joyce8/EMBER2024-capa huggingface dataset:
Function at 0x451f4a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp eax, 0x80
jb 0x452100
movdqu xmm4, xmmword [edx]
not ecx
movdqu xmm3, xmmword [edx + 0x10]
movdqu xmm2, xmmword [edx + 0x20]
movdqu xmm1, xmmword [edx + 0x30]
movdqa xmm5, xmmword [0x5421b0]
add edx, 0x40
add eax, 0xffffffc0
movd xmm0, ecx
pxor xmm0, xmm4
movdqa xmm4, xmmword [0x5421a0]
movdqa xmm6, xmm0
movdqa xmm7, xmm0
movdqu xmm0, xmmword [edx]
add eax, 0xffffffc0
pclmulqdq xmm6, xmm4, 0
pclmulqdq xmm7, xmm5, 0x11
pxor xmm0, xmm6
movdqu xmm6, xmmword [edx + 0x10]
pxor xmm0, xmm7
movdqa xmm7, xmm3
pclmulqdq xmm3, xmm5, 0x11
pclmulqdq xmm7, xmm4, 0
pxor xmm7, xmm6
movdqu xmm6, xmmword [edx + 0x20]
pxor xmm3, xmm7
movdqa xmm7, xmm2
pclmulqdq xmm2, xmm5, 0x11
pclmulqdq xmm7, xmm4, 0
pxor xmm7, xmm6
movdqu xmm6, xmmword [edx + 0x30]
add edx, 0x40
cmp eax, 0x3f
pxor xmm2, xmm7
movdqa xmm7, xmm1
pclmulqdq xmm1, xmm5, 0x11
pclmulqdq xmm7, xmm4, 0
pxor xmm7, xmm6
pxor xmm1, xmm7
ja 0x451f8e
movdqa xmm4, xmmword [0x5421c0]
movdqa xmm5, xmmword [0x5421d0]
movdqa xmm6, xmm0
cmp eax, 0x10
pclmulqdq xmm6, xmm4, 0
pclmulqdq xmm0, xmm5, 0x11
pxor xmm0, xmm6
pxor xmm0, xmm3
movdqa xmm3, xmm0
pclmulqdq xmm0, xmm5, 0x11
pclmulqdq xmm3, xmm4, 0
pxor xmm0, xmm3
pxor xmm0, xmm2
movdqa xmm2, xmm0
pclmulqdq xmm0, xmm5, 0x11
pclmulqdq xmm2, xmm4, 0
pxor xmm0, xmm2
pxor xmm0, xmm1
jb 0x452098
movdqu xmm1, xmmword [edx]
movdqa xmm2, xmm0
add eax, 0xfffffff0
pclmulqdq xmm0, xmm5, 0x11
add edx, 0x10
pclmulqdq xmm2, xmm4, 0
cmp eax, 0xf
pxor xmm2, xmm1
pxor xmm0, xmm2
ja 0x452071
movdqa xmm1, xmmword [0x5421d0]
pxor xmm2, xmm2
test eax, eax
pclmulqdq xmm1, xmm0, 1
psrldq xmm0, 8
pxor xmm0, xmm1
pxor xmm1, xmm1
movss xmm2, xmm0
psrldq xmm0, 4
pclmulqdq xmm2, xmmword [0x5421e0], 0
pxor xmm0, xmm2
pxor xmm2, xmm2
movss xmm2, xmm0
pclmulqdq xmm2, xmmword [0x5421f0], 0x10
pblendw xmm2, xmm1, 0xfc
pclmulqdq xmm2, xmmword [0x542200], 0
pxor xmm2, xmm0
pextrd ecx, xmm2, 1
not ecx
je 0x45210b
push eax
call fcn.00451deb
add esp, 4
jmp 0x45210d
mov eax, ecx
pop ebp
ret
Function at 0x45408c
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov eax, dword [0x541008]
mov esi, ecx
test eax, eax
je 0x45418e
dec eax
push eax
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
jbe 0x4540ba
cmp dword [eax + 4], 0
mov edi, eax
jne 0x45417d
mov eax, dword [0x541008]
test eax, eax
je 0x45419d
dec eax
push eax
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
je 0x454182
mov edi, eax
test eax, eax
jne 0x45411d
mov al, byte [0x5c91e8]
mov ecx, 0x14
mov edx, 4
call fcn.0041aa20
test eax, eax
je 0x4541bb
mov dword [eax], 0x541008
mov dword [eax + 4], 0
mov edi, eax
mov eax, dword [0x541008]
test eax, eax
je 0x4541ac
dec eax
push edi
push eax
call sub.kernel32.dll_TlsSetValue
xor eax, eax
mov dl, 3
test esi, esi
je 0x454149
cmp dword [esi], 0
mov dword [esi], 0
je 0x454149
mov cl, byte [esi + 0xf]
mov eax, dword [esi + 4]
mov ebx, dword [esi + 8]
mov dl, byte [esi + 0xc]
movzx esi, word [esi + 0xd]
mov byte [ebp - 0xe], cl
mov word [ebp - 0x10], si
jmp 0x454149
mov ecx, dword [edi + 0xc]
mov dh, byte [edi + 0x10]
cmp dword [edi + 4], 0
mov dword [edi + 4], 1
mov dword [edi + 8], eax
mov dword [edi + 0xc], ebx
mov byte [edi + 0x10], dl
movzx eax, word [ebp - 0x10]
mov word [edi + 0x11], ax
mov al, byte [ebp - 0xe]
mov byte [edi + 0x13], al
je 0x45417d
cmp dh, 3
je 0x45417d
call fcn.00452c30
add edi, 8
jmp 0x454184
xor edi, edi
mov eax, edi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, 0x541008
call fcn.004832d0
jmp 0x4540a3
mov ecx, 0x541008
call fcn.004832d0
jmp 0x4540c8
mov ecx, 0x541008
call fcn.004832d0
jmp 0x454116
mov ecx, 4
mov edx, 0x14
call fcn.0041b1c0
ud2

Function at 0x4568ea
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov eax, dword [0x541018]
mov esi, ecx
test eax, eax
je 0x456998
dec eax
push eax
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
jbe 0x456915
cmp dword [eax + 4], 0
je 0x456915
add eax, 8
jmp 0x456994
mov eax, dword [0x541018]
test eax, eax
je 0x4569a7
dec eax
push eax
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
je 0x456981
mov edi, eax
test eax, eax
jne 0x45696c
mov al, byte [0x5c91e8]
mov ecx, 0xc
mov edx, 4
call fcn.0041aa20
test eax, eax
je 0x4569c2
mov dword [eax], 0x541018
mov dword [eax + 4], 0
mov edi, eax
mov eax, dword [0x541018]
test eax, eax
je 0x4569b6
dec eax
push edi
push eax
call sub.kernel32.dll_TlsSetValue
test esi, esi
je 0x456985
mov ecx, dword [esi]
mov dword [esi], 0
test ecx, ecx
je 0x456987
mov ecx, dword [esi + 4]
jmp 0x456987
xor eax, eax
jmp 0x456994
xor ecx, ecx
mov dword [edi + 4], 1
lea eax, [edi + 8]
mov dword [edi + 8], ecx
pop esi
pop edi
pop ebp
ret
mov ecx, 0x541018
call fcn.004832d0
jmp 0x4568ff
mov ecx, 0x541018
call fcn.004832d0
jmp 0x456923
mov ecx, 0x541018
call fcn.004832d0
jmp 0x456965
mov ecx, 4
mov edx, 0xc
call fcn.0041b1c0
ud2
Function at 0x456d38
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov eax, dword [0x541028]
mov edi, ecx
test eax, eax
je 0x456e28
dec eax
push eax
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
jbe 0x456d68
cmp dword [eax + 4], 0
mov esi, eax
je 0x456d68
add esi, 4
jmp 0x456e22
mov eax, dword [0x541028]
test eax, eax
je 0x456e37
dec eax
push eax
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
je 0x456e20
mov esi, eax
test eax, eax
jne 0x456dcb
mov al, byte [0x5c91e8]
mov ecx, 8
mov edx, 4
call fcn.0041aa20
test eax, eax
je 0x456e61
mov dword [eax], 0x541028
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0x541028]
test eax, eax
je 0x456e46
dec eax
push esi
push eax
call sub.kernel32.dll_TlsSetValue
test edi, edi
je 0x456ddb
mov eax, dword [edi]
mov dword [edi], 0
test eax, eax
jne 0x456e09
mov al, byte [0x5c91e8]
mov ecx, 0x18
mov edx, 4
call fcn.0041aa20
test eax, eax
je 0x456e55
xor ecx, ecx
inc ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
xor ecx, ecx
mov dword [eax + 0xc], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
add esi, 4
mov ecx, dword [esi]
mov dword [esi], eax
test ecx, ecx
je 0x456e22
lock dec dword [ecx]
jne 0x456e22
call fcn.0045604e
jmp 0x456e22
xor esi, esi
mov eax, esi
pop esi
pop edi
pop ebp
ret
mov ecx, 0x541028
call fcn.004832d0
jmp 0x456d4d
mov ecx, 0x541028
call fcn.004832d0
jmp 0x456d76
mov ecx, 0x541028
call fcn.004832d0
jmp 0x456dc4
mov ecx, 4
mov edx, 0x18
jmp 0x456e6b
mov ecx, 4
mov edx, 8
call fcn.0041b1c0
ud2
Function at 0x45f4ce
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov bl, byte [edx]
mov eax, ebx
and al, 3
cmp al, 1
jne 0x45f4f0
mov ebx, dword [edx]
lea esi, [edx + 1]
mov eax, ebx
shr eax, 2
and eax, 0x3f
jmp 0x45f4f6
mov esi, dword [edx + 4]
mov eax, dword [edx + 8]
test eax, eax
je 0x45f560
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], edx
mov edx, eax
neg eax
xor edi, edi
mov dword [ebp - 0x10], ecx
mov bl, byte [esi + edi]
movzx ecx, bl
cmp ecx, 0x3e
jg 0x45f528
cmp ecx, 0x21
je 0x45f553
cmp ecx, 0x3d
je 0x45f553
cmp ecx, 0x23
jne 0x45f537
jmp 0x45f5e4
cmp ecx, 0x7c
je 0x45f553
cmp ecx, 0x7e
je 0x45f553
cmp ecx, 0x3f
je 0x45f585
mov ecx, ebx
add cl, 0x9f
cmp cl, 0x1a
jb 0x45f553
mov ecx, ebx
add cl, 0xdc
cmp cl, 0x18
jb 0x45f553
and bl, 0xe0
cmp bl, 0x40
jne 0x45f5cd
inc edi
mov ecx, eax
add ecx, edi
jne 0x45f509
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
xor ebx, ebx
dec ebx
movsd xmm0, qword [edx]
movsd xmm1, qword [edx + 8]
movsd qword [ecx + 0xc], xmm1
movsd qword [ecx + 4], xmm0
mov word [ecx + 0x14], bx
mov byte [ecx], 0
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
cmp di, 0xffff
je 0x45f638
mov eax, edi
sub eax, edx
cmp eax, 0xffffffff
je 0x45f5c9
lea eax, [edi + 1]
movzx ebx, byte [esi + eax]
cmp ebx, 0x21
je 0x45f5c4
cmp ebx, 0x3d
je 0x45f5c4
cmp ebx, 0x23
je 0x45f646
mov ecx, ebx
add cl, 0xdc
cmp cl, 0x18
jb 0x45f5c4
add bl, 0xc1
cmp bl, 0x3f
ja 0x45f5cd
inc eax
cmp edx, eax
jne 0x45f59b
mov ebx, edi
jmp 0x45f63b
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
mov word [eax], 1
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.0041d4b8
xor ebx, ebx
mov eax, edi
dec ebx
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
and cl, 3
cmp cl, 1
jne 0x45f61f
mov ecx, dword [edx]
mov esi, ecx
shr esi, 2
and esi, 0x3f
cmp esi, eax
jb 0x45f617
cmp eax, 0xf
ja 0x45f64a
and ecx, 0xffffff03
shl eax, 2
or eax, ecx
mov dword [edx], eax
mov ecx, dword [ebp - 0x10]
jmp 0x45f563
cmp dword [edx + 8], eax
mov ecx, dword [ebp - 0x10]
jb 0x45f563
cmp dword [edx + 0xc], eax
jb 0x45f65b
mov dword [edx + 8], eax
jmp 0x45f563
xor ebx, ebx
dec ebx
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
jmp 0x45f563
mov ebx, edi
jmp 0x45f5e9
mov ecx, str.assertion_failed:_len___INLINE_CAP
mov edx, 0x23
push 0x5a3748
jmp 0x45f66a
mov ecx, 0x5a36f3
mov edx, 0x21
push 0x5a3714
call fcn.00445340
add esp, 4
ud2
Function at 0x46146d
Capabilities:
Decode data using base64 via dword translation table

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x44
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x50], ecx
mov ecx, 0xaaaaaaab
mov dword [ebp - 0x1c], edx
lea eax, [ebx*4]
mul ecx
call fcn.00461492

Function at 0x46f749
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov bl, byte [edx + 0x44]
mov edi, ecx
mov esi, edx
mov eax, ebx
add al, 0xfc
movzx ecx, al
cmp al, 3
mov eax, 3
cmovb eax, ecx
movzx eax, al
lea ecx, [eax - 2]
cmp ecx, 2
jae 0x46f78e
cmp dword [esi], 0
je 0x46f815
mov eax, dword [esi + 4]
mov edx, dword [eax]
and edx, 0xe
or edx, 1
jmp 0x46f818
test eax, eax
jne 0x46f81f
mov eax, dword [esi]
mov edx, 0
test eax, eax
mov dword [ebp - 0x14], eax
je 0x46f7ac
mov eax, dword [esi + 4]
mov edx, dword [eax]
and edx, 0xe
lea eax, [esi + 0x44]
mov ecx, esi
mov dword [ebp - 0x10], eax
call fcn.0046f884
mov edi, dword [edi]
xor eax, eax
lea ecx, [ebp - 0x20]
mov dword [ecx], eax
mov dword [ecx + 4], str.failed_to_write_whole_buffer
lea ecx, [ebp - 0x18]
mov dword [ecx], eax
lea ecx, [ebp - 0x24]
mov dword [ecx], eax
lea edx, [edi + 4]
push eax
push edx
lea eax, [ebp - 0x18]
push eax
push ecx
push 1
lea eax, [ebp - 0x20]
push eax
push dword [edi]
call sub.ws2_32.dll_WSARecv
cmp eax, 0xffffffff
je 0x46f827
je 0x46f83d
cmp byte [esi + 0x4c], 0
je 0x46f83d
mov edi, dword [ebp - 0x10]
cmp bl, 3
ja 0x46f808
push edi
call fcn.0045fe82
add esp, 4
cmp dword [ebp - 0x14], 0
mov byte [edi], 6
jne 0x46f77e
xor edx, edx
inc edx
mov ecx, esi
call fcn.0046f884
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
call sub.ws2_32.dll_WSAGetLastError
cmp eax, 0x3e5
jne 0x46f85a
mov esi, dword [ebp - 0x10]
cmp bl, 4
jb 0x46f845
jmp 0x46f84e
mov esi, dword [ebp - 0x10]
cmp bl, 3
ja 0x46f84e
push esi
call fcn.0045fe82
add esp, 4
mov byte [esi], 5
lock inc dword [edi + 0x8c]
jmp 0x46f81f
mov edi, dword [ebp - 0x10]
cmp bl, 3
ja 0x46f86f
push edi
mov ebx, eax
call fcn.0045fe82
mov eax, ebx
add esp, 4
cmp dword [ebp - 0x14], 0
mov dword [edi + 4], eax
mov dword [edi], 0
jne 0x46f77e
jmp 0x46f815
Function at 0x46ff38
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
cmp dword [edx + 0x10], 0
jne 0x470003
cmp dword [edx], 0
mov esi, edx
mov ebx, ecx
mov edx, 0
je 0x46ff61
mov eax, dword [esi + 4]
mov edx, dword [eax]
and edx, 0xe
lea eax, [esi + 0x10]
mov ecx, esi
mov dword [ebp - 0x10], eax
call fcn.0046f884
lea edi, [ebp - 0x24]
mov edx, esi
mov ecx, edi
push 0x10000
call fcn.0047005d
add esp, 4
mov eax, dword [edi + 4]
mov edx, dword [edi]
lea ecx, [ebp - 0x30]
mov dword [edi + 8], eax
mov edi, dword [ebx]
mov dword [ecx], eax
mov dword [ecx + 4], edx
xor edx, edx
lea eax, [ebp - 0x14]
lea ebx, [esi + 0x20]
lea ecx, [esi + 0xa0]
mov dword [eax], edx
lea eax, [ebp - 0x18]
mov dword [eax], edx
lea eax, [edi + 0xc8]
push edx
push eax
push ecx
push ebx
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
push 1
lea eax, [ebp - 0x30]
push eax
push dword [edi + 0xf8]
call sub.ws2_32.dll_WSARecvFrom
cmp eax, 0xffffffff
jne 0x46ffdd
call sub.ws2_32.dll_WSAGetLastError
cmp eax, 0x3e5
jne 0x47000b
mov ecx, dword [ebp - 0x10]
call fcn.0047013f
movsd xmm0, qword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
mov dword [esi + 0x10], 1
movsd qword [esi + 0x14], xmm0
mov dword [esi + 0x1c], eax
lock inc dword [edi + 0x100]
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, dword [ebp - 0x10]
mov ebx, eax
call fcn.0047013f
mov dword [esi + 0x10], 3
mov dword [esi + 0x18], ebx
mov dword [esi + 0x14], 0
cmp dword [esi], 0
je 0x470038
mov eax, dword [esi + 4]
mov edx, dword [eax]
and edx, 0xe
or edx, 1
jmp 0x47003b
xor edx, edx
inc edx
mov ecx, esi
call fcn.0046f884
mov eax, dword [ebp - 0x1c]
movsd xmm0, qword [ebp - 0x24]
lea edx, [ebp - 0x30]
mov ecx, esi
mov dword [edx + 8], eax
movsd qword [edx], xmm0
call fcn.00470178
jmp 0x470003
Function at 0x470729
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x34
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov esi, ecx
mov dword [ebp - 0x14], edx
mov eax, dword [edi]
test eax, eax
mov dword [ebp - 0x18], eax
je 0x470750
mov eax, dword [edi + 4]
mov edx, dword [eax]
and edx, 0xd
jmp 0x470752
xor edx, edx
mov ecx, edi
call fcn.0046f884
mov eax, dword [ebp - 0x14]
mov edx, dword [eax + 8]
cmp edx, ebx
jb 0x4707ed
mov ecx, dword [esi]
mov dword [ebp - 0x28], edx
lea esi, [ecx + 0x1c]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x30], esi
mov esi, dword [eax]
mov eax, dword [ecx]
mov dword [ebp - 0x2c], eax
mov al, byte [edi + 0x4c]
mov dword [ebp - 0x1c], esi
mov byte [ebp - 0xd], al
mov edi, edx
lea eax, [esi + ebx]
sub edi, ebx
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x3c], eax
xor eax, eax
mov dword [ebp - 0x20], eax
push eax
push dword [ebp - 0x30]
push eax
lea eax, [ebp - 0x20]
push eax
push 1
lea eax, [ebp - 0x40]
push eax
push dword [ebp - 0x2c]
call sub.ws2_32.dll_WSASend
cmp eax, 0xffffffff
je 0x4707bb
mov ecx, dword [ebp - 0x20]
xor eax, eax
inc eax
jmp 0x4707d0
call sub.ws2_32.dll_WSAGetLastError
cmp eax, 0x3e5
jne 0x47084d
mov ecx, dword [ebp - 0x34]
xor eax, eax
mov edx, dword [ebp - 0x28]
test eax, eax
je 0x4707fe
cmp byte [ebp - 0xd], 0
je 0x4707fe
cmp edi, ecx
je 0x470834
mov esi, dword [ebp - 0x1c]
add ebx, ecx
mov dword [ebp - 0x34], ecx
cmp edx, ebx
jae 0x470785
mov ecx, ebx
push 0x567b58
call fcn.00444cf0
add esp, 4
ud2
mov esi, dword [ebp + 0xc]
lea ecx, [esi + 0x10]
call fcn.00470373
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x24]
mov dword [esi + 0x10], 1
movsd xmm0, qword [eax]
mov eax, dword [eax + 8]
movsd qword [esi + 0x14], xmm0
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], ebx
lock inc dword [ecx + 0x8c]
jmp 0x4708d9
mov edi, dword [ebp - 0x1c]
cmp dword [ebp - 0x18], 0
mov esi, dword [ebp + 0xc]
je 0x47087e
mov eax, dword [esi + 4]
mov edx, dword [eax]
and edx, 0xd
or edx, 2
jmp 0x470883
mov edi, dword [ebp + 0xc]
mov esi, eax
lea ecx, [edi + 0x10]
call fcn.00470373
cmp dword [ebp - 0x18], 0
mov dword [edi + 0x10], 3
mov dword [edi + 0x18], esi
mov dword [edi + 0x14], 0
je 0x4708b2
mov eax, dword [edi + 4]
mov edx, dword [eax]
and edx, 0xd
or edx, 2
jmp 0x4708b7
mov edx, 2
mov ecx, esi
call fcn.0046f884
lea ecx, [esi + 0x10]
call fcn.00470373
mov eax, dword [ebp - 0x14]
mov dword [esi + 0x10], 0
cmp dword [eax + 4], 0
je 0x4708d9
push edi
push 0
push dword [0x5c9128]
call sub.kernel32.dll_HeapFree
jmp 0x4708d9
mov edx, 2
mov ecx, edi
call fcn.0046f884
mov ecx, dword [ebp - 0x14]
lea edx, [ebp - 0x40]
mov eax, dword [ecx + 8]
movsd xmm0, qword [ecx]
mov ecx, edi
mov dword [edx + 8], eax
movsd qword [edx], xmm0
call fcn.00470178
add esp, 0x34
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4708e1
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
cmp dword [ebp + 0xc], 0
mov esi, ecx
je 0x47092b
mov ecx, dword [edx + 0x10]
mov edi, edx
call fcn.0046f4c5
mov cl, byte [eax + 0x4c]
and dl, 1
add cl, 0xfc
movzx ebx, cl
cmp cl, 3
mov ecx, 3
cmovb ecx, ebx
cmp cl, 2
jae 0x47093a
mov dword [ebp - 0x14], 0
mov ebx, 0xd01
xor edi, edi
jmp 0x4709ce
mov dword [esi + 4], 0
mov byte [esi], 4
jmp 0x4709e6
mov ebx, eax
mov byte [ebp - 0xd], dl
lea edx, [eax + 8]
mov dword [ebp - 0x18], eax
movzx eax, cl
add edi, 0x10
add ebx, 0x4c
cmp eax, 2
jne 0x47099f
mov dword [ebp - 0x14], edx
mov edx, dword [ebp + 0xc]
mov eax, dword [edi]
mov ecx, 0x7fffffff
cmp edx, ecx
cmovb ecx, edx
push 0
push ecx
push dword [ebp + 8]
push dword [eax]
call sub.ws2_32.dll_recv
cmp eax, 0xffffffff
jne 0x470988
call sub.ws2_32.dll_WSAGetLastError
mov ecx, eax
xor eax, eax
cmp ecx, 0x274a
jne 0x4709ee
cmp eax, dword [ebp + 0xc]
mov dword [esi + 4], eax
mov byte [esi], 4
movzx edx, byte [ebp - 0xd]
mov ecx, dword [ebp - 0x18]
call fcn.004bee2a
jmp 0x4709e6
mov eax, dword [ebx]
mov ecx, dword [ebx + 4]
mov dword [ebx], 4
mov dword [ebx + 4], 0
mov ebx, eax
mov dword [ebp - 0x14], ecx
test bl, 0xfc
jne 0x470a1d
mov ecx, edi
call fcn.0046f749
mov edi, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
mov dl, byte [ebp - 0xd]
shr edi, 8
movzx edx, dl
mov ecx, eax
call fcn.004bee2a
movzx eax, byte [ebp - 0x14]
shl edi, 8
mov dword [esi], ebx
or eax, edi
mov dword [esi + 4], eax
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
cmp byte [ebx], 4
mov dword [ebp - 0x1c], ecx
jae 0x4709ff
push ebx
call fcn.0045fe82
add esp, 4
mov edx, dword [ebp - 0x14]
mov ecx, edi
mov byte [ebx], 4
call fcn.0046f749
mov eax, dword [ebp - 0x1c]
mov dword [esi], 0
mov dword [esi + 4], eax
jmp 0x470991
mov ecx, 0x5a3cc0
mov edx, 0xe
push 0x567b38
call fcn.0046a13b
add esp, 4
ud2
Function at 0x471cd2
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x28
mov esi, dword [ecx]
mov edi, edx
lea ebx, [ebp - 0x34]
mov ecx, ebx
mov eax, dword [esi + 0x3c]
lea edx, [esi + 0x3c]
mov eax, dword [eax]
and eax, 0xd
push eax
call fcn.0046ecae
add esp, 4
cmp byte [ebx], 4
jne 0x471e58
mov edx, dword [edi + 8]
mov ecx, dword [ebp + 8]
mov eax, edx
sub eax, ecx
jb 0x471e83
mov dword [ebp - 0x10], edi
mov edi, dword [edi]
mov edx, esi
add esi, 0x84
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x24], edi
add ecx, edi
mov edi, dword [edx + 0x38]
push esi
push 0
push eax
push ecx
push edi
call sub.kernel32.dll_WriteFile
mov ebx, eax
test eax, eax
je 0x471d44
mov al, 4
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], eax
jmp 0x471d65
call sub.kernel32.dll_GetLastError
cmp eax, 0x3e5
mov dword [ebp - 0x14], 0
jne 0x471db4
mov dword [ebp - 0x1c], 0x3e5
mov dword [ebp - 0x18], 0
xor eax, eax
lea ecx, [ebp - 0x2c]
mov dword [ecx], eax
push eax
push ecx
push esi
push edi
call sub.kernel32.dll_GetOverlappedResult
test eax, eax
je 0x471d8c
mov eax, dword [ebp - 0x2c]
mov esi, dword [ebp - 0x10]
mov edi, dword [ebp + 0xc]
xor ecx, ecx
inc ecx
mov dword [ebp - 0x14], ecx
mov cl, 1
jmp 0x471dc5
call sub.kernel32.dll_GetLastError
mov esi, dword [ebp - 0x10]
mov edi, dword [ebp + 0xc]
cmp eax, 0x3e4
jne 0x471dbc
xor ecx, ecx
mov edx, eax
mov dword [ebp - 0x14], 0
call fcn.004c35f2
mov cl, 1
xor eax, eax
jmp 0x471dc5
mov esi, dword [ebp - 0x10]
mov edi, dword [ebp + 0xc]
jmp 0x471e13
xor ecx, ecx
mov dword [ebp - 0x14], 0
test ebx, ebx
jne 0x471ddf
mov dword [ebp - 0x10], ecx
movzx ecx, byte [ebp - 0x18]
mov edx, dword [ebp - 0x1c]
mov ebx, eax
call fcn.004c35f2
mov ecx, dword [ebp - 0x10]
mov eax, ebx
mov ebx, dword [ebp + 8]
test cl, cl
je 0x471e13
lea ecx, [edi + 0x14]
call fcn.004717e3
movsd xmm0, qword [esi]
mov eax, dword [esi + 8]
mov ecx, dword [ebp - 0x20]
mov dword [edi + 0x14], 1
mov dword [edi + 0x18], ebx
movsd qword [edi + 0x1c], xmm0
mov dword [edi + 0x24], eax
lock inc dword [ecx + 0xa0]
jmp 0x471e50
lea ecx, [edi + 0x14]
mov ebx, eax
call fcn.004717e3
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x20]
mov edx, 2
mov dword [edi + 0x14], 3
mov dword [edi + 0x1c], ebx
mov dword [edi + 0x18], eax
call fcn.00471f47
cmp dword [esi + 4], 0
je 0x471e50
push dword [ebp - 0x24]
push 0
push dword [0x5c9128]
call sub.kernel32.dll_HeapFree
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
movsd xmm0, qword [ebp - 0x34]
lea eax, [ebp - 0x2c]
mov ecx, 0x567da6
mov edx, 0x15
movsd qword [eax], xmm0
push 0x567e38
push 0x567d18
push eax
call fcn.00447310
add esp, 0xc
ud2
push 0x567e48
call fcn.00444cf0
add esp, 4
ud2
Function at 0x4745d1
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
push str.api_ms_win_core_synch_l1_2_0.dll
call sub.kernel32.dll_GetModuleHandleA
test eax, eax
je 0x474615
mov edi, eax
push str.WaitOnAddress
push eax
call sub.kernel32.dll_GetProcAddress
test eax, eax
je 0x474615
mov esi, eax
push str.WakeByAddressSingle
push edi
call sub.kernel32.dll_GetProcAddress
test eax, eax
je 0x474615
mov ebx, eax
mov dword [ebp - 0x10], 0
jmp 0x474683
push str.ntdll.dll
call sub.kernel32.dll_GetModuleHandleA
test eax, eax
je 0x4746dd
mov esi, eax
push str.NtCreateKeyedEvent
push eax
call sub.kernel32.dll_GetProcAddress
test eax, eax
je 0x4746dd
mov ebx, eax
push str.NtReleaseKeyedEvent
push esi
call sub.kernel32.dll_GetProcAddress
test eax, eax
je 0x4746dd
mov edi, eax
push str.NtWaitForKeyedEvent
push esi
call sub.kernel32.dll_GetProcAddress
test eax, eax
je 0x4746dd
mov esi, eax
lea eax, [ebp - 0x14]
xor ecx, ecx
mov dword [eax], 0x1010101
push ecx
push ecx
push 0xc0000000
push eax
call ebx
test eax, eax
jne 0x4746dd
mov ebx, dword [ebp - 0x14]
mov dword [ebp - 0x10], edi
mov al, byte [0x5c91e8]
mov ecx, 0xc
mov edx, 4
call fcn.0041aa20
test eax, eax
je 0x4746f6
mov edi, eax
mov eax, dword [ebp - 0x10]
mov dword [edi], eax
mov dword [edi + 4], esi
mov dword [edi + 8], ebx
xor eax, eax
lock cmpxchg dword [0x5c9080], edi
je 0x4746d3
cmp dword [edi], 0
mov esi, eax
je 0x4746c3
push dword [edi + 8]
call sub.kernel32.dll_CloseHandle
push edi
push 0
push dword [0x5c9128]
call sub.kernel32.dll_HeapFree
mov edi, esi
mov eax, edi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, str.parking_lot_requires_either_NT_Keyed_Events__WinXP__or_WaitOnAddress_WakeByAddress__Win8__home_vi_.cargo_registry_src_index.crates.io_6f17d22bba15001f_parking_lot_core_0.6.3_src_thread_parker_windows_mod.rs
mov edx, 0x5b
push 0x568688
call fcn.00474707
add esp, 4
ud2
mov ecx, 4
mov edx, 0xc
call fcn.0041b1c0
ud2
Function at 0x474eb5
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x1c
mov eax, dword [0x54107c]
test eax, eax
je 0x474f8b
dec eax
push eax
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
jbe 0x474ee2
cmp dword [eax + 4], 0
mov esi, eax
jne 0x474f7b
mov eax, dword [0x54107c]
test eax, eax
je 0x474f9a
dec eax
push eax
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
je 0x474f80
mov esi, eax
test eax, eax
jne 0x474f41
mov al, byte [0x5c91e8]
mov ecx, 0x20
mov edx, 4
call fcn.0041aa20
test eax, eax
je 0x474fb5
mov dword [eax], 0x54107c
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0x54107c]
test eax, eax
je 0x474fa9
dec eax
push esi
push eax
call sub.kernel32.dll_TlsSetValue
lea edi, [ebp - 0x24]
mov ecx, edi
call fcn.00474725
movsd xmm1, qword [edi + 8]
movsd xmm0, qword [edi]
cmp dword [esi + 4], 0
movsd qword [esi + 0xc], xmm1
movsd xmm1, qword [edi + 0x10]
movsd qword [esi + 0x14], xmm1
mov eax, dword [edi + 0x18]
movsd qword [esi + 4], xmm0
mov dword [esi + 0x1c], eax
je 0x474f7b
lock dec dword [0x5c9078]
add esi, 4
jmp 0x474f82
xor esi, esi
mov eax, esi
add esp, 0x1c
pop esi
pop edi
pop ebp
ret
mov ecx, 0x54107c
call fcn.004832d0
jmp 0x474ecb
mov ecx, 0x54107c
call fcn.004832d0
jmp 0x474ef0
mov ecx, 0x54107c
call fcn.004832d0
jmp 0x474f3a
mov ecx, 4
mov edx, 0x20
call fcn.0041b1c0
ud2