joyce8/EMBER2024-capa huggingface dataset:
Function at 0x470c60
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [esp + 0x10]
push esi
mov esi, ecx
push edi
test eax, eax
jne 0x470c7b
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov eax, dword [eax + 0x2c]
mov ecx, dword [esp + 0x10]
mov edi, dword [esp + 0x14]
mov dword [esi + 0x28], eax
mov eax, dword [esp + 0x1c]
mov dword [esi + 0x2c], eax
mov eax, dword [esp + 0xc]
mov dword [esi], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], ecx
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x30], 0
mov dword [esi + 8], 0
cmp eax, ecx
jb 0x470cdc
lea edx, [ecx - 1]
dec ecx
add edx, eax
not ecx
and ecx, edx
mov eax, edi
mov dword [esi + 4], ecx
xor edx, edx
div ecx
pop edi
mov dword [esi + 0x1c], eax
pop esi
ret 0x14

Function at 0x470dd0
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
mov ebp, ecx
mov ecx, dword [esp + 0x18]
push edi
push dword [0x884adc]
mov esi, dword [ecx + 0xc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
lea edx, [esi*4 + 0x7f]
and edx, 0xffffff80
mov dword [esp + 0x14], edx
mov edi, dword [eax + 0xc]
lea ecx, [edi + edx]
cmp edx, dword [eax + 8]
jg 0x470e0f
cmp ecx, dword [eax + 0x10]
ja 0x470e0f
mov dword [eax + 0xc], ecx
jmp 0x470e19
push edx
mov ecx, eax
call fcn.0046a3c0
mov edi, eax
mov ecx, dword [esp + 0x1c]
xor esi, esi
mov ebx, dword [ebp + 4]
mov edx, ebp
imul ebx, dword [ecx + 0xc]
mov eax, dword [ecx + 8]
mov ecx, dword [ebp]
mov dword [esp + 0x10], eax
add ebx, eax
test ecx, ecx
je 0x470e56
cmp ecx, eax
jb 0x470e4e
cmp ecx, ebx
jae 0x470e4e
mov dword [edi + esi*4], ecx
inc esi
mov eax, dword [ecx]
mov dword [edx], eax
mov eax, dword [esp + 0x10]
jmp 0x470e50
mov edx, ecx
mov ecx, dword [ecx]
test ecx, ecx
jne 0x470e38
mov ecx, dword [ebp + 0x20]
cmp ecx, eax
jb 0x470e8b
cmp ecx, ebx
jae 0x470e8b
mov eax, dword [ebp + 0x24]
xor edx, edx
sub eax, ecx
mov ecx, dword [esp + 0x1c]
div dword [ebp + 4]
add eax, esi
cmp eax, dword [ecx + 0xc]
jne 0x470e9b
mov dword [ebp + 0x20], 0
mov esi, 1
mov dword [ebp + 0x24], 0
jmp 0x470edf
mov ecx, dword [esp + 0x1c]
cmp esi, dword [ecx + 0xc]
jne 0x470e9b
mov esi, 1
jmp 0x470edf
test esi, esi
jle 0x470edd
cmp esi, 1
jle 0x470eb8
push 0x471080
lea eax, [esi - 1]
push eax
push 0
push edi
call fcn.00470f60
add esp, 0x10
mov edx, dword [edi]
mov ecx, 1
cmp esi, ecx
jle 0x470ecf
mov eax, dword [edi + ecx*4]
inc ecx
mov dword [edx], eax
mov edx, eax
cmp ecx, esi
jl 0x470ec3
mov ecx, dword [edi + esi*4 - 4]
mov eax, dword [ebp]
mov dword [ecx], eax
mov eax, dword [edi]
mov dword [ebp], eax
xor esi, esi
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [esp + 0x14]
lea edx, [ecx + 0xf]
and edx, 0xfffffff0
cmp ecx, dword [eax + 8]
jg 0x470f16
lea ecx, [edx + edi]
cmp ecx, dword [eax + 0xc]
jne 0x470f16
cmp dword [eax + 0x14], edi
je 0x470f16
mov dword [eax + 0xc], edi
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 4
push edx
push edi
mov ecx, eax
call fcn.0046a590
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 8
ret 4
Function at 0x4723b0
Capabilities:
Get thread local storage value

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
push edi
push dword [0x884adc]
mov ebx, dword [ebp + 4]
sub ebx, dword [ebp]
mov dword [esp + 0x14], ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
lea edi, [ebx + 0x80]
and edi, 0xffffff80
mov esi, dword [eax + 0xc]
lea ecx, [esi + edi]
cmp edi, dword [eax + 8]
jg 0x4723ed
cmp ecx, dword [eax + 0x10]
ja 0x4723ed
mov dword [eax + 0xc], ecx
jmp 0x4723f7
push edi
mov ecx, eax
call fcn.0046a3c0
mov esi, eax
push ebx
push dword [ebp]
push esi
call fcn.0045d480
mov ecx, dword [esp + 0x1c]
add esp, 8
mov eax, esp
mov byte [esi + ebx], 0
push esi
push dword [esp + 0x20]
mov byte [eax], 1
call fcn.00472470
push dword [0x884adc]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
lea edx, [edi + 0xf]
and edx, 0xfffffff0
cmp edi, dword [eax + 8]
jg 0x47244e
lea ecx, [edx + esi]
cmp ecx, dword [eax + 0xc]
jne 0x47244e
cmp dword [eax + 0x14], esi
je 0x47244e
mov dword [eax + 0xc], esi
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc
push edx
push esi
mov ecx, eax
call fcn.0046a590
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
pop ecx
ret 0xc

Function at 0x473e90
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push 0x14
mov ecx, dword [eax + 0x30]
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, eax
test esi, esi
je 0x473eba
xorps xmm0, xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
push esi
push dword [0x884c50]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov byte [esi + 0x10], 0
mov dword [esi], 0
mov dword [esi + 8], 0
mov dword [esi + 4], 0
mov dword [esi + 0xc], 0
pop esi
ret

Function at 0x474750
Capabilities:
Get thread local storage value

Disassembly:
push esi
mov esi, ecx
call fcn.0045caa0
mov eax, dword [esp + 8]
test al, 1
je 0x4747a2
test al, 4
jne 0x474797
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0xc
cmp ax, cx
je 0x47477a
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0xc
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4

Function at 0x474924
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, ecx
mov dword [esi], vtable.hkBaseObject.0
test al, 1
je 0x474973
test al, 4
jne 0x474968
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0xc
cmp ax, cx
je 0x47494b
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0xc
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4
Function at 0x474984
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, ecx
mov dword [esi], vtable.hkBaseObject.0
test al, 1
je 0x4749d3
test al, 4
jne 0x4749c8
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0xc
cmp ax, cx
je 0x4749ab
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0xc
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4

Function at 0x4749e4
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, ecx
mov dword [esi + 0x14], vtable.hkBaseObject.0
mov dword [esi + 8], vtable.hkBaseObject.0
mov dword [esi], vtable.hkBaseObject.0
test al, 1
je 0x474a41
test al, 4
jne 0x474a36
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0x20
cmp ax, cx
je 0x474a19
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0x20
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4

Function at 0x477370
Capabilities:
Get thread local storage value

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
push dword [0x884adc]
mov edi, dword [ebx + 4]
sub edi, dword [ebx]
mov dword [esp + 0x10], ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub edi, 0xffffff80
and edi, 0xffffff80
mov esi, dword [eax + 0xc]
lea ecx, [esi + edi]
cmp edi, dword [eax + 8]
jg 0x4773a8
cmp ecx, dword [eax + 0x10]
ja 0x4773a8
mov dword [eax + 0xc], ecx
jmp 0x4773b2
push edi
mov ecx, eax
call fcn.0046a3c0
mov esi, eax
mov edx, dword [ebx]
mov ecx, dword [ebx + 4]
sub ecx, edx
push ecx
push edx
push esi
call fcn.0045d480
mov eax, dword [ebx + 4]
mov ecx, esi
sub ecx, dword [ebx]
add esp, 0xc
mov byte [ecx + eax], 0
mov ecx, dword [esp + 0xc]
push esi
mov eax, dword [ecx]
call dword [eax + 0x14]
push dword [0x884adc]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
lea edx, [edi + 0xf]
and edx, 0xfffffff0
cmp edi, dword [eax + 8]
jg 0x47740b
lea ecx, [edx + esi]
cmp ecx, dword [eax + 0xc]
jne 0x47740b
cmp dword [eax + 0x14], esi
je 0x47740b
pop edi
mov dword [eax + 0xc], esi
mov eax, ebx
pop esi
pop ebx
pop ecx
ret 4
push edx
push esi
mov ecx, eax
call fcn.0046a590
pop edi
pop esi
mov eax, ebx
pop ebx
pop ecx
ret 4

Function at 0x4792d0
Capabilities:
Get thread local storage value

Disassembly:
push esi
push edi
push dword [0x884adc]
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, dword [esp + 0xc]
push 0x40
push esi
push dword [eax + 0x2c]
call fcn.004605d0
add esp, 0xc
mov dword [edi], eax
mov dword [edi + 0xc], esi
mov eax, edi
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0x10], 0xffffffff
mov dword [edi + 0x14], 0xffffffff
pop edi
pop esi
ret 4
Function at 0x479320
Capabilities:
Get thread local storage value

Disassembly:
push esi
push dword [0x884adc]
mov esi, dword [ecx]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
push dword [eax + 0x2c]
call fcn.00460610
add esp, 8
pop esi
ret

Function at 0x479480
Capabilities:
Get thread local storage value

Disassembly:
push esi
mov esi, ecx
call fcn.004790d0
mov eax, dword [esp + 8]
test al, 1
je 0x4794d2
test al, 4
jne 0x4794c7
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0x24
cmp ax, cx
je 0x4794aa
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0x24
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4

Function at 0x479550
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, ecx
push dword [esi + 0xc]
push dword [esp + 0x10]
push 1
push dword [esp + 0x14]
call fcn.0062bf6e
add esp, 0x10
test eax, eax
jg 0x479570
mov byte [esi + 0x10], 0
pop esi
ret 8

Function at 0x479640
Capabilities:
Get thread local storage value

Disassembly:
push esi
mov esi, ecx
call fcn.00479520
mov eax, dword [esp + 8]
test al, 1
je 0x479692
test al, 4
jne 0x479687
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0x14
cmp ax, cx
je 0x47966a
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0x14
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4

Function at 0x4797f0
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 8]
test eax, eax
je 0x479822
push edi
push eax
push dword [esp + 0x14]
push 1
push dword [esp + 0x18]
call fcn.0062ced1
mov edi, eax
add esp, 0x10
test edi, edi
jg 0x47981b
mov ecx, esi
call fcn.004797a0
mov eax, edi
pop edi
pop esi
ret 8
xor eax, eax
pop esi
ret 8

Function at 0x4798a0
Capabilities:
Get thread local storage value

Disassembly:
push esi
mov esi, ecx
call fcn.004797d0
mov eax, dword [esp + 8]
test al, 1
je 0x4798f2
test al, 4
jne 0x4798e7
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0x10
cmp ax, cx
je 0x4798ca
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0x10
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4
Function at 0x479b76
Capabilities:
Get hostname
Set socket configuration

Disassembly:
sub esp, 0x3ac
push esi
mov esi, ecx
call fcn.00479eb0
test eax, eax
jne 0x479bde
push dword [esp + 0x3b4]
mov eax, 2
mov dword [esp + 0x1c], 0
mov word [esp + 0x18], ax
call sub.WSOCK32.dll_htons
push 4
mov word [esp + 0x1a], ax
lea eax, [esp + 8]
push eax
push 4
push 0xffff
push dword [esi + 0x20]
mov dword [esp + 0x18], 1
call sub.WSOCK32.dll_setsockopt
push 0x10
lea eax, [esp + 0x18]
push eax
push dword [esi + 0x20]
call sub.WSOCK32.dll_bind
cmp eax, 0xffffffff
jne 0x479bed
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x10]
mov eax, 1
pop esi
add esp, 0x3ac
ret 4
push 2
push dword [esi + 0x20]
call sub.WSOCK32.dll_listen
cmp eax, 0xffffffff
je 0x479bd7
lea eax, [esp + 0x30]
mov dword [esp + 0x2c], 0x80000080
mov dword [esp + 0x24], eax
lea eax, [esp + 0xb0]
push 0x100
push eax
mov dword [esp + 0x30], 1
mov byte [esp + 0x38], 0
call sub.WSOCK32.dll_gethostname
lea eax, [esp + 0xb0]
push eax
lea ecx, [esp + 0x28]
call fcn.0045eb10
push 0x200
lea eax, [esp + 0x1b4]
push eax
lea ecx, [esp + 0x10]
call fcn.004745a0
push dword [esp + 0x3b4]
lea eax, [esp + 0x28]
push str.__port
push eax
push str.Listening_on_host_
lea ecx, [esp + 0x18]
call fcn.0045cb80
mov ecx, eax
call fcn.0045ce20
mov ecx, eax
call fcn.0045cb80
mov ecx, eax
call fcn.0045cc40
mov ecx, dword [0x884c54]
lea edx, [esp + 0x1b0]
push 0x198
push str.SystemIoSocketBsdhkBsdSocket.cpp
push edx
mov eax, dword [ecx]
push 0xffffffffffffffff
push 0
call dword [eax + 0xc]
lea ecx, [esp + 8]
call fcn.0045caa0
lea ecx, [esp + 0x24]
call fcn.00469220
xor eax, eax
pop esi
add esp, 0x3ac
ret 4
Function at 0x479cd6
Capabilities:
Get socket status
Get thread local storage value
Set socket configuration

Disassembly:
sub esp, 0x4c0
push esi
mov esi, ecx
mov eax, dword [esi + 0x20]
cmp eax, 0xffffffff
je 0x479e15
lea ecx, [esp + 0xc]
mov dword [esp + 0xc0], eax
push ecx
lea ecx, [esp + 0x1c4]
mov dword [esp + 0x1c8], eax
push ecx
push 0
lea ecx, [esp + 0xc8]
mov dword [esp + 0xc8], 1
inc eax
mov dword [esp + 0x1cc], 1
push ecx
push eax
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
call sub.WSOCK32.dll_select
test eax, eax
jle 0x479e15
lea eax, [esp + 0xbc]
push eax
push dword [esi + 0x20]
call sub.WSOCK32.dll___WSAFDIsSet
test eax, eax
je 0x479e15
lea eax, [esp + 4]
mov dword [esp + 4], 0x10
push eax
lea eax, [esp + 0x24]
push eax
push dword [esi + 0x20]
call sub.WSOCK32.dll_accept
push dword [esp + 0x22]
mov esi, eax
mov dword [esp + 0x3c], 0x80000080
lea eax, [esp + 0x40]
mov dword [esp + 0x38], 1
mov dword [esp + 0x34], eax
mov byte [esp + 0x40], 0
call sub.WSOCK32.dll_ntohs
movzx ecx, ax
push ecx
push dword [esp + 0x28]
call sub.WSOCK32.dll_inet_ntoa
push eax
lea eax, [esp + 0x38]
push str.Socket_got_connection_from___s:_d__n
push eax
call fcn.0045efe0
add esp, 0x10
lea eax, [esp + 0x2c4]
lea ecx, [esp + 0x14]
push 0x200
push eax
call fcn.004745a0
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x18]
call fcn.0045ce20
mov ecx, dword [0x884c54]
lea edx, [esp + 0x2c4]
push 0x1cf
push str.SystemIoSocketBsdhkBsdSocket.cpp
push edx
mov eax, dword [ecx]
push 0xffffffffffffffff
push 0
call dword [eax + 0xc]
lea ecx, [esp + 0x14]
call fcn.0045caa0
cmp esi, 0xffffffff
jne 0x479e1f
lea ecx, [esp + 0x30]
call fcn.00469220
xor eax, eax
pop esi
add esp, 0x4c0
ret
push 4
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 1
push eax
push 1
push 6
push esi
call sub.WSOCK32.dll_setsockopt
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push 0x24
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, 0x24
push esi
mov word [eax + 4], cx
mov ecx, eax
call fcn.00479900
lea ecx, [esp + 0x30]
mov esi, eax
call fcn.00469220
mov eax, esi
pop esi
add esp, 0x4c0
ret

Function at 0x479eb0
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi]
call dword [eax + 0x10]
push 0
push 1
push 2
call sub.WSOCK32.dll_socket
xor ecx, ecx
mov dword [esi + 0x20], eax
cmp eax, 0xffffffff
pop esi
sete cl
mov eax, ecx
ret

Function at 0x479f70
Capabilities:
Get thread local storage value

Disassembly:
push esi
mov esi, ecx
call fcn.00479930
mov eax, dword [esp + 8]
test al, 1
je 0x479fc2
test al, 4
jne 0x479fb7
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0x24
cmp ax, cx
je 0x479f9a
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0x24
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4
Function at 0x47b534
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, ecx
mov dword [esi], vtable.hkBaseObject.0
test al, 1
je 0x47b583
test al, 4
jne 0x47b578
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 8
cmp ax, cx
je 0x47b55b
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 8
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4

Function at 0x47b594
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, ecx
mov dword [esi], vtable.hkBaseObject.0
test al, 1
je 0x47b5e3
test al, 4
jne 0x47b5d8
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 8
cmp ax, cx
je 0x47b5bb
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 8
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4

Function at 0x47b5f0
Capabilities:
Get thread local storage value

Disassembly:
push esi
mov esi, ecx
call fcn.0047ae10
mov eax, dword [esp + 8]
test al, 1
je 0x47b642
test al, 4
jne 0x47b637
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0x40
cmp ax, cx
je 0x47b61a
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0x40
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4

Function at 0x47b6b4
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, ecx
mov dword [esi], vtable.hkBaseObject.0
test al, 1
je 0x47b703
test al, 4
jne 0x47b6f8
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 8
cmp ax, cx
je 0x47b6db
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 8
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4

Function at 0x47b714
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, ecx
mov dword [esi], vtable.hkBaseObject.0
test al, 1
je 0x47b763
test al, 4
jne 0x47b758
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 8
cmp ax, cx
je 0x47b73b
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 8
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4
Function at 0x47b774
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, ecx
mov dword [esi], vtable.hkBaseObject.0
test al, 1
je 0x47b7c3
test al, 4
jne 0x47b7b8
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 8
cmp ax, cx
je 0x47b79b
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 8
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4

Function at 0x47b7d0
Capabilities:
Get thread local storage value

Disassembly:
push esi
mov esi, ecx
call fcn.0047b4b0
mov eax, dword [esp + 8]
test al, 1
je 0x47b822
test al, 4
jne 0x47b817
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0x2c
cmp ax, cx
je 0x47b7fa
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0x2c
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4

Function at 0x47ea94
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, ecx
mov dword [esi], vtable.hkBaseObject.0
test al, 1
je 0x47eae3
test al, 4
jne 0x47ead8
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 8
cmp ax, cx
je 0x47eabb
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 8
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4

Function at 0x47eaf0
Capabilities:
Get thread local storage value

Disassembly:
push esi
mov esi, ecx
lea ecx, [esi + 0xc]
call fcn.0046a7e0
mov eax, dword [esp + 8]
mov dword [esi], vtable.hkBaseObject.0
test al, 1
je 0x47eb4b
test al, 4
jne 0x47eb40
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0x20
cmp ax, cx
je 0x47eb23
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0x20
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4

Function at 0x47eb60
Capabilities:
Get thread local storage value

Disassembly:
push esi
mov esi, ecx
lea ecx, [esi + 0xc]
call fcn.0046a7e0
mov eax, dword [esp + 8]
mov dword [esi], vtable.hkBaseObject.0
test al, 1
je 0x47ebbb
test al, 4
jne 0x47ebb0
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0x1c
cmp ax, cx
je 0x47eb93
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0x1c
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4
Function at 0x47ebd0
Capabilities:
Get thread local storage value

Disassembly:
push esi
mov esi, ecx
lea ecx, [esi + 8]
call fcn.0046a7e0
mov eax, dword [esp + 8]
mov dword [esi], vtable.hkBaseObject.0
test al, 1
je 0x47ec2b
test al, 4
jne 0x47ec20
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0x20
cmp ax, cx
je 0x47ec03
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0x20
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4

Function at 0x47f810
Capabilities:
Get thread local storage value

Disassembly:
push esi
push edi
mov edi, ecx
xor esi, esi
cmp dword [edi + 0x14], esi
jle 0x47f84f
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov eax, dword [edi + 0x10]
mov ebx, dword [eax + esi*4]
test ebx, ebx
je 0x47f847
mov ecx, ebx
call fcn.00484690
push dword [0x884adc]
call ebp
push 4
push ebx
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
inc esi
cmp esi, dword [edi + 0x14]
jl 0x47f823
pop ebp
pop ebx
mov eax, dword [edi + 0x18]
mov dword [edi + 0x14], 0
test eax, eax
js 0x47f876
and eax, 0x3fffffff
mov ecx, 0x7d8950
shl eax, 2
push eax
mov eax, dword [0x7d8950]
push dword [edi + 0x10]
call dword [eax + 0x10]
push 0x7d8954
lea ecx, [edi + 4]
mov dword [edi + 0x10], 0
mov dword [edi + 0x18], connect
call fcn.00480410
pop edi
pop esi
ret