebp - 4], 4
mov ebx, dword [esi + 0x7c]
push dword [0x6efacc]
mov esi, dword [ebp - 0x70]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4a443c
cmp dword [eax], esi
je 0x4a443c
mov eax, dword [eax + 8]
test eax, eax
jne 0x4a4431
lea eax, [ebp - 0x74]
mov dword [ebp - 0x80], eax
lea eax, [ebp - 0x6c]
push eax
push 0x58
call fcn.00475b10
mov esi, eax
mov dword [ebp - 0x78], 0
add esp, 8
mov dword [ebp - 0x7c], esi
mov byte [ebp - 4], 6
lea eax, [ebp - 0x74]
push eax
lea ecx, [esi + 0x20]
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0x4afc00
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x1c], 0
call fcn.004afdc0
push ecx
mov ecx, dword [ebx + 8]
push esi
call fcn.00476620
mov ecx, dword [ebp - 0x48]
test ecx, ecx
je 0x4a44c5
mov edx, dword [ecx]
lea eax, [ebp - 0x6c]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
push 0x6efa14
push 0x450a50
push 0x6efa4c
mov dword [edi], 0
call fcn.005fe6fd
add esp, 0xc
test eax, eax
je 0x4a4525
mov ecx, dword [ebp + 0x30]
mov dword [edi + 4], 0x6efa14
test ecx, ecx
je 0x4a4505
mov esi, dword [ecx]
lea eax, [ebp + 0xc]
cmp ecx, eax
setne dl
movzx edx, dl
push edx
call dword [esi + 0x10]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.006021fd
mov esp, ebp
pop ebp
ret 0x2c
call fcn.0062204e
int3
Function at 0x4aa810
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x64c25a
mov eax, dword fs:[0]
push eax
sub esp, 0xe4
push ebx
push esi
push edi
mov eax, dword [0x6e1c7c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [ebp + 0x14]
lea ebx, [esi + 8]
mov dword [esi + 0x24], eax
sub eax, 1
je 0x4aa9c7
mov edi, dword [ebp + 0x10]
mov ecx, ebx
push edi
call fcn.004ab480
mov ecx, dword [ebp + 8]
test ecx, ecx
jne 0x4aa865
test edi, edi
je 0x4aa86d
mov edi, dword [esi + 0x18]
cmp edi, dword [esi + 0x14]
jb 0x4aa872
mov edi, dword [esi + 0x18]
jmp 0x4aa884
xor edx, edx
mov eax, 0x10000
test ecx, ecx
cmovne eax, edx
je 0x4aa9d4
lea eax, [esi + 0x30]
push eax
lea ecx, [ebp - 0x68]
call fcn.004aa680
mov eax, dword [ebp + 8]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], edi
mov dword [ebp - 4], 0
lea edi, [esi + 0x2c]
mov ebx, dword [esi + 0x28]
push dword [0x6efacc]
mov esi, dword [edi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4aa8cf
nop
cmp dword [eax], esi
je 0x4aa9aa
mov eax, dword [eax + 8]
test eax, eax
jne 0x4aa8c0
lea eax, [ebp - 0x68]
push eax
push 0x78
mov dword [ebp - 0x18], eax
call fcn.00475b10
mov esi, eax
mov dword [ebp - 0x10], 0
add esp, 8
mov dword [ebp - 0x14], esi
mov byte [ebp - 4], 3
lea eax, [ebp - 0x68]
push eax
lea ecx, [esi + 0x20]
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0x4b2320
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x1c], 0
call fcn.004b2410
push esi
mov byte [ebp - 4], 2
mov ecx, ebx
push edi
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
call fcn.0047a430
lea ecx, [ebp - 0x18]
call fcn.004b1a50
mov esi, dword [ebp - 0x2c]
test esi, esi
je 0x4aa97e
or edi, 0xffffffff
mov eax, edi
lock xadd dword [esi + 4], eax
jne 0x4aa97e
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lock xadd dword [esi + 8], edi
dec edi
jne 0x4aa97e
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov ecx, dword [ebp - 0x34]
test ecx, ecx
je 0x4aa9fc
mov edx, dword [ecx]
lea eax, [ebp - 0x58]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp dword [eax + 4], 0
je 0x4aa8cf
lea eax, [ebp - 0x68]
mov byte [ebp - 4], 1
push eax
push eax
call fcn.004b4600
add esp, 8
jmp 0x4aa956
xor ecx, ecx
mov eax, 0x10000
cmp dword [ebp + 8], ecx
cmovne eax, ecx
push eax
lea eax, [ebp - 0xf0]
mov ecx, ebx
push eax
call fcn.004ab4e0
mov ecx, dword [esi + 4]
lea edx, [ecx + 0x44]
push edx
push esi
push 0
push eax
lea eax, [ecx + 4]
mov ecx, dword [ecx]
push eax
add ecx, 0x14
call fcn.004b0c10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4acd90
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x64c5d1
mov eax, dword fs:[0]
push eax
sub esp, 0x188
mov eax, dword [0x6e1c7c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x194]
push esi
call fcn.004aaae0
mov eax, dword [esi + 0x80]
mov dword [ebp - 0x114], eax
mov eax, dword [esi + 0x84]
mov dword [ebp - 0x110], eax
sub esp, 8
mov dword [ebp - 4], 0
lea eax, [ebp - 0x4c]
mov ecx, edi
push eax
call fcn.00489cd0
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x68]
call fcn.00480270
mov byte [ebp - 4], 1
cmp dword [ebp - 0x3c], 0
je 0x4ace20
lea eax, [ebp - 0x4c]
push eax
mov eax, dword [ebp - 0x40]
mov eax, dword [eax]
call eax
add esp, 4
sub esp, 8
mov byte [ebp - 4], 2
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x84]
push eax
call fcn.004ae910
mov ebx, eax
mov byte [ebp - 4], 3
cmp dword [ebx + 0x10], 0
je 0x4acfa8
mov ecx, dword [ebx + 0x14]
mov eax, dword [ecx + 0xc]
test eax, eax
je 0x4ace68
lea ecx, [ebp - 0x194]
push ecx
push 0x4b1d00
push ebx
call eax
add esp, 0xc
jmp 0x4acf4c
lea eax, [ebp - 0x194]
push eax
lea ecx, [ebp - 0x10c]
call fcn.004aaae0
mov eax, dword [ebp - 0x114]
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 0x110]
mov dword [ebp - 0x88], eax
mov byte [ebp - 4], 4
lea eax, [ebp - 0x25]
push dword [0x6efae0]
mov dword [ebp - 0x20], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4aceb1
mov ecx, dword [eax + 4]
jmp 0x4aceb3
xor ecx, ecx
push ecx
push dword [ebp - 0x24]
mov edx, 0x98
call fcn.004b2030
mov edi, eax
mov dword [ebp - 0x18], 0
add esp, 8
mov dword [ebp - 0x1c], edi
lea esi, [edi + 8]
mov byte [ebp - 4], 5
lea eax, [ebp - 0x10c]
mov dword [ebp - 0x2c], esi
push eax
mov ecx, esi
call fcn.004aaae0
mov eax, dword [ebp - 0x8c]
lea ecx, [ebp - 0x20]
mov dword [esi + 0x80], eax
mov eax, dword [ebp - 0x88]
mov dword [esi + 0x84], eax
mov dword [edi], 0x4b2a40
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x1c], 0
call fcn.004b1650
lea ecx, [ebp - 0x10c]
call fcn.00498640
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x24]
mov eax, dword [ebx + 0x14]
push ecx
push ebx
mov eax, dword [eax + 8]
call eax
add esp, 8
mov byte [ebp - 4], 7
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x4acf4c
push 0
push eax
mov eax, dword [eax]
call eax
add esp, 8
mov byte [ebp - 4], 9
cmp dword [ebp - 0x74], 0
je 0x4acf67
lea eax, [ebp - 0x84]
push eax
mov eax, dword [ebp - 0x78]
mov eax, dword [eax]
call eax
add esp, 4
mov byte [ebp - 4], 0xa
cmp dword [ebp - 0x58], 0
je 0x4acf7f
lea eax, [ebp - 0x68]
push eax
mov eax, dword [ebp - 0x5c]
mov eax, dword [eax]
call eax
add esp, 4
lea ecx, [ebp - 0x194]
call fcn.00498640
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.006021fd
mov esp, ebp
pop ebp
ret 0xc
lea ecx, [ebp - 0x20]
call fcn.00475c00
mov byte [ebp - 4], 8
call fcn.00489c70
int3
Function at 0x4ad910
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x64c6a0
mov eax, dword fs:[0]
push eax
sub esp, 0xd4
push ebx
push esi
push edi
mov eax, dword [0x6e1c7c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov esi, ecx
lea eax, [edi + 8]
push eax
lea ecx, [ebp - 0xe0]
call fcn.004af610
push esi
lea ecx, [ebp - 0x90]
mov dword [ebp - 4], 0
call fcn.004afd50
mov dword [ebp - 4], 1
lea ebx, [edi + 4]
mov eax, dword [edi]
push dword [0x6efacc]
mov esi, dword [ebx]
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4ad991
cmp dword [eax], esi
je 0x4ada8d
mov eax, dword [eax + 8]
test eax, eax
jne 0x4ad982
lea eax, [ebp - 0xe0]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x88]
push eax
push 0xe8
call fcn.00475b10
mov edi, eax
mov dword [ebp - 0x14], 0
add esp, 8
mov dword [ebp - 0x18], edi
mov byte [ebp - 4], 4
lea esi, [edi + 0x20]
lea eax, [ebp - 0xe0]
mov dword [edi + 0x14], 0
push eax
mov ecx, esi
mov dword [edi + 0x18], 0x4b3910
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x1c], 0
mov dword [ebp - 0x20], esi
call fcn.0048e680
lea eax, [ebp - 0x90]
mov byte [ebp - 4], 5
push eax
lea ecx, [esi + 0x50]
call fcn.004afd50
mov ecx, dword [ebp - 0x10]
push edi
mov byte [ebp - 4], 3
push ebx
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
call fcn.0047a430
lea ecx, [ebp - 0x1c]
call fcn.004b3890
mov esi, dword [ebp - 0x2c]
test esi, esi
je 0x4ada68
or edi, 0xffffffff
mov eax, edi
lock xadd dword [esi + 4], eax
jne 0x4ada68
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lock xadd dword [esi + 8], edi
dec edi
jne 0x4ada68
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
lea ecx, [ebp - 0x80]
call fcn.00485550
lea ecx, [ebp - 0xd8]
call fcn.00485550
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [eax + 4], 0
je 0x4ad991
lea eax, [ebp - 0xe0]
mov byte [ebp - 4], 2
push eax
push eax
call fcn.004b4ab0
add esp, 8
jmp 0x4ada40