joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a0300
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x53c160]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, 0xffff
mov esi, ecx
cmp ax, di
jne 0x4a0335
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c3ba1
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push ebx
mov ecx, dword [eax]
test ecx, ecx
je 0x4a0373
mov edx, dword [esi + 0x30]
mov ebx, dword [edx]
lea eax, [ecx + ebx*2]
cmp ecx, eax
jae 0x4a0373
lea ecx, [ebx - 1]
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 2]
mov dword [edx], ecx
mov word [esi], di
pop ebx
mov ax, di
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c3ba1
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x4a0442
mov ebx, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [ebx], eax
jne 0x4a039d
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [ebx], ecx
mov eax, dword [esi + 0x1c]
sar edx, 1
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4a03aa
push dword [esi + 0x4c]
push edi
jmp 0x4a03e8
movzx eax, di
mov dword [ebp - 0x28], eax
mov eax, dword [ecx]
mov edx, dword [eax + 0x1c]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x26]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call edx
sub eax, 0
je 0x4a0412
sub eax, 1
je 0x4a0412
sub eax, 2
jne 0x4a0442
push dword [esi + 0x4c]
push dword [ebp - 0x28]
call fcn.004d9f05
mov ecx, 0xffff
add esp, 8
cmp ax, cx
movzx eax, di
jne 0x4a0447
pop ebx
pop edi
mov eax, ecx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c3ba1
mov esp, ebp
pop ebp
ret 4
mov ebx, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub ebx, eax
je 0x4a0432
lfence
push dword [esi + 0x4c]
push ebx
push 1
push eax
call fcn.004d32a8
add esp, 0x10
cmp ebx, eax
jne 0x4a0442
lea eax, [ebp - 0x28]
mov byte [esi + 0x3e], 1
cmp dword [ebp - 0x30], eax
jne 0x4a035d
mov eax, 0xffff
mov ecx, dword [ebp - 4]
pop ebx
pop edi
xor ecx, ebp
pop esi
call fcn.004c3ba1
mov esp, ebp
pop ebp
ret 4
Function at 0x4a09b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x53c160]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x4a0a77
cmp byte [esi + 0x3e], 0
je 0x4a0a77
mov eax, dword [esi]
push edi
push 0xffff
call dword [eax + 0xc]
mov ecx, 0xffff
cmp cx, ax
je 0x4a0a65
mov ecx, dword [esi + 0x38]
mov eax, dword [ecx]
mov edx, dword [eax + 0x20]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call edx
sub eax, 0
je 0x4a0a2a
sub eax, 1
je 0x4a0a2e
sub eax, 2
jne 0x4a0a65
mov byte [esi + 0x3e], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c3ba1
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3e], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x4a0a4e
lfence
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.004d32a8
add esp, 0x10
cmp edi, eax
jne 0x4a0a65
cmp byte [esi + 0x3e], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c3ba1
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c3ba1
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.004c3ba1
mov esp, ebp
pop ebp
ret
Function at 0x4a0b30
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fea7f
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x53c160]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x18], 0
mov dword [ebx], 0x518424
mov dword [ebx + 0x78], 0
mov dword [ebx + 0x98], 0
mov dword [ebx + 0x9c], 0
mov dword [ebx + 0xa0], 0
mov dword [ebx + 0x70], vtable.std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__.0
sub esp, 8
mov dword [ebp - 4], 0
lea esi, [ebx + 0x10]
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x14], esi
push esi
call fcn.00405020
mov dword [ebp - 4], 1
mov eax, dword [ebx]
mov eax, dword [eax + 4]
mov dword [ebx + eax], vtable.std::basic_ifstream_wchar_t__struct_std::char_traits_wchar_t__.0
mov eax, dword [ebx]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x1c], esi
lea eax, [ecx - 0x70]
mov dword [ecx + ebx - 4], eax
mov ecx, esi
call fcn.00404e00
lea eax, [ebx + 0x10]
lea ebx, [eax + 4]
mov dword [eax], vtable.std::basic_filebuf_wchar_t__struct_std::char_traits_wchar_t__.0
mov dword [eax + 0xc], ebx
lea ecx, [eax + 0x18]
mov dword [eax + 0x20], ecx
lea esi, [eax + 8]
mov byte [eax + 0x48], 0
lea edi, [eax + 0x14]
mov byte [eax + 0x3e], 0
lea edx, [eax + 0x24]
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x1c], ebx
mov ebx, dword [ebp - 0x14]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x1c]
mov dword [esi], 0
mov dword [ecx], 0
mov ecx, dword [0x54884c]
mov dword [eax], 0
mov eax, dword [0x548848]
mov dword [ebx], 0
mov ebx, dword [ebp - 0x14]
mov dword [edi], 0
mov dword [edx], 0
mov dword [ebx + 0x4c], 0
mov dword [ebx + 0x40], eax
mov dword [ebx + 0x44], ecx
mov dword [ebx + 0x38], 0
mov byte [ebp - 4], 2
cmp dword [ebx + 0x4c], 0
jne 0x4a0cdd
push 0x40
push 0x21
push dword [ebp + 8]
call fcn.004b0d47
add esp, 0xc
test eax, eax
je 0x4a0cdd
push 1
push eax
mov ecx, ebx
call fcn.004a0a90
mov eax, dword [ebx + 0x34]
mov esi, dword [eax + 4]
mov ecx, esi
mov dword [ebp - 0x1c], esi
mov eax, dword [esi]
call dword [eax + 4]
lea eax, [ebp - 0x20]
mov byte [ebp - 4], 3
push eax
call fcn.004a1ef0
add esp, 4
mov ecx, ebx
push eax
call fcn.00428ba0
test esi, esi
je 0x4a0cc6
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 8]
test eax, eax
je 0x4a0cc6
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov esi, dword [ebp - 0x10]
push 0
mov eax, dword [esi]
mov ecx, dword [eax + 4]
xor eax, eax
add ecx, esi
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.004089c0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4a33e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f2ca0
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x53c160]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 0x16c], 0
mov dword [esi], vtable.fusion::debugviewpp::FileReader.0
jne 0x4a35dc
mov dword [esi + 0x158], 0x51d7f4
mov dword [ebp - 4], 0
mov edi, dword [esi + 0x164]
test edi, edi
je 0x4a3460
or ebx, 0xffffffff
lea eax, [edi + 4]
mov ecx, ebx
lock xadd dword [eax], ecx
cmp ecx, 1
jne 0x4a3460
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 4]
lea eax, [edi + 8]
lock xadd dword [eax], ebx
cmp ebx, 1
jne 0x4a3460
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 8]
mov dword [esi + method.boost::signals2::signal_base.virtual_0], vtable.boost::signals2::signal_base.0
mov ecx, dword [esi + 0x150]
cmp ecx, 0x10
jb 0x4a34a4
mov eax, dword [esi + 0x13c]
inc ecx
cmp ecx, 0x1000
jb 0x4a349a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4a35d7
mov eax, edx
push ecx
push eax
call fcn.004c3baf
add esp, 8
mov dword [esi + 0x14c], 0
mov dword [esi + 0x150], 0xf
mov byte [esi + 0x13c], 0
mov ecx, dword [esi + 0x134]
cmp ecx, 0x10
jb 0x4a34f9
mov eax, dword [esi + 0x120]
inc ecx
cmp ecx, 0x1000
jb 0x4a34ef
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4a35d7
mov eax, edx
push ecx
push eax
call fcn.004c3baf
add esp, 8
lea ecx, [esi + 0x68]
mov dword [esi + 0x130], 0
mov dword [esi + 0x134], 0xf
mov byte [esi + 0x120], 0
call fcn.004540f0
mov eax, dword [esi + 0x64]
test eax, eax
je 0x4a352f
cmp eax, 0xffffffff
je 0x4a352f
push eax
call dword [sym.imp.KERNEL32.DLL_FindCloseChangeNotification]
mov ecx, dword [esi + 0x5c]
cmp ecx, 0x10
jb 0x4a3563
mov eax, dword [esi + 0x48]
inc ecx
cmp ecx, 0x1000
jb 0x4a3559
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4a35d7
mov eax, edx
push ecx
push eax
call fcn.004c3baf
add esp, 8
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0xf
mov byte [esi + 0x48], 0
mov ecx, dword [esi + 0x44]
cmp ecx, 0x10
jb 0x4a35a5
mov eax, dword [esi + 0x30]
inc ecx
cmp ecx, 0x1000
jb 0x4a359b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4a35d7
mov eax, edx
push ecx
push eax
call fcn.004c3baf
add esp, 8
mov dword [esi + 0x40], 0
lea ecx, [esi + 0xc]
mov dword [esi + 0x44], 0xf
mov byte [esi + 0x30], 0
mov dword [esi], vtable.fusion::debugviewpp::LogSource.0
call fcn.00408a80
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.004cecff
call fcn.004d7554
int3
Function at 0x4a6690
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, ecx
push 0xffffffffffffffff
push 0
mov eax, dword [esi + 8]
mov dword [ebp - 8], eax
mov eax, dword [esi + 4]
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push 2
call dword [sym.imp.KERNEL32.DLL_WaitForMultipleObjects]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
xor eax, eax
mov ecx, 0x548774
lock xadd dword [ecx], eax
mov ecx, dword [esi + 4]
push 0
push ecx
test eax, eax
je 0x4a66de
call dword [sym.imp.KERNEL32.DLL_TerminateThread]
pop esi
mov esp, ebp
pop ebp
ret
push method.std::basic_streambuf_char__struct_std::char_traits_char__.virtual_56
call dword [sym.imp.KERNEL32.DLL_QueueUserAPC]
push 0xffffffffffffffff
push dword [esi + 4]
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4a67e0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ff504
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
mov eax, dword [0x53c160]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [ebp + 8]
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], 0
mov dword [ebp - 4], 0
mov dword [esi], vtable.boost::asio::detail::win_iocp_io_context.0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
call fcn.004a6f80
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov byte [ebp - 4], 3
lea ecx, [esi + 0x38]
mov dword [esi + 0x34], 0
call fcn.004a6290
test eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], 0x518630
setne byte [ebp - 0x18]
test eax, eax
jne 0x4a68f0
mov dword [esi + 0x50], eax
mov dword [esi + 0x54], eax
mov dword [esi + 0x58], eax
mov ecx, dword [ebp + 0xc]
or eax, 0xffffffff
test ecx, ecx
mov byte [ebp - 4], 5
mov dword [esi + 0x5c], ecx
cmovns eax, ecx
push eax
push 0
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.DLL_CreateIoCompletionPort]
mov dword [esi + 0x14], eax
test eax, eax
jne 0x4a68dc
call dword [sym.imp.KERNEL32.DLL_GetLastError]
test eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], 0x518630
setne byte [ebp - 0x18]
test eax, eax
jne 0x4a68fd
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 8
mov edx, str.mutex
lea ecx, [ebp - 0x1c]
call fcn.00478060
mov edx, str.iocp
lea ecx, [ebp - 0x1c]
call fcn.00478060
int3
Function at 0x4a7010
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov ebx, ecx
mov dword [ebp - 8], edx
xor esi, esi
push edi
mov edi, dword [ebp + 0xc]
cmp ebx, 0xffffffff
je 0x4a7137
cmp byte [ebp + 8], 0
mov esi, dword [sym.imp.WS2_32.dll_WSASetLastError]
je 0x4a7067
mov al, byte [edx]
test al, 8
je 0x4a7067
xor ecx, ecx
or al, 8
push ecx
mov dword [ebp - 4], ecx
mov byte [edx], al
call esi
push 4
lea eax, [ebp - 4]
push eax
push 0x80
push 0xffff
push ebx
call dword [sym.imp.WS2_32.dll_setsockopt]
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push 0
call esi
push ebx
call dword [sym.imp.WS2_32.dll_closesocket]
mov esi, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
test eax, eax
mov dword [ebp - 0x14], eax
setne byte [ebp - 0x10]
movq xmm0, qword [ebp - 0x14]
movq qword [edi], xmm0
mov dword [edi + 8], 0x518630
test esi, esi
je 0x4a7137
mov eax, dword [edi]
cmp eax, 0x2733
jne 0x4a70c6
mov eax, dword [edi + 8]
cmp dword [eax + 8], 0x25c5e09b
jne 0x4a7152
cmp dword [eax + 0xc], 0x8fafd21e
je 0x4a70e6
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp eax, 0x4d5
jne 0x4a7152
mov eax, dword [edi + 8]
cmp dword [eax + 8], 0x25c5e09b
jne 0x4a7152
cmp dword [eax + 0xc], 0x8fafd21e
jne 0x4a7152
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0x8004667e
push ebx
call dword [sym.imp.WS2_32.dll_ioctlsocket]
mov eax, dword [ebp - 8]
push 0
and byte [eax], 0xfc
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push ebx
call dword [sym.imp.WS2_32.dll_closesocket]
mov esi, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
test eax, eax
mov dword [ebp - 0x14], eax
setne byte [ebp - 0x10]
movq xmm0, qword [ebp - 0x14]
movq qword [edi], xmm0
mov dword [edi + 8], 0x518630
test esi, esi
jne 0x4a7152
mov dword [ebp - 0x14], 0
mov byte [ebp - 0x10], 0
movq xmm0, qword [ebp - 0x14]
movq qword [edi], xmm0
mov dword [edi + 8], 0x518630
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4a7160
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
push 0
mov esi, edx
mov edi, ecx
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push 0
push 0
push 0
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push dword [ebp + 8]
push esi
push edi
call dword [sym.imp.WS2_32.dll_WSASend]
mov esi, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
test eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
setne byte [ebp - 0xc]
movq xmm0, qword [ebp - 0x10]
movq qword [eax], xmm0
mov dword [eax + 8], 0x518630
mov ecx, dword [eax]
cmp ecx, 0x40
jne 0x4a71c4
mov dword [ebp - 0x10], 0x2746
jmp 0x4a71d3
cmp ecx, 0x4d2
jne 0x4a71e7
mov dword [ebp - 0x10], 0x274d
mov byte [ebp - 0xc], 1
movq xmm0, qword [ebp - 0x10]
movq qword [eax], xmm0
mov dword [eax + 8], 0x518630
pop edi
test esi, esi
pop esi
je 0x4a71f4
or eax, 0xffffffff
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x10], 0
mov byte [ebp - 0xc], 0
movq xmm0, qword [ebp - 0x10]
movq qword [eax], xmm0
mov dword [eax + 8], 0x518630
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x4aa170
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
mov edi, ecx
mov esi, dword [edi + 4]
cmp esi, 0xffffffff
jne 0x4aa1a2
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x10], 0x2719
mov byte [ebp - 0xc], 1
movq xmm0, qword [ebp - 0x10]
movq qword [ecx], xmm0
mov dword [ecx + 8], 0x518630
jmp 0x4aa208
push 0
call dword [sym.imp.WS2_32.dll_WSASetLastError]
lea eax, [ebp - 4]
mov dword [ebp - 4], 1
push eax
push 0x8004667e
push esi
call dword [sym.imp.WS2_32.dll_ioctlsocket]
mov esi, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, dword [ebp + 0x10]
test eax, eax
mov dword [ebp - 0x10], eax
setne byte [ebp - 0xc]
movq xmm0, qword [ebp - 0x10]
movq qword [ecx], xmm0
mov dword [ecx + 8], 0x518630
test esi, esi
js 0x4aa208
mov dword [ebp - 0x10], 0
mov byte [ebp - 0xc], 0
movq xmm0, qword [ebp - 0x10]
movq qword [ecx], xmm0
mov dword [ecx + 8], 0x518630
or byte [edi + 8], 2
mov eax, dword [ebp + 8]
movq xmm0, qword [ecx]
mov ecx, dword [ecx + 8]
pop edi
movq qword [eax], xmm0
mov dword [eax + 8], ecx
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4aa820
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, ecx
push edi
push 0x10
mov dword [ebp - 4], esi
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call fcn.004c3bbd
add esp, 4
mov edi, eax
mov dword [ebp - 8], edi
push 0
push 0
push 1
mov dword [edi], vtable.boost::asio::detail::win_thread::func_class_boost::asio::detail::resolver_service_base::work_io_context_runner_.0
mov ecx, dword [ebp + 8]
push 0
mov dword [edi + 0xc], ecx
call dword [sym.imp.KERNEL32.DLL_CreateEventW]
mov ebx, eax
mov dword [edi + 4], ebx
test ebx, ebx
jne 0x4aa899
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov edx, dword [edi]
mov ecx, edi
push 1
mov esi, eax
call dword [edx]
test esi, esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0xc], 0x518630
setne byte [ebp - 0x10]
test esi, esi
jne 0x4aa966
mov esi, dword [ebp - 4]
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.DLL_CreateEventW]
mov dword [esi + 8], eax
mov dword [edi + 8], eax
cmp dword [esi + 8], 0
jne 0x4aa8de
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov edx, dword [edi]
mov ecx, edi
push 1
mov esi, eax
call dword [edx]
test esi, esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0xc], 0x518630
setne byte [ebp - 0x10]
test esi, esi
jne 0x4aa973
mov esi, dword [ebp - 4]
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0
push edi
push 0x4a6700
push 0
push 0
call fcn.004d7c43
add esp, 0x18
mov dword [esi + 4], eax
test eax, eax
jne 0x4aa945
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov edx, dword [edi]
mov ecx, edi
push 1
mov dword [ebp - 4], eax
call dword [edx]
mov edi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
test ebx, ebx
je 0x4aa922
push ebx
call edi
mov eax, dword [esi + 8]
test eax, eax
je 0x4aa92c
push eax
call edi
mov eax, dword [ebp - 4]
test eax, eax
mov dword [ebp - 0x14], eax
setne byte [ebp - 0x10]
mov dword [ebp - 0xc], 0x518630
test eax, eax
jne 0x4aa980
jmp 0x4aa94b
mov edi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
test ebx, ebx
je 0x4aa95b
push 0xffffffffffffffff
push ebx
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
push ebx
call edi
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov edx, str.thread.entry_event
lea ecx, [ebp - 0x14]
call fcn.00478060
mov edx, str.thread.exit_event
lea ecx, [ebp - 0x14]
call fcn.00478060
mov edx, str.thread
lea ecx, [ebp - 0x14]
call fcn.00478060
int3
Function at 0x4ab210
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ff995
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push esi
mov eax, dword [0x53c160]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ecx + 0xc]
xor edx, edx
mov dword [ebp - 0x20], 0
mov byte [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0x518630
mov esi, dword [eax + 8]
lea eax, [esi + 0x18]
lock xadd dword [eax], edx
test edx, edx
jne 0x4ab283
mov ecx, esi
call fcn.004a6bd0
mov dword [ebp - 0x38], 0
mov byte [ebp - 0x34], 0
movq xmm0, qword [ebp - 0x38]
movq qword [ebp - 0x20], xmm0
mov dword [ebp - 0x18], 0x518630
jmp 0x4ab31f
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov ecx, esi
mov dword [ebp - 4], 0
push dword [0x548824]
neg ecx
lea eax, [esi + 0x14]
sbb ecx, ecx
and ecx, eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], eax
call dword [sym.imp.KERNEL32.DLL_TlsGetValue]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x2c]
push eax
push dword [0x548824]
call dword [sym.imp.KERNEL32.DLL_TlsSetValue]
lea eax, [ebp - 0x20]
mov byte [ebp - 4], 1
push eax
push ecx
mov ecx, esi
call fcn.004a6c30
test eax, eax
je 0x4ab2f0
nop
lea eax, [ebp - 0x20]
push eax
push ecx
mov ecx, esi
call fcn.004a6c30
test eax, eax
jne 0x4ab2e0
push dword [ebp - 0x24]
push dword [0x548824]
call dword [sym.imp.KERNEL32.DLL_TlsSetValue]
mov dword [ebp - 4], 0xffffffff
xor esi, esi
mov eax, dword [ebp + esi*4 - 0x14]
test eax, eax
je 0x4ab319
push eax
call fcn.004c3b9c
add esp, 4
inc esi
cmp esi, 2
jl 0x4ab308
cmp byte [ebp - 0x1c], 0
jne 0x4ab335
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x20]
call fcn.004a6220
int3
Function at 0x4ada90
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ffea3
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x53c160]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x14]
mov dword [esi + 8], eax
xor eax, eax
mov byte [esi + 4], 1
mov dword [esi + 0xc], 0
mov word [esi + 0xc], ax
mov eax, dword [ebp + 8]
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 7
mov dword [esi + 0x24], 1
mov dword [esi + 0x28], eax
mov byte [esi + 0x2c], 0
mov dword [ebp - 4], 0
mov dword [esi], vtable.fusion::debugviewpp::PolledLogSource.0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 2
test ecx, ecx
jle 0x4adb3c
mov eax, 0xf4240
xor edx, edx
div ecx
jmp 0x4adb3e
xor eax, eax
push 0
cdq
push 0
push ecx
lea ecx, [esi + 0x50]
mov dword [esi + 0x48], eax
mov dword [esi + 0x4c], edx
call fcn.004812a0
add esp, 0xc
lea eax, [esi + 0x54]
push 2
push eax
call fcn.004b0aa4
add esp, 8
mov dword [esi + 0x84], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0x10

Function at 0x4adbc0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f31c0
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x53c160]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov ecx, dword [esi + 0x84]
mov dword [esi], vtable.fusion::debugviewpp::PolledLogSource.0
mov byte [esi + 0x2c], 1
test ecx, ecx
je 0x4adbff
call fcn.0047c8e0
mov eax, dword [esi + 0x84]
mov dword [esi + 0x84], 0
test eax, eax
je 0x4adc28
cmp dword [eax + 4], 0
jne 0x4adca7
push 8
push eax
call fcn.004c3baf
add esp, 8
mov eax, dword [esi]
mov ecx, esi
mov eax, dword [eax + 0x1c]
cmp eax, fcn.004adf00
jne 0x4adc3d
call fcn.004adf00
jmp 0x4adc3f
call eax
mov eax, dword [esi + 0x84]
test eax, eax
je 0x4adc5a
cmp dword [eax + 4], 0
jne 0x4adca7
push 8
push eax
call fcn.004c3baf
add esp, 8
lea eax, [esi + 0x54]
push eax
call fcn.004b0a7a
mov eax, dword [esi + 0x50]
add esp, 4
test eax, eax
je 0x4adc79
cmp eax, 0xffffffff
je 0x4adc79
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
lea ecx, [esi + 0x3c]
call fcn.004ae510
lea ecx, [esi + 0x30]
call fcn.004ae510
lea ecx, [esi + 0xc]
mov dword [esi], vtable.fusion::debugviewpp::LogSource.0
call fcn.00408a80
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
call fcn.004d7554
int3
Function at 0x4adcc0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ffedc
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x53c160]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 0x4c], 0
jl 0x4add85
jg 0x4add00
cmp dword [esi + 0x48], 0
jbe 0x4add85
push 8
call fcn.004c3bbd
mov edi, eax
add esp, 4
mov dword [ebp - 0x10], edi
push 0x10
mov dword [ebp - 4], 0
call fcn.004c3bbd
add esp, 4
mov dword [ebp - 0x14], eax
mov dword [eax], esi
mov dword [eax + 8], 0x4ade00
mov dword [eax + 0xc], 0
lea ebx, [edi + 4]
mov byte [ebp - 4], 1
push ebx
push 0
push eax
push 0x4ae850
push 0
push 0
call fcn.004d7c43
add esp, 0x18
mov dword [edi], eax
test eax, eax
je 0x4add97
lea ecx, [esi + 0x84]
lea eax, [ebp - 0x14]
cmp ecx, eax
je 0x4add75
mov eax, dword [ecx]
mov dword [ecx], edi
test eax, eax
je 0x4add85
cmp dword [eax + 4], 0
jne 0x4adda4
push 8
push eax
jmp 0x4add7d
cmp dword [ebx], 0
jne 0x4adda4
push 8
push edi
call fcn.004c3baf
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 6
mov dword [ebx], 0
call fcn.004b0bbd
call fcn.004d7554
int3