joyce8/EMBER2024-capa huggingface dataset:
Function at 0x449330
Capabilities:
Enumerate pe sections
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x7c
mov esi, dword [esp + 0x98]
mov eax, dword [esp + 0x90]
mov edi, dword [esp + 0x9c]
mov ebp, dword [esp + 0x94]
mov dword [esp], esi
mov dword [esp + 0x14], eax
mov eax, dword [0x4b850c]
mov dword [esp + 0x6c], eax
xor eax, eax
call sub.msvcrt.dll_strlen
mov dword [esp], edi
mov ebx, eax
call sub.msvcrt.dll_strlen
mov ecx, eax
lea eax, [ebx + eax + 2]
mov dword [esp + 0x18], eax
cmp eax, 0x40
ja 0x449438
mov eax, ebp
lea ebp, [esp + 0x2d]
mov byte [esp + 0x2c], al
lea eax, [ebx + 1]
cmp eax, 4
jb 0x449418
mov edx, dword [esi]
mov dword [esp + 0x2d], edx
mov edx, dword [esi + eax - 4]
mov dword [esp + eax + 0x29], edx
lea edx, [esp + 0x30]
sub ebp, edx
add eax, ebp
sub esi, ebp
and eax, 0xfffffffc
cmp eax, 4
jb 0x4493d3
mov dword [esp + 0x1c], ecx
and eax, 0xfffffffc
xor ebp, ebp
mov ecx, dword [esi + ebp]
mov dword [edx + ebp], ecx
add ebp, 4
cmp ebp, eax
jb 0x4493c2
mov ecx, dword [esp + 0x1c]
lea eax, [esp + ebx + 0x2e]
mov dword [esp + 8], ecx
mov dword [esp + 4], edi
mov dword [esp], eax
call sub.msvcrt.dll_memcpy
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x2c]
mov edx, 0x7343414c
mov dword [esp], eax
mov eax, dword [esp + 0x14]
call fcn.00447030
mov eax, dword [esp + 0x6c]
sub eax, dword [0x4b850c]
jne 0x449466
add esp, 0x7c
pop ebx
pop esi
pop edi
pop ebp
ret
test eax, eax
je 0x4493d3
movzx edx, byte [esi]
mov byte [esp + 0x2d], dl
test al, 2
je 0x4493d3
movzx esi, word [esi + eax - 2]
mov word [esp + eax + 0x2b], si
jmp 0x4493d3
mov eax, dword [esp + 0x6c]
sub eax, dword [0x4b850c]
jne 0x449466
mov dword [esp + 0x94], str.Cant_write_sCAL__buffer_too_small_
mov eax, dword [esp + 0x14]
mov dword [esp + 0x90], eax
add esp, 0x7c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.0042b170
call fcn.00464ba0
lea esi, cs:[esi]

Function at 0x449470
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov eax, dword [0x4b850c]
mov dword [esp + 0x1c], eax
xor eax, eax
cmp dword [esp + 0x4c], 1
mov esi, dword [esp + 0x40]
mov ebp, dword [esp + 0x44]
mov edi, dword [esp + 0x48]
jle 0x4494a5
mov dword [esp + 4], str.Unrecognized_unit_type_for_pHYs_chunk
mov dword [esp], esi
call fcn.0042b170
mov ebx, ebp
mov eax, ebp
mov ecx, edi
mov dword [esp], 9
shr eax, 0x10
movzx edx, bl
mov ebx, ebp
shr ecx, 0x10
movzx ebx, bh
shl edx, 8
movzx eax, al
movzx ecx, cl
or edx, ebx
mov ebx, edi
shl edx, 8
movzx ebx, bh
or edx, eax
mov eax, edi
movzx eax, al
shld edx, ebp, 8
shl eax, 8
mov dword [esp + 0x10], edx
mov edx, 0x70485973
or eax, ebx
shl eax, 8
or eax, ecx
lea ecx, [esp + 0x10]
shld eax, edi, 8
mov dword [esp + 0x14], eax
movzx eax, byte [esp + 0x4c]
mov byte [esp + 0x18], al
mov eax, esi
call fcn.00447030
mov eax, dword [esp + 0x1c]
sub eax, dword [0x4b850c]
jne 0x449521
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
call fcn.00464ba0
lea esi, cs:[esi]
nop
Function at 0x449530
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
mov edx, dword [0x4b850c]
mov dword [esp + 0x2c], edx
xor edx, edx
mov eax, dword [esp + 0x54]
mov ebx, dword [esp + 0x50]
movzx esi, byte [eax + 2]
lea edx, [esi - 1]
cmp dl, 0xb
ja 0x449563
movzx edx, byte [eax + 3]
lea ecx, [edx - 1]
cmp cl, 0x1e
jbe 0x449590
mov eax, dword [esp + 0x2c]
sub eax, dword [0x4b850c]
jne 0x44960b
mov dword [esp + 0x50], ebx
mov dword [esp + 0x54], str.Invalid_time_specified_for_tIME_chunk
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.0042b170
movzx ecx, byte [eax + 4]
mov byte [esp + 0x1f], cl
cmp cl, 0x17
ja 0x449563
movzx edi, byte [eax + 6]
mov ecx, edi
cmp cl, 0x3c
ja 0x449563
movzx ebp, word [eax]
mov ecx, esi
shl edx, 8
movzx esi, cl
or edx, esi
mov ecx, ebp
movzx esi, cl
shl edx, 8
mov ecx, ebp
or edx, esi
movzx ebp, ch
lea ecx, [esp + 0x24]
shl edx, 8
or edx, ebp
mov dword [esp + 0x24], edx
movzx edx, byte [esp + 0x1f]
mov dh, byte [eax + 5]
mov dword [esp], 7
mov eax, edi
mov byte [esp + 0x2a], al
mov eax, ebx
mov word [esp + 0x28], dx
mov edx, 0x74494d45
call fcn.00447030
mov eax, dword [esp + 0x2c]
sub eax, dword [0x4b850c]
jne 0x44960b
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
call fcn.00464ba0
Function at 0x44ad90
Capabilities:
Write file on windows

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov ebx, dword [esp + 0x40]
mov eax, dword [esp + 0x44]
mov esi, dword [esp + 0x48]
mov edi, dword [esp + 0x4c]
mov ecx, dword [ebx + 0x27c]
mov edx, dword [ebx + 0x264]
test ecx, ecx
jne 0x44ad50
cmp esi, edx
jne 0x44ad7b
cmp dword [ebx + 0x268], edi
jne 0x44ad7b
movzx edx, byte [eax + 0x1b]
mov dword [esp + 0x20], edx
movzx edx, byte [eax + 0x1a]
mov dword [esp + 0x1c], edx
movzx edx, byte [eax + 0x1c]
mov dword [esp + 0x18], edx
movzx edx, byte [eax + 0x19]
mov dword [esp + 0x14], edx
movzx edx, byte [eax + 0x18]
mov dword [esp + 4], eax
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], edi
mov dword [esp + 8], esi
mov dword [esp], ebx
call fcn.00440470
movzx eax, byte [ebx + 0x152]
mov dword [ebx + 0x100], esi
mov dword [ebx + 0x104], edi
cmp al, 7
jbe 0x44ad70
shr al, 3
movzx eax, al
imul eax, esi
mov dword [ebx + 0x110], eax
mov dword [ebx + 0x10c], esi
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp edx, esi
jb 0x44ad60
cmp dword [ebx + 0x268], edi
jae 0x44acde
mov dword [esp + 4], str.width_and_or_height_for_a_frame_greater_than_the_ones_in_IHDR
mov dword [esp], ebx
call fcn.0042b7c0
imul eax, esi
add eax, 7
shr eax, 3
jmp 0x44ad3a
mov dword [esp + 4], str.width_and_or_height_in_the_first_frames_fcTL_dont_match_the_ones_in_IHDR
mov dword [esp], ebx
call fcn.0042b7c0
nop
nop
nop
nop
nop
push esi
push ebx
sub esp, 0x14
mov ebx, dword [esp + 0x20]
mov esi, dword [esp + 0x28]
test ebx, ebx
je 0x44adc4
mov eax, dword [ebx + 0x60]
mov dword [esp + 8], esi
mov dword [esp + 4], 1
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sub.msvcrt.dll_fwrite
cmp esi, eax
jne 0x44adca
add esp, 0x14
pop ebx
pop esi
ret
mov dword [esp + 4], str.Write_Error
mov dword [esp], ebx
call fcn.0042b7c0
lea esi, [esi]
mov eax, dword [esp + 4]
test eax, eax
je 0x44adf8
mov eax, dword [eax + 0x60]
mov dword [esp + 4], eax
jmp sub.msvcrt.dll_fflush
ret

Function at 0x44b130
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.0046aa70
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.0046aa70
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]
Function at 0x44b190
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x4b848c]
test esi, esi
jle 0x44b2b0
mov eax, dword [0x4b8490]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp ebx, edx
jb 0x44b1c4
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x44b247
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x44b1b0
mov dword [esp], ebx
call fcn.0044bb80
mov edi, eax
test eax, eax
je 0x44b2d7
mov eax, dword [0x4b8490]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.0044bcc0
mov edx, dword [0x4b8490]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x44b2b7
mov eax, dword [esp + 0x28]
lea edx, [eax - 4]
and edx, 0xfffffffb
je 0x44b240
lea edx, [eax - 0x40]
and edx, 0xffffffbf
jne 0x44b250
add dword [0x4b848c], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 4
mov eax, 0x40
mov ecx, dword [esp + 0x20]
cmove eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x4b8490]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x44b240
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.0044b130
lea esi, cs:[esi]
nop
xor esi, esi
jmp 0x44b1ce
mov eax, dword [0x4b8490]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.0044b130
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.0044b130
lea esi, cs:[esi]
nop

Function at 0x44b7f0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x4b84a8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x4b84a0]
sub esp, 4
test ebx, ebx
je 0x44b845
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
mov esi, eax
sub esp, 4
call edi
test esi, esi
je 0x44b83e
test eax, eax
jne 0x44b83e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x44b820
mov dword [esp], 0x4b84a8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x44bb80
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x400000], 0x5a4d
jne 0x44bba5
mov ecx, dword [0x40003c]
cmp dword [ecx + 0x400000], 0x4550
lea edx, [ecx + 0x400000]
je 0x44bbb0
ret
cmp word [ecx + 0x400018], 0x10b
jne 0x44bba5
push esi
movzx eax, word [ecx + 0x400014]
push ebx
movzx esi, word [ecx + 0x400006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x400000
test si, si
je 0x44bbf8
xor ecx, ecx
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x44bbee
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x44bbfa
add ecx, 1
add eax, 0x28
cmp esi, ecx
jne 0x44bbe0
xor eax, eax
pop ebx
pop esi
ret
Function at 0x464b10
Capabilities:
Terminate process

Disassembly:
sub esp, 0x1c
mov dword [esp + 8], 0x2d
mov dword [esp + 4], str._buffer_overflow_detected_:_terminated_n
mov dword [esp], 2
call sub.msvcrt.dll__write
mov dword [esp], 0x17
call sub.KERNEL32.dll_IsProcessorFeaturePresent
sub esp, 4
test eax, eax
je 0x464b49
mov ecx, 8
int 0x29
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [esp + 4], 0xc0000409
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push eax
push eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop

Function at 0x464b70
Capabilities:
Terminate process

Disassembly:
sub esp, 0xc
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
cmp dword [esp + 0x1c], eax
jb 0x464b99
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], edx
add esp, 0xc
jmp sub.msvcrt.dll_memcpy
call fcn.00464b10
nop
nop

Function at 0x464ba0
Capabilities:
Terminate process

Disassembly:
sub esp, 0x1c
mov dword [esp + 8], 0x2c
mov dword [esp + 4], str._stack_smashing_detected_:_terminated_n
mov dword [esp], 2
call sub.msvcrt.dll__write
mov dword [esp], 0x17
call sub.KERNEL32.dll_IsProcessorFeaturePresent
sub esp, 4
test eax, eax
je 0x464bd9
mov ecx, 2
int 0x29
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [esp + 4], 0xc0000409
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push eax
push eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x46d410
Capabilities:
Print debug messages

Disassembly:
push edi
pxor xmm0, xmm0
lea edi, [esp + 8]
and esp, 0xfffffff0
push dword [edi - 4]
push ebp
mov ebp, esp
push edi
push ebx
lea ebx, [ebp - 0x41]
sub esp, 0x50
movups xmmword [ebp - 0x21], xmm0
mov eax, dword [0x4b850c]
mov dword [ebp - 0xc], eax
xor eax, eax
movups xmmword [ebp - 0x41], xmm0
movups xmmword [ebp - 0x31], xmm0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [esp + 8], str.Error_cleaning_up_spin_keys_for_thread__lu._n
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0x35
mov dword [esp], ebx
call fcn.00471540
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
sub esp, 4
call sub.msvcrt.dll_abort
lea esi, cs:[esi]
lea esi, [esi]

Function at 0x46d800
Capabilities:
Allocate thread local storage

Disassembly:
cmp dword [0x4b8f24], 1
je 0x46d8b8
push edi
mov eax, 0x4b8f24
push esi
push ebx
sub esp, 0x10
call fcn.0046d1f0
lea esi, [eax + 4]
mov ebx, eax
mov dword [esp], esi
call fcn.0046ca60
mov edi, dword [0x4b8f24]
test edi, edi
jne 0x46d870
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x4861c8], eax
cmp eax, 0xffffffff
je 0x483cf5
mov dword [0x4b8f24], 1
mov dword [esp], esi
call fcn.0046cd90
test ebx, ebx
je 0x46d8aa
add esp, 0x10
mov eax, ebx
pop ebx
pop esi
pop edi
jmp fcn.0046d490
cmp edi, 1
je 0x46d852
mov dword [esp], 2
call dword [0x4861ac]
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0x4b8f24
mov dword [esp + 4], str._once__p_is__ld_n
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
mov dword [esp], esi
call fcn.0046cd90
test ebx, ebx
jne 0x46d85e
add esp, 0x10
pop ebx
pop esi
pop edi
ret
ret
call sub.msvcrt.dll_abort
call sub.msvcrt.dll_abort
mov eax, dword [0x14]
ud2

Function at 0x46d9f0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
sub esp, 0x1c
call fcn.0046d800
mov eax, dword [0x4861c8]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x46da18
add esp, 0x1c
ret
add esp, 0x1c
jmp fcn.0046d8c0
Function at 0x46dce0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [esp + 0x24]
test eax, eax
jne 0x46dd08
mov ecx, dword [esp + 0x28]
test ecx, ecx
je 0x46de00
add esp, 0x14
pop ebx
pop esi
ret 0xc
cmp eax, 1
je 0x46ddd0
cmp eax, 3
jne 0x46dcf9
mov eax, dword [0x4861c8]
cmp eax, 0xffffffff
je 0x46dcf9
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x46dcf9
test byte [eax + 0x20], 0x30
je 0x46de30
mov eax, dword [eax + 0xb4]
test eax, eax
je 0x46dd4b
call fcn.0046da20
mov eax, dword [ebx + 0x14]
test eax, eax
je 0x46dd7d
mov dword [esp], eax
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
mov eax, dword [ebx + 0x18]
sub esp, 4
test eax, eax
je 0x46dd6f
mov dword [esp], eax
call esi
sub esp, 4
mov dword [ebx + 0x14], 0
mov dword [ebx + 0x18], 0
lea eax, [ebx + 0x1c]
mov dword [esp], eax
call fcn.0046cf30
lea eax, [ebx + 0x38]
mov dword [esp], eax
call fcn.0046d0f0
cmp eax, 1
je 0x46defe
mov eax, dword [ebx + 0xb0]
mov dword [ebx + 0x38], 0xffffffff
test eax, eax
je 0x46def2
mov eax, dword [0x4861c8]
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
jmp 0x46dcf9
mov eax, dword [0x4b8efc]
test eax, eax
je 0x46de1c
mov dword [esp + 4], 0x46d160
mov dword [esp], 1
call eax
mov dword [0x4b8f00], eax
add esp, 0x14
pop ebx
pop esi
ret 0xc
mov eax, dword [0x4b8f00]
test eax, eax
je 0x46dcf9
mov edx, dword [0x4b8ef8]
test edx, edx
je 0x46de1c
mov dword [esp], eax
call edx
mov dword [0x4b8f00], 0
add esp, 0x14
pop ebx
pop esi
ret 0xc
mov edx, dword [ebx + 0x68]
mov eax, dword [eax + 0x18]
test edx, edx
jne 0x46dea4
test eax, eax
je 0x46de4a
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov eax, dword [ebx + 0xb4]
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x68], 1
test eax, eax
je 0x46de67
call fcn.0046da20
test byte [ebx + 0x24], 4
je 0x46dee2
mov eax, dword [ebx + 0x14]
mov dword [ebx], 0xdeadbeef
test eax, eax
je 0x46dd7d
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebx + 0x1c]
mov dword [ebx + 0x14], 0
sub esp, 4
mov dword [esp], eax
call fcn.0046cf30
lea eax, [ebx + 0x38]
jmp 0x46dd8b
test eax, eax
je 0x46dee2
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebx + 0x1c]
mov dword [ebx + 0x18], 0
sub esp, 4
mov dword [esp], eax
call fcn.0046cf30
lea eax, [ebx + 0x38]
mov dword [esp], eax
call fcn.0046d0f0
cmp eax, 1
je 0x46defe
mov dword [ebx + 0x38], 0xffffffff
jmp 0x46dcf9
lea eax, [ebx + 0x1c]
mov dword [esp], eax
call fcn.0046cf30
lea eax, [ebx + 0x38]
jmp 0x46dec9
mov eax, ebx
call fcn.0046d640
jmp 0x46ddb1
call fcn.0046d410
lea esi, cs:[esi]
lea esi, cs:[esi]
Function at 0x46e1e0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
mov ebx, dword [esp + 0x50]
mov edi, dword [esp + 0x54]
mov eax, dword [0x4b850c]
mov dword [esp + 0x2c], eax
mov eax, dword [ebx]
test edi, edi
je 0x46e320
cmp eax, 1
je 0x46e245
mov eax, ebx
call fcn.0046d1f0
mov esi, eax
lea eax, [eax + 4]
mov dword [esp], eax
mov dword [esp + 0x1c], eax
call fcn.0046ca60
mov ebp, dword [ebx]
test ebp, ebp
je 0x46e260
cmp ebp, 1
jne 0x46e2f0
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
call fcn.0046cd90
test esi, esi
je 0x46e245
mov eax, esi
call fcn.0046d490
xor eax, eax
mov edx, dword [esp + 0x2c]
sub edx, dword [0x4b850c]
jne 0x46e36a
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0x20], 0x46d550
mov dword [esp + 0x24], esi
call fcn.0046d800
mov eax, dword [0x4861c8]
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [esp], eax
call ebp
sub esp, 4
test eax, eax
je 0x46e358
mov eax, dword [eax + 0xc]
mov dword [esp + 0x28], eax
lock or dword [esp], 0
call fcn.0046d800
mov eax, dword [0x4861c8]
mov dword [esp], eax
call ebp
sub esp, 4
test eax, eax
je 0x46e340
lea ecx, [esp + 0x20]
mov dword [eax + 0xc], ecx
lock or dword [esp], 0
call edi
call fcn.0046d800
mov eax, dword [0x4861c8]
mov dword [esp], eax
call ebp
sub esp, 4
test eax, eax
je 0x46e330
mov edx, dword [esp + 0x28]
mov dword [eax + 0xc], edx
mov dword [ebx], 1
jmp 0x46e22e
mov dword [esp], 2
call dword [0x4861ac]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], ebx
mov dword [esp + 4], str._once__p_is__ld_n
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
jmp 0x46e22e
mov eax, 0x16
jmp 0x46e247
call fcn.0046d8c0
test eax, eax
jne 0x46e2d6
jmp 0x483d1f
call fcn.0046d8c0
test eax, eax
jne 0x46e2b2
jmp 0x483d14
call fcn.0046d8c0
test eax, eax
jne 0x46e28c
jmp 0x483d0d
call fcn.00464ba0
nop
mov eax, dword [pe_dos_header]
ud2
lea eax, [esp + 0x20]
mov dword [0], eax
ud2
mov eax, dword [esp + 0x28]
mov dword [0], eax
ud2

Function at 0x46e5b0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call fcn.0046d800
mov eax, dword [0x4861c8]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x46e628
lea ebp, [ebx + 0x38]
xor edi, edi
mov dword [esp], ebp
call fcn.0046d100
mov eax, dword [ebx + 0x28]
cmp dword [esp + 0x30], eax
jae 0x46e604
mov eax, dword [ebx + 0x30]
mov edx, dword [esp + 0x30]
cmp byte [eax + edx], 0
je 0x46e604
mov eax, dword [ebx + 0x2c]
mov edi, dword [eax + edx*4]
mov dword [esp], ebp
call fcn.0046d150
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
call fcn.0046d8c0
mov ebx, eax
jmp 0x46e5db
Function at 0x46e640
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov esi, dword [esp + 0x40]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x14], eax
call fcn.0046d800
mov eax, dword [0x4861c8]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x46e760
lea edi, [ebx + 0x38]
mov dword [esp], edi
call fcn.0046d100
cmp esi, dword [ebx + 0x28]
jae 0x46e6c0
mov edx, dword [ebx + 0x2c]
mov eax, dword [esp + 0x44]
mov dword [edx + esi*4], eax
mov eax, dword [ebx + 0x30]
mov byte [eax + esi], 1
mov dword [esp], edi
call fcn.0046d150
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
sub esp, 4
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
lea ebp, [esi + 1]
lea eax, [ebp*4]
mov dword [esp + 4], eax
mov eax, dword [ebx + 0x2c]
mov dword [esp], eax
call sub.msvcrt.dll_realloc
test eax, eax
je 0x46e76c
mov dword [esp + 0x1c], eax
mov dword [esp + 4], ebp
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
call sub.msvcrt.dll_realloc
mov edx, dword [esp + 0x1c]
test eax, eax
mov dword [esp + 0x18], eax
je 0x46e76c
mov ecx, dword [ebx + 0x28]
mov eax, ebp
mov dword [esp + 4], 0
mov dword [esp + 0x1c], edx
sub eax, ecx
lea ecx, [edx + ecx*4]
shl eax, 2
mov dword [esp], ecx
mov dword [esp + 8], eax
call sub.msvcrt.dll_memset
mov eax, dword [ebx + 0x28]
mov edx, dword [esp + 0x18]
mov ecx, ebp
mov dword [esp + 4], 0
sub ecx, eax
add eax, edx
mov dword [esp + 8], ecx
mov dword [esp], eax
call sub.msvcrt.dll_memset
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
mov dword [ebx + 0x28], ebp
mov dword [ebx + 0x2c], edx
mov dword [ebx + 0x30], eax
jmp 0x46e688
call fcn.0046d8c0
mov ebx, eax
jmp 0x46e675
mov dword [esp], edi
call fcn.0046d150
mov eax, 0xc
jmp 0x46e6b0

Function at 0x46e7f0
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 0x1c
call fcn.0046d800
mov eax, dword [0x4861c8]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x46e818
mov eax, dword [eax + 0x18]
add esp, 0x1c
ret
call fcn.0046d8c0
test eax, eax
jne 0x46e80d
add esp, 0x1c
ret

Function at 0x46e880
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 0x1c
call fcn.0046d800
mov eax, dword [0x4861c8]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x46e8a8
add eax, 0xc
add esp, 0x1c
ret
call fcn.0046d8c0
test eax, eax
jne 0x46e89d
jmp 0x46e8a0