joyce8/EMBER2024-capa huggingface dataset:
Function at 0x412130
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xa000]
push edi
or ebp, 0xffffffff
jmp 0x412152
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x412159
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x412148
mov eax, 1
add ebx, ebx
jne 0x41216b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x412160
jne 0x41217c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x412160
xor ecx, ecx
sub eax, 3
jb 0x412190
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x412202
mov ebp, eax
add ebx, ebx
jne 0x41219b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4121a8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4121cc
inc ecx
add ebx, ebx
jne 0x4121b8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4121ad
jne 0x4121c9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4121ad
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4121ec
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4121dd
jmp 0x41214e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4121ec
add edi, ecx
jmp 0x41214e
pop esi
mov edi, esi
mov ecx, 0xee
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x41220a
cmp byte [edi], 1
jne 0x41220a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x41220f
lea edi, [esi + 0x10000]
mov eax, dword [edi]
or eax, eax
je 0x41227e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x12130]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x121fc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41223c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x12204]
or eax, eax
je 0x412278
mov dword [ebx], eax
add ebx, 4
jmp 0x412259
call dword [esi + 0x12200]
mov ebp, dword [esi + 0x12208]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x247]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4122b2
sub esp, 0xffffff80
jmp 0x406ced
Function at 0x45df60
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x40000]
push edi
jmp 0x45df7a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x45df81
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x45df70
mov eax, 1
add ebx, ebx
jne 0x45df93
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x45dfa4
jne 0x45dfc3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x45dfc3
dec eax
add ebx, ebx
jne 0x45dfb0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x45df88
add ebx, ebx
jne 0x45dfbf
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x45e015
xor ecx, ecx
sub eax, 3
jb 0x45dfdb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x45e04a
sar eax, 1
mov ebp, eax
jmp 0x45dfe6
add ebx, ebx
jne 0x45dfe6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x45dfb4
inc ecx
add ebx, ebx
jne 0x45dff4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x45dfb4
add ebx, ebx
jne 0x45e001
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x45dff6
jne 0x45e012
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x45dff6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x45e034
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x45e026
jmp 0x45df76
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x45e034
add edi, ecx
jmp 0x45df76
pop esi
mov edi, esi
mov ecx, 0x18fe
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x45e052
cmp byte [edi], 7
jne 0x45e052
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x45e057
lea edi, [esi + 0x56000]
mov eax, dword [edi]
or eax, eax
je 0x45e0c6
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x5eb30]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x5ebd4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x45e084
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x5ebdc]
or eax, eax
je 0x45e0c0
mov dword [ebx], eax
add ebx, 4
jmp 0x45e0a1
call dword [esi + 0x5ebd8]
mov ebp, dword [esi + 0x5ebe0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x45e0fa
sub esp, 0xffffff80
jmp 0x431580
Function at 0x476e20
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x71000]
push edi
jmp 0x476e3a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x476e41
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x476e30
mov eax, 1
add ebx, ebx
jne 0x476e53
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x476e48
jne 0x476e64
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x476e48
xor ecx, ecx
sub eax, 3
jb 0x476e78
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x476eea
mov ebp, eax
add ebx, ebx
jne 0x476e83
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x476e90
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x476eb4
inc ecx
add ebx, ebx
jne 0x476ea0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x476e95
jne 0x476eb1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x476e95
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x476ed4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x476ec5
jmp 0x476e36
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x476ed4
add edi, ecx
jmp 0x476e36
pop esi
mov edi, esi
mov ecx, 0x290
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x476ef2
cmp byte [edi], 1
jne 0x476ef2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x476ef7
lea edi, [esi + 0x74000]
mov eax, dword [edi]
or eax, eax
je 0x476f6f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x90db0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x90e68]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x476f24
mov ecx, edi
jns 0x476f53
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x90e70]
or eax, eax
je 0x476f69
mov dword [ebx], eax
add ebx, 4
jmp 0x476f41
call dword [esi + 0x90e6c]
mov ebp, dword [esi + 0x90e74]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1f7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x476fa3
sub esp, 0xffffff80
jmp 0x403640
Function at 0x427b60
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x21000]
push edi
or ebp, 0xffffffff
jmp 0x427b82
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x427b89
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x427b78
mov eax, 1
add ebx, ebx
jne 0x427b9b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x427b90
jne 0x427bac
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x427b90
xor ecx, ecx
sub eax, 3
jb 0x427bc0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x427c32
mov ebp, eax
add ebx, ebx
jne 0x427bcb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x427bd8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x427bfc
inc ecx
add ebx, ebx
jne 0x427be8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x427bdd
jne 0x427bf9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x427bdd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x427c1c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x427c0d
jmp 0x427b7e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x427c1c
add edi, ecx
jmp 0x427b7e
pop esi
mov edi, esi
mov ecx, 0x43b
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x427c3a
cmp byte [edi], 0
jne 0x427c3a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x427c3f
lea edi, [esi + 0x25000]

Function at 0x432004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
je 0x432072
nop
nop
nop
nop
nop
mov ebx, 0x40c7d0
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x71e8717f
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x432060
nop
nop
nop
nop
mov eax, section..text_1
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x4320d2
nop
mov ebx, 0x42f314
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x16cc5ea0
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x4320c0
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x469230
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
mov edi, edi
push esi
mov esi, dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
push 0xfffffffffffffffe
push 0xfffffffffffffffe
push 0x776138
mov dword [ebx], 0
call esi
cmp eax, 0xfffffffe
jne 0x4692bd
push edi
push 0
push 1
push 0x78f790
call esi
cmp eax, 1
jne 0x46927a
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push 1
call edi
push 0
push 1
push 0x78f790
call esi
cmp eax, 1
je 0x469266
push 0xfffffffffffffffe
push 0xfffffffffffffffe
push 0x776138
call esi
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov esi, eax
cmp esi, 0xfffffffe
jne 0x4692a7
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov esi, eax
cmp esi, 0xffffffff
je 0x4692a7
push esi
push 0x776138
call edi
push 0
push 0x78f790
call edi
cmp esi, 0xffffffff
pop edi
jne 0x4692bd
mov eax, 0x8007000e
pop esi
ret
mov eax, dword [0x776138]
test eax, eax
jl 0x4692e2
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4692e2
add dword [eax + 0x124], 1
mov dword [ebx], 1
xor eax, eax
pop esi
ret
push 0x128
call sub.msvcrt.dll_malloc
mov esi, eax
add esp, 4
test esi, esi
je 0x4692b6
push 0x128
push 0
push esi
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [esi + 0x124], 1
mov dword [ebx], 1
mov eax, dword [0x776138]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
xor eax, eax
pop esi
ret

Function at 0x469420
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [0x776138]
test eax, eax
jl 0x469439
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0x46943f
xor eax, eax
pop ebp
ret 8
mov ecx, dword [eax + 0x18]
pop ebp
jmp fcn.007515ae

Function at 0x469450
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [0x776138]
test eax, eax
jge 0x469462
xor eax, eax
jmp 0x469469
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
mov edi, dword [ebp + 8]
xor ecx, ecx
lea edx, [eax + 0x1c]
cmp dword [ecx*4 + 0x441dc0], edi
jne 0x469480
cmp dword [edx], 0
jne 0x46949b
add ecx, 1
add edx, 8
cmp ecx, 0x1a
jb 0x469472
mov ecx, dword [eax + 0x18]
push 0x10
push edi
call fcn.007515ae
pop edi
pop ebp
ret 4
mov edx, dword [eax + ecx*8 + 0x1c]
test edx, edx
je 0x4694bd
push esi
mov esi, dword [edx]
mov dword [eax + ecx*8 + 0x1c], esi
test esi, esi
pop esi
jne 0x4694b7
mov dword [eax + ecx*8 + 0x20], 0
mov dword [edx], 0xfefefefe
cmp ecx, 0x1a
jb 0x4694d2
mov ecx, dword [eax + 0x18]
push 0x10
push edi
call fcn.007515ae
pop edi
pop ebp
ret 4
mov eax, edx
pop edi
pop ebp
ret 4
Function at 0x47e8e0
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x94
push ebx
xor ebx, ebx
push esi
push edi
xor edi, edi
cmp dword [ebp + 0xc], ebx
mov dword [ebp - 8], edi
mov dword [ebp - 4], ebx
mov dword [ebp - 0x90], ebx
mov dword [ebp - 0x8c], ebx
mov dword [ebp - 0x88], ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x10], ebx
je 0x47e944
push 8
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
cmp eax, ebx
je 0x47e93c
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x10]
mov dword [eax], ecx
mov dword [eax + 4], edx
mov dword [ebp - 4], eax
jmp 0x47e947
mov dword [ebp - 4], ebx
jmp 0x47e9f3
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 4]
lea eax, [ebp - 8]
push eax
mov eax, dword [ecx]
and eax, 0xc3
push edx
push eax
mov eax, dword [ecx + 4]
lea ecx, [ebp - 0x90]
call fcn.004bf050
test eax, eax
jge 0x47e97c
lea esi, [ebp - 0x90]
call fcn.004befb0
mov edi, dword [ebp - 8]
jmp 0x47e9fe
mov edi, dword [ebp - 8]
mov ecx, dword [edi]
mov edx, dword [ecx + 0x10]
push edi
call edx
mov esi, eax
mov eax, dword [0x776138]
cmp eax, ebx
mov dword [ebp + 0xc], esi
jl 0x47e9f3
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, ebx
je 0x47e9f3
mov ecx, dword [eax + 0x18]
push 1
push esi
call fcn.007515ae
mov esi, eax
cmp esi, ebx
je 0x47e9f3
mov eax, dword [ebp + 0xc]
mov ecx, dword [edi]
mov edx, dword [ecx + 0xc]
push eax
push edi
call edx
push eax
push esi
call sub.msvcrt.dll_memcpy
mov eax, dword [edi]
mov ecx, dword [eax + 8]
add esp, 0xc
push edi
call ecx
push 0x48
xor edi, edi
call fcn.00469450
cmp eax, ebx
je 0x47e9f3
mov edx, dword [ebp + 8]
push esi
add edx, 0x28
push edx
mov edx, dword [ebp + 0xc]
call fcn.00482970
cmp eax, ebx
mov dword [ebp + 0xc], eax
jne 0x47ea2b
lea esi, [ebp - 0x90]
call fcn.004befb0
mov ecx, dword [ebp - 4]
mov eax, dword [ebp + 8]
push ecx
mov dword [eax + 0x50], 1
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
add esp, 4
cmp edi, ebx
je 0x47ea20
mov edx, dword [edi]
mov eax, dword [edx + 8]
push edi
call eax
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
push ecx
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
add esp, 4
lea esi, [ebp - 0x90]
call fcn.004befb0
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x47f580
Capabilities:
Get thread local storage value

Disassembly:
test esi, esi
je 0x47f5d4
mov eax, dword [0x776138]
test eax, eax
push ebx
push edi
jge 0x47f593
xor ebx, ebx
jmp 0x47f59c
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov edi, dword [esi + 4]
mov eax, dword [edi*4 + 0x441dc0]
push eax
push 0xfe
push esi
call sub.msvcrt.dll_memset
lea ecx, [ebx + edi*8 + 0x20]
mov dword [esi], 0
mov eax, dword [ecx]
add esp, 0xc
test eax, eax
je 0x47f5cc
pop edi
mov dword [eax], esi
mov dword [ecx], esi
pop ebx
ret
mov dword [ebx + edi*8 + 0x1c], esi
pop edi
mov dword [ecx], esi
pop ebx
ret
Function at 0x48f940
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [esi + 0x18]
test eax, eax
push ebx
push edi
je 0x48faa8
cmp dword [esi + 0x40], 0
je 0x48faa8
cmp dword [esi + 0x54], 0
jne 0x48faa8
xor edx, edx
test eax, eax
mov dword [esi + 0x50], 0
jbe 0x48f9a5
mov ecx, dword [esi + 0x14]
add ecx, ecx
add ecx, ecx
jmp 0x48f980
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x1c]
mov eax, dword [ecx + eax]
mov eax, dword [eax + 0x9c]
add eax, 1
cmp dword [esi + 0x50], eax
jae 0x48f99a
mov dword [esi + 0x50], eax
add edx, 1
add ecx, 4
cmp edx, dword [esi + 0x18]
jb 0x48f980
mov edi, dword [esi + 0x50]
mov eax, dword [0x776138]
mov ebx, dword [sym.imp.KERNEL32.dll_TlsGetValue]
add edi, edi
add edi, edi
test eax, eax
jl 0x48f9c2
push eax
call ebx
test eax, eax
jne 0x48f9c6
xor eax, eax
jmp 0x48f9d1
mov ecx, dword [eax + 0x18]
push 0x10
push edi
call fcn.007515ae
test eax, eax
mov dword [esi + 0x54], eax
jne 0x48f9e5
pop edi
mov eax, 0x8007000e
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edi, dword [esi + 0x18]
mov eax, dword [0x776138]
add edi, edi
add edi, edi
test eax, eax
jl 0x48f9fc
push eax
call ebx
test eax, eax
jne 0x48fa00
xor eax, eax
jmp 0x48fa0b
mov ecx, dword [eax + 0x18]
push 0x10
push edi
call fcn.007515ae
test eax, eax
mov dword [esi + 0x58], eax
je 0x48f9d8
mov ecx, dword [esi + 0x50]
mov edx, dword [esi + 0x54]
add ecx, ecx
add ecx, ecx
push ecx
push 0
push edx
call sub.msvcrt.dll_memset
mov eax, dword [esi + 0x18]
mov ecx, dword [esi + 0x58]
add eax, eax
add eax, eax
push eax
push 0
push ecx
call sub.msvcrt.dll_memset
mov edx, dword [esi + 0x40]
mov ebx, dword [edx + 0x24]
xor edi, edi
add esp, 0x18
cmp dword [esi + 0x18], edi
mov dword [ebp - 4], ebx
jbe 0x48faa8
jmp 0x48fa50
test ebx, ebx
je 0x48faa8
mov ecx, dword [ebp + 8]
mov eax, dword [esi + 0x14]
mov edx, dword [ecx + 0x1c]
add eax, edi
mov ecx, dword [edx + eax*4]
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + 8]
and eax, 0x800080
xor edx, edx
or eax, edx
jne 0x48fa9a
mov eax, dword [ebx + 8]
mov edx, dword [ecx + 0x9c]
mov ebx, dword [esi + 0x54]
add eax, 0x18
mov dword [ebx + edx*4], eax
mov ebx, dword [ebp - 4]
mov eax, dword [ebx + 8]
mov ecx, dword [ecx + 0x90]
mov edx, dword [esi + 0x58]
add eax, 0x18
mov dword [edx + ecx*4], eax
mov ebx, dword [ebx + 0xc]
add edi, 1
cmp edi, dword [esi + 0x18]
mov dword [ebp - 4], ebx
jb 0x48fa50
pop edi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4c4570
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [0x776138]
test eax, eax
jl 0x4c4589
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0x4c458f
xor eax, eax
pop ebp
ret 4
mov ecx, dword [ebp + 8]
mov edx, dword [eax + 0x18]
mov dword [eax + 0x18], ecx
lea ecx, [eax + 0x1c]
mov eax, 0x1a
mov dword [ecx], 0
mov dword [ecx + 4], 0
add ecx, 8
sub eax, 1
jne 0x4c45a0
mov eax, edx
pop ebp
ret 4
Function at 0x4ca530
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [0x776138]
push ebx
push edi
xor edi, edi
cmp eax, edi
jge 0x4ca546
xor eax, eax
jmp 0x4ca54d
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp dword [eax + 0x10], edi
je 0x4ca575
mov ecx, dword [eax + 0x10]
cmp ecx, edi
jne 0x4ca55f
xor ecx, ecx
mov ebx, ecx
jmp 0x4ca583
mov edx, dword [ecx]
cmp edx, edi
mov dword [eax + 0x10], edx
jne 0x4ca56b
mov dword [eax + 0x14], edi
mov dword [ecx], 0xfefefefe
mov ebx, ecx
jmp 0x4ca583
mov ecx, dword [eax + 0xc]
push 0x10
push 0x40
call fcn.007515ae
mov ebx, eax
cmp ebx, edi
je 0x4ca5ee
mov edx, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x14]
or eax, 0xffffffff
push esi
push edi
mov dword [ebx + 0x10], eax
mov dword [ebx + 0x20], eax
mov eax, dword [ebp + 0x10]
push ebx
mov dword [ebx], edi
mov dword [ebx + 8], edi
mov dword [ebx + 0x38], edi
mov dword [ebx + 4], edi
mov word [ebx + 0x3c], di
mov dword [ebx + 0xc], edi
mov word [ebx + 0x3e], di
mov dword [ebx + 0x14], edi
mov dword [ebx + 0x18], edi
mov dword [ebx + 0x1c], edi
mov dword [ebx + 0x24], edi
mov dword [ebx + 0x30], edi
mov dword [ebx + 0x34], edi
call fcn.004cc5e0
cmp eax, edi
mov dword [ebp + 0x18], eax
jl 0x4ca5f9
mov esi, dword [ebp + 8]
push ebx
call fcn.004ca180
cmp eax, edi
mov dword [ebp + 0x18], eax
jl 0x4ca5f9
mov ecx, dword [ebp + 0xc]
pop esi
pop edi
mov dword [ecx], ebx
xor eax, eax
pop ebx
pop ebp
ret 0x14
pop edi
mov eax, 0x8007000e
pop ebx
pop ebp
ret 0x14
lea esi, [ebx + 4]
lea edi, [ebx + 0x3c]
call fcn.004cc530
lea esi, [ebx + 0xc]
lea edi, [ebx + 0x3e]
call fcn.004cc530
mov esi, ebx
call fcn.004ce8a0
mov eax, dword [ebp + 0x18]
pop esi
pop edi
pop ebx
pop ebp
ret 0x14
Function at 0x4ca820
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [0x776138]
push ebx
push edi
xor edi, edi
cmp eax, edi
jge 0x4ca836
xor eax, eax
jmp 0x4ca83d
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp dword [eax + 0x10], edi
je 0x4ca865
mov ecx, dword [eax + 0x10]
cmp ecx, edi
jne 0x4ca84f
xor ecx, ecx
mov ebx, ecx
jmp 0x4ca873
mov edx, dword [ecx]
cmp edx, edi
mov dword [eax + 0x10], edx
jne 0x4ca85b
mov dword [eax + 0x14], edi
mov dword [ecx], 0xfefefefe
mov ebx, ecx
jmp 0x4ca873
mov ecx, dword [eax + 0xc]
push 0x10
push 0x40
call fcn.007515ae
mov ebx, eax
cmp ebx, edi
je 0x4ca8dc
or eax, 0xffffffff
mov dword [ebx + 0x10], eax
mov dword [ebx + 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push eax
push ebx
mov dword [ebx], edi
mov dword [ebx + 8], edi
mov dword [ebx + 0x38], edi
mov dword [ebx + 4], edi
mov word [ebx + 0x3c], di
mov dword [ebx + 0xc], edi
mov word [ebx + 0x3e], di
mov dword [ebx + 0x14], edi
mov dword [ebx + 0x18], edi
mov dword [ebx + 0x1c], edi
mov dword [ebx + 0x24], edi
mov dword [ebx + 0x30], edi
mov dword [ebx + 0x34], edi
call fcn.004ccff0
cmp eax, edi
mov dword [ebp + 0xc], eax
jl 0x4ca8e7
mov esi, dword [ebp + 8]
push ebx
call fcn.004ca180
cmp eax, edi
mov dword [ebp + 0xc], eax
jl 0x4ca8e7
mov ecx, dword [ebp + 0x10]
xor eax, eax
cmp ecx, edi
je 0x4ca907
pop esi
pop edi
mov dword [ecx], ebx
pop ebx
pop ebp
ret 0xc
pop edi
mov eax, 0x8007000e
pop ebx
pop ebp
ret 0xc
lea esi, [ebx + 4]
lea edi, [ebx + 0x3c]
call fcn.004cc530
lea esi, [ebx + 0xc]
lea edi, [ebx + 0x3e]
call fcn.004cc530
mov esi, ebx
call fcn.004ce8a0
mov eax, dword [ebp + 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x4cace0
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
cmp ebx, dword [eax + 0xc]
jae 0x4cad8b
push esi
push edi
mov ecx, dword [eax + 0x38]
mov esi, dword [ecx + ebx*4]
test esi, esi
je 0x4cad7a
mov ecx, dword [esi + 0x10]
test ecx, ecx
je 0x4cad37
cmp ecx, 0xffffffff
je 0x4cad37
mov eax, dword [esi + 0x18]
test eax, eax
je 0x4cad1c
mov edx, dword [esi + 0x14]
mov dword [eax + 0x14], edx
jmp 0x4cad22
mov eax, dword [esi + 0x14]
mov dword [ecx + 0x24], eax
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4cad31
mov ecx, dword [esi + 0x18]
mov dword [eax + 0x18], ecx
jmp 0x4cad37
mov edx, dword [esi + 0x18]
mov dword [ecx + 0x28], edx
mov eax, dword [0x776138]
test eax, eax
jge 0x4cad44
xor edi, edi
jmp 0x4cad4d
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
push pe_nt_image_headers32
push 0xfe
push esi
call sub.msvcrt.dll_memset
mov dword [esi], 0
mov eax, dword [edi + 8]
add esp, 0xc
test eax, eax
je 0x4cad71
mov dword [eax], esi
jmp 0x4cad74
mov dword [edi + 4], esi
mov eax, dword [ebp + 8]
mov dword [edi + 8], esi
add ebx, 1
cmp ebx, dword [eax + 0xc]
jb 0x4cacf7
mov ebx, dword [ebp + 0xc]
pop edi
pop esi
or dword [eax + 0x18], 4
mov dword [eax + 0xc], ebx
pop ebx
pop ebp
ret 8