joyce8/EMBER2024-capa huggingface dataset:
Function at 0x473660
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov eax, dword [ebx + 0x1614]
cmp eax, dword [ebx + 0x1610]
jne 0x4736af
lea eax, [ebx + 0x1610]
add dword [eax], 0x32
mov eax, dword [ebx + 0x1610]
shl eax, 2
push eax
lea eax, [ebx + 0x160c]
mov dword [ebp - 4], eax
mov edx, dword [eax]
push edx
call fcn.0049b5d0
add esp, 8
mov edx, dword [ebp - 4]
mov dword [edx], eax
lea eax, [ebx + 0x1614]
mov edx, dword [eax]
lea ecx, [edx + 1]
mov dword [eax], ecx
mov eax, dword [ebx + 0x160c]
mov ecx, dword [ebp + 8]
mov dword [eax + edx*4], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4737c0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov eax, 0xc
mul dword [ebp + 8]
mov ecx, dword [ebx + 0x1628]
lea eax, [ecx + eax + 4]
add dword [eax], 1
pop ebx
pop ebp
ret

Function at 0x473860
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
mov eax, 0xc
mul dword [ebp + 8]
mov ecx, dword [esi + 0x1628]
lea ebx, [ecx + eax]
mov eax, dword [ebx + 4]
test eax, eax
je 0x4738c1
lea eax, [ebx + 4]
mov edx, dword [eax]
dec edx
mov dword [eax], edx
test edx, edx
jne 0x4738c1
mov eax, dword [ebx]
mov eax, dword [eax]
and eax, 0xf405
je 0x4738ab
mov eax, dword [ebx]
push eax
call fcn.004a45e0
pop ecx
mov eax, dword [ebx]
push eax
call fcn.0049b640
pop ecx
push esi
mov eax, dword [ebp + 8]
push eax
call fcn.004737f0
add esp, 8
pop esi
pop ebx
pop ebp
ret

Function at 0x473940
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov eax, dword [ebx + 0x1628]
test eax, eax
je 0x4739b3
mov eax, 0xc
mul dword [ebp + 8]
mov ecx, dword [ebx + 0x1628]
lea esi, [ecx + eax]
mov eax, dword [esi + 4]
test eax, eax
je 0x4739b3
lea eax, [esi + 4]
mov edx, dword [eax]
dec edx
mov dword [eax], edx
test edx, edx
jne 0x4739b3
mov eax, dword [esi]
mov eax, dword [eax]
and eax, 0x400
je 0x47399d
mov eax, dword [esi]
push eax
call fcn.004a4580
pop ecx
mov eax, dword [esi]
mov dword [eax], 0
mov eax, dword [esi]
push eax
call fcn.0049b640
pop ecx
push ebx
mov eax, dword [ebp + 8]
push eax
call fcn.004737f0
add esp, 8
pop esi
pop ebx
pop ebp
ret
Function at 0x4739c0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
push esi
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push eax
call fcn.00473280
add esp, 8
mov ebx, eax
mov eax, dword [ebp + 0xc]
and dword [eax], 0xfffff7ff
mov eax, ebx
test eax, eax
je 0x473a98
mov eax, dword [ebx + 4]
test eax, eax
je 0x473a70
mov eax, 0xc
mul dword [ebx + 4]
mov ecx, dword [esi + 0x1628]
mov edi, dword [ecx + eax]
mov eax, dword [edi]
and eax, 0x2000
je 0x473a26
push edi
call fcn.004a0990
pop ecx
mov edi, eax
mov eax, dword [edi]
and eax, 0x8000
je 0x473a61
mov eax, dword [edi + 8]
movzx eax, word [eax + 0xc]
test eax, eax
je 0x473a61
push edi
call fcn.004874e0
pop ecx
and eax, 0x8000
je 0x473a61
push edi
push 0
push 0
push str.__OPASSIGN
mov eax, dword [ebp + 0xc]
push eax
push edi
call fcn.004689e0
add esp, 0x18
jmp 0x473a7f
mov eax, dword [ebp + 0xc]
push eax
push edi
call fcn.004a4960
add esp, 8
jmp 0x473a7f
mov eax, dword [ebp + 0xc]
push eax
push 0x40
push ebx
call fcn.00473f30
add esp, 0xc
mov eax, 0xc
mul dword [ebx + 4]
mov ecx, dword [esi + 0x1628]
mov eax, dword [ecx + eax]
and dword [eax], 0xfffff7ff
jmp 0x473aaf
push 0
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push eax
push 0
push 0x233d
call fcn.00492ef0
add esp, 0x10
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x473ac0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
push esi
push edi
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
mov di, 1
push esi
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
push eax
call fcn.00473280
add esp, 8
mov ebx, eax
test eax, eax
je 0x473b42
mov eax, dword [ebx + 4]
test eax, eax
je 0x473b59
mov eax, 0xc
mul dword [ebx + 4]
mov ecx, dword [esi + 0x1628]
mov eax, dword [ecx + eax]
mov dword [ebp - 4], eax
mov eax, dword [eax]
and eax, 0x2000
je 0x473b2d
mov eax, dword [ebp - 4]
push eax
call fcn.004a0990
pop ecx
push eax
mov eax, dword [ebp + 8]
push eax
call fcn.004a4960
add esp, 8
jmp 0x473b3d
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp + 8]
push eax
call fcn.004a4960
add esp, 8
xor di, di
jmp 0x473b59
push 0
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
push eax
push 0
push 0x233d
call fcn.00492ef0
add esp, 0x10
movzx eax, di
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x473c00
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
push esi
push edi
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
push esi
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
push eax
call fcn.00473280
add esp, 8
mov ebx, eax
test eax, eax
je 0x473d5e
mov eax, dword [ebx + 4]
test eax, eax
je 0x473cb9
mov eax, 0xc
mul dword [ebx + 4]
mov ecx, dword [esi + 0x1628]
mov eax, dword [ecx + eax]
mov dword [ebp - 4], eax
mov eax, dword [eax]
and eax, 0x2000
je 0x473c6d
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp + 8]
push eax
call fcn.004a4960
add esp, 8
jmp 0x473d75
mov eax, dword [ebp + 8]
push eax
call fcn.004a45e0
pop ecx
mov eax, dword [ebp + 8]
mov dword [eax], 0x6000
mov eax, dword [ebp + 8]
mov dword [eax + 0xc], 0
mov eax, dword [ebp + 8]
mov edx, dword [ebx + 4]
mov dword [eax + 0x10], edx
mov eax, dword [ebp + 8]
lea edx, [esi + 0x1628]
mov dword [eax + 8], edx
mov eax, 0xc
mul dword [ebx + 4]
mov ecx, dword [esi + 0x1628]
lea eax, [ecx + eax + 4]
add dword [eax], 1
jmp 0x473d75
mov di, 1
push 1
push 0
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
push eax
push 0
push 0x3eb
push 0xe
push 0
push 2
call fcn.00492330
add esp, 0x20
mov dword [ebp - 4], eax
jmp 0x473d46
mov eax, dword [ebp - 4]
push eax
call fcn.004912d0
pop ecx
mov edi, eax
movzx eax, di
cmp eax, 1
jne 0x473d46
mov eax, dword [ebx + 4]
test eax, eax
je 0x473d46
mov eax, dword [ebp + 8]
push eax
call fcn.004a45e0
pop ecx
mov eax, dword [ebp + 8]
mov dword [eax], 0x6000
mov eax, dword [ebp + 8]
mov dword [eax + 0xc], 0
mov eax, dword [ebp + 8]
mov edx, dword [ebx + 4]
mov dword [eax + 0x10], edx
mov eax, dword [ebp + 8]
lea edx, [esi + 0x1628]
mov dword [eax + 8], edx
mov eax, 0xc
mul dword [ebx + 4]
mov ecx, dword [esi + 0x1628]
lea eax, [ecx + eax + 4]
add dword [eax], 1
xor di, di
movzx eax, di
cmp eax, 1
je 0x473ce1
mov eax, dword [ebp - 4]
push eax
call fcn.0049f7d0
pop ecx
jmp 0x473d75
push 0
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
push eax
push 0
push 0x233d
call fcn.00492ef0
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x473d80
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
push ebx
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push eax
call fcn.00473280
add esp, 8
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
push 6
push esi
call fcn.00473f30
add esp, 0xc
pop esi
pop ebx
pop ebp
ret
Function at 0x473dc0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 0x28], eax
lea edi, [ebp - 0x20]
lea esi, [0x69706c]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x24], 0
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
push eax
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.004a4e80
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
call fcn.00474570
pop ecx
mov ebx, eax
test eax, eax
je 0x473e69
mov eax, dword [ebx + 4]
test eax, eax
je 0x473e69
mov eax, 0xc
mul dword [ebx + 4]
mov ecx, dword [ebp - 0x28]
mov ecx, dword [ecx + 0x1628]
mov eax, dword [ecx + eax]
mov dword [ebp - 0x2c], eax
mov eax, dword [eax]
and eax, 0x2000
je 0x473e49
mov eax, dword [ebp - 0x2c]
push eax
call fcn.004a0990
pop ecx
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax]
and eax, 0x400
je 0x473e69
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp - 0x2c]
mov edx, dword [edx + 8]
mov dword [eax], edx
mov eax, dword [ebp - 0x24]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x473e80
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
xor ebx, ebx
mov eax, dword [ebp + 8]
mov eax, dword [eax]
and eax, 0x100
je 0x473ebd
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x14]
mov eax, dword [eax]
push eax
call fcn.00473280
add esp, 8
mov ebx, eax
jmp 0x473f10
mov eax, dword [ebp + 8]
mov eax, dword [eax]
and eax, 0x400
je 0x473ee0
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x10]
push eax
call fcn.00473280
add esp, 8
mov ebx, eax
jmp 0x473f10
push 1
call fcn.0049d010
pop ecx
mov dword [ebp - 8], eax
push 2
call fcn.0049d010
pop ecx
push eax
mov eax, dword [ebp - 8]
push eax
push 2
push 0x69716b
push 0
push 0xbc0
push 1
call fcn.00492870
add esp, 0x1c
mov eax, ebx
test eax, eax
je 0x473f28
mov eax, dword [ebp + 0x10]
push eax
movzx eax, byte [ebp + 0xc]
push eax
push ebx
call fcn.00473f30
add esp, 0xc
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x473f30
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
movzx eax, byte [ebp + 0xc]
and eax, 0x80
je 0x474013
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
test eax, eax
jne 0x474055
push 1
mov eax, dword [ebp + 0x10]
push eax
call fcn.004734e0
add esp, 8
mov edx, dword [ebp + 8]
mov dword [edx + 4], eax
mov eax, dword [ebp + 0x10]
test eax, eax
jne 0x474055
mov eax, 0xc
mov edx, dword [ebp + 8]
mul dword [edx + 4]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 0x1628]
mov eax, dword [ecx + eax]
mov dword [eax], pe_nt_image_headers32
push 0x697163
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov eax, dword [eax]
push eax
call fcn.00534750
add esp, 8
test eax, eax
je 0x473fd3
push 0x69715b
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov eax, dword [eax]
push eax
call fcn.00534750
add esp, 8
test eax, eax
jne 0x473ff3
mov eax, 0xc
mov edx, dword [ebp + 8]
mul dword [edx + 4]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 0x1628]
mov eax, dword [ecx + eax]
mov dword [eax + 8], 1
jmp 0x474055
mov eax, 0xc
mov edx, dword [ebp + 8]
mul dword [edx + 4]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 0x1628]
mov eax, dword [ecx + eax]
mov dword [eax + 8], 0
jmp 0x474055
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
mov dword [ebp - 8], eax
push 1
mov eax, dword [ebp + 0x10]
push eax
call fcn.004734e0
add esp, 8
mov edx, dword [ebp + 8]
mov dword [edx + 4], eax
mov eax, 0xc
mov edx, dword [ebp + 8]
mul dword [edx + 4]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 0x1628]
mov ebx, dword [ebp - 8]
mov dword [ecx + eax + 8], ebx
mov eax, dword [ebp + 8]
push eax
call fcn.00473660
pop ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x474060
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
push esi
push edi
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
and eax, 0x400
je 0x474101
mov esi, dword [ebx + 0x1614]
jmp 0x4740ed
dec esi
mov eax, dword [ebx + 0x160c]
mov edi, dword [eax + esi*4]
mov eax, dword [edi + 4]
test eax, eax
je 0x4740ed
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x10]
push eax
mov eax, dword [edi + 8]
mov eax, dword [eax]
push eax
call fcn.004a9ca0
add esp, 8
test eax, eax
jne 0x4740ed
mov eax, 0xc
mul dword [edi + 4]
mov ecx, dword [ebx + 0x1628]
mov eax, dword [ecx + eax]
mov dword [ebp - 4], eax
mov eax, dword [eax]
and eax, 0xf405
je 0x4740e2
mov eax, dword [ebp - 4]
push eax
call fcn.004a45e0
pop ecx
jmp 0x474122
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x474122
test esi, esi
jne 0x47408f
mov eax, dword [ebp + 8]
push eax
call fcn.004743f0
pop ecx
jmp 0x474122
push 1
call fcn.0049d010
pop ecx
push eax
push 1
push str.RELEASE
push 0
push 0xbc0
push 1
call fcn.00492870
add esp, 0x18
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x474130
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
push edi
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
mov ebx, dword [edi + 0x1614]
push 0
push 0
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.004bb0c0
add esp, 0x10
test eax, eax
jne 0x474217
push 0
mov eax, dword [ebp + 8]
push eax
push str.Invalid_mask_passed_as_MEMVAR_filter__s_n
push 0x238c
call fcn.00492ef0
add esp, 0x10
jmp 0x474217
dec ebx
mov eax, dword [edi + 0x160c]
mov esi, dword [eax + ebx*4]
mov eax, dword [esi + 4]
test eax, eax
je 0x474217
mov eax, 0xc
mul dword [esi + 4]
mov ecx, dword [edi + 0x1628]
mov eax, dword [ecx + eax]
mov dword [ebp - 0x20], eax
push 0
mov eax, dword [esi + 8]
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.004bb250
add esp, 0xc
mov dword [ebp - 0x1c], eax
cmp dword [ebp + 0xc], 0
je 0x4741d4
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
jmp 0x4741f0
cmp dword [ebp - 0x1c], 0
jne 0x4741e3
mov dword [ebp - 0x28], 1
jmp 0x4741ea
mov dword [ebp - 0x28], 0
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x474217
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
and eax, 0xf405
je 0x47420e
mov eax, dword [ebp - 0x20]
push eax
call fcn.004a45e0
pop ecx
jmp 0x474217
mov eax, dword [ebp - 0x20]
mov dword [eax], 0
cmp ebx, dword [edi + 0x1618]
ja 0x474186
lea eax, [ebp - 0x18]
push eax
call fcn.004bb210
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x474240
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
test eax, eax
jne 0x474263
or eax, 0xffffffff
jmp 0x47429d
mov esi, dword [ebx + 0x1614]
mov edi, 1
jmp 0x474297
dec esi
mov eax, dword [ebp + 8]
mov edx, dword [ebx + 0x160c]
mov edx, dword [edx + esi*4]
cmp eax, edx
jne 0x474297
cmp esi, dword [ebx + 0x1618]
jb 0x474290
mov edi, 4
jmp 0x474295
mov edi, 2
xor esi, esi
test esi, esi
jne 0x474270
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4742b0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
push esi
mov eax, dword [ebp + 8]
push eax
call fcn.004732e0
add esp, 8
mov ebx, eax
test eax, eax
je 0x4742e2
push ebx
call fcn.00474240
pop ecx
mov edi, eax
jmp 0x4742e7
mov edi, 0xfffffffe
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x474410
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 1
jne 0x474448
mov dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
push 0x474350
call fcn.004a2240
add esp, 8
mov eax, dword [ebp - 8]
jmp 0x474451
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1614]
mov esp, ebp
pop ebp
ret
Function at 0x4744a0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
xor ebx, ebx
mov eax, dword [ebp + 0x10]
mov dword [eax], 0
cmp dword [ebp + 0xc], 0
jle 0x474562
dec dword [ebp + 0xc]
cmp dword [ebp + 8], 1
jne 0x47451e
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0
lea eax, [ebp - 0x10]
push eax
push 0x474460
call fcn.004a2240
add esp, 8
cmp dword [ebp - 0xc], 0
je 0x474562
mov eax, 0xc
mov edx, dword [ebp - 8]
mul dword [edx + 4]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 0x1628]
mov ebx, dword [ecx + eax]
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp - 8]
mov edx, dword [edx + 8]
mov edx, dword [edx]
mov dword [eax], edx
jmp 0x474562
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x1614]
jae 0x474562
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x160c]
mov eax, dword [edx + eax*4]
mov dword [ebp - 8], eax
mov eax, 0xc
mov edx, dword [ebp - 8]
mul dword [edx + 4]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 0x1628]
mov ebx, dword [ecx + eax]
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp - 8]
mov edx, dword [edx + 8]
mov edx, dword [edx]
mov dword [eax], edx
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x474570
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
xor ebx, ebx
mov eax, dword [ebp + 8]
test eax, eax
je 0x4745ae
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
test eax, eax
je 0x4745ae
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 8], eax
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x10]
push eax
call fcn.004732e0
add esp, 8
mov ebx, eax
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x47ad80
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
mov eax, dword [ebp + 0xc]
push eax
call fcn.0049dcf0
pop ecx
mov ebx, eax
push ebx
mov eax, dword [ebp + 8]
push eax
call fcn.004a2750
add esp, 8
mov eax, dword [ebp + 0xc]
inc eax
mov dword [ebp - 4], eax
mov dword [ebp + 0xc], eax
mov edx, dword [0x7d8230]
push edx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov eax, dword [eax + 0x30]
mov eax, dword [eax]
movzx eax, word [eax + 0xe]
mov edx, dword [ebp - 4]
cmp edx, eax
jg 0x47adec
jmp 0x47ade8
mov eax, ebx
lea ebx, [eax - 1]
push eax
mov eax, dword [ebp + 8]
push eax
call fcn.004a30e0
add esp, 8
mov edx, dword [ebp + 0xc]
push edx
push eax
call fcn.0047ad80
add esp, 8
test ebx, ebx
jne 0x47adc9
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4827d0
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push ebx
mov dword [ebp - 0x104], 0
xor ebx, ebx
jmp 0x4827f8
mov eax, dword [ebp + ebx*4 - 0x100]
mov edx, dword [ebp + 8]
cmp eax, dword [edx + 4]
je 0x482800
inc ebx
cmp ebx, dword [ebp - 0x104]
jb 0x4827e8
cmp ebx, dword [ebp - 0x104]
jne 0x482825
cmp dword [ebp - 0x104], 0x40
jae 0x482825
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
mov dword [ebp + ebx*4 - 0x100], eax
add dword [ebp - 0x104], 1
mov eax, dword [ebp + 8]
cmp dword [eax + 0x24], 0xffffffff
jne 0x48284b
push 0
push 0
push 0
lea eax, [ebp - 0x104]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
inc eax
push eax
call dword [sym.imp.WSOCK32.dll_select]
jmp 0x4828ab
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x24]
mov ecx, 0x3e8
cdq
idiv ecx
mov dword [ebp - 0x10c], eax
mov eax, 0x3e8
mov dword [ebp - 0x114], eax
mov edx, dword [ebp + 8]
mov dword [ebp - 0x110], edx
mov eax, dword [edx + 0x24]
mov ecx, dword [ebp - 0x114]
cdq
idiv ecx
imul eax, edx, 0x3e8
mov dword [ebp - 0x108], eax
lea eax, [ebp - 0x10c]
push eax
push 0
push 0
lea eax, [ebp - 0x104]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
inc eax
push eax
call dword [sym.imp.WSOCK32.dll_select]
lea eax, [ebp - 0x104]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
push eax
call sub.WSOCK32.dll___WSAFDIsSet
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4828d0
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push ebx
mov dword [ebp - 0x104], 0
xor ebx, ebx
jmp 0x4828f8
mov eax, dword [ebp + ebx*4 - 0x100]
mov edx, dword [ebp + 8]
cmp eax, dword [edx + 4]
je 0x482900
inc ebx
cmp ebx, dword [ebp - 0x104]
jb 0x4828e8
cmp ebx, dword [ebp - 0x104]
jne 0x482925
cmp dword [ebp - 0x104], 0x40
jae 0x482925
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
mov dword [ebp + ebx*4 - 0x100], eax
add dword [ebp - 0x104], 1
mov eax, dword [ebp + 8]
cmp dword [eax + 0x24], 0xffffffff
jne 0x48294b
push 0
push 0
lea eax, [ebp - 0x104]
push eax
push 0
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
inc eax
push eax
call dword [sym.imp.WSOCK32.dll_select]
jmp 0x4829ab
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x24]
mov ecx, 0x3e8
cdq
idiv ecx
mov dword [ebp - 0x10c], eax
mov eax, 0x3e8
mov dword [ebp - 0x114], eax
mov edx, dword [ebp + 8]
mov dword [ebp - 0x110], edx
mov eax, dword [edx + 0x24]
mov ecx, dword [ebp - 0x114]
cdq
idiv ecx
imul eax, edx, 0x3e8
mov dword [ebp - 0x108], eax
lea eax, [ebp - 0x10c]
push eax
push 0
lea eax, [ebp - 0x104]
push eax
push 0
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
inc eax
push eax
call dword [sym.imp.WSOCK32.dll_select]
lea eax, [ebp - 0x104]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
push eax
call sub.WSOCK32.dll___WSAFDIsSet
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4829d0
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
push ebx
mov dword [ebp - 0x104], 0
xor ebx, ebx
jmp 0x4829f8
mov eax, dword [ebp + ebx*4 - 0x100]
mov edx, dword [ebp + 8]
cmp eax, dword [edx + 4]
je 0x482a00
inc ebx
cmp ebx, dword [ebp - 0x104]
jb 0x4829e8
cmp ebx, dword [ebp - 0x104]
jne 0x482a25
cmp dword [ebp - 0x104], 0x40
jae 0x482a25
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
mov dword [ebp + ebx*4 - 0x100], eax
add dword [ebp - 0x104], 1
mov dword [ebp - 0x208], 0
xor ebx, ebx
jmp 0x482a43
mov eax, dword [ebp + ebx*4 - 0x204]
mov edx, dword [ebp + 8]
cmp eax, dword [edx + 4]
je 0x482a4b
inc ebx
cmp ebx, dword [ebp - 0x208]
jb 0x482a33
cmp ebx, dword [ebp - 0x208]
jne 0x482a70
cmp dword [ebp - 0x208], 0x40
jae 0x482a70
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
mov dword [ebp + ebx*4 - 0x204], eax
add dword [ebp - 0x208], 1
mov eax, dword [ebp + 8]
cmp dword [eax + 0x24], 0xffffffff
jne 0x482a9b
push 0
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x104]
push eax
push 0
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
inc eax
push eax
call dword [sym.imp.WSOCK32.dll_select]
jmp 0x482b00
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x24]
mov ecx, 0x3e8
cdq
idiv ecx
mov dword [ebp - 0x210], eax
mov eax, 0x3e8
mov dword [ebp - 0x218], eax
mov edx, dword [ebp + 8]
mov dword [ebp - 0x214], edx
mov eax, dword [edx + 0x24]
mov ecx, dword [ebp - 0x218]
cdq
idiv ecx
imul eax, edx, 0x3e8
mov dword [ebp - 0x20c], eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x104]
push eax
push 0
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
inc eax
push eax
call dword [sym.imp.WSOCK32.dll_select]
lea eax, [ebp - 0x208]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
push eax
call sub.WSOCK32.dll___WSAFDIsSet
test eax, eax
je 0x482b1e
mov eax, 2
jmp 0x482b3e
lea eax, [ebp - 0x104]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
push eax
call sub.WSOCK32.dll___WSAFDIsSet
test eax, eax
je 0x482b3c
mov eax, 1
jmp 0x482b3e
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret