joyce8/EMBER2024-capa huggingface dataset:
Function at 0x438fe4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x60
mov edi, edx
mov edx, dword [esp + 0x7c]
mov dword [esp + 0x54], ecx
call 0x438ffa
pop eax
lea ebx, [esp + 0x18]
mov dword [esp + 0x58], eax
mov ecx, edx
neg ecx
cmovs ecx, edx
xor ebp, ebp
mov dword [esp + 0x5c], ecx
cmp ebp, dword [esp + 0x5c]
jge 0x4392e8
cmp dword [esp + 0x7c], 0
mov ecx, edi
jle 0x439069
call fcn.00431d0e
test al, al
jne 0x4392e8
cmp byte [esp + 0x78], 0
je 0x4390bf
mov eax, dword [edi + 0x10]
movsd xmm0, qword [edi]
movsd xmm1, qword [edi + 8]
mov ecx, esp
mov edx, ebx
mov dword [esp + 0x28], eax
movsd qword [esp + 0x20], xmm1
movsd qword [esp + 0x18], xmm0
push dword [esp + 0x74]
call fcn.00439364
jmp 0x439102
call fcn.00431b2e
test al, al
jne 0x4392e8
mov eax, dword [edi + 0x10]
movsd xmm0, qword [edi]
movsd xmm1, qword [edi + 8]
cmp dword [esp + 0x74], 6
mov dword [esp + 0x28], eax
movsd qword [esp + 0x20], xmm1
movsd qword [esp + 0x18], xmm0
ja 0x439140
mov eax, dword [esp + 0x74]
mov eax, dword [eax*4 + 0x439348]
add eax, dword [esp + 0x58]
jmp eax
mov eax, dword [edi + 0x10]
movsd xmm0, qword [edi]
movsd xmm1, qword [edi + 8]
cmp dword [esp + 0x74], 6
mov dword [esp + 0x3c], eax
movsd qword [esp + 0x34], xmm1
movsd qword [esp + 0x2c], xmm0
ja 0x439140
mov eax, dword [esp + 0x74]
mov eax, dword [eax*4 + 0x43932c]
add eax, dword [esp + 0x58]
jmp eax
pop eax
mov edx, dword [esp]
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
test edx, edx
je 0x439315
mov esi, dword [esp + 0xc]
mov dword [edi], edx
mov dword [edi + 4], eax
mov ebx, dword [esp + 0x10]
inc ebp
mov dword [edi + 8], ecx
mov dword [esp + 0x14], esi
mov dword [edi + 0x10], ebx
mov esi, ebp
lea ebx, [esp + 0x18]
mov eax, dword [esp + 0x14]
mov dword [edi + 0xc], eax
jmp 0x439010
call fcn.00438f26
mov dword [esp + 4], eax
mov dword [esp + 8], edx
and dword [esp], 0
jmp 0x439103
mov eax, ebp
mov ecx, dword [edi + 0x10]
mov edx, dword [esp + 0x54]
movsd xmm0, qword [edi]
movsd xmm1, qword [edi + 8]
neg eax
cmp dword [esp + 0x7c], 0
mov dword [edx + 0x10], ecx
movsd qword [edx + 8], xmm1
movsd qword [edx], xmm0
cmovg eax, ebp
mov dword [edx + 0x14], eax
jmp 0x439322
mov edx, dword [esp + 0x54]
mov dword [edx + 4], eax
mov dword [edx + 8], ecx
and dword [edx], 0
add esp, 0x60
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x43bd37
Capabilities:
Open clipboard

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov esi, ecx
mov dword [esp], edx
push 0xfffffffffffffffb
pop ebp
mov edi, dword [sym.imp.kernel32.dll_GetLastError]
push 2
pop ebx
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
jne 0x43bd68
call edi
test ebp, ebp
je 0x43bd71
push 5
call sub.kernel32.dll_Sleep
inc ebp
jmp 0x43bd4d
mov eax, dword [esp]
mov dword [esi + 4], eax
push 5
pop ebx
mov dword [esi], ebx
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4477b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, edx
mov edx, dword [esp + 0x14]
mov ebp, dword [esp + 0x20]
xor esi, esi
lea edx, [eax + edx*2]
movzx ebx, byte [eax + 1]
cmp byte [eax], ch
lea eax, [eax + 2]
lea edi, [esi + ebx]
jne 0x447800
cmp edi, esi
jb 0x447868
cmp edi, dword [esp + 0x1c]
ja 0x44787b
add esi, dword [esp + 0x18]
nop word [eax + eax]
test ebx, ebx
je 0x447802
dec ebx
cmp byte [esi], cl
lea esi, [esi + 1]
jne 0x4477f0
jmp 0x44785f
ja 0x447808
cmp eax, edx
mov esi, edi
jne 0x4477c3
mov edi, dword [esp + 0x24]
movzx ecx, cx
mov al, 1
add edi, ebp
nop word cs:[eax + eax]
nop dword [eax]
movzx edx, byte [ebp]
lea esi, [ebp + 1]
test dl, dl
js 0x447840
mov ebp, esi
sub ecx, edx
jns 0x447857
jmp 0x447861
cmp esi, edi
je 0x447890
movzx esi, byte [ebp + 1]
and edx, 0x7f
add ebp, 2
shl edx, 8
or edx, esi
sub ecx, edx
js 0x447861
xor al, 1
cmp ebp, edi
jne 0x447820
jmp 0x447861
xor eax, eax
and al, 1
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, esi
mov edx, edi
push 0x7ffe10
call fcn.0063cf70
add esp, 4
ud2
mov edx, dword [esp + 0x1c]
mov ecx, edi
push 0x7ffe10
call fcn.0063cd00
add esp, 4
ud2
mov ecx, 0xa3a547
mov edx, 0x2b
push 0x7ffe20
call fcn.0063cd70
add esp, 4
ud2
Function at 0x44d42d
Capabilities:
Hash data with crc32

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov eax, edx
mov edx, dword [esp + 0x18]
mov ebx, ecx
not ebx
cmp edx, 0x40
jb 0x44d554
push 4
pop edi
sub edi, 1
jb 0x44d43c
cmp edx, 0xf
jbe 0x44d564
movzx ebp, byte [eax + 0xe]
movzx esi, byte [eax + 0xf]
mov ecx, ebx
mov dword [esp], edx
mov edx, 0xff
shr ecx, 0x18
mov ebp, dword [ebp*4 + 0x806894]
xor ebp, dword [esi*4 + 0x806494]
movzx esi, byte [eax + 0xd]
xor ebp, dword [esi*4 + 0x806c94]
movzx esi, byte [eax + 0xc]
xor ebp, dword [esi*4 + 0x807094]
movzx esi, byte [eax + 0xb]
xor ebp, dword [esi*4 + 0x807494]
movzx esi, byte [eax + 0xa]
xor ebp, dword [esi*4 + 0x807894]
movzx esi, byte [eax + 9]
xor ebp, dword [esi*4 + 0x807c94]
movzx esi, byte [eax + 8]
xor ebp, dword [esi*4 + 0x808094]
movzx esi, byte [eax + 7]
xor ebp, dword [esi*4 + 0x808494]
movzx esi, byte [eax + 6]
xor ebp, dword [esi*4 + 0x808894]
movzx esi, byte [eax + 5]
xor ebp, dword [esi*4 + 0x808c94]
movzx esi, byte [eax + 4]
xor ebp, dword [esi*4 + 0x809094]
movzx esi, byte [eax + 3]
xor ecx, esi
mov esi, ebx
xor ebp, dword [ecx*4 + 0x809494]
movzx ecx, byte [eax + 2]
shr esi, 0x10
and esi, edx
xor esi, ecx
movzx ecx, byte [eax + 1]
xor ebp, dword [esi*4 + 0x809894]
mov esi, ebx
and ebx, edx
shr esi, 8
and esi, edx
mov edx, dword [esp]
xor esi, ecx
movzx ecx, byte [eax]
xor ebp, dword [esi*4 + 0x809c94]
xor ebx, ecx
mov ecx, eax
xor ebp, dword [ebx*4 + 0x80a094]
push 0x806484
call fcn.0044d9cb
pop ecx
mov ebx, ebp
jmp 0x44d448
mov cl, byte [eax]
inc eax
dec edx
xor cl, bl
shr ebx, 8
movzx esi, cl
xor ebx, dword [esi*4 + 0x806494]
test edx, edx
jne 0x44d541
not ebx
mov eax, ebx
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
push 0xf
pop ecx
push 0x806474
call fcn.0063cc20
pop eax
ud2

Function at 0x44dfa9
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
mov ecx, 0xa6f22c
call fcn.004b2dd8
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jbe 0x44dfce
cmp dword [eax + 4], 0
mov edi, eax
je 0x44dfce
add edi, 8
jmp 0x44e039
mov ecx, 0xa6f22c
call fcn.004b2dd8
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x44e037
mov esi, eax
test eax, eax
jne 0x44e013
push 0xc
pop ecx
push 4
pop edx
call fcn.00401e40
mov dword [eax], 0xa6f22c
and dword [eax + 4], 0
mov ecx, 0xa6f22c
mov esi, eax
call fcn.004b2dd8
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
call fcn.0044da12
call fcn.0044da6e
mov ecx, dword [esi + 4]
mov edx, dword [esi + 8]
mov dword [esi + 4], 1
lea edi, [esi + 8]
mov dword [esi + 8], eax
call fcn.0044daf3
jmp 0x44e039
xor edi, edi
mov eax, edi
pop esi
pop edi
ret
Function at 0x44e1c9
Capabilities:
Get common file path

Disassembly:
push edi
push esi
push eax
mov edi, esp
mov esi, ecx
and dword [edi], 0
push edi
push 0
push 0
push edx
call dword [sym.imp.shell32.dll_SHGetKnownFolderPath]
test eax, eax
mov eax, dword [edi]
je 0x44e1f2
push eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov byte [esi + 0xc], 2
jmp 0x44e20e
push eax
call dword [sym.imp.kernel32.dll_lstrlenW]
mov edx, dword [esp]
mov ecx, esi
push eax
call fcn.005e0460
pop eax
push dword [esp]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
add esp, 4
pop esi
pop edi
ret

Function at 0x45003e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xb8
lea eax, [ecx + 0x58]
mov dword [esp + 4], ecx
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 0x18]
mov edx, 0x80b898
call fcn.0045019f
mov ecx, dword [eax + 0xc]
test ecx, ecx
je 0x450195
mov esi, dword [eax + 8]
mov ebx, dword [eax + 4]
lea edi, [esi + 1]
cmp edi, ebx
mov edi, 0
cmovb ebx, edi
dec ecx
neg ebx
lea edi, [esi + ebx + 1]
mov ebx, dword [eax]
mov dword [eax + 8], edi
mov dword [eax + 0xc], ecx
imul eax, esi, 0x58
lea esi, [ebx + eax + 0x1c]
mov ecx, dword [esi - 0x18]
mov eax, dword [esi - 0x1c]
movsd xmm0, qword [esi - 0x14]
mov ebx, dword [esi - 8]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esi - 0xc]
mov dword [esp + 8], ecx
mov ecx, dword [esi - 4]
mov dword [esp + 0xc], ecx
push 0xf
pop ecx
lea edi, [esp + 0x78]
rep movsd dword es:[edi], dword [esi]
inc dword [edx]
cmp eax, 0x13
je 0x450118
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0xc]
cmp eax, 0x14
je 0x450197
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x24], eax
movsd qword [esp + 0x28], xmm0
mov dword [esp + 0x30], edx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ecx
push 0xf
pop ecx
lea edi, [esp + 0x3c]
lea esi, [esp + 0x78]
lea edx, [esp + 0x20]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 4]
call fcn.0044fd24
jmp 0x450058
lea ecx, [esp + 0x10]
mov dword [esp + 0x20], 0xa
mov eax, dword [esp + 8]
and dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0x1b
movsd qword [esp + 0x30], xmm0
mov edi, dword [esp + 0xc]
lea edx, [esp + 0x20]
mov dword [esp + 0x38], ecx
mov ecx, dword [esp + 4]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
mov dword [esp + 0x68], edi
call fcn.0044fd24
push 0xffffffffffffffeb
push edi
call dword [sym.imp.user32.dll_GetWindowLongW]
mov ecx, dword [eax + 8]
call fcn.004501d0
mov esi, dword [eax + 0xbc]
movzx edx, dl
mov ecx, eax
call fcn.00608264
mov ecx, esi
mov edx, edi
push dword [esp + 0x14]
push dword [esp + 0x14]
call fcn.006262af
pop eax
pop ecx
jmp 0x450058
inc dword [edx]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x473841
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 8
pop eax
xor edx, edx
lock cmpxchg dword [ecx], edx
jne fcn.00640dd2
ret
Function at 0x47901d
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x78
mov dword [esp], ecx
lea ecx, [esp + 4]
mov edi, edx
call fcn.00628c06
lea ecx, [esp + 4]
call fcn.00479485
test ax, ax
je 0x4790a6
movzx esi, dx
push 0
push esi
call dword [sym.imp.user32.dll_MapVirtualKeyA]
mov ecx, esi
mov ebx, eax
call fcn.00625a34
mov esi, eax
call fcn.00626160
mov ecx, dword [esp]
lea edx, [esp + 0x18]
mov dword [esp + 0x60], ecx
mov cl, 1
and dword [esp + 0x24], 0
mov dword [esp + 0x20], 0xd
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], eax
mov byte [esp + 0x34], cl
and dword [esp + 0x38], 0
mov byte [esp + 0x3c], cl
mov dword [esp + 0x18], 0xa
mov ecx, dword [edi + 0xc]
call fcn.00478e7c
jmp 0x479037
lea ecx, [esp + 4]
call fcn.004bb4b2
mov ecx, dword [edi + 8]
call fcn.004501d0
and dword [eax + 0xb8], 0
movzx edx, dl
mov ecx, eax
call fcn.00608264
mov esi, dword [esp]
lea ebx, [esp + 0x18]
mov dword [ebx + 0x48], esi
and dword [ebx + 0xc], 0
mov dword [ebx + 8], 0xe
and dword [ebx + 0x10], 0
push 0xa
pop eax
mov dword [ebx], eax
mov edx, ebx
mov ecx, dword [edi + 0xc]
call fcn.00478e7c
mov dword [ebx + 0x48], esi
and dword [ebx + 0xc], 0
mov dword [ebx + 8], 0xc
mov byte [ebx + 0x10], 0
push 0xa
pop eax
mov dword [ebx], eax
lea edx, [esp + 0x18]
mov ecx, dword [edi + 0xc]
call fcn.00478e7c
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x47911b
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x80
mov dword [esp], ecx
lea ecx, [esp + 0xc]
mov dword [esp + 4], edx
call fcn.00628c06
mov ebx, dword [esp]
mov edi, dword [esp + 4]
lea ecx, [esp + 0xc]
call fcn.00479485
test ax, ax
je 0x4791bc
movzx esi, dx
push 0
push esi
call dword [sym.imp.user32.dll_MapVirtualKeyA]
mov ecx, esi
mov dword [esp + 8], eax
call fcn.00625a34
mov ecx, ebx
mov edx, edi
mov esi, eax
call fcn.00478eb1
call fcn.00626160
mov ecx, dword [esp + 8]
mov dword [esp + 0x68], ebx
and dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0xd
mov dword [esp + 0x30], esi
lea edx, [esp + 0x20]
mov dword [esp + 0x34], ecx
mov cl, 1
mov dword [esp + 0x38], eax
mov byte [esp + 0x3c], cl
and dword [esp + 0x40], 0
mov byte [esp + 0x44], cl
mov dword [esp + 0x20], 0xa
mov ecx, dword [edi + 0xc]
call fcn.00478e7c
jmp 0x479141
lea ecx, [esp + 0xc]
call fcn.004bb4b2
mov eax, dword [esp]
mov ecx, dword [esp + 4]
lea edx, [esp + 0x20]
mov dword [edx + 0x48], eax
and dword [edx + 0xc], 0
mov dword [edx + 8], 0xc
mov byte [edx + 0x10], 1
mov dword [edx], 0xa
mov ecx, dword [ecx + 0xc]
call fcn.00478e7c
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x47c96e
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x40
mov ebp, ecx
mov ecx, 0xa6f23c
call fcn.004b2dd8
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jbe 0x47c99d
cmp dword [eax + 4], 0
mov esi, eax
je 0x47c99d
add esi, 8
jmp 0x47ca8f
mov ecx, 0xa6f23c
call fcn.004b2dd8
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x47ca32
mov ebx, eax
test eax, eax
jne 0x47c9e2
push 0x28
pop ecx
push 4
pop edx
call fcn.004a3937
mov dword [eax], 0xa6f23c
and dword [eax + 4], 0
mov ecx, 0xa6f23c
mov ebx, eax
call fcn.004b2dd8
push ebx
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
xor edx, edx
lea esi, [ebx + 4]
test ebp, ebp
je 0x47ca36
mov dword [esp], esi
push 9
pop ecx
lea eax, [esp + 0x1c]
mov esi, ebp
mov edi, eax
rep movsd dword es:[edi], dword [esi]
and dword [ebp], 0
cmp dword [eax], 0
je 0x47ca3b
movsd xmm0, qword [esp + 0x28]
movsd xmm2, qword [esp + 0x30]
movsd xmm1, qword [esp + 0x38]
mov edx, dword [esp + 0x20]
mov ebp, dword [esp + 0x24]
movsd qword [esp + 4], xmm0
movsd qword [esp + 0xc], xmm2
movsd qword [esp + 0x14], xmm1
jmp 0x47ca49
xor esi, esi
jmp 0x47ca8f
push 3
pop ebp
jmp 0x47ca4c
lea ecx, [esp + 0x1c]
call fcn.0047b003
xor edx, edx
push 3
pop ebp
mov esi, dword [esp]
push 9
pop ecx
lea eax, [esp + 0x1c]
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov dword [ebx + 4], 1
mov dword [ebx + 8], edx
mov dword [ebx + 0xc], ebp
mov ecx, eax
lea esi, [ebx + 8]
movsd xmm0, qword [esp + 4]
movsd xmm1, qword [esp + 0xc]
movsd qword [ebx + 0x10], xmm0
movsd qword [ebx + 0x18], xmm1
movsd xmm0, qword [esp + 0x14]
movsd qword [ebx + 0x20], xmm0
call fcn.0047b003
mov eax, esi
add esp, 0x40
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x48a8a6
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x198
mov edi, ecx
mov ecx, edx
mov esi, edx
call fcn.004825df
mov eax, dword [esi + 0x100]
movzx ecx, byte [esi + 0xbd]
mov dword [esp + 0x24], edi
movss xmm1, dword [eax + 0x74]
cmp ecx, 1
je 0x48a8ed
test ecx, ecx
jne 0x48a8e3
xor ecx, ecx
jmp 0x48a8ed
cmp byte [esi + 0xbc], 2
sete cl
lea ebx, [esp + 0x78]
mov dword [ebx], 0x1000000
mov byte [ebx + 4], 1
mov byte [ebx + 5], cl
movss xmm2, dword [eax + 0x3c]
movss xmm3, dword [eax + 0x40]
movss dword [esp + 0x1c], xmm2
movss dword [esp + 0x20], xmm3
sub esp, 4
lea edi, [esp + 0x3c]
mov edx, esi
movss dword [esp], xmm3
movss dword [esp + 0x1c], xmm0
movss dword [esp + 0x18], xmm1
mov ecx, edi
call fcn.00482608
pop eax
movsd xmm0, qword [edi]
movsd xmm1, qword [edi + 8]
lea edi, [esp + 0x80]
lea ecx, [esp + 0x48]
mov edx, esi
movsd qword [edi + 8], xmm1
movsd qword [edi], xmm0
movss xmm0, dword [esp + 0x18]
movss xmm1, dword [esp + 0x14]
push edi
call fcn.00482b64
pop eax
mov ecx, edi
mov edx, esi
push ebx
lea ebx, [esp + 0x4c]
push ebx
call fcn.00489744
pop eax
pop ecx
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
push edi
call fcn.00488528
pop eax
movsd xmm0, qword [edi + 0x88]
movsd xmm1, qword [edi + 0x90]
lea edx, [esp + 0x28]
mov ecx, esi
movsd qword [esp + 8], xmm1
movsd qword [esp], xmm0
movsd qword [edx + 8], xmm1
movsd qword [ebx + 8], xmm1
movsd qword [edx], xmm0
movsd qword [ebx], xmm0
movss xmm0, dword [esp + 0x1c]
movss xmm1, dword [esp + 0x20]
push ebx
call fcn.00482cb0
pop eax
mov eax, dword [esi + 0x100]
cmp byte [eax + 0x214], 0
je 0x48aaa2
movsd xmm0, qword [esp]
movsd xmm1, qword [esp + 8]
lea edx, [esp + 0x48]
mov ecx, esi
movsd qword [edx + 8], xmm1
movsd qword [edx], xmm0
call fcn.00483404
test al, al
je 0x48aaa2
mov edx, dword [esi + 0xe0]
lea ebx, [esp + 0x48]
mov ecx, ebx
call fcn.0048207b
movsd xmm0, qword [esp + 0x38]
lea edi, [esp + 0x28]
movsd xmm1, qword [esp + 0x40]
mov eax, 0xffe6d8ad
mov ecx, ebx
mov edx, edi
movsd qword [edi], xmm0
movss xmm0, dword [0x6460f4]
movsd qword [edi + 8], xmm1
push eax
mov eax, 0x3f800000
push eax
call fcn.0048209a
pop eax
pop ecx
movsd xmm0, qword [esp]
movsd xmm1, qword [esp + 8]
mov eax, 0xffe6d8ad
lea edx, [esp + 0x28]
mov ecx, ebx
movsd qword [edi], xmm0
movss xmm0, dword [0x6460f4]
movsd qword [edi + 8], xmm1
mov edi, ebx
push eax
lea ebx, [esp + 0x4c]
mov eax, 0x3f800000
push eax
call fcn.0048209a
pop eax
pop ecx
mov ecx, esi
mov edx, edi
push 0x811da9
call fcn.00483528
pop eax
lea ecx, [esp + 0x68]
call fcn.0041a650
movsd xmm0, qword [esp]
movsd xmm1, qword [esp + 8]
mov ecx, dword [esp + 0x24]
lea edi, [esp + 0x80]
mov edx, esi
movsd qword [esp + 0x50], xmm1
movsd qword [esp + 0x48], xmm0
push 0
push dword [edi + 0xf4]
push dword [edi + 0xf0]
push ebx
call fcn.0047f92e
add esp, 0x10
mov ecx, edi
call fcn.00488b3a
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x48d6a3
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push edi
push esi
lea edi, [ecx + 8]
mov esi, ecx
mov ebx, edx
mov ecx, edi
call fcn.0047e405
mov byte [esi + 0x4ec], bl
mov ecx, edi
pop esi
pop edi
pop ebx
jmp fcn.00473841
Function at 0x493ec9
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push edi
push esi
lea esi, [ecx + 8]
mov ebx, ecx
mov edi, edx
mov ecx, esi
call fcn.0047e405
add ebx, 0x20c
mov ecx, ebx
call fcn.0048a4f6
add eax, 0xa4
push 0x158
push edi
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov ecx, esi
pop esi
pop edi
pop ebx
jmp fcn.00473841
Function at 0x4b1e3c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x8c
mov edi, edx
mov dword [esp], ecx
lea eax, [edx + 0x48]
lea esi, [edx + 0x78]
lea ecx, [edx + 0x9c]
mov dword [esp + 4], edx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], esi
mov dword [esp + 8], ecx
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x38]
call fcn.004b2178
cmp dword [esp + 0x38], 0
jne 0x4b1ffb
cmp dword [edi], 2
mov eax, 0
cmove edi, eax
je 0x4b1fe7
lea esi, [edi + 0x10]
lea ebp, [edi + 4]
lea ecx, [esp + 0x2c]
mov edx, esi
call fcn.004b21cd
cmp dword [esp + 0x2c], 0
jne 0x4b1ee0
mov ebx, dword [edi]
test ebx, ebx
cmovne ebx, ebp
je 0x4b1ed2
mov ecx, ebx
call fcn.004b1d72
test eax, eax
je 0x4b1ed2
mov eax, dword [ebx + 8]
mov dword [edi + 0x10], 1
and dword [edi + 0x14], 0
mov dword [edi + 0x18], eax
mov dword [edi + 0x1c], edx
jmp 0x4b1e96
lea edx, [edi + 0x20]
lea ecx, [esp + 0x20]
call fcn.004b21cd
jmp 0x4b1ef4
mov eax, dword [esp + 0x34]
movsd xmm0, qword [esp + 0x2c]
mov dword [esp + 0x28], eax
movsd qword [esp + 0x20], xmm0
cmp dword [esp + 0x20], 0
je 0x4b1fe7
lea edx, [edi + 0x30]
lea ecx, [esp + 0x5c]
push dword [esp + 0x28]
push dword [esp + 0x28]
call fcn.004b1700
pop eax
pop ecx
mov eax, dword [esp + 0x5c]
mov esi, dword [esp + 0x68]
mov ebx, dword [edi + 0x40]
mov ebp, dword [esp + 0x64]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x60]
mov ecx, esi
mov edx, ebx
mov dword [esp + 0x18], eax
mov eax, dword [edi + 0x3c]
mov dword [esp + 0x14], eax
call fcn.004b1836
mov edi, dword [esp + 4]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x1c]
movsd xmm0, qword [esp + 0x50]
movsd xmm1, qword [esp + 0x40]
movsd xmm2, qword [esp + 0x6c]
mov dword [edi + 0x48], 1
and dword [edi + 0x4c], 0
mov dword [edi + 0x50], eax
mov dword [edi + 0x54], esi
mov dword [edi + 0x58], ebx
mov dword [edi + 0x5c], ebp
mov dword [edi + 0x60], esi
mov dword [edi + 0x64], ecx
mov dword [edi + 0x68], ebx
mov dword [edi + 0x6c], edx
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0xc]
mov dword [edi + 0x70], ecx
and dword [edi + 0x74], 0
movsd qword [edx + 0x18], xmm0
movsd xmm0, qword [esp + 0x48]
movsd qword [edx + 8], xmm1
mov ecx, dword [esp + 8]
movsd xmm1, qword [esp + 0x7c]
movsd qword [edx + 0x10], xmm0
movsd xmm0, qword [esp + 0x38]
movsd qword [edx], xmm0
and dword [edi + 0x98], 0
movsd xmm0, qword [esp + 0x84]
movsd qword [ecx + 0x10], xmm1
movsd xmm1, qword [esp + 0x74]
movsd qword [ecx], xmm2
movsd qword [ecx + 0x18], xmm0
movsd qword [ecx + 8], xmm1
jmp 0x4b1e67
mov edx, dword [esp + 4]
mov ecx, dword [esp]
add edx, 0xbc
call fcn.004b2178
jmp 0x4b2025
mov eax, dword [esp + 0x50]
mov ecx, dword [esp]
movsd xmm0, qword [esp + 0x48]
movsd xmm2, qword [esp + 0x38]
movsd xmm1, qword [esp + 0x40]
mov dword [ecx + 0x18], eax
movsd qword [ecx + 0x10], xmm0
movsd qword [ecx + 8], xmm1
movsd qword [ecx], xmm2
add esp, 0x8c
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4b2dd8
Capabilities:
Allocate thread local storage

Disassembly:
mov eax, dword [ecx]
test eax, eax
je fcn.00642bc0
dec eax
ret
Function at 0x4b3f9d
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, ecx
mov ecx, 0xa6f24c
call fcn.004b2dd8
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jbe 0x4b3fcc
cmp dword [eax + 4], 0
mov ebx, eax
je 0x4b3fcc
add ebx, 8
jmp 0x4b4090
mov ecx, 0xa6f24c
call fcn.004b2dd8
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x4b4053
mov edi, eax
test eax, eax
jne 0x4b401c
push 4
pop ecx
push 0x14
pop edx
push 0
call fcn.0043ca88
pop ecx
test eax, eax
je 0x4b409a
mov dword [eax], 0xa6f24c
and dword [eax + 4], 0
mov ecx, 0xa6f24c
mov edi, eax
call fcn.004b2dd8
push edi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
xor edx, edx
lea ebx, [edi + 4]
xor ebp, ebp
inc edx
test esi, esi
je 0x4b4062
movsd xmm0, qword [esi]
movsd xmm1, qword [esi + 8]
and dword [esi], 0
movsd qword [esp], xmm0
movsd qword [esp + 8], xmm1
cmp dword [esp], 0
je 0x4b4057
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
mov ebp, dword [esp + 0xc]
jmp 0x4b4064
xor ebx, ebx
jmp 0x4b4090
mov ecx, esp
mov esi, edx
call fcn.004b2dc4
mov edx, esi
xor eax, eax
movsd xmm0, qword [ebx]
movsd xmm1, qword [ebx + 8]
mov ecx, esp
lea ebx, [edi + 8]
movsd qword [ecx + 8], xmm1
movsd qword [ecx], xmm0
mov dword [edi + 4], 1
mov dword [edi + 8], edx
mov dword [edi + 0xc], eax
mov dword [edi + 0x10], ebp
call fcn.004b2dc4
mov eax, ebx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
push 4
pop ecx
push 0x14
pop edx
call fcn.0063c970
ud2