joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45ec00
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov edx, ecx
mov ebx, dword [ebp + 8]
movzx eax, byte [edi + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edi + 9]
xor ecx, eax
movzx eax, byte [edi + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edi + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [edx + 0x18]
and ecx, eax
lea esi, [ecx*8]
mov ecx, dword [edx + 0xc]
add ecx, esi
mov eax, dword [ecx]
cmp dword [ecx + 4], edi
jne 0x45ec76
cmp eax, edi
jne 0x45ec6e
mov eax, dword [edx + 4]
mov dword [ecx], eax
mov ecx, dword [edx + 0xc]
mov eax, dword [edx + 4]
mov dword [esi + ecx + 4], eax
jmp 0x45ec7e
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x45ec7e
cmp eax, edi
jne 0x45ec7e
mov eax, dword [edi]
mov dword [ecx], eax
mov eax, dword [edi + 4]
mov esi, dword [edi]
mov dword [eax], esi
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
lea ecx, [edi + 0xc]
dec dword [edx + 8]
call fcn.0043a9c0
push 0x54
push edi
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
add esp, 8
mov dword [ebx], esi
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x4616c0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a9b68
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x4c8104]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x20], ebx
mov eax, dword [ebp + 0xc]
xorps xmm0, xmm0
mov esi, dword [ebp + 8]
movlpd qword [ebp - 0x1c], xmm0
push ebx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x18], 1
call fcn.00477850
add esp, 4
mov dword [ebp - 4], 0
cmp dword [esi + 0x14], 8
mov edi, dword [esi + 0x10]
jb 0x461723
mov esi, dword [esi]
xor ecx, ecx
xor edx, edx
test edi, edi
je 0x461746
nop dword [eax + eax]
movzx eax, word [esi + edx*2]
ror ecx, 3
cmp eax, 0x61
jb 0x46173f
sub eax, 0x20
inc edx
add ecx, eax
cmp edx, edi
jb 0x461730
lea eax, [ebx + 0x80]
mov edi, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
movzx eax, cl
xor eax, 0x811c9dc5
mov dword [ebp - 0x14], ecx
imul edx, eax, 0x1000193
mov eax, ecx
shr eax, 8
movzx eax, al
mov edi, dword [edi + 0x84]
xor edx, eax
mov eax, ecx
imul edx, edx, 0x1000193
shr eax, 0x10
movzx eax, al
xor edx, eax
mov eax, ecx
imul edx, edx, 0x1000193
shr eax, 0x18
xor edx, eax
imul eax, edx, 0x1000193
mov edx, dword [ebx + 0x98]
and edx, eax
mov eax, dword [ebx + 0x8c]
mov ebx, dword [eax + edx*8]
mov esi, ebx
lea edx, [eax + edx*8]
nop dword [eax]
cmp ebx, edi
jne 0x4617b8
mov eax, edi
jmp 0x4617bd
mov eax, dword [edx + 4]
mov eax, dword [eax]
cmp esi, eax
je 0x4617ca
cmp dword [esi + 8], ecx
je 0x4617cc
mov esi, dword [esi]
jmp 0x4617b0
mov esi, edi
cmp esi, edi
je 0x4617e9
mov ecx, dword [ebp - 0x24]
lea eax, [ebp - 0x14]
push eax
call fcn.00465320
mov ecx, dword [ebp - 0x28]
push eax
call fcn.00459150
mov bl, 1
jmp 0x4617eb
xor bl, bl
push dword [ebp - 0x20]
call fcn.00477870
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049f3c4
mov esp, ebp
pop ebp
ret 8
Function at 0x461820
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a9b68
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x4c8104]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x20], ebx
mov eax, dword [ebp + 0xc]
xorps xmm0, xmm0
mov esi, dword [ebp + 8]
movlpd qword [ebp - 0x1c], xmm0
push ebx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x18], 1
call fcn.00477850
add esp, 4
mov dword [ebp - 4], 0
cmp dword [esi + 0x14], 8
mov edi, dword [esi + 0x10]
jb 0x461883
mov esi, dword [esi]
xor ecx, ecx
xor edx, edx
test edi, edi
je 0x4618a6
nop dword [eax + eax]
movzx eax, word [esi + edx*2]
ror ecx, 3
cmp eax, 0x61
jb 0x46189f
sub eax, 0x20
inc edx
add ecx, eax
cmp edx, edi
jb 0x461890
lea eax, [ebx + 0xa0]
mov edi, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
movzx eax, cl
xor eax, 0x811c9dc5
mov dword [ebp - 0x14], ecx
imul edx, eax, 0x1000193
mov eax, ecx
shr eax, 8
movzx eax, al
mov edi, dword [edi + 0xa4]
xor edx, eax
mov eax, ecx
imul edx, edx, 0x1000193
shr eax, 0x10
movzx eax, al
xor edx, eax
mov eax, ecx
imul edx, edx, 0x1000193
shr eax, 0x18
xor edx, eax
imul eax, edx, 0x1000193
mov edx, dword [ebx + 0xb8]
and edx, eax
mov eax, dword [ebx + 0xac]
mov ebx, dword [eax + edx*8]
mov esi, ebx
lea edx, [eax + edx*8]
nop dword [eax]
cmp ebx, edi
jne 0x461918
mov eax, edi
jmp 0x46191d
mov eax, dword [edx + 4]
mov eax, dword [eax]
cmp esi, eax
je 0x46192a
cmp dword [esi + 8], ecx
je 0x46192c
mov esi, dword [esi]
jmp 0x461910
mov esi, edi
cmp esi, edi
je 0x461949
mov ecx, dword [ebp - 0x24]
lea eax, [ebp - 0x14]
push eax
call fcn.00465320
mov ecx, dword [ebp - 0x28]
push eax
call fcn.00459150
mov bl, 1
jmp 0x46194b
xor bl, bl
push dword [ebp - 0x20]
call fcn.00477870
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049f3c4
mov esp, ebp
pop ebp
ret 8
Function at 0x465320
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0xc], esi
mov edx, dword [esi + 0xc]
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor ecx, eax
movzx eax, byte [edi + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [esi + 0x18]
mov esi, dword [esi + 4]
and ecx, eax
mov ebx, dword [edx + ecx*8]
mov eax, ebx
lea edx, [edx + ecx*8]
cmp ebx, esi
jne 0x46537e
mov ecx, esi
jmp 0x465383
mov ecx, dword [edx + 4]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x465396
mov ecx, dword [eax + 8]
cmp ecx, dword [edi]
je 0x465392
mov eax, dword [eax]
jmp 0x465376
cmp eax, esi
jne 0x4653e0
mov esi, dword [esi]
lea eax, [ebp - 8]
push ecx
push eax
push ecx
mov dword [ebp - 8], edi
mov edi, dword [esi + 4]
push edi
push esi
call fcn.00469aa0
mov edx, dword [ebp - 0xc]
mov ebx, eax
mov ecx, 0x30c30c2
mov eax, dword [edx + 8]
sub ecx, eax
cmp ecx, 1
jb 0x4653ec
inc eax
mov ecx, edx
mov dword [edx + 8], eax
mov dword [esi + 4], ebx
mov dword [edi], ebx
mov eax, dword [edx + 4]
mov eax, dword [eax]
push eax
add eax, 8
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.0045e4d0
mov eax, dword [ebp - 0x10]
pop edi
pop esi
add eax, 0xc
pop ebx
mov esp, ebp
pop ebp
ret 4
push str.list_T__too_long
call fcn.00475800
int3
Function at 0x4665e0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4aa4c0
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x4c8104]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
mov dword [ebp - 0x20], edi
mov edx, dword [ebp + 0xc]
mov dword [ebp - 4], 0
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x28], edi
movzx eax, byte [edx]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 1]
xor ecx, eax
movzx eax, byte [edx + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [edi + 0x18]
and ecx, eax
mov eax, dword [edi + 0xc]
mov dword [ebp - 0x1c], ecx
lea esi, [eax + ecx*8]
mov ecx, dword [edi + 4]
mov eax, dword [esi]
cmp eax, ecx
jne 0x466670
mov esi, ecx
jmp 0x466675
mov esi, dword [esi + 4]
mov esi, dword [esi]
cmp esi, eax
je 0x4666a9
mov esi, dword [esi + 4]
mov ecx, dword [edx]
cmp ecx, dword [esi + 8]
jne 0x466675
mov dword [ebx], esi
mov byte [ebx + 4], 0
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0049f3c4
mov esp, ebp
pop ebp
ret 0xc
mov dword [ebp - 4], 0xffffffff
mov eax, dword [edi + 4]
push edx
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
mov ecx, dword [eax + 4]
push ecx
push eax
mov dword [ebp - 0x18], ecx
call fcn.00469b10
mov edx, eax
mov ecx, 0x15555554
mov eax, dword [edi + 8]
sub ecx, eax
cmp ecx, 1
jb 0x466764
inc eax
mov dword [edi + 8], eax
mov eax, dword [ebp - 0x24]
mov dword [eax + 4], edx
mov eax, dword [ebp - 0x18]
mov dword [eax], edx
mov edi, dword [edi + 4]
mov edi, dword [edi]
mov dword [ebp - 0x18], edi
mov eax, dword [edi]
cmp esi, eax
je 0x466719
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov ecx, dword [eax + 4]
mov edx, dword [esi + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
push dword [ebp - 0x1c]
push esi
mov esi, dword [ebp - 0x20]
mov ecx, esi
push edi
call fcn.00467380
mov ecx, esi
mov dword [ebp - 4], 2
call fcn.004672e0
mov dword [ebx], edi
mov byte [ebx + 4], 1
jmp 0x466689
push str.list_T__too_long
call fcn.00475800
int3
Function at 0x467400
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x4c8104]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 8], eax
mov ebx, ecx
push edi
mov edi, dword [ebp + 0xc]
movzx eax, byte [edi + 8]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 9]
xor edx, eax
movzx eax, byte [edi + 0xa]
imul ecx, edx, 0x1000193
xor ecx, eax
movzx eax, byte [edi + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [ebx + 0x18]
and ecx, eax
lea edx, [ecx*8]
mov ecx, dword [ebx + 0xc]
add ecx, edx
mov eax, dword [ecx]
cmp dword [ecx + 4], edi
jne 0x467486
cmp eax, edi
jne 0x46747e
mov eax, dword [ebx + 4]
mov dword [ecx], eax
mov ecx, dword [ebx + 0xc]
mov eax, dword [ebx + 4]
mov dword [edx + ecx + 4], eax
jmp 0x46748e
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x46748e
cmp eax, edi
jne 0x467491
mov eax, dword [edi]
mov dword [ecx], eax
mov edi, dword [ebp + 0xc]
mov eax, dword [edi + 4]
mov esi, dword [edi]
push 0xc
push edi
mov dword [eax], esi
mov edx, dword [edi]
mov ecx, dword [edi + 4]
mov dword [edx + 4], ecx
dec dword [ebx + 8]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
mov eax, dword [ebp - 8]
add esp, 8
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
mov dword [eax], esi
pop esi
pop ebx
call fcn.0049f3c4
mov esp, ebp
pop ebp
ret 8
Function at 0x467dd0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4aa660
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x4c8104]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x1c], esi
mov edx, dword [ebp + 0xc]
mov dword [ebp - 4], 0
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x24], esi
movzx eax, byte [edx]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 1]
xor ecx, eax
movzx eax, byte [edx + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [esi + 0x18]
and ecx, eax
mov eax, dword [esi + 0xc]
mov esi, dword [esi + 4]
mov dword [ebp - 0x20], ecx
lea ecx, [eax + ecx*8]
mov eax, dword [ecx]
cmp esi, eax
je 0x467eb8
mov esi, dword [ecx + 4]
mov esi, dword [esi]
cmp esi, eax
je 0x467eb8
mov esi, dword [esi + 4]
mov ecx, dword [edx]
cmp ecx, dword [esi + 8]
jne 0x467e61
mov edi, dword [ebp + 0x10]
push 0xc
push edi
mov ecx, dword [edi + 4]
mov eax, dword [edi]
mov dword [ecx], eax
mov edx, dword [edi]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [edi + 4]
mov dword [edx + 4], ecx
dec dword [eax + 8]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
add esp, 8
mov dword [ebx], esi
mov byte [ebx + 4], 0
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0049f3c4
mov esp, ebp
pop ebp
ret 0xc
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x18], edi
mov eax, dword [edi]
cmp esi, eax
je 0x467ee5
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov ecx, dword [eax + 4]
mov edx, dword [esi + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
push dword [ebp - 0x20]
push esi
mov esi, dword [ebp - 0x1c]
mov ecx, esi
push edi
call fcn.00467380
mov ecx, esi
mov dword [ebp - 4], 2
call fcn.004672e0
mov dword [ebx], edi
mov byte [ebx + 4], 1
jmp 0x467e98
Function at 0x4681a0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4aa6c8
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x4c8104]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x3c], ecx
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
push esi
push 0x40
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], esi
call fcn.0042ae70
mov edi, eax
mov dword [ebp - 0x2c], 0
add esp, 8
mov dword [ebp - 0x30], edi
push 0x4694c0
mov ecx, edi
mov dword [ebp - 4], 0
call fcn.0042b010
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov eax, dword [esi]
mov dword [edi + 0x28], eax
mov eax, dword [esi + 4]
mov dword [edi + 0x2c], eax
mov dword [esi], 0
mov dword [esi + 4], 0
mov eax, dword [esi + 8]
mov dword [edi + 0x30], eax
mov eax, dword [esi + 0xc]
mov dword [edi + 0x34], eax
mov esi, dword [ebp - 0x38]
mov byte [ebp - 4], 1
mov ecx, dword [esi]
test ecx, ecx
je 0x46824c
mov eax, dword [ecx]
call dword [eax]
jmp 0x46824e
xor eax, eax
mov dword [edi + 0x38], eax
mov al, byte [esi + 4]
mov byte [edi + 0x3c], al
mov byte [ebp - 4], 2
mov ecx, dword [edi + 0x38]
test ecx, ecx
je 0x46826d
mov eax, dword [ecx]
call dword [eax]
mov esi, eax
mov al, byte [edi + 0x3c]
jmp 0x46826f
xor esi, esi
test al, al
jne 0x46829c
mov byte [ebp - 4], 3
test esi, esi
je 0x4682ff
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xc]
cmp byte [edi + 0x3c], 0
jne 0x46829c
mov byte [ebp - 4], 4
mov ecx, dword [edi + 0x38]
test ecx, ecx
je 0x46830f
mov eax, dword [ecx]
call dword [eax + 0xc]
mov byte [ebp - 4], 5
test esi, esi
je 0x4682ab
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov ecx, dword [ebp - 0x3c]
lea eax, [ebx + 0xc]
push edi
push eax
mov byte [ebp - 4], 0
lea eax, [ecx + 0x14]
mov byte [ebx + 8], 1
mov ecx, dword [ecx + 0x2c]
push ebx
push eax
mov dword [ebp - 0x2c], edi
call fcn.00416b10
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x30], 0
call fcn.00469010
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049f3c4
mov esp, ebp
pop ebp
ret 0xc
lea ecx, [ebp - 0x1c]
call fcn.0042afa0
lea ecx, [ebp - 0x1c]
call fcn.0042aff0
lea ecx, [ebp - 0x28]
call fcn.0042afa0
lea ecx, [ebp - 0x28]
call fcn.0042aff0
int3
Function at 0x468320
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4aa6c8
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x4c8104]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x3c], ecx
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
push esi
push 0x40
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], esi
call fcn.0042ae70
mov edi, eax
mov dword [ebp - 0x2c], 0
add esp, 8
mov dword [ebp - 0x30], edi
push 0x4692c0
mov ecx, edi
mov dword [ebp - 4], 0
call fcn.0042b010
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov eax, dword [esi]
mov dword [edi + 0x28], eax
mov eax, dword [esi + 4]
mov dword [edi + 0x2c], eax
mov dword [esi], 0
mov dword [esi + 4], 0
mov eax, dword [esi + 8]
mov dword [edi + 0x30], eax
mov eax, dword [esi + 0xc]
mov dword [edi + 0x34], eax
mov esi, dword [ebp - 0x38]
mov byte [ebp - 4], 1
mov ecx, dword [esi]
test ecx, ecx
je 0x4683cc
mov eax, dword [ecx]
call dword [eax]
jmp 0x4683ce
xor eax, eax
mov dword [edi + 0x38], eax
mov al, byte [esi + 4]
mov byte [edi + 0x3c], al
mov byte [ebp - 4], 2
mov ecx, dword [edi + 0x38]
test ecx, ecx
je 0x4683ed
mov eax, dword [ecx]
call dword [eax]
mov esi, eax
mov al, byte [edi + 0x3c]
jmp 0x4683ef
xor esi, esi
test al, al
jne 0x46841c
mov byte [ebp - 4], 3
test esi, esi
je 0x46847f
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xc]
cmp byte [edi + 0x3c], 0
jne 0x46841c
mov byte [ebp - 4], 4
mov ecx, dword [edi + 0x38]
test ecx, ecx
je 0x46848f
mov eax, dword [ecx]
call dword [eax + 0xc]
mov byte [ebp - 4], 5
test esi, esi
je 0x46842b
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov ecx, dword [ebp - 0x3c]
lea eax, [ebx + 0xc]
push edi
push eax
mov byte [ebp - 4], 0
lea eax, [ecx + 0x14]
mov byte [ebx + 8], 1
mov ecx, dword [ecx + 0x2c]
push ebx
push eax
mov dword [ebp - 0x2c], edi
call fcn.00416b10
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x30], 0
call fcn.00469010
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049f3c4
mov esp, ebp
pop ebp
ret 0xc
lea ecx, [ebp - 0x1c]
call fcn.0042afa0
lea ecx, [ebp - 0x1c]
call fcn.0042aff0
lea ecx, [ebp - 0x28]
call fcn.0042afa0
lea ecx, [ebp - 0x28]
call fcn.0042aff0
int3
Function at 0x4684a0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4aa6c8
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x4c8104]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x3c], ecx
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
push esi
push 0x40
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], esi
call fcn.0042ae70
mov edi, eax
mov dword [ebp - 0x2c], 0
add esp, 8
mov dword [ebp - 0x30], edi
push 0x4690c0
mov ecx, edi
mov dword [ebp - 4], 0
call fcn.0042b010
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov eax, dword [esi]
mov dword [edi + 0x28], eax
mov eax, dword [esi + 4]
mov dword [edi + 0x2c], eax
mov dword [esi], 0
mov dword [esi + 4], 0
mov eax, dword [esi + 8]
mov dword [edi + 0x30], eax
mov eax, dword [esi + 0xc]
mov dword [edi + 0x34], eax
mov esi, dword [ebp - 0x38]
mov byte [ebp - 4], 1
mov ecx, dword [esi]
test ecx, ecx
je 0x46854c
mov eax, dword [ecx]
call dword [eax]
jmp 0x46854e
xor eax, eax
mov dword [edi + 0x38], eax
mov al, byte [esi + 4]
mov byte [edi + 0x3c], al
mov byte [ebp - 4], 2
mov ecx, dword [edi + 0x38]
test ecx, ecx
je 0x46856d
mov eax, dword [ecx]
call dword [eax]
mov esi, eax
mov al, byte [edi + 0x3c]
jmp 0x46856f
xor esi, esi
test al, al
jne 0x46859c
mov byte [ebp - 4], 3
test esi, esi
je 0x4685ff
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xc]
cmp byte [edi + 0x3c], 0
jne 0x46859c
mov byte [ebp - 4], 4
mov ecx, dword [edi + 0x38]
test ecx, ecx
je 0x46860f
mov eax, dword [ecx]
call dword [eax + 0xc]
mov byte [ebp - 4], 5
test esi, esi
je 0x4685ab
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov ecx, dword [ebp - 0x3c]
lea eax, [ebx + 0xc]
push edi
push eax
mov byte [ebp - 4], 0
lea eax, [ecx + 0x14]
mov byte [ebx + 8], 1
mov ecx, dword [ecx + 0x2c]
push ebx
push eax
mov dword [ebp - 0x2c], edi
call fcn.00416b10
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x30], 0
call fcn.00469010
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049f3c4
mov esp, ebp
pop ebp
ret 0xc
lea ecx, [ebp - 0x1c]
call fcn.0042afa0
lea ecx, [ebp - 0x1c]
call fcn.0042aff0
lea ecx, [ebp - 0x28]
call fcn.0042afa0
lea ecx, [ebp - 0x28]
call fcn.0042aff0
int3
Function at 0x4699f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4aa8a0
mov eax, dword fs:[0]
push eax
push ebx
push ecx
push esi
mov eax, dword [0x4c8104]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.0042c880
mov ecx, dword [ebx + 0xc]
mov esi, eax
mov dword [ebp - 4], 0
mov word [esi + 0xc], 0
mov ecx, dword [ecx]
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
movups xmm0, xmmword [ecx]
movups xmmword [esi + 0x10], xmm0
movq xmm0, qword [ecx + 0x10]
movq qword [esi + 0x20], xmm0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
mov byte [ecx], 0
mov byte [ebp - 4], 1
lea ecx, [esi + 0x30]
push 0
mov byte [esi + 0x28], 0
call fcn.00430de0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0xc
Function at 0x469b30
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4aa8dd
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x4c8104]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x20], ecx
mov ebx, dword [ebp + 8]
push dword [0x50b8e0]
mov edi, dword [ebp + 0xc]
mov esi, dword [ebx]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x469b85
cmp dword [eax], esi
je 0x469c9b
mov eax, dword [eax + 8]
test eax, eax
jne 0x469b76
push edi
push 0x38
mov dword [ebp - 0x30], edi
call fcn.0042ae70
add esp, 8
mov esi, eax
mov dword [ebp - 4], 1
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], fcn.00469df0
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x1c], 0
mov al, byte [edi + 1]
mov byte [esi + 0x21], al
mov byte [edi + 1], 0
mov eax, dword [edi + 4]
mov dword [esi + 0x24], eax
mov eax, dword [edi + 8]
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov eax, dword [edi + 0xc]
mov dword [esi + 0x2c], eax
mov eax, dword [edi + 0x10]
mov dword [esi + 0x30], eax
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov eax, dword [edi + 0x14]
mov edi, dword [ebp - 0x20]
mov ecx, edi
push esi
push ebx
mov dword [esi + 0x34], eax
call fcn.0042abe0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x2c], 0
test al, al
je 0x469ce1
mov eax, dword [ebx]
xorps xmm0, xmm0
push dword [0x50b8e0]
movq qword [ebp - 0x1c], xmm0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x1c], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x1c]
push eax
push dword [0x50b8e0]
mov dword [ebp - 0x18], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [edi + 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebx]
mov dword [ebp - 0x20], eax
push 0x50b818
push 0x435e10
push 0x50b820
mov byte [ebp - 4], 3
call fcn.00475b00
add esp, 0xc
test eax, eax
je 0x469d07
jmp 0x469cb8
cmp dword [eax + 4], 0
je 0x469b85
push edi
push edi
mov dword [ebp - 4], 0
call fcn.0046acc0
add esp, 8
jmp 0x469ce9
push 0
lea eax, [ebp - 0x38]
push eax
push esi
push dword [edi + 0x14]
call fcn.00469df0
add esp, 0x10
lea ecx, [ebp - 0x24]
call fcn.0042ab70
push dword [ebp - 0x14]
push dword [0x50b8e0]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
lea ecx, [ebp - 0x30]
call fcn.0041aa80
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049f3c4
mov esp, ebp
pop ebp
ret 8
call sub.msvcrt.dll_void___cdecl_terminate_void_
int3