joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4421b0
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51ec20
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x56c36c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esi], vtable.plat::EventManager.0
mov eax, dword [esi + 0x10]
mov dword [ebp - 4], 0
cmp eax, dword [esi + 0x14]
je 0x44221c
nop dword [eax + eax]
add dword [esi + 8], 0xfffffffc
mov edx, dword [esi + 0x14]
mov edi, dword [edx - 4]
lea eax, [edx - 4]
push 0
push edx
push eax
call fcn.00481be0
add dword [esi + 0x14], 0xfffffffc
add esp, 0xc
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 4]
mov eax, dword [esi + 0x10]
cmp eax, dword [esi + 0x14]
jne 0x4421f0
push dword [esi + 0x1c]
push dword [0x571820]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [esi + 0x20]
mov dword [esi + 0x20], 0
test eax, eax
je 0x442240
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi + 0x10]
test eax, eax
je 0x44228c
mov ecx, dword [esi + 0x18]
sub ecx, eax
and ecx, 0xfffffffc
cmp ecx, 0x1000
jb 0x44226d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4422fa
mov eax, edx
push ecx
push eax
call fcn.0047f224
mov dword [esi + 0x10], 0
add esp, 8
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x4422d4
mov ecx, dword [esi + 0xc]
sub ecx, eax
and ecx, 0xfffffffc
cmp ecx, 0x1000
jb 0x4422b5
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4422fa
mov eax, edx
push ecx
push eax
call fcn.0047f224
mov dword [esi + 4], 0
add esp, 8
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
test byte [ebp + 8], 1
je 0x4422e5
push 0x28
push esi
call fcn.0047f224
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
call fcn.0048aa1d
int3
Function at 0x4480d0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51f43e
mov eax, dword fs:[0]
push eax
sub esp, 0x15c
mov eax, dword [0x56c36c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x164], esi
mov dword [ebp - 0x168], esi
mov dword [esi], vtable.plat::TimerManager.0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
cmp byte [ebp + 8], 0
mov dword [ebp - 4], 0
mov dword [esi + 0x28], 0
jne 0x448165
push dword [0x57185c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0x44819f
push dword [0x57185c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
mov dword [esi + 4], eax
push dword [0x57185c]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0047f941
mov esp, ebp
pop ebp
ret 4
push 0x13
push str.C:ent_slave_rootworkspaceVNCConnectBuildsClientsVNC_7.13.xlabelcon_windows_64_rvcore_baseplatTimerManager.cxx
push str.nested___thrInst
lea ecx, [ebp - 0x160]
call fcn.00428f10
push eax
call fcn.00428f90
int3

Function at 0x448210
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51f470
mov eax, dword fs:[0]
push eax
sub esp, 0x154
mov eax, dword [0x56c36c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 8], 0
mov dword [esi], vtable.plat::TimerManager.0
je 0x448260
nop dword [eax + eax]
push dword [esi + 8]
mov ecx, esi
call fcn.00448850
cmp dword [esi + 8], 0
jne 0x448250
mov eax, dword [esi + 0x1c]
cmp eax, dword [esi + 0x20]
je 0x448282
mov ecx, dword [esi + 0x18]
and ecx, eax
mov eax, dword [esi + 0x24]
push dword [eax + ecx*4]
mov ecx, esi
call fcn.00448850
mov eax, dword [esi + 0x1c]
cmp eax, dword [esi + 0x20]
jne 0x448268
push dword [0x57185c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, esi
jne 0x4482c4
push dword [esi + 4]
push dword [0x57185c]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
lea ecx, [esi + 0x10]
call fcn.004481c0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0047f941
mov esp, ebp
pop ebp
ret
push 0x1c
push str.C:ent_slave_rootworkspaceVNCConnectBuildsClientsVNC_7.13.xlabelcon_windows_64_rvcore_baseplatTimerManager.cxx
push str.thrInst__this
lea ecx, [ebp - 0x160]
call fcn.00428f10
push eax
call fcn.00428f90
int3
Function at 0x4482f0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51f4a0
mov eax, dword fs:[0]
push eax
sub esp, 0x154
mov eax, dword [0x56c36c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 8], 0
mov dword [ebp - 4], 0
mov dword [esi], vtable.plat::TimerManager.0
je 0x448342
push dword [esi + 8]
mov ecx, esi
call fcn.00448850
cmp dword [esi + 8], 0
jne 0x448332
mov eax, dword [esi + 0x1c]
cmp eax, dword [esi + 0x20]
je 0x44836a
nop word [eax + eax]
mov ecx, dword [esi + 0x18]
and ecx, eax
mov eax, dword [esi + 0x24]
push dword [eax + ecx*4]
mov ecx, esi
call fcn.00448850
mov eax, dword [esi + 0x1c]
cmp eax, dword [esi + 0x20]
jne 0x448350
push dword [0x57185c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, esi
jne 0x4483c1
push dword [esi + 4]
push dword [0x57185c]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
lea ecx, [esi + 0x10]
call fcn.004481c0
test byte [ebp + 8], 1
je 0x4483a2
push 0x2c
push esi
call fcn.0047f224
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0047f941
mov esp, ebp
pop ebp
ret 4
push 0x1c
push str.C:ent_slave_rootworkspaceVNCConnectBuildsClientsVNC_7.13.xlabelcon_windows_64_rvcore_baseplatTimerManager.cxx
push str.thrInst__this
lea ecx, [ebp - 0x160]
call fcn.00428f10
push eax
call fcn.00428f90
int3
Function at 0x448ff0
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51f515
mov eax, dword fs:[0]
push eax
sub esp, 0x2e0
mov eax, dword [0x56c36c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp byte [0x571880], 0
jne 0x449045
lea eax, [ebp - 0x2e8]
push eax
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x44910e
mov byte [0x571880], 1
mov eax, dword [0x571518]
test eax, eax
jne 0x44907c
push 0x11c
call fcn.0047f1f4
add esp, 4
mov dword [ebp - 0x2ec], eax
mov dword [ebp - 4], 0
test eax, eax
je 0x449075
mov ecx, eax
call fcn.00432e50
jmp 0x449077
xor eax, eax
mov dword [0x571518], eax
cmp dword [eax + 4], 6
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
ja 0x449097
jne 0x4490ae
mov eax, dword [eax + 8]
cmp eax, 1
ja 0x449097
jne 0x4490ae
push 0x81
push 0
push 0
push esi
push edi
push ebx
call dword [sym.imp.WS2_32.dll_WSASocketW]
cmp eax, 0xffffffff
jne 0x4490f2
push esi
push edi
push ebx
call dword [sym.imp.WS2_32.dll_socket]
mov edi, eax
test edi, edi
js 0x4490f0
push 0
push 1
push edi
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
setne bl
test eax, eax
jne 0x4490e7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
mov esi, eax
call dword [sym.imp.WS2_32.dll_closesocket]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
test bl, bl
jne 0x4490f0
or eax, 0xffffffff
jmp 0x4490f2
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0047f941
mov esp, ebp
pop ebp
ret
call sub.KERNEL32.dll_GetLastError
push eax
push str.unable_to_initialise_Winsock2
lea ecx, [ebp - 0x158]
call fcn.00402910
push 0x558100
lea eax, [ebp - 0x158]
push eax
call fcn.00480e30
int3
Function at 0x449370
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x158
mov eax, dword [0x56c36c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x14]
lea eax, [ebp - 0x154]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
push eax
lea eax, [ebp - 0x150]
mov dword [ebp - 0x158], ebx
push eax
push esi
push 0xffff
push edi
mov dword [ebp - 0x154], 4
call dword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x44946b
mov ecx, dword [ebp - 0x150]
cmp dword [ebp + 0xc], ecx
jle 0x449458
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
test ecx, ecx
jle 0x449458
push 4
lea eax, [ebp + 0xc]
push eax
push esi
push 0xffff
push edi
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
je 0x449433
call ebx
cmp eax, 0x2747
jne 0x449497
mov ecx, dword [ebp - 0x150]
mov eax, 0x66666667
imul dword [ebp + 0xc]
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
shl eax, 2
mov dword [ebp + 0xc], eax
cmp eax, ecx
jg 0x4493d7
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047f941
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x154]
push eax
lea eax, [ebp - 0x150]
push eax
push esi
push 0xffff
push edi
call dword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x4494c8
mov ecx, dword [ebp - 0x150]
mov eax, ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0047f941
mov esp, ebp
pop ebp
ret
push ebx
call sub.KERNEL32.dll_GetLastError
push eax
lea eax, [ebp - 0x14c]
push str.getsockopt__s_
push eax
call fcn.0040e910
add esp, 0x10
lea eax, [ebp - 0x14c]
push 0x559658
push eax
call fcn.00480e30
push dword [ebp - 0x158]
call sub.KERNEL32.dll_GetLastError
push eax
lea eax, [ebp - 0x14c]
push str.setsockopt__s_
push eax
call fcn.0040e910
add esp, 0x10
lea eax, [ebp - 0x14c]
push 0x559658
push eax
call fcn.00480e30
push dword [ebp - 0x158]
call sub.KERNEL32.dll_GetLastError
push eax
lea eax, [ebp - 0x14c]
push str.getsockopt__s_
push eax
call fcn.0040e910
add esp, 0x10
lea eax, [ebp - 0x14c]
push 0x559658
push eax
call fcn.00480e30
int3

Function at 0x449720
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2dc
mov eax, dword [0x56c36c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x571880], 0
jne 0x449756
lea eax, [ebp - 0x2dc]
push eax
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x449764
mov byte [0x571880], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047f941
mov esp, ebp
pop ebp
ret
call sub.KERNEL32.dll_GetLastError
push eax
push str.unable_to_initialise_Winsock2
lea ecx, [ebp - 0x14c]
call fcn.00402910
push 0x558100
lea eax, [ebp - 0x14c]
push eax
call fcn.00480e30
int3
Function at 0x44ddc0
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x820
mov eax, dword [0x56c36c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0x1c]
lea eax, [ebp - 0x408]
push edi
mov edi, dword [ebp + 8]
push 0x401
push 0
push eax
mov dword [ebp - 0x820], edi
mov dword [ebp - 0x814], esi
mov dword [ebp - 0x818], 0
call fcn.00481320
push 0x401
lea eax, [ebp - 0x80c]
push 0
push eax
call fcn.00481320
push 0x400
push edi
lea eax, [ebp - 0x408]
push 0x401
lea ebx, [ebp - 0x80c]
mov dword [ebp - 0x81c], eax
push eax
mov dword [ebp - 0x810], ebx
call fcn.004acfa7
add esp, 0x28
nop dword [eax]
nop dword [eax + eax]
push dword [ebp - 0x820]
mov edi, esi
mov dword [esi], 0
mov byte [ebx], 0
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov ebx, eax
test ebx, ebx
je 0x44dfb9
cmp word [ebx + 8], 2
jne 0x44deae
cmp word [ebx + 0xa], 4
jne 0x44deae
mov esi, dword [ebx + 0xc]
mov eax, dword [esi]
test eax, eax
je 0x44deae
push dword [eax]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.0044e010
mov dword [edi], eax
test eax, eax
je 0x44df5e
add esi, 4
lea edi, [eax + 0x1c]
mov eax, dword [esi]
test eax, eax
jne 0x44de88
push 0x400
push dword [ebx]
mov ebx, dword [ebp - 0x810]
push 0x401
push ebx
call fcn.004acfa7
mov eax, dword [ebp - 0x814]
xor esi, esi
add esp, 0x10
cmp dword [eax], esi
jne 0x44df68
mov ecx, ebx
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x44dee0
sub ecx, edx
je case.0x44dfc9.11003
mov edi, dword [ebp - 0x81c]
mov ecx, ebx
mov eax, edi
nop dword [eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x44df20
test dl, dl
je 0x44df1c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x44df20
add eax, 2
add ecx, 2
test dl, dl
jne 0x44df00
xor eax, eax
jmp 0x44df25
sbb eax, eax
or eax, 1
test eax, eax
je case.0x44dfc9.11003
mov esi, dword [ebp - 0x818]
inc esi
mov dword [ebp - 0x818], esi
cmp esi, 0x10
je case.0x44dfc9.11003
mov esi, dword [ebp - 0x814]
mov eax, edi
mov dword [ebp - 0x81c], ebx
mov ebx, eax
mov dword [ebp - 0x810], ebx
jmp 0x44de50
mov esi, 8
jmp 0x44dfe3
cmp dword [ebp + 0x18], esi
je 0x44dfe3
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x44df72
sub ecx, edx
lea ebx, [ecx + 1]
push ebx
push 1
call fcn.004acfb2
mov edi, eax
add esp, 8
test edi, edi
je 0x44df9f
push dword [ebp - 0x810]
push ebx
push edi
call fcn.004acdc8
add esp, 0xc
mov ecx, dword [ebp - 0x814]
mov eax, dword [ecx]
mov dword [eax + 0x14], edi
mov eax, dword [ecx]
mov ecx, 8
cmp dword [eax + 0x14], esi
cmove esi, ecx
jmp 0x44dfe3
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
add eax, 0xffffd507
cmp eax, 3
ja case.0x44dfc9.11001
jmp dword [eax*4 + 0x44dff8]
mov esi, 0x2afa
jmp 0x44dfe3
mov esi, 0x2afb
jmp 0x44dfe3
mov esi, 0x2af9
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0047f941
mov esp, ebp
pop ebp
ret 0x18
Function at 0x44eaa0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x56c36c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x5718c4], 0
mov dword [ebp - 0x230], str.getaddrinfo
mov dword [ebp - 0x22c], 0x44d810
mov dword [ebp - 0x228], str.getnameinfo
mov dword [ebp - 0x224], 0x44db80
mov dword [ebp - 0x220], str.freeaddrinfo
mov dword [ebp - 0x21c], fcn.0044d7c0
jne 0x44ec22
push 0x104
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x44ec18
push ebx
push esi
push edi
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x110]
push 0x10c
push eax
call fcn.004acdc8
push 0x531f54
lea eax, [ebp - 0x110]
push 0x10c
push eax
call fcn.004ace8b
add esp, 0x18
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov edi, eax
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
test edi, edi
je 0x44eb78
push str.getaddrinfo
push edi
call ebx
test eax, eax
jne 0x44ebcd
push edi
call esi
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x110]
push 0x10c
push eax
call fcn.004acdc8
push str.wship6
lea eax, [ebp - 0x110]
push 0x10c
push eax
call fcn.004ace8b
add esp, 0x18
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x44ec15
push str.getaddrinfo
push edi
call ebx
test eax, eax
jne 0x44ebcd
push edi
call esi
jmp 0x44ec15
xor esi, esi
nop
push dword [ebp + esi*8 - 0x230]
push edi
call ebx
mov dword [ebp + esi*8 - 0x22c], eax
test eax, eax
je 0x44ec0e
inc esi
cmp esi, 3
jl 0x44ebd0
mov eax, dword [ebp - 0x22c]
mov dword [0x56c2c8], eax
mov eax, dword [ebp - 0x224]
mov dword [0x56c2d0], eax
mov eax, dword [ebp - 0x21c]
mov dword [fcn.0044d7c0], eax
jmp 0x44ec15
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
pop ebx
mov dword [0x5718c4], 1
movzx eax, word [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, dword [eax*8 + 0x56c2c8]
call fcn.0047f941
mov esp, ebp
pop ebp
ret 4
Function at 0x4588a0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
push dword [ebp + 8]
mov esi, ecx
mov dword [ebp - 0xc], esi
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov edi, dword [ebp + 0xc]
mov edx, eax
mov dword [esi], edx
test edi, edi
je 0x4588d8
mov ecx, edi
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4588c7
sub ecx, ebx
sar ecx, 1
jmp 0x4588da
xor ecx, ecx
lea eax, [edx + 1]
mov dword [esi + 4], 0
lea ebx, [esi + 4]
add eax, ecx
mov dword [ebp - 4], eax
mov dword [ebp + 0xc], ebx
je 0x45890f
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0047fc8b
add esp, 4
mov dword [ebp + 0xc], eax
jmp 0x458916
mov dword [ebp + 0xc], 0
push dword [ebx]
call fcn.0047f232
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov eax, dword [ebp - 4]
add esp, 4
mov dword [ebx], ecx
mov word [ecx + eax*2 - 2], dx
xor ecx, ecx
mov eax, dword [ebx]
mov word [eax], cx
mov eax, dword [esi]
inc eax
push eax
push dword [ebx]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [ebx]
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x458950
lea eax, [ebp - 0xc]
sub ecx, edx
push eax
lea eax, [ebp - 8]
sar ecx, 1
push eax
push 0xb0
push dword [ebp + 8]
mov dword [esi], ecx
call dword [sym.imp.USER32.dll_SendMessageW]
mov edx, dword [esi]
mov ecx, dword [ebp - 8]
cmp ecx, edx
jg 0x458988
test ecx, ecx
js 0x458988
mov eax, ecx
jmp 0x45898a
xor eax, eax
mov dword [esi + 0xc], eax
mov eax, dword [ebp - 0xc]
cmp eax, ecx
jl 0x45899c
cmp eax, edx
jg 0x45899c
sub eax, ecx
jmp 0x45899e
xor eax, eax
mov dword [esi + 8], eax
test edi, edi
je 0x4589ad
push edi
mov ecx, esi
call fcn.00459370
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x472550
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x523716
mov eax, dword fs:[0]
push eax
mov eax, 0x201c
call fcn.0047fce0
mov eax, dword [0x56c36c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x2010]
push 0x1000
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
je 0x4726bd
push 4
lea eax, [ebp - 0x2010]
push str.LOC:
push eax
call fcn.004ad0bd
add esp, 0xc
test eax, eax
jne 0x4726bd
push 1
push 0xffffffffffffffff
push 0xfde9
lea eax, [ebp - 0x2008]
push eax
lea ecx, [ebp - 0x2028]
call fcn.00411420
push 0
push 0xae
push str.C:ent_slave_rootworkspaceVNCConnectBuildsClientsVNC_7.13.xlabelcon_windows_64_rvcoreuilibsuiwinDialog.cxx
push dword [ebp - 0x2024]
mov dword [ebp - 4], 0
call fcn.004161f0
add esp, 0x10
mov dword [ebp - 0x201c], 0
mov dword [ebp - 0x2018], 0
mov byte [ebp - 0x2014], 0
push 1
push 0xffffffffffffffff
push 0xfde9
push eax
lea ecx, [ebp - 0x201c]
mov byte [ebp - 4], 1
call fcn.0042a7b0
push dword [ebp - 0x2018]
push esi
call dword [sym.imp.USER32.dll_SetWindowTextW]
cmp byte [ebp - 0x2014], 0
mov ecx, dword [ebp - 0x2018]
mov byte [ebp - 4], 2
je 0x472668
test ecx, ecx
je 0x472668
mov eax, dword [ebp - 0x201c]
add eax, eax
push eax
push ecx
call fcn.00408000
mov ecx, dword [ebp - 0x2018]
add esp, 8
push ecx
call fcn.0047f232
add esp, 4
mov dword [ebp - 0x201c], 0
mov dword [ebp - 0x2018], 0
cmp byte [ebp - 0x2020], 0
mov eax, dword [ebp - 0x2024]
mov dword [ebp - 4], 3
je 0x4726b4
test eax, eax
je 0x4726b4
push dword [ebp - 0x2028]
push eax
call fcn.00408000
mov eax, dword [ebp - 0x2024]
add esp, 8
push eax
call fcn.0047f232
add esp, 4
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0047f941
mov esp, ebp
pop ebp
ret 8

Function at 0x4726e0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 8
call fcn.0047f1f4
mov esi, eax
add esp, 4
mov dword [ebp - 4], esi
test esi, esi
je 0x47271e
push dword [0x571aac]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [ebp + 8]
push esi
mov dword [esi], ecx
mov dword [esi + 4], eax
push dword [0x571aac]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop esi
mov esp, ebp
pop ebp
ret
xor esi, esi
push esi
push dword [0x571aac]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x472b10
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, ecx
push esi
mov esi, dword [ebx + 4]
test esi, esi
jne 0x472b26
pop esi
xor al, al
pop ebx
pop ebp
ret 4
push edi
push dword [0x571aac]
mov edi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
call edi
test eax, eax
je 0x472b8f
push dword [0x571aac]
call edi
push dword [0x571aac]
cmp dword [eax], esi
jne 0x472b63
call edi
mov esi, eax
push dword [esi + 4]
push dword [0x571aac]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push 8
push esi
jmp 0x472b87
call edi
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x472b8f
nop dword [eax]
mov edx, dword [ecx + 4]
cmp dword [ecx], esi
je 0x472b81
mov eax, ecx
mov ecx, edx
test ecx, ecx
jne 0x472b70
jmp 0x472b8f
push 8
mov dword [eax + 4], edx
push ecx
call fcn.0047f224
add esp, 8
movzx eax, byte [ebp + 8]
push eax
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_EndDialog]
mov ecx, ebx
call fcn.004cfe50
pop edi
pop esi
mov al, 1
pop ebx
pop ebp
ret 4

Function at 0x472c60
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push dword [0x571aac]
mov edi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
call edi
test eax, eax
je 0x472cd9
push esi
push dword [0x571aac]
call edi
mov esi, dword [ebp + 8]
push dword [0x571aac]
cmp dword [eax], esi
jne 0x472cae
call edi
mov esi, eax
push dword [esi + 4]
push dword [0x571aac]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push 8
push esi
call fcn.0047f224
add esp, 8
pop esi
pop edi
pop ebp
ret
call edi
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x472cd8
mov edx, dword [ecx + 4]
cmp dword [ecx], esi
je 0x472cca
mov eax, ecx
mov ecx, edx
test ecx, ecx
jne 0x472cb7
pop esi
pop edi
pop ebp
ret
push 8
push ecx
mov dword [eax + 4], edx
call fcn.0047f224
add esp, 8
pop esi
pop edi
pop ebp
ret

Function at 0x472ee0
Capabilities:
Open clipboard

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14c
mov eax, dword [0x56c36c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
push str.opening_clipboard
push 0x571ab0
mov edi, ecx
call fcn.004172b0
add esp, 8
push esi
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x472f2b
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.0047f941
mov esp, ebp
pop ebp
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x537e88
lea ecx, [ebp - 0x14c]
call fcn.00472fe0
push 0x564d48
lea eax, [ebp - 0x14c]
push eax
call fcn.00480e30
int3