joyce8/EMBER2024-capa huggingface dataset:
Function at 0x496d80
Capabilities:
Get file attributes
Set file attributes

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
mov eax, edx
mov r12, rcx
mov ebx, edx
mov rsi, r8
and eax, 0x3000
cmp eax, 0x3000
je 0x496e08
test eax, eax
je 0x496dad
test dl, 0x92
je 0x496e08
mov rcx, qword [r12]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
test eax, eax
je 0x496e20
test rsi, rsi
je 0x496dd1
mov dword [rsi], 0
call method.boost::system.system_category__
mov qword [rsi + 8], rax
mov edx, edi
and edx, 0xfffffffe
test bh, 0x10
jne 0x496de5
or edi, 1
test bh, 0x20
je 0x496e50
mov edx, edi
mov rcx, qword [r12]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
xor ecx, ecx
test eax, eax
je 0x496e69
lea r9, str.boost::filesystem::permissions
mov r8, rsi
mov rdx, r12
call sym._anonymous_namespace_::error_unsigned_long__boost::filesystem::path_const__boost::system::error_code__char_const_
nop
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
test ebp, ebp
je 0x496dbd
test rsi, rsi
je 0x496e73
call method.boost::system.system_category__
mov dword [rsi], ebp
mov qword [rsi + 8], rax
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
and ebx, 0x92
mov rcx, qword [r12]
cmove edx, edi
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
xor ecx, ecx
test eax, eax
jne 0x496df5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
jmp 0x496df5
mov ecx, 0x50
lea r14, [rsp + 0x30]
call sym.__cxa_allocate_exception
mov r13, rax
call method.boost::system.system_category__
lea rdx, str.boost::filesystem::permissions
mov rcx, r14
mov rsi, rax
call fcn.0085be40
mov rcx, r13
lea r9, [rsp + 0x20]
mov r8, r12
mov rdx, r14
mov qword [rsp + 0x20], rbp
mov qword [rsp + 0x28], rsi
call sym._ZN5boost10filesystem16filesystem_errorC1ERKNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEERKNS0_4pathENS_6system10error_
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x40]
cmp rcx, rax
je 0x496ecd
call sym.operator_delete_void_
lea r8, [sym.boost::filesystem::filesystem_error::filesystem_error__]
lea rdx, [0x0093d330]
mov rcx, r13
call sym.__cxa_throw
mov r12, rax
mov rcx, r13
call sym.__cxa_free_exception
mov rcx, r12
call sym._Unwind_Resume
nop
nop word [rax + rax]
Function at 0x49fdd0
Capabilities:
Create thread
Resume thread

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x30
lea r8, [method.boost._anonymous_namespace_::thread_start_function_void_]
xor edx, edx
mov r9, qword [rcx]
lea rax, [r9 + 0x20]
mov qword [rsp + 0x28], rax
mov rbx, rcx
xor ecx, ecx
mov dword [rsp + 0x20], 4
call qword [sym.imp.msvcrt.dll__beginthreadex]
mov rsi, rax
xor eax, eax
test rsi, rsi
jne 0x49fe18
add rsp, 0x30
pop rbx
pop rsi
pop rdi
ret
mov rax, qword [rbx]
lock add dword [rax + 8], 1
mov rdi, qword [rbx]
mov rcx, qword [rdi + 0x10]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
jbe 0x49fe50
mov qword [rdi + 0x10], rsi
mov rax, qword [rbx]
mov rcx, qword [rax + 0x10]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, 1
add rsp, 0x30
pop rbx
pop rsi
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x49fe31

Function at 0x49fe60
Capabilities:
Create thread
Resume thread

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x30
lea r8, [method.boost._anonymous_namespace_::thread_start_function_void_]
mov r9, qword [rcx]
mov rdx, qword [rdx]
lea rax, [r9 + 0x20]
mov qword [rsp + 0x28], rax
mov rbx, rcx
xor ecx, ecx
mov dword [rsp + 0x20], 4
call qword [sym.imp.msvcrt.dll__beginthreadex]
mov rsi, rax
xor eax, eax
test rsi, rsi
jne 0x49fea8
add rsp, 0x30
pop rbx
pop rsi
pop rdi
ret
mov rax, qword [rbx]
lock add dword [rax + 8], 1
mov rdi, qword [rbx]
mov rcx, qword [rdi + 0x10]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
jbe 0x49fee0
mov qword [rdi + 0x10], rsi
mov rax, qword [rbx]
mov rcx, qword [rax + 0x10]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, 1
add rsp, 0x30
pop rbx
pop rsi
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x49fec1

Function at 0x4a0390
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov ecx, dword [0x00865180]
cmp ecx, 0xffffffff
je 0x4a0440
mov rbx, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rbx
test rax, rax
je 0x4a0440
mov ecx, dword [0x00865180]
cmp ecx, 0xffffffff
je 0x4a0450
call rbx
cmp byte [rax + 0x90], 0
je 0x4a0440
mov ecx, dword [0x00865180]
cmp ecx, 0xffffffff
je 0x4a0440
call rbx
test rax, rax
je 0x4a0440
mov ecx, dword [0x00865180]
cmp ecx, 0xffffffff
je 0x4a045a
call rbx
xor r8d, r8d
xor edx, edx
mov rcx, qword [rax + 0x88]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
test eax, eax
jne 0x4a0440
mov ecx, dword [0x00865180]
cmp ecx, 0xffffffff
je 0x4a045a
call rbx
mov rcx, qword [rax + 0x88]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov ecx, 1
call sym.__cxa_allocate_exception
xor r8d, r8d
lea rdx, [0x0093e880]
mov rcx, rax
call sym.__cxa_throw
nop
nop dword [rax]
add rsp, 0x20
pop rbx
ret
movzx eax, byte [0x90]
ud2
mov rax, qword [0x88]
ud2

Function at 0x4a0470
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov ecx, dword [0x00865180]
cmp ecx, 0xffffffff
je 0x4a04b0
mov rbx, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rbx
test rax, rax
je 0x4a04b0
mov ecx, dword [0x00865180]
cmp ecx, 0xffffffff
je 0x4a04b8
call rbx
movzx eax, byte [rax + 0x90]
add rsp, 0x20
pop rbx
ret
xor eax, eax
add rsp, 0x20
pop rbx
ret
movzx eax, byte [0x90]
ud2
Function at 0x4a04d0
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov ecx, dword [0x00865180]
cmp ecx, 0xffffffff
je 0x4a0520
mov rbx, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rbx
test rax, rax
je 0x4a0520
mov ecx, dword [0x00865180]
cmp ecx, 0xffffffff
je 0x4a0528
call rbx
xor r8d, r8d
xor edx, edx
mov rcx, qword [rax + 0x88]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
test eax, eax
sete al
add rsp, 0x20
pop rbx
ret
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov rax, qword [0x88]
ud2

Function at 0x4a0560
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rbx, rcx
mov ecx, dword [0x00865180]
cmp ecx, 0xffffffff
je 0x4a05c0
mov rsi, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rsi
test rax, rax
je 0x4a05c0
mov ecx, dword [0x00865180]
cmp ecx, 0xffffffff
je 0x4a05ca
call rsi
cmp byte [rax + 0x90], 0
je 0x4a05c0
mov ecx, dword [0x00865180]
mov byte [rbx], 1
cmp ecx, 0xffffffff
je 0x4a05d4
call rsi
mov byte [rax + 0x90], 0
add rsp, 0x28
pop rbx
pop rsi
ret
mov byte [rbx], 0
add rsp, 0x28
pop rbx
pop rsi
ret
movzx eax, byte [0x90]
ud2
mov byte [0x90], 0
ud2

Function at 0x4a05e0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rbx, rcx
mov ecx, dword [0x00865180]
cmp ecx, 0xffffffff
je 0x4a0618
mov rsi, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rsi
test rax, rax
je 0x4a0618
mov ecx, dword [0x00865180]
cmp ecx, 0xffffffff
je 0x4a061f
call rsi
movzx edx, byte [rbx]
mov byte [rax + 0x90], dl
add rsp, 0x28
pop rbx
pop rsi
ret
mov byte [0x90], 0
ud2

Function at 0x4a0630
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
cmp byte [rdx], 0
je 0x4a0651
mov ecx, dword [0x00865180]
cmp ecx, 0xffffffff
je 0x4a0656
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov byte [rax + 0x90], 1
add rsp, 0x28
ret
mov byte [0x90], 0
ud2

Function at 0x4a0660
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov ecx, dword [0x00865180]
cmp ecx, 0xffffffff
je 0x4a0692
mov rbx, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rbx
test rax, rax
je 0x4a0692
mov ecx, dword [0x00865180]
cmp ecx, 0xffffffff
je 0x4a0698
call rbx
mov byte [rax + 0x90], 0
add rsp, 0x20
pop rbx
ret
mov byte [0x90], 0
ud2

Function at 0x4a06b0
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, dword [0x00865180]
cmp ecx, 0xffffffff
je 0x4a0710
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x4a0710
mov rdx, qword [rax + 0x38]
lea rcx, [rax + 0x30]
test rdx, rdx
je 0x4a0710
mov rax, rcx
jmp 0x4a06ec
mov rax, rdx
mov rdx, qword [rdx + 0x10]
test rdx, rdx
je 0x4a06fb
cmp qword [rdx + 0x20], rbx
jae 0x4a06e0
mov rdx, qword [rdx + 0x18]
test rdx, rdx
jne 0x4a06ec
cmp rcx, rax
je 0x4a0710
cmp qword [rax + 0x20], rbx
ja 0x4a0710
add rax, 0x28
add rsp, 0x20
pop rbx
ret
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x4a0720
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, dword [0x00865180]
cmp ecx, 0xffffffff
je 0x4a0780
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x4a0780
lea rcx, [rax + 0x30]
mov rax, qword [rax + 0x38]
test rax, rax
je 0x4a0780
mov rdx, rcx
jmp 0x4a075c
mov rdx, rax
mov rax, qword [rax + 0x10]
test rax, rax
je 0x4a076b
cmp qword [rax + 0x20], rbx
jae 0x4a0750
mov rax, qword [rax + 0x18]
test rax, rax
jne 0x4a075c
cmp rcx, rdx
je 0x4a0780
cmp qword [rdx + 0x20], rbx
ja 0x4a0780
mov rax, qword [rdx + 0x38]
add rsp, 0x20
pop rbx
ret
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x4a07f0
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbx
sub rsp, 0x28
mov r12, rcx
mov ecx, dword [0x00865180]
mov rbx, rdx
cmp ecx, 0xffffffff
je 0x4a0840
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, rax
test rax, rax
je 0x4a0840
mov rax, qword [rax]
mov r8, qword [rbx]
mov rdx, r12
mov qword [rbx], 0
mov byte [rbx + 8], 0
mov rax, qword [rax + 0x18]
add rsp, 0x28
pop rbx
pop r12
jmp rax
add rsp, 0x28
pop rbx
pop r12
ret
Function at 0x4a2340
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov qword [rsp + 0x30], rcx
mov ecx, dword [0x00865180]
cmp ecx, 0xffffffff
je 0x4a2378
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x4a2378
lea rcx, [rax + 0x28]
lea rdx, [rsp + 0x30]
call method.std::_Rb_tree_void_const__std::pair_void_const_const__boost::detail::tss_data_node___std::_Select1st_std::pair_void_const_const__boost::detail::tss_data_node_____std::less_void_const___std::allocator_std::pair_void_const_const__boost::detail::
nop
add rsp, 0x28
ret
call method.boost._anonymous_namespace_::get_or_make_current_thread_data____clone_.part.0_
jmp 0x4a235f

Function at 0x4a2380
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x30
mov rsi, rcx
mov ecx, dword [0x00865180]
cmp ecx, 0xffffffff
je 0x4a23e0
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x4a23e0
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor edx, edx
mov r8d, 0x10
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
je 0x4a23ea
mov rdx, qword [rbx + 0x18]
mov qword [rax], rsi
mov qword [rax + 8], rdx
mov qword [rbx + 0x18], rax
add rsp, 0x30
pop rbx
pop rsi
pop r12
ret
call method.boost._anonymous_namespace_::get_or_make_current_thread_data____clone_.part.0_
mov rbx, rax
jmp 0x4a23a4
mov rax, qword [0x0093a8b0]
add rax, 0x10
mov qword [rsp + 0x28], rax
call method.void_boost::throw_exception_std.bad_alloc__std::bad_alloc_const___clone_.isra.0_
mov r12, rax
lea rcx, [rsp + 0x28]
call method.std::bad_alloc.bad_alloc__
mov rcx, r12
call sym._Unwind_Resume
nop
nop word cs:[rax + rax]

Function at 0x4a2420
Capabilities:
Get thread local storage value

Disassembly:
push r13
push r12
sub rsp, 0x68
movups xmmword [rsp + 0x50], xmm6
movq xmm6, rcx
mov ecx, dword [0x00865180]
mov qword [rsp + 0x90], r8
mov r12, rdx
cmp ecx, 0xffffffff
je 0x4a24d0
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x4a24d0
mov rcx, qword [r12]
mov r12, qword [r12 + 8]
test r12, r12
je 0x4a2472
lea rdx, [r12 + 8]
lock add dword [rdx], 1
lock add dword [rdx], 1
movq xmm1, rcx
movq xmm0, r12
lea rcx, [rsp + 0x20]
punpcklqdq xmm6, xmm1
lea rdx, [rax + 0x28]
lea r8, [rsp + 0x30]
movhps xmm0, qword [rsp + 0x90]
movups xmmword [rsp + 0x30], xmm6
movups xmmword [rsp + 0x40], xmm0
call sym._ZNSt8_Rb_treeIPKvSt4pairIKS1_N5boost6detail13tss_data_nodeEESt10_Select1stIS7_ESt4lessIS1_ESaIS7_EE17_M_emplace_uniqueIJS2_IS
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x4a24b4
call method.boost::detail::sp_counted_base.release__
test r12, r12
je 0x4a24c2
mov rcx, r12
call method.boost::detail::sp_counted_base.release__
nop
movups xmm6, xmmword [rsp + 0x50]
add rsp, 0x68
pop r12
pop r13
ret
call method.boost._anonymous_namespace_::get_or_make_current_thread_data____clone_.part.0_
jmp 0x4a2457
Function at 0x4a2510
Capabilities:
Get thread local storage value

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov r12, rcx
mov ecx, dword [0x00865180]
mov rbx, rdx
mov rsi, r8
mov r13d, r9d
cmp ecx, 0xffffffff
je 0x4a25f8
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rbp
test rax, rax
je 0x4a25f8
lea rdx, [rax + 0x30]
mov rax, qword [rax + 0x38]
test rax, rax
je 0x4a25f8
mov rdi, rdx
jmp 0x4a256c
mov rdi, rax
mov rax, qword [rax + 0x10]
test rax, rax
je 0x4a257b
cmp qword [rax + 0x20], r12
jae 0x4a2560
mov rax, qword [rax + 0x18]
test rax, rax
jne 0x4a256c
cmp rdx, rdi
je 0x4a25f8
cmp qword [rdi + 0x20], r12
ja 0x4a25f8
test r13b, r13b
je 0x4a25a3
mov rcx, qword [rdi + 0x28]
test rcx, rcx
je 0x4a25a3
mov rdx, qword [rdi + 0x38]
test rdx, rdx
je 0x4a25a3
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rax, qword [rbx]
mov rdx, rsi
or rdx, rax
je 0x4a2650
mov rdx, qword [rbx + 8]
test rdx, rdx
je 0x4a25c0
lock add dword [rdx + 8], 1
mov rcx, qword [rdi + 0x30]
movq xmm0, rax
movq xmm1, rdx
punpcklqdq xmm0, xmm1
movups xmmword [rdi + 0x28], xmm0
test rcx, rcx
je 0x4a25e0
call method.boost::detail::sp_counted_base.release__
mov qword [rdi + 0x38], rsi
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov rax, qword [rbx]
mov rdi, rsi
or rdi, rax
je 0x4a25e4
mov qword [rsp + 0x20], rax
mov rax, qword [rbx + 8]
mov qword [rsp + 0x28], rax
test rax, rax
je 0x4a261b
lock add dword [rax + 8], 1
lea rdx, [rsp + 0x20]
mov r8, rsi
mov rcx, r12
call method.boost::detail.add_new_tss_node_void_const__boost::shared_ptr_boost::detail::tss_cleanup_function___void_
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x4a25e4
call method.boost::detail::sp_counted_base.release__
nop
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov ecx, dword [0x00865180]
mov qword [rsp + 0x20], r12
cmp ecx, 0xffffffff
je 0x4a2680
call rbp
test rax, rax
je 0x4a2680
lea rdx, [rsp + 0x20]
lea rcx, [rax + 0x28]
call method.std::_Rb_tree_void_const__std::pair_void_const_const__boost::detail::tss_data_node___std::_Select1st_std::pair_void_const_const__boost::detail::tss_data_node_____std::less_void_const___std::allocator_std::pair_void_const_const__boost::detail::
jmp 0x4a25e4
call method.boost._anonymous_namespace_::get_or_make_current_thread_data____clone_.part.0_
jmp 0x4a2667
Function at 0x4a4440
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
cmp edx, 3
je 0x4a4450
ret
jmp method.boost.on_thread_exit__

Function at 0x4a4560
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov rax, rcx
mov qword [rsp + 0x90], rcx
movzx ecx, word [rcx + 0x42]
mov rsi, rdx
mov qword [rsp + 0xa0], r8
mov r15, qword [rax + rcx*8 + 0x48]
movzx r14d, word [r15 + 0xc]
movzx edx, word [r15 + 0xa]
sub r14d, 0x10
mov eax, edx
mov edi, r14d
shr ax, 1
shr edi, 1
xor eax, 1
mov dword [rsp + 0x2c], edi
lea r13d, [rdi - 1]
mov rdi, qword [rsp + 0x90]
and eax, 1
mov r14d, eax
mov r11, qword [rdi + 0x30]
mov rdi, qword [r11 + 0x10]
lea r11, [sym.mdb_cmp_cint]
cmp rdi, r11
je 0x4a4768
and dx, 0x20
jne 0x4a46e0
lea rbp, [rsp + 0x30]
cmp eax, r13d
jle 0x4a4661
xor eax, eax
xor r12d, r12d
xor ebx, ebx
nop dword [rax + rax]
cmp qword [rsp + 0xa0], 0
je 0x4a4623
mov r9d, dword [rsp + 0x2c]
test eax, eax
mov rsi, qword [rsp + 0xa0]
sete r8b
xor eax, eax
test r9d, r9d
setne al
and eax, r8d
mov dword [rsi], eax
mov rax, qword [rsp + 0x90]
cmp ebx, dword [rsp + 0x2c]
mov word [rax + rcx*2 + 0x148], dx
mov eax, 0
cmovae r12, rax
mov rax, r12
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea r14d, [rbx + 1]
cmp r13d, r14d
jl 0x4a46a2
lea ebx, [r14 + r13]
mov rdx, rbp
mov rcx, rsi
sar ebx, 1
mov eax, ebx
movzx r12d, word [r15 + rax*2 + 0x10]
add r12, r15
movzx eax, word [r12 + 6]
mov qword [rsp + 0x30], rax
lea rax, [r12 + 8]
mov qword [rsp + 0x38], rax
call rdi
test eax, eax
je 0x4a4750
jg 0x4a4658
lea r13d, [rbx - 1]
cmp r13d, r14d
jge 0x4a4661
mov rsi, qword [rsp + 0x90]
movzx ecx, word [rsi + 0x42]
test eax, eax
jle 0x4a479f
add ebx, 1
mov edx, ebx
test byte [r15 + 0xa], 0x20
jne 0x4a45f8
mov r8d, ebx
movzx r12d, word [r15 + r8*2 + 0x10]
add r12, r15
jmp 0x4a45f8
mov rdx, qword [rsp + 0x90]
movzx r12d, word [r15 + 0x10]
mov rdx, qword [rdx + 0x28]
add r12, r15
mov edx, dword [rdx]
mov qword [rsp + 0x30], rdx
cmp eax, r13d
jg 0x4a4794
lea rbp, [rsp + 0x30]
jmp 0x4a471e
lea r14d, [rbx + 1]
cmp r14d, r13d
jg 0x4a46a2
mov rdx, qword [rsp + 0x30]
lea ebx, [r13 + r14]
mov rcx, rsi
sar ebx, 1
movsxd rax, ebx
imul rax, rdx
mov rdx, rbp
lea rax, [r15 + rax + 0x10]
mov qword [rsp + 0x38], rax
call rdi
test eax, eax
je 0x4a4750
jg 0x4a4710
lea r13d, [rbx - 1]
jmp 0x4a4714
mov rsi, qword [rsp + 0x90]
mov edx, ebx
movzx ecx, word [rsi + 0x42]
jmp 0x4a45f8
test dl, 1
je 0x4a45d8
movzx r11d, word [r15 + 0x12]
lea rdi, [sym.mdb_cmp_long]
cmp word [r15 + r11 + 6], 8
lea r11, [sym.mdb_cmp_int]
cmovne rdi, r11
jmp 0x4a45d8
xor edx, edx
xor eax, eax
xor ebx, ebx
jmp 0x4a45f8
mov edx, ebx
jmp 0x4a45f8
Function at 0x4a4840
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x78
mov rbx, qword [rcx + 0x48]
mov r14, qword [rcx + 0x20]
mov rax, qword [rbx]
mov esi, edx
mov qword [rsp + 0xc0], rcx
mov r13d, eax
mov r12d, edx
mov dword [rsp + 0xc8], edx
add esi, 1
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rax
test byte [r14 + 0x1a], 8
jne 0x4a4a18
cmp eax, esi
jl 0x4a4aa8
movsxd rax, edx
mov ebp, dword [r14 + 0x1c]
lea r15, [rsp + 0x50]
mov rdi, rax
mov qword [rsp + 0x48], rax
shl rdi, 4
add rdi, rbx
mov rbx, rdi
jmp 0x4a4927
mov rcx, qword [rbx + 0x10]
mov r8d, eax
mov r9d, ebp
and r8d, 0xffffffef
mov word [rdx + 0xa], r8w
imul rcx, r9
mov r8d, ebp
test al, 4
je 0x4a48de
mov r8d, dword [rdx + 0xc]
imul r8d, r9d
mov qword [r15], 0
xor r9d, r9d
mov qword [r15 + 8], 0
mov qword [r15 + 0x10], 0
mov qword [r15 + 0x18], 0
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x20], r15
mov rcx, qword [r14]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4a4a98
add esi, 1
add rbx, 0x10
cmp r13d, esi
jl 0x4a4950
mov rdx, qword [rbx + 0x18]
movzx eax, word [rdx + 0xa]
test ax, 0xc000
je 0x4a48b8
and ax, 0x7fff
add esi, 1
add rbx, 0x10
mov word [rdx + 0xa], ax
mov qword [rbx], 0
cmp r13d, esi
jge 0x4a4927
mov edx, dword [rsp + 0xc8]
mov rax, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
not edx
add eax, edx
add rax, qword [rsp + 0x48]
shl rax, 4
lea rbx, [rsi + rax + 0x10]
jmp 0x4a498c
cmp dword [rcx + 0xc], 1
je 0x4a499d
call sym.free
add rdi, 0x10
cmp rdi, rbx
je 0x4a49b7
cmp qword [rdi + 0x10], 0
mov rcx, qword [rdi + 0x18]
je 0x4a49f0
test byte [rcx + 0xa], 4
jne 0x4a4978
mov rax, qword [r14 + 0xc8]
add rdi, 0x10
mov qword [rcx], rax
mov qword [r14 + 0xc8], rcx
cmp rdi, rbx
jne 0x4a498c
mov eax, dword [rsp + 0x40]
mov rsi, qword [rsp + 0xc0]
sub eax, r12d
mov edi, r12d
add dword [rsi + 0x80], eax
mov rax, qword [rsp + 0x38]
mov qword [rax], rdi
xor eax, eax
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea eax, [r12 + 1]
movdqu xmm0, xmmword [rdi + 0x10]
mov rdx, qword [rcx]
mov r12, rax
shl rax, 4
add rax, rsi
movups xmmword [rax], xmm0
mov qword [rax], rdx
jmp 0x4a4983
mov rdi, qword [rsp + 0x40]
cmp edi, esi
jl 0x4a4aa8
mov eax, r12d
movsxd rcx, edx
mov rsi, qword [rsp + 0x38]
not eax
mov rdx, rcx
add eax, edi
shl rdx, 4
mov r9, rsi
add rax, rcx
add rdx, rsi
shl rax, 4
lea r8, [rsi + rax + 0x10]
jmp 0x4a4a64
and eax, 0xffffffef
mov word [rcx + 0xa], ax
add rdx, 0x10
cmp r8, rdx
je 0x4a49b7
mov rcx, qword [rdx + 0x18]
movzx eax, word [rcx + 0xa]
test ax, 0xc000
je 0x4a4a50
and ax, 0x7fff
movdqu xmm1, xmmword [rdx + 0x10]
mov word [rcx + 0xa], ax
lea eax, [r12 + 1]
mov r12, rax
shl rax, 4
movups xmmword [r9 + rax], xmm1
jmp 0x4a4a57
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4a49d9
mov eax, r12d
jmp 0x4a49bb
Function at 0x4a4d10
Capabilities:
Get thread local storage value

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
cmp edx, 3
je 0x4a4d28
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
mov eax, dword [0x009cc720]
test eax, eax
jle 0x4a4d1c
mov rsi, qword [sym.imp.KERNEL32.dll_TlsGetValue]
xor ebx, ebx
lea rdi, [0x009cc740]
nop word [rax + rax]
mov ecx, dword [rdi + rbx*4]
call rsi
test rax, rax
je 0x4a4d59
mov dword [rax + 8], 0
add rbx, 1
cmp dword [0x009cc720], ebx
jg 0x4a4d48
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
Function at 0x4a6660
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
test rcx, rcx
je 0x4a6674
mov eax, dword [rcx + 0x7c]
and eax, 0x20001
cmp eax, 0x20001
je 0x4a6680
mov eax, 0x16
ret
jmp sym.mdb_txn_renew0
Function at 0x4d2450
Capabilities:
Encode data using xor

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x68
mov rdi, rcx
mov rsi, rdx
lea rcx, [rsp + 0x40]
mov rbx, r8
mov rdx, rdi
call method.cryptonote.get_block_hashing_blob_abi:cxx11__cryptonote::block_const_
movzx ecx, byte [rdi]
cmp cl, 4
jbe 0x4d2548
cmp cl, 7
ja 0x4d24a8
cmp cl, 5
je 0x4d267e
cmp cl, 6
mov edx, 0x40000
mov eax, 0x20000
mov r9d, 1
cmove rdx, rax
jmp 0x4d2550
cmp cl, 8
je 0x4d25c0
mov rax, qword [rdi + 8]
cmp cl, 9
je 0x4d2608
movsx ecx, byte [rdi + 0x10]
movsx r8d, byte [rdi + 0x11]
mov edx, 1
movzx r9d, cl
mov byte [rsp + 0x3d], cl
movzx ecx, r8b
mov byte [rsp + 0x3e], r8b
movsx r8d, byte [rdi + 0x12]
shl ecx, 8
shl r9d, 0x10
or r9d, ecx
movzx ecx, r8b
mov byte [rsp + 0x3f], r8b
or ecx, r9d
cmove ecx, edx
xor edx, edx
mov ecx, ecx
div rcx
test rbx, rbx
je 0x4d2521
nop word [rax + rax]
mov r8, rdx
xor rdx, rbx
and r8, rbx
mov rbx, r8
add rbx, rbx
jne 0x4d2510
and edx, 0x7fff
mov r9d, 2
mov rax, rdx
xor rax, 0x40000
test rdx, rdx
mov edx, 0x40000
cmovne edx, eax
jmp 0x4d2575
mov edx, 0x80000
xor r9d, r9d
mov eax, 1
nop dword [rax]
mov rcx, rax
and rcx, rbx
xor rbx, rax
mov rax, rcx
add rax, rax
jne 0x4d2558
and ebx, 0x3ff
xor rbx, rdx
lea edx, [rbx + rbx]
mov dword [rsp + 0x28], edx
mov rcx, qword [rsp + 0x40]
mov r8, rsi
mov dword [rsp + 0x20], 0
mov rdx, qword [rsp + 0x48]
call sym.cn_slow_hash
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x50]
cmp rcx, rax
je 0x4d25a7
call sym.operator_delete_void_
mov eax, 1
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop r12
ret
mov rax, rbx
mov edx, 1
nop dword [rax + rax]
mov rcx, rdx
and rcx, rax
xor rax, rdx
mov rdx, rcx
add rdx, rdx
jne 0x4d25d0
and eax, 0x3ff
xor rax, 0x40000
cmp rbx, 0x2d5ff
jbe 0x4d2660
mov edx, eax
mov r9d, 2
jmp 0x4d2575
xor edx, edx
div rbx
mov eax, 1
nop word [rax + rax]
mov rcx, rax
and rax, rbx
mov r8, rbx
xor rbx, rcx
add rax, rax
jne 0x4d2618
cmp rcx, r8
je 0x4d2641
nop
mov r8, rdx
xor rdx, rbx
and r8, rbx
mov rbx, r8
add rbx, rbx
jne 0x4d2630
and edx, 0xfff
je 0x4d266e
or edx, 0x40000
mov r9d, 2
jmp 0x4d2575
lea edx, [rax + rax]
mov r9d, 2
jmp 0x4d2575
mov edx, 0x40000
mov r9d, 2
jmp 0x4d2575
mov edx, 0x80000
mov r9d, 1
jmp 0x4d2550