joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48fc30
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52c1ca
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
push edi
mov eax, dword [0x57a0ec]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x57a0d0]
mov edi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], 0
cmp eax, 0xffffffff
je 0x48fc77
push eax
call edi
mov esi, eax
test esi, esi
jne 0x48fc8f
call fcn.00490e40
mov eax, dword [0x57a0d0]
cmp eax, 0xffffffff
jne 0x48fc8a
xor esi, esi
jmp 0x48fc8f
push eax
call edi
mov esi, eax
push dword [ebp + 0x14]
mov eax, dword [ebp + 0xc]
sub esp, 8
mov ecx, esp
mov dword [ecx], eax
mov eax, dword [ebp + 0x10]
mov dword [ecx + 4], eax
test eax, eax
je 0x48fcb2
lea ecx, [eax + 4]
mov eax, 1
lock xadd dword [ecx], eax
lea ecx, [ebp - 0x20]
call fcn.0048f190
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.0048ed60
add esp, 0xc
push eax
lea ecx, [esi + 0x14]
mov byte [ebp - 4], 2
call fcn.0048e240
push eax
add eax, 0x10
lea ecx, [esi + 0x14]
push eax
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.0048e540
mov esi, dword [ebp - 0x28]
or edi, 0xffffffff
mov byte [ebp - 4], 3
test esi, esi
je 0x48fd23
lea eax, [esi + 4]
mov ecx, edi
lock xadd dword [eax], ecx
cmp ecx, 1
jne 0x48fd23
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
lea eax, [esi + 8]
mov edx, edi
lock xadd dword [eax], edx
cmp edx, 1
jne 0x48fd23
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 8]
mov esi, dword [ebp - 0x1c]
mov byte [ebp - 4], 4
test esi, esi
je 0x48fd58
lea eax, [esi + 4]
mov ecx, edi
lock xadd dword [eax], ecx
cmp ecx, 1
jne 0x48fd58
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
lea eax, [esi + 8]
mov edx, edi
lock xadd dword [eax], edx
cmp edx, 1
jne 0x48fd58
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 8]
mov esi, dword [ebp + 0x10]
mov dword [ebp - 4], 5
test esi, esi
je 0x48fd8e
lea eax, [esi + 4]
mov ecx, edi
lock xadd dword [eax], ecx
cmp ecx, 1
jne 0x48fd8e
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
lea eax, [esi + 8]
lock xadd dword [eax], edi
cmp edi, 1
jne 0x48fd8e
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x48fda0
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x57a0d0]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 0xffffffff
je 0x48fdb8
push eax
call esi
test eax, eax
jne 0x48fde1
call fcn.00490e40
mov eax, dword [0x57a0d0]
cmp eax, 0xffffffff
jne 0x48fdde
xor eax, eax
lea esi, [eax + 0xc]
lea eax, [esp + 8]
push esi
push eax
call fcn.0048ec00
add esp, 8
mov dword [esi], eax
pop esi
ret
push eax
call esi
lea esi, [eax + 0xc]
lea eax, [esp + 8]
push esi
push eax
call fcn.0048ec00
add esp, 8
mov dword [esi], eax
pop esi
ret
Function at 0x490360
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x57a0d0]
sub esp, 8
push esi
mov esi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 0xffffffff
je 0x49037b
push eax
call esi
test eax, eax
jne 0x490391
call fcn.00490e40
mov eax, dword [0x57a0d0]
cmp eax, 0xffffffff
jne 0x49038e
xor eax, eax
jmp 0x490391
push eax
call esi
lea esi, [eax + 0x14]
lea eax, [esp + 0x10]
mov ecx, esi
push eax
lea eax, [esp + 8]
push eax
call fcn.004e04b0
push dword [esp + 8]
lea eax, [esp + 8]
mov ecx, esi
push dword [esp + 8]
push eax
call fcn.0040a560
pop esi
add esp, 8
ret

Function at 0x490770
Capabilities:
Get thread local storage value

Disassembly:
push ecx
mov eax, dword [esp + 8]
mov dword [esp + 8], eax
mov eax, dword [0x57a0d0]
cmp eax, 0xffffffff
je 0x4907b6
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4907b6
push esi
lea esi, [eax + 0x14]
lea eax, [esp + 0xc]
mov ecx, esi
push eax
lea eax, [esp + 8]
push eax
call fcn.004903c0
mov eax, dword [esp + 4]
cmp eax, dword [esi]
pop esi
je 0x4907b6
add eax, 0x14
je 0x4907b6
mov eax, dword [eax + 8]
pop ecx
ret
xor eax, eax
pop ecx
ret
Function at 0x490e40
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52c380
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x57a0ec]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
call fcn.0048eb40
mov esi, eax
mov dword [ebp - 4], 0
push 0x4902d0
push 0x582db4
mov dword [ebp - 0x14], esi
call fcn.0048fe00
mov eax, dword [0x57a0d0]
add esp, 8
cmp eax, 0xffffffff
je 0x490ea0
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4914e0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52c43e
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x57a0ec]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x57a0d0]
cmp eax, 0xffffffff
jne 0x491516
xor ebx, ebx
jmp 0x49151f
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], 0
test ebx, ebx
je 0x491561
nop dword [eax]
cmp dword [ebx + 0x18], 0
mov esi, dword [ebx + 0xc]
jne 0x4915a0
test esi, esi
jne 0x4915a4
push 0x4902d0
push 0x582db4
call fcn.0048fe00
mov eax, dword [0x57a0d0]
add esp, 8
cmp eax, 0xffffffff
je 0x491561
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [ebp - 4], 1
test ebx, ebx
je 0x49158e
or eax, 0xffffffff
lock xadd dword [ebx + 4], eax
jne 0x49158e
mov eax, dword [ebx]
mov ecx, ebx
push 0
call dword [eax]
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x4915e6
mov eax, dword [esi + 4]
mov dword [ebx + 0xc], eax
mov ecx, dword [esi]
test ecx, ecx
je 0x4915cf
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [esi]
mov ecx, edi
push 0
mov eax, dword [edi]
call dword [eax]
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov esi, dword [ebx + 0xc]
test esi, esi
jne 0x4915a4
cmp dword [ebx + 0x18], 0
je 0x491530
mov esi, dword [ebx + 0x14]
mov esi, dword [esi]
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x491609
mov edx, dword [esi + 0x1c]
test edx, edx
je 0x491609
mov eax, dword [ecx]
push edx
call dword [eax + 4]
push esi
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebx + 0x14]
call fcn.0040acd0
cmp dword [ebx + 0x18], 0
jne 0x4915f0
jmp 0x491530
Function at 0x491630
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52c46e
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x57a0ec]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x57a0d0]
mov edi, dword [ebp + 8]
mov dword [ebp - 4], 0
mov dword [ebp + 8], edi
cmp eax, 0xffffffff
je 0x4916de
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4916de
lea esi, [eax + 0x14]
lea eax, [ebp + 8]
mov ecx, esi
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.004903c0
mov eax, dword [ebp - 0x10]
cmp eax, dword [esi]
je 0x4916de
lea esi, [eax + 0x14]
test esi, esi
je 0x4916de
cmp byte [ebp + 0x18], 0
je 0x4916b1
mov ecx, dword [esi]
test ecx, ecx
je 0x4916b1
mov edx, dword [esi + 8]
test edx, edx
je 0x4916b1
mov eax, dword [ecx]
push edx
call dword [eax + 4]
cmp dword [ebp + 0xc], 0
mov ebx, dword [ebp + 0x14]
setne al
test al, al
jne 0x4916ce
test ebx, ebx
jne 0x4916ce
push edi
call fcn.00490360
add esp, 4
jmp 0x491718
lea eax, [ebp + 0xc]
mov ecx, esi
push eax
call fcn.004e4df0
mov dword [esi + 8], ebx
jmp 0x491718
mov ecx, dword [ebp + 0xc]
test ecx, ecx
setne al
test al, al
mov eax, dword [ebp + 0x14]
jne 0x4916f1
test eax, eax
je 0x491718
push eax
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [ebp + 0x10]
mov dword [eax + 4], ecx
test ecx, ecx
je 0x49170f
add ecx, 4
mov eax, 1
lock xadd dword [ecx], eax
push edi
call fcn.0048fc30
add esp, 0x10
mov esi, dword [ebp + 0x10]
mov dword [ebp - 4], 1
test esi, esi
je 0x491751
or edi, 0xffffffff
lea ecx, [esi + 4]
mov eax, edi
lock xadd dword [ecx], eax
cmp eax, 1
jne 0x491751
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
lea eax, [esi + 8]
lock xadd dword [eax], edi
cmp edi, 1
jne 0x491751
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x491770
Capabilities:
Create thread
Resume thread

Disassembly:
push ebx
push edi
mov edi, ecx
mov edx, dword [edi]
lea eax, [edx + 0x10]
push eax
push 4
push edx
push 0x4919a0
push 0
push 0
call fcn.0050c8f3
mov ebx, eax
add esp, 0x18
test ebx, ebx
jne 0x491799
pop edi
xor al, al
pop ebx
ret
mov eax, dword [edi]
push esi
add eax, 4
lock inc dword [eax]
mov esi, dword [edi]
mov eax, dword [esi + 8]
test eax, eax
je 0x4917b7
cmp eax, 0xffffffff
je 0x4917b7
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 8], ebx
mov eax, dword [edi]
push dword [eax + 8]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop esi
pop edi
mov al, 1
pop ebx
ret
Function at 0x4949c0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52c788
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x57a0ec]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
cmp dword [edi + 0x14], 8
jb 0x4949fb
mov eax, dword [edi]
jmp 0x4949fd
mov eax, edi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x494a23
test esi, esi
je 0x494a1c
mov dword [esi], 0
call fcn.00492720
mov dword [esi + 4], eax
mov al, 1
jmp 0x494aa9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov dword [ebp - 0x64], 0
call fcn.00492720
mov dword [ebp - 0x60], eax
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x6c]
push edi
push eax
call fcn.004968a0
add esp, 0xc
cmp dword [ebp - 0x6c], 3
sete al
test al, al
je 0x494a67
test esi, esi
je 0x494aa7
mov dword [esi], 0
call fcn.00492720
jmp 0x494aa4
test esi, esi
jne 0x494a9d
push str.boost::filesystem::create_directory
lea ecx, [ebp - 0x28]
call fcn.00408500
mov dword [ebp - 4], esi
call fcn.00492720
push eax
push ebx
push edi
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x5c]
call fcn.00494050
push 0x578188
lea eax, [ebp - 0x5c]
push eax
call fcn.004f83e3
call fcn.00492720
mov dword [esi], ebx
mov dword [esi + 4], eax
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004927a4
mov esp, ebp
pop ebp
ret

Function at 0x494ad0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52c7b8
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x57a0ec]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
push 0
mov dword [ebp - 0x10], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov edi, eax
mov edx, 2
test edi, edi
mov eax, 1
cmove edi, eax
xor ecx, ecx
mov eax, edi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00492ce7
mov esi, eax
add esp, 4
mov dword [ebp - 0x14], esi
push esi
push edi
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
jne 0x494b4f
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x494b51
xor eax, eax
push str.boost::filesystem::current_path
push dword [ebp + 0xc]
push eax
call fcn.00495990
mov edi, dword [ebp + 8]
xor eax, eax
add esp, 0xc
mov dword [edi + 0x14], 7
mov dword [edi + 0x10], 0
mov word [edi], ax
cmp word [esi], ax
je 0x494b91
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x494b82
sub eax, edx
sar eax, 1
push eax
push esi
mov ecx, edi
call fcn.00409790
push esi
call fcn.00492819
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x496430
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 8
push ebx
push esi
mov esi, dword [esp + 0x14]
cmp dword [esi + 0x14], 8
jb 0x496443
mov eax, dword [esi]
jmp 0x496445
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x49646d
push dword [esp + 0x18]
lea eax, [esp + 0xc]
push esi
push eax
call fcn.00496320
add esp, 0xc
mov eax, dword [eax]
pop esi
pop ebx
add esp, 8
ret
push edi
mov edi, dword [esp + 0x1c]
test edi, edi
je 0x496484
mov dword [edi], 0
call fcn.00492720
mov dword [edi + 4], eax
pop edi
test ebx, 0x400
je 0x4964bb
push esi
call fcn.00495bf0
add esp, 4
test al, al
je 0x4964b0
test bl, 0x10
mov eax, 4
mov ecx, 0xb
pop esi
cmovne eax, ecx
pop ebx
add esp, 8
ret
pop esi
mov eax, 9
pop ebx
add esp, 8
ret
and ebx, 0x10
or ebx, 0x20
shr ebx, 4
pop esi
mov eax, ebx
pop ebx
add esp, 8
ret

Function at 0x496540
Capabilities:
Check if file exists
Delete directory

Disassembly:
mov eax, dword [esp + 4]
cmp dword [eax + 0x14], 8
jb 0x49654c
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x49658a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x49658a
cmp eax, 3
je 0x49658a
cmp eax, 0x7b
je 0x49658a
cmp eax, 0xf
je 0x49658a
cmp eax, 0x15
je 0x49658a
cmp eax, 0x57
je 0x49658a
cmp eax, 0xa1
je 0x49658a
cmp eax, 0x35
je 0x49658a
xor al, al
ret
mov al, 1
ret

Function at 0x496590
Capabilities:
Check if file exists
Delete file

Disassembly:
mov eax, dword [esp + 4]
cmp dword [eax + 0x14], 8
jb 0x49659c
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x4965da
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x4965da
cmp eax, 3
je 0x4965da
cmp eax, 0x7b
je 0x4965da
cmp eax, 0xf
je 0x4965da
cmp eax, 0x15
je 0x4965da
cmp eax, 0x57
je 0x4965da
cmp eax, 0xa1
je 0x4965da
cmp eax, 0x35
je 0x4965da
xor al, al
ret
mov al, 1
ret

Function at 0x496680
Capabilities:
Move file

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
cmp dword [esi + 0x14], 8
jb 0x496690
mov eax, dword [esi]
jmp 0x496692
mov eax, esi
mov edi, dword [esp + 0xc]
cmp dword [edi + 0x14], 8
jb 0x4966a0
mov ecx, dword [edi]
jmp 0x4966a2
mov ecx, edi
push 3
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x4966b8
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4966ba
xor eax, eax
push str.boost::filesystem::rename
push dword [esp + 0x18]
push esi
push edi
push eax
call fcn.00495830
add esp, 0x14
pop edi
pop esi
ret
Function at 0x4967e0
Capabilities:
Get disk size

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x18
cmp dword [eax + 0x14], 8
jb 0x4967f1
mov ecx, dword [eax]
jmp 0x4967f3
mov ecx, eax
push str.boost::filesystem::space
push dword [esp + 0x28]
push eax
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x24]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
neg eax
sbb eax, eax
inc eax
push eax
call fcn.004958e0
add esp, 0x10
test al, al
jne 0x496868
mov ecx, dword [esp + 4]
xor eax, eax
add eax, dword [esp]
mov edx, dword [esp + 0xc]
adc ecx, 0
push esi
mov esi, dword [esp + 0x20]
mov dword [esi + 4], ecx
xor ecx, ecx
add ecx, dword [esp + 0xc]
mov dword [esi + 8], ecx
adc edx, 0
mov dword [esi], eax
xor ecx, ecx
mov dword [esi + 0xc], edx
add ecx, dword [esp + 0x14]
mov eax, esi
mov edx, dword [esp + 0x18]
adc edx, 0
mov dword [esi + 0x10], ecx
mov dword [esi + 0x14], edx
pop esi
add esp, 0x18
ret
mov eax, dword [esp + 0x1c]
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
mov dword [eax], 0
mov dword [eax + 4], 0
add esp, 0x18
ret
Function at 0x4968a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52cc62
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x57a0ec]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x34], esi
cmp dword [edi + 0x14], 8
jb 0x4968e1
mov eax, dword [edi]
jmp 0x4968e3
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 0x38], eax
cmp eax, 0xffffffff
jne 0x496902
push esi
push edi
push ebx
call fcn.00496320
add esp, 0xc
jmp 0x4969fe
test eax, 0x400
je 0x4969bd
cmp dword [edi + 0x14], 8
jb 0x496917
mov eax, dword [edi]
jmp 0x496919
mov eax, edi
push eax
lea ecx, [ebp - 0x28]
call fcn.004941b0
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push 0
cmovae eax, dword [ebp - 0x28]
push 0x2000000
push 3
push 0
push 7
push 0
push eax
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 0x2c], esi
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.00408240
cmp esi, 0xffffffff
jne 0x496972
push dword [ebp - 0x34]
push edi
push ebx
call fcn.00496320
add esp, 0xc
jmp 0x4969fe
push edi
call fcn.00495bf0
add esp, 4
test al, al
jne 0x4969a5
mov eax, dword [ebp - 0x38]
push eax
push edi
call fcn.00495f70
add esp, 8
mov dword [ebx], 9
mov dword [ebx + 4], eax
push esi
mov dword [ebp - 4], 4
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4969fe
push esi
mov dword [ebp - 4], 5
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x34]
mov dword [ebp - 4], 0xffffffff
test esi, esi
je 0x4969cf
mov dword [esi], 0
call fcn.00492720
mov dword [esi + 4], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x30], 3
push eax
push edi
test al, 0x10
jne 0x4969e6
mov dword [ebp - 0x30], 2
call fcn.00495f70
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x2c], eax
mov eax, dword [ecx]
add esp, 8
mov dword [ebx], eax
mov eax, dword [ecx + 4]
mov dword [ebx + 4], eax
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004927a4
mov esp, ebp
pop ebp
ret
Function at 0x496a20
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 8
push ebx
push esi
mov esi, dword [esp + 0x18]
cmp dword [esi + 0x14], 8
jb 0x496a33
mov eax, dword [esi]
jmp 0x496a35
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x496a5d
push dword [esp + 0x1c]
push esi
mov esi, dword [esp + 0x1c]
push esi
call fcn.00496320
add esp, 0xc
mov eax, esi
pop esi
pop ebx
add esp, 8
ret
push edi
mov edi, dword [esp + 0x20]
test edi, edi
je 0x496a74
mov dword [edi], 0
call fcn.00492720
mov dword [edi + 4], eax
pop edi
test ebx, 0x400
je 0x496a9e
push esi
call fcn.00495bf0
add esp, 4
mov dword [esp + 8], 4
push ebx
push esi
test al, al
jne 0x496ab5
mov dword [esp + 0x10], 9
jmp 0x496ab5
mov dword [esp + 8], 3
push ebx
push esi
test bl, 0x10
jne 0x496ab5
mov dword [esp + 0x10], 2
call fcn.00495f70
mov dword [esp + 0x14], eax
lea edx, [esp + 0x10]
mov eax, dword [esp + 0x1c]
add esp, 8
mov ecx, dword [edx]
mov dword [eax], ecx
mov ecx, dword [edx + 4]
pop esi
mov dword [eax + 4], ecx
pop ebx
add esp, 8
ret

Function at 0x49b9a0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52d695
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
mov eax, dword [0x57a0ec]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], 0
mov dword [ebp - 4], 0
call fcn.00410f70
mov dword [esi], vtable.boost::log::v2s_mt_nt5::aux::basic_ostringstreambuf_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
lea edx, [esi + 0x44]
mov dword [esi + 0x38], 0
mov ecx, esi
mov dword [esi + 0x3c], 0
sub ecx, edx
mov byte [esi + 0x40], 0
add ecx, 0x64
mov eax, dword [esi + 0x10]
sar ecx, 1
mov dword [eax], edx
mov eax, dword [esi + 0x20]
mov dword [eax], edx
mov eax, dword [esi + 0x30]
mov dword [eax], ecx
lea edx, [esi + 0x68]
mov dword [ebp - 4], 1
mov dword [ebp - 0x18], edx
mov dword [edx], 0x553234
mov dword [edx + 8], vtable.std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__.0
mov eax, dword [edx]
push 0
push esi
mov byte [ebp - 4], 2
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], 1
mov dword [edx + eax], vtable.std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__.0
mov eax, dword [edx]
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
mov dword [ecx + edx - 4], eax
mov eax, dword [edx]
mov ecx, dword [eax + 4]
add ecx, edx
call fcn.004119e0
mov ecx, esi
mov dword [ebp - 4], 3
call fcn.0049c940
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4a03c0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52de1f
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x57a0ec]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
test esi, esi
je 0x4a04c1
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.InitializeSRWLock
push esi
call edi
mov ebx, eax
test ebx, ebx
je 0x4a04c1
push str.AcquireSRWLockExclusive
push esi
call edi
mov dword [ebp - 0x10], eax
test eax, eax
je 0x4a04c1
push str.ReleaseSRWLockExclusive
push esi
call edi
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4a04c1
push str.InitializeConditionVariable
push esi
call edi
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x4a04c1
push str.SleepConditionVariableSRW
push esi
call edi
mov dword [ebp - 0x18], eax
test eax, eax
je 0x4a04c1
push str.WakeAllConditionVariable
push esi
call edi
mov edi, eax
test edi, edi
je 0x4a04c1
push 0x1c
call fcn.004927c3
mov esi, eax
add esp, 4
mov dword [ebp - 0x20], esi
mov dword [ebp - 4], 0
test esi, esi
je 0x4a0541
mov eax, dword [ebp - 0x10]
mov dword [esi + 0xc], eax
mov eax, dword [ebp - 0x14]
mov dword [esi + 0x10], eax
mov eax, dword [ebp - 0x18]
mov dword [esi + 0x14], eax
lea eax, [esi + 4]
push eax
mov dword [esi], vtable.once_block_impl_nt6.0
mov dword [esi + 0x18], edi
call ebx
lea eax, [esi + 8]
push eax
call dword [ebp - 0x1c]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x2c
call fcn.004927c3
mov esi, eax
add esp, 4
mov dword [ebp - 0x20], esi
test esi, esi
je 0x4a0541
push 0x2c
push 0
push esi
call fcn.004f7830
mov dword [esi], vtable.once_block_impl_nt5.0
add esp, 0xc
mov dword [esi + 4], 0
mov eax, esi
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor esi, esi
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret