joyce8/EMBER2024-capa huggingface dataset:
Function at 0x482b50
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
xor ebx, ebx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.WSOCK32.dll_inet_addr]
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
jne 0x482b94
mov eax, dword [ebp + 8]
push eax
push str.255.255.255.255
call fcn.00534750
add esp, 8
test eax, eax
jne 0x482ba4
push 2
push 4
lea eax, [ebp - 4]
push eax
call dword [sym.imp.WSOCK32.dll_gethostbyaddr]
mov ebx, eax
jmp 0x482ba4
push 2
push 4
lea eax, [ebp - 4]
push eax
call dword [sym.imp.WSOCK32.dll_gethostbyaddr]
mov ebx, eax
mov eax, ebx
test eax, eax
jne 0x482bb6
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.WSOCK32.dll_gethostbyname]
mov ebx, eax
mov eax, ebx
test eax, eax
jne 0x482be3
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x482be3
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
mov edx, dword [ebp + 0xc]
mov dword [edx + 0xc], eax
mov eax, dword [ebp + 0xc]
lea edx, str.Generic_error_in_GetHostByName__
mov dword [eax + 8], edx
push 0
call dword [sym.imp.WSOCK32.dll_WSASetLastError]
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x482c50
Capabilities:
Connect socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov dword [ebp - 4], 1
push 4
lea eax, [ebp - 4]
push eax
push 8
push 0xffff
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
push eax
call dword [sym.imp.WSOCK32.dll_setsockopt]
mov eax, dword [ebp + 8]
push eax
call fcn.00482bf0
pop ecx
push 0x10
mov eax, dword [ebp + 8]
lea edx, [eax + 0x10]
push edx
mov eax, dword [eax + 4]
push eax
call dword [sym.imp.WSOCK32.dll_connect]
mov ebx, eax
test ebx, ebx
je 0x482d1a
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x482cd9
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
mov edx, dword [ebp + 8]
mov dword [edx + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov edx, dword [eax + 0xc]
push edx
call fcn.00534900
pop ecx
mov edx, dword [ebp - 8]
mov dword [edx + 8], eax
push 0
call dword [sym.imp.WSOCK32.dll_WSASetLastError]
jmp 0x482d1a
mov eax, dword [ebp + 8]
push eax
call fcn.004829d0
pop ecx
mov ebx, eax
cmp ebx, 2
jne 0x482d02
mov eax, dword [ebp + 8]
mov dword [eax + 0xc], 2
mov eax, dword [ebp + 8]
lea edx, str.Connection_failed
mov dword [eax + 8], edx
jmp 0x482d1a
cmp ebx, 1
je 0x482d1a
mov eax, dword [ebp + 8]
or dword [eax + 0xc], 0xffffffff
mov eax, dword [ebp + 8]
lea edx, str.Timeout
mov dword [eax + 8], edx
mov eax, dword [ebp + 8]
push eax
call fcn.00482c20
pop ecx
mov eax, dword [ebp + 8]
cmp dword [eax + 0xc], 0
jne 0x482d34
mov esi, 1
jmp 0x482d36
xor esi, esi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x48a450
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push eax
call fcn.004a2000
pop ecx
mov ebx, eax
test eax, eax
je 0x48a4bd
mov eax, dword [ebx + 8]
mov dword [ebp - 8], eax
push eax
call fcn.0046b2e0
pop ecx
mov eax, dword [ebp + 8]
push eax
call fcn.0046a8b0
pop ecx
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x48a4b0
lea edi, [ebp + 0x14]
xor esi, esi
jmp 0x48a4ab
lea edi, [edi + 4]
mov eax, dword [edi - 4]
push eax
call fcn.0046a8b0
pop ecx
inc esi
cmp esi, dword [ebp + 0x10]
jb 0x48a49d
movzx eax, word [ebp + 0x10]
push eax
call fcn.00469190
pop ecx
jmp 0x48a4d5
push 0
push str.__ObjSendMsg__
push 0
push 0xbb8
push 1
call fcn.00492870
add esp, 0x14
mov eax, dword [ebp - 4]
lea eax, [eax + 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x48ba10
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
mov ebx, dword [eax + 0x64]
mov eax, ebx
test eax, eax
jne 0x48ba63
push 0x10
call fcn.0049b550
pop ecx
mov ebx, eax
mov edx, dword [ebp - 4]
mov dword [edx + 0x64], eax
mov word [ebx], 0xffff
mov dword [ebx + 4], 2
lea ebx, [ebx + 8]
mov ax, word [ebp + 8]
mov word [ebx], ax
mov dword [ebx + 4], 1
jmp 0x48bb25
mov edi, 1
mov esi, dword [ebx + 4]
lea ebx, [ebx + 8]
movzx eax, word [ebx]
movzx edx, word [ebp + 8]
cmp eax, edx
jl 0x48badc
movzx eax, word [ebx]
movzx edx, word [ebp + 8]
cmp eax, edx
jne 0x48ba8c
lea eax, [ebx + 4]
add dword [eax], 1
jmp 0x48bae8
lea eax, [esi + 1]
shl eax, 3
push eax
mov eax, dword [ebp - 4]
lea eax, [eax + 0x64]
mov dword [ebp - 8], eax
mov edx, dword [eax]
push edx
call fcn.0049b5d0
add esp, 8
mov ebx, eax
mov edx, dword [ebp - 8]
mov dword [edx], eax
lea eax, [ebx + 4]
add dword [eax], 1
lea ebx, [ebx + edi*8]
mov eax, esi
sub eax, edi
shl eax, 3
push eax
push ebx
lea eax, [ebx + 8]
push eax
call fcn.00532af0
add esp, 0xc
mov ax, word [ebp + 8]
mov word [ebx], ax
mov dword [ebx + 4], 1
jmp 0x48bae8
lea ebx, [ebx + 8]
inc edi
cmp edi, esi
jb 0x48ba6e
cmp edi, esi
jne 0x48bb25
lea eax, [esi + 1]
shl eax, 3
push eax
mov eax, dword [ebp - 4]
lea eax, [eax + 0x64]
mov dword [ebp - 8], eax
mov edx, dword [eax]
push edx
call fcn.0049b5d0
add esp, 8
mov ebx, eax
mov edx, dword [ebp - 8]
mov dword [edx], eax
lea eax, [ebx + 4]
add dword [eax], 1
lea ebx, [ebx + edi*8]
mov ax, word [ebp + 8]
mov word [ebx], ax
mov dword [ebx + 4], 1
mov eax, dword [ebx + 4]
cmp eax, 1
jne 0x48bb49
push 0
movzx eax, word [ebp + 8]
shl eax, 6
mov edx, dword [0x7beafc]
mov eax, dword [edx + eax - 4]
push eax
call fcn.0048ec50
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x48bb50
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
push esi
push edi
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
mov ebx, dword [eax + 0x64]
xor edi, edi
mov eax, ebx
test eax, eax
je 0x48bbb3
mov edi, dword [ebx + 4]
lea ebx, [ebx + 8]
mov esi, 1
jmp 0x48bb84
lea ebx, [ebx + 8]
inc esi
cmp edi, esi
jae 0x48bb93
movzx eax, word [ebx]
movzx edx, word [ebp + 8]
cmp eax, edx
jl 0x48bb80
movzx eax, word [ebx]
movzx edx, word [ebp + 8]
cmp eax, edx
jne 0x48bbb1
mov eax, dword [ebx + 4]
test eax, eax
je 0x48bbb1
lea eax, [ebx + 4]
mov edx, dword [eax]
dec edx
mov dword [eax], edx
mov edi, edx
jmp 0x48bbb3
xor edi, edi
mov eax, dword [ebx + 4]
test eax, eax
jne 0x48bbd6
push 0
movzx eax, word [ebp + 8]
shl eax, 6
mov edx, dword [0x7beafc]
mov eax, dword [edx + eax - 4]
push eax
call fcn.0048f220
add esp, 8
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x48bbe0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
mov ebx, dword [edi + 0x64]
mov eax, ebx
test eax, eax
je 0x48bc33
mov esi, dword [ebx + 4]
lea ebx, [ebx + 8]
jmp 0x48bc2a
mov eax, dword [ebx + 4]
test eax, eax
je 0x48bc27
push 0
movzx eax, word [ebx]
shl eax, 6
mov edx, dword [0x7beafc]
mov eax, dword [edx + eax - 4]
push eax
call fcn.0048f220
add esp, 8
lea ebx, [ebx + 8]
lea eax, [esi - 1]
mov esi, eax
test eax, eax
jne 0x48bc05
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x48bc40
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
mov ebx, dword [edi + 0x64]
mov eax, ebx
test eax, eax
je 0x48bc93
mov esi, dword [ebx + 4]
lea ebx, [ebx + 8]
jmp 0x48bc8a
mov eax, dword [ebx + 4]
test eax, eax
je 0x48bc87
push 0
movzx eax, word [ebx]
shl eax, 6
mov edx, dword [0x7beafc]
mov eax, dword [edx + eax - 4]
push eax
call fcn.0048ec50
add esp, 8
lea ebx, [ebx + 8]
lea eax, [esi - 1]
mov esi, eax
test eax, eax
jne 0x48bc65
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x48bca0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov eax, dword [ebp + 8]
mov edx, dword [eax]
and edx, 0x8000
je 0x48be2b
mov eax, dword [eax + 8]
cmp word [eax + 0xc], 0
je 0x48be2b
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov si, word [eax + 0xc]
movzx eax, si
test eax, eax
je 0x48be2b
movzx edx, word [0x7beb00]
cmp eax, edx
jg 0x48be2b
movzx eax, si
shl eax, 6
mov edx, dword [0x7beafc]
lea eax, [edx + eax - 0x40]
mov dword [ebp - 4], eax
mov eax, dword [eax + 0x20]
test eax, eax
je 0x48be2b
mov eax, dword [ebx + 0x30]
mov eax, dword [eax]
mov edx, dword [eax + 0x18]
test edx, edx
jne 0x48be2b
push str.__CLSINSTSUPER
mov eax, dword [eax + 0x14]
mov eax, dword [eax]
push eax
call fcn.00534750
add esp, 8
test eax, eax
je 0x48be2b
mov eax, dword [ebp - 4]
movzx eax, word [eax + 0x12]
and eax, 0x1000
je 0x48be2b
push 1
call fcn.0049b500
pop ecx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x20]
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebx + 0x10]
and eax, 0x8000
je 0x48bdce
mov eax, dword [ebx + 0x18]
mov edx, dword [ebp + 8]
mov edx, dword [edx + 8]
cmp eax, edx
jne 0x48bdce
mov dword [ebp - 8], 0
mov eax, dword [ebx + 8]
dec eax
mov dword [ebp - 0x18], eax
mov edx, dword [ebx + 4]
mov ecx, dword [ebx]
sub edx, ecx
mov dword [ebp - 0x14], edx
mov eax, edx
cdq
and edx, 3
add eax, edx
sar eax, 2
mov ecx, dword [ebp - 0x18]
cmp ecx, eax
jg 0x48bdba
call fcn.004a8c60
lea eax, [ebx + 4]
mov edx, dword [eax]
lea edx, [edx + 4]
mov dword [eax], edx
mov eax, dword [edx]
mov dword [eax], 0
jmp 0x48bdd3
call fcn.0046a920
mov eax, dword [ebp - 0x10]
push eax
call fcn.0046b2e0
pop ecx
mov eax, dword [ebp + 8]
push eax
call fcn.0046a8b0
pop ecx
push 0
call fcn.00469190
pop ecx
cmp dword [ebp - 8], 0
je 0x48bdfc
call fcn.0046bcd0
jmp 0x48be21
lea eax, [ebx + 4]
mov edx, dword [eax]
lea edx, [edx - 4]
mov dword [eax], edx
mov eax, edx
mov edx, dword [ebx]
cmp eax, edx
jae 0x48be21
push 0
push 0
push 0
push 0x233b
call fcn.00492ef0
add esp, 0x10
mov eax, dword [ebp - 0xc]
push eax
call fcn.0049b500
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x48d580
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
push 0x7d87c0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [esi + 0x1658], 0
push 0x7d87c0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ebx, dword [esi + 0x1664]
jmp 0x48d5d5
dec ebx
lea eax, [ebx + ebx]
add eax, eax
mov edx, dword [esi + 0x1660]
mov edx, dword [edx + eax]
push edx
mov edx, dword [esi + 0x165c]
call dword [edx + eax]
pop ecx
test ebx, ebx
jg 0x48d5bb
push esi
call fcn.0048d650
pop ecx
push 0
call fcn.00534a50
pop ecx
pop esi
pop ebx
pop ebp
ret
Function at 0x48d5f0
Capabilities:
Get thread local storage value
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
push 0
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x1650]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push 0x7d87c0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [ebx + 0x1658], 0
push 0x7d87c0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0x7d87c0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebp + 8]
push eax
call fcn.0048d650
pop ecx
pop ebx
pop ebp
ret

Function at 0x48d750
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edx, dword [0x7d87bc]
cmp edx, eax
jne 0x48d7db
push 0x7d87d8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
dec dword [0x7d87f0]
mov dword [ebx + 0x7c], 0
push 0x7d87f8
call fcn.0048dab0
pop ecx
jmp 0x48d7ab
push 0xffffffffffffffff
push 0x7d87d8
push 0x7d87f8
call fcn.0048db80
add esp, 0xc
cmp dword [0x7d87f0], 0
jg 0x48d797
mov eax, dword [0x7beb38]
mov eax, dword [eax + 0x166c]
test eax, eax
jne 0x48d797
inc dword [0x7d87f0]
mov dword [ebx + 0x7c], 1
push 0x7d87d8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop ebx
pop ebp
ret

Function at 0x48d7e0
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
push esi
push edi
call fcn.0048d8d0
mov ebx, dword [0x7beb38]
jmp 0x48d883
mov eax, dword [ebx + 0x70]
mov dword [ebp - 4], eax
cmp eax, dword [0x7d87bc]
je 0x48d814
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edx, dword [ebp - 4]
cmp edx, eax
jne 0x48d81c
mov ebx, dword [ebx + 0x166c]
jmp 0x48d883
cmp dword [ebx + 0x1658], 0
jne 0x48d831
mov dword [ebx + 0x1654], 1
jmp 0x48d883
push 0
mov eax, dword [ebx + 0x1650]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [ebx + 0x1650]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [0x7da154]
jmp 0x48d867
mov eax, dword [esi + 0x48]
cmp eax, dword [ebx + 0x70]
jne 0x48d864
push esi
call fcn.0048eb10
pop ecx
mov esi, dword [esi + 0x58]
mov eax, esi
test eax, eax
jne 0x48d855
mov edi, dword [ebx + 0x166c]
push ebx
call fcn.0048d260
pop ecx
push ebx
call fcn.0048d120
pop ecx
mov ebx, edi
mov eax, ebx
test eax, eax
jne 0x48d7f9
call fcn.0048d9a0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x48d8d0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
push 0x7d87d8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x7da158], 0
je 0x48d900
mov dword [0x7d87f4], 1
dec dword [0x7d87f0]
mov eax, dword [ebx + 0x1664]
mov edx, dword [ebx + 0x165c]
lea ecx, [0x48d8a0]
mov dword [edx + eax*4], ecx
mov eax, dword [ebx + 0x1664]
mov edx, dword [ebx + 0x1660]
lea ecx, [0x7d87d8]
mov dword [edx + eax*4], ecx
lea eax, [ebx + 0x1664]
inc dword [eax]
mov dword [ebx + 0x7c], 0
jmp 0x48d955
push 0xffffffffffffffff
push 0x7d87d8
push 0x7d87f8
call fcn.0048db80
add esp, 0xc
cmp dword [0x7d87f0], 0
jne 0x48d941
mov dword [0x7d87f4], 1
inc dword [0x7d87f0]
lea eax, [ebx + 0x80]
movzx edx, word [eax]
inc edx
mov word [eax], dx
lea eax, [ebx + 0x1664]
dec dword [eax]
push 0x7d87d8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop ebx
pop ebp
ret
Function at 0x48db80
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
push esi
push edi
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
push 0xffffffffffffffff
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebp + 8]
lea eax, [eax + 0x24]
inc dword [eax]
push 0
push 1
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0x7d87c0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [edi + 0x1654], 0
je 0x48dbeb
push 0x7d87c0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.0048d580
mov dword [edi + 0x1658], 1
push 0x7d87c0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x48dc1c
mov esi, 1
jmp 0x48dc1e
xor esi, esi
push 0x7d87c0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [edi + 0x1658], 0
push 0x7d87c0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebp + 8]
lea eax, [eax + 8]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x28]
mov ebx, eax
test eax, eax
je 0x48dc61
mov eax, dword [ebp + 8]
lea eax, [eax + 0x28]
dec dword [eax]
jmp 0x48dca7
mov eax, dword [ebp + 8]
lea eax, [eax + 0x20]
mov edx, dword [eax]
inc edx
mov dword [eax], edx
cmp edx, 0x77359400
jne 0x48dca7
push 0xffffffffffffffff
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebp + 8]
lea edx, [eax + 0x24]
mov eax, dword [eax + 0x20]
sub dword [edx], eax
push 0
push 1
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
mov eax, dword [ebp + 8]
mov dword [eax + 0x20], 0
mov eax, dword [ebp + 8]
lea eax, [eax + 8]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp ebx, 1
jne 0x48dcc9
push 0
push 1
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
test esi, esi
jne 0x48dce0
mov dword [ebp - 4], 1
jmp 0x48dce7
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x48ec50
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
mov eax, dword [ebp + 8]
push eax
call fcn.004a0070
pop ecx
mov ebx, eax
test eax, eax
je 0x48ec7c
mov eax, dword [ebx]
cmp eax, 0xf0316913
je 0x48ecaa
cmp dword [ebp + 0xc], 0
je 0x48eca3
push 1
call fcn.0049d010
pop ecx
push eax
push 1
push str.MUTEXLOCK
push 0
push 0xbc4
push 1
call fcn.00492c70
add esp, 0x18
xor eax, eax
jmp 0x48edd2
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edx, dword [ebx + 0x48]
cmp edx, eax
jne 0x48ecc6
lea eax, [ebx + 0x4c]
movzx edx, word [eax]
inc edx
mov word [eax], dx
jmp 0x48edcd
cmp dword [esi + 0x7c], 0
je 0x48ed05
movzx eax, word [esi + 0x80]
test eax, eax
jne 0x48ed05
push 0x7d87d8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
dec dword [0x7d87f0]
mov dword [esi + 0x7c], 0
push 0x7d87f8
call fcn.0048dab0
pop ecx
push 0x7d87d8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea eax, [ebx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esi + 0x1664]
mov edx, dword [esi + 0x165c]
lea ecx, [0x48eb40]
mov dword [edx + eax*4], ecx
mov eax, dword [esi + 0x1664]
mov edx, dword [esi + 0x1660]
lea ecx, [ebx + 4]
mov dword [edx + eax*4], ecx
lea eax, [esi + 0x1664]
inc dword [eax]
jmp 0x48ed52
push 0xffffffffffffffff
lea eax, [ebx + 4]
push eax
lea eax, [ebx + 0x1c]
push eax
call fcn.0048db80
add esp, 0xc
mov eax, dword [ebx + 0x48]
test eax, eax
jne 0x48ed40
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebx + 0x48], eax
mov word [ebx + 0x4c], 1
lea eax, [esi + 0x1664]
dec dword [eax]
lea eax, [ebx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [esi + 0x7c], 0
jne 0x48edcd
movzx eax, word [esi + 0x80]
test eax, eax
jne 0x48edcd
push 0x7d87d8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
jmp 0x48edac
push 0xffffffffffffffff
push 0x7d87d8
push 0x7d87f8
call fcn.0048db80
add esp, 0xc
mov eax, dword [0x7d87f4]
test eax, eax
jne 0x48ed98
inc dword [0x7d87f0]
mov dword [esi + 0x7c], 1
push 0x7d87d8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, 1
pop esi
pop ebx
pop ebp
ret
Function at 0x48ee30
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
mov eax, dword [ebp + 8]
push eax
call fcn.004a0070
pop ecx
mov ebx, eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, ebx
test eax, eax
je 0x48ee6d
mov eax, dword [ebx]
cmp eax, 0xf0316913
jne 0x48ee6d
cmp dword [ebp + 0xc], 0
jge 0x48eeaa
cmp dword [ebp + 0x10], 0
je 0x48eea3
push 1
call fcn.0049d010
pop ecx
mov dword [ebp - 8], eax
push 2
call fcn.0049d010
pop ecx
push eax
mov eax, dword [ebp - 8]
push eax
push 2
push str.MUTEXTIMEOUTLOCK
push 0
push 0xbc4
push 1
call fcn.00492c70
add esp, 0x1c
xor eax, eax
jmp 0x48efe7
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edx, dword [ebx + 0x48]
cmp edx, eax
jne 0x48eec6
lea eax, [ebx + 0x4c]
movzx edx, word [eax]
inc edx
mov word [eax], dx
jmp 0x48efe2
cmp dword [esi + 0x7c], 0
je 0x48ef05
movzx eax, word [esi + 0x80]
test eax, eax
jne 0x48ef05
push 0x7d87d8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
dec dword [0x7d87f0]
mov dword [esi + 0x7c], 0
push 0x7d87f8
call fcn.0048dab0
pop ecx
push 0x7d87d8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea eax, [ebx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esi + 0x1664]
mov edx, dword [esi + 0x165c]
lea ecx, [0x48eb40]
mov dword [edx + eax*4], ecx
mov eax, dword [esi + 0x1664]
mov edx, dword [esi + 0x1660]
lea ecx, [ebx + 4]
mov dword [edx + eax*4], ecx
lea eax, [esi + 0x1664]
inc dword [eax]
mov eax, dword [ebp - 4]
push eax
lea eax, [ebx + 4]
push eax
lea eax, [ebx + 0x1c]
push eax
call fcn.0048db80
add esp, 0xc
mov eax, dword [ebx + 0x48]
test eax, eax
je 0x48ef62
mov dword [ebp - 8], 0
jmp 0x48ef78
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebx + 0x48], eax
mov word [ebx + 0x4c], 1
mov dword [ebp - 8], 1
lea eax, [esi + 0x1664]
dec dword [eax]
lea eax, [ebx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [esi + 0x7c], 0
jne 0x48efdd
movzx eax, word [esi + 0x80]
test eax, eax
jne 0x48efdd
push 0x7d87d8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
jmp 0x48efbc
push 0xffffffffffffffff
push 0x7d87d8
push 0x7d87f8
call fcn.0048db80
add esp, 0xc
mov eax, dword [0x7d87f4]
test eax, eax
jne 0x48efa8
inc dword [0x7d87f0]
mov dword [esi + 0x7c], 1
push 0x7d87d8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebp - 8]
jmp 0x48efe7
mov eax, 1
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x48f050
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
mov eax, dword [ebp + 8]
push eax
call fcn.004a0070
pop ecx
mov ebx, eax
test eax, eax
je 0x48f07d
mov eax, dword [ebx]
cmp eax, 0xf0316913
je 0x48f0ab
cmp dword [ebp + 0xc], 0
je 0x48f0a4
push 1
call fcn.0049d010
pop ecx
push eax
push 1
push str.MUTEXTRYLOCK
push 0
push 0xbc4
push 1
call fcn.00492c70
add esp, 0x18
xor eax, eax
jmp 0x48f1ca
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edx, dword [ebx + 0x48]
cmp edx, eax
jne 0x48f0cc
lea eax, [ebx + 0x4c]
movzx edx, word [eax]
inc edx
mov word [eax], dx
mov edi, 1
jmp 0x48f1c8
cmp dword [esi + 0x7c], 0
je 0x48f10b
movzx eax, word [esi + 0x80]
test eax, eax
jne 0x48f10b
push 0x7d87d8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
dec dword [0x7d87f0]
mov dword [esi + 0x7c], 0
push 0x7d87f8
call fcn.0048dab0
pop ecx
push 0x7d87d8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea eax, [ebx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esi + 0x1664]
mov edx, dword [esi + 0x165c]
lea ecx, [0x48eb40]
mov dword [edx + eax*4], ecx
mov eax, dword [esi + 0x1664]
mov edx, dword [esi + 0x1660]
lea ecx, [ebx + 4]
mov dword [edx + eax*4], ecx
lea eax, [esi + 0x1664]
inc dword [eax]
mov eax, dword [ebx + 0x48]
test eax, eax
je 0x48f14f
xor edi, edi
jmp 0x48f163
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebx + 0x48], eax
mov word [ebx + 0x4c], 1
mov edi, 1
lea eax, [esi + 0x1664]
dec dword [eax]
lea eax, [ebx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [esi + 0x7c], 0
jne 0x48f1c8
movzx eax, word [esi + 0x80]
test eax, eax
jne 0x48f1c8
push 0x7d87d8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
jmp 0x48f1a7
push 0xffffffffffffffff
push 0x7d87d8
push 0x7d87f8
call fcn.0048db80
add esp, 0xc
mov eax, dword [0x7d87f4]
test eax, eax
jne 0x48f193
inc dword [0x7d87f0]
mov dword [esi + 0x7c], 1
push 0x7d87d8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret