joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4772c0
Capabilities:
Read pipe
Write pipe

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xb4
mov edi, dword [ebp + 8]
mov eax, dword [0x5c1040]
xor eax, ebp
mov dword [ebp - 0x10], eax
movaps xmm0, xmmword [0x5ae660]
mov ebx, dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp byte [edi + 0xb], 0
mov eax, edi
jns 0x4772f0
mov eax, dword [edi]
sub esp, 0x1c
movups xmmword [esp + 4], xmm0
mov dword [esp], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x110000
call ebx
cmp eax, 0xffffffff
je 0x477386
mov esi, eax
lea eax, [ebp - 0xbc]
mov dword [eax], 2
xor edi, edi
push edi
push edi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetNamedPipeHandleState]
test eax, eax
je 0x477478
lea eax, [ebp - 0xc0]
mov dword [eax], edi
push edi
push eax
push 0xc
push dword [ebp + 0x10]
push 0x24
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_TransactNamedPipe]
test eax, eax
je 0x47743c
mov bl, 1
cmp dword [ebp - 0xc0], 0xc
jne 0x4774c6
push esi
call fcn.00477eb0
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004f1eb0
mov eax, ebx
add esp, 0xb4
pop esi
pop edi
pop ebx
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xe7
jne 0x4773ee
cmp byte [edi + 0xb], 0
mov eax, edi
jns 0x47739d
mov eax, dword [edi]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
test eax, eax
movaps xmm0, xmmword [0x5ae660]
jne 0x4772e6
push 2
call fcn.004bb790
add esp, 4
test al, al
je 0x477435
call fcn.0053eb80
lea esi, [ebp - 0xb8]
mov ecx, esi
push eax
push 2
push 0x71
push 0x5ae6a0
call fcn.0053ed50
lea eax, [ebp - 0xb0]
push 0xd
push str.WaitNamedPipe
jmp 0x477425
push 2
call fcn.004bb790
add esp, 4
test al, al
je 0x477435
call fcn.0053eb80
lea esi, [ebp - 0xb8]
mov ecx, esi
push eax
push 2
push 0x6c
push 0x5ae6a0
call fcn.0053ed50
lea eax, [ebp - 0xb0]
push 0xa
push 0x5ae6ea
push eax
call fcn.00499a00
add esp, 0xc
mov ecx, esi
call fcn.0053edb0
xor ebx, ebx
jmp 0x47736f
push 2
call fcn.004bb790
add esp, 4
test al, al
je 0x4774bf
call fcn.0053eb80
lea edi, [ebp - 0xb8]
mov ecx, edi
push eax
push 2
push 0x88
push 0x5ae6a0
call fcn.0053ed50
lea eax, [ebp - 0xb0]
push 0x11
push 0x5ae71b
jmp 0x4774af
push 2
call fcn.004bb790
add esp, 4
test al, al
je 0x4774bf
call fcn.0053eb80
lea edi, [ebp - 0xb8]
mov ecx, edi
push eax
push 2
push 0x7a
push 0x5ae6a0
call fcn.0053ed50
lea eax, [ebp - 0xb0]
push 0x17
push 0x5ae703
push eax
call fcn.00499a00
add esp, 0xc
mov ecx, edi
call fcn.0053edb0
xor ebx, ebx
jmp 0x477366
push 2
call fcn.004bb790
add esp, 4
test al, al
je 0x4774bf
lea edi, [ebp - 0xb8]
mov ecx, edi
push 2
push 0x8c
push 0x5ae6a0
call fcn.0044fd30
lea eax, [ebp - 0xb0]
push 0x1c
push str.TransactNamedPipe:_expected
push eax
call fcn.00499a00
add esp, 0xc
mov ecx, eax
push 0xc
call fcn.00411b50
push 0xb
push str.__observed
push eax
call fcn.00499a00
add esp, 0xc
mov ecx, eax
push dword [ebp - 0xc0]
call fcn.00411b50
mov ecx, edi
call fcn.00450200
jmp 0x4774bf
Function at 0x477540
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x12c
mov esi, dword [ebp + 8]
mov al, byte [ebp + 0xc]
mov ecx, dword [0x5c1040]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
xor ecx, ecx
dec ecx
mov dword [ebp - 0x138], ecx
mov dword [ebp - 0x134], ecx
mov dword [ebp - 0x130], ecx
test al, al
je 0x47761b
lea ebx, [ebp - 0x120]
xor edi, edi
push 0x110
push edi
push ebx
call fcn.004f5920
add esp, 0xc
mov dword [ebx - 0xc], 0x11c
sub esp, 0x10
movaps xmm0, xmmword [0x5ae670]
movups xmmword [esp], xmm0
mov ebx, dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
call ebx
mov ecx, 3
push ecx
push 1
push edx
push eax
call ebx
mov ecx, 3
push ecx
push 0x20
push edx
push eax
call ebx
lea ecx, [ebp - 0x120]
mov dword [ecx - 8], 6
mov dword [ecx - 4], edi
mov word [ecx + 0x108], 0
lea ecx, [ebp - 0x12c]
push edx
push eax
push 0x23
push ecx
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov ebx, 0x80003
test eax, eax
je 0x477622
lea edi, [ebp - 0x138]
mov dword [edi], 0xc
push 0
call fcn.00477670
add esp, 4
mov dword [edi + 4], eax
mov dword [edi + 8], 1
jmp 0x477622
xor edi, edi
mov ebx, 3
cmp byte [esi + 0xb], 0
jns 0x47762a
mov esi, dword [esi]
sub esp, 0x20
mov dword [esp + 0x1c], edi
movaps xmm0, xmmword [0x5ae680]
movups xmmword [esp + 8], xmm0
mov dword [esp + 4], ebx
mov dword [esp], esi
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov esi, eax
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004f1eb0
mov eax, esi
add esp, 0x12c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4780b0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0xa0]
mov eax, dword [eax + 0xc]
mov ecx, dword fs:[0x18]
cmp eax, dword [ecx + 0x24]
sete al
pop ebp
ret
Function at 0x47b3c0
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xb8
mov esi, ecx
mov eax, dword [0x5c1040]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [ecx + 0xb], 0
mov eax, ecx
jns 0x47b3e2
mov eax, dword [esi]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x47b417
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x47b430
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004f1eb0
mov ecx, esi
add esp, 0xb8
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.0047b500
mov bl, 1
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004f1eb0
mov eax, ebx
add esp, 0xb8
pop esi
pop edi
pop ebx
pop ebp
ret
push 2
call fcn.004bb790
add esp, 4
test al, al
je 0x47b4e0
call fcn.0053eb80
lea ecx, [ebp - 0xb8]
push eax
push 2
push 0x265
push str....._third_partycrashpadcrashpadclientcrash_report_database_win.cc
call fcn.0053ed50
lea eax, [ebp - 0xb0]
push 0x10
push str.CreateDirectory
push eax
call fcn.00499a00
add esp, 0xc
mov edi, eax
movsx eax, byte [esi + 0xb]
test eax, eax
jns 0x47b484
mov eax, dword [esi + 4]
mov esi, dword [esi]
test eax, eax
js 0x47b4e7
je 0x47b48e
test esi, esi
je 0x47b4ee
lea ebx, [ebp - 0xc4]
push eax
push esi
push ebx
call fcn.004b2ea0
add esp, 0xc
movsx eax, byte [ebx + 0xb]
test eax, eax
jns 0x47b4b3
mov eax, dword [ebp - 0xc0]
mov ebx, dword [ebp - 0xc4]
push eax
push ebx
push edi
call fcn.00499a00
add esp, 0xc
cmp byte [ebp - 0xb9], 0
jns 0x47b4d5
push dword [ebp - 0xc4]
call fcn.004f193e
add esp, 4
lea ecx, [ebp - 0xb8]
call fcn.0053edb0
xor ebx, ebx
jmp 0x47b419
push str....._third_partylibc_srcinclude_string_view:314:_assertion___len___static_cast_size_type__numeric_limits_difference_type_::max____failed:_string_view::string_view__CharT___size_t_:_length_does_not_fit_in_difference_type_n
jmp 0x47b4f3
push str....._third_partylibc_srcinclude_string_view:316:_assertion___len__0____s___nullptr_failed:_string_view::string_view__CharT___size_t_:_received_nullptr_n
push 0x59a9a3
call fcn.00523170
int3
Function at 0x47b500
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xac
mov esi, ecx
mov eax, dword [0x5c1040]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [ecx + 0xb], 0
mov eax, ecx
jns 0x47b522
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x47b5ad
mov bl, 1
test al, 0x10
je 0x47b54b
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004f1eb0
mov eax, ebx
add esp, 0xac
pop esi
pop edi
pop ebx
pop ebp
ret
push 2
call fcn.004bb790
add esp, 4
test al, al
je 0x47b5a9
lea edi, [ebp - 0xb8]
mov ecx, edi
push 2
push 0x255
push str....._third_partycrashpadcrashpadclientcrash_report_database_win.cc
call fcn.0044fd30
lea eax, [ebp - 0xb0]
push 0x12
push str.GetFileAttributes
push eax
call fcn.00499a00
add esp, 0xc
push esi
push eax
call fcn.0053fb40
add esp, 8
push 0x11
push str.:_not_a_directory
push eax
call fcn.00499a00
add esp, 0xc
mov ecx, edi
call fcn.00450200
xor ebx, ebx
jmp 0x47b534
push 2
call fcn.004bb790
add esp, 4
test al, al
je 0x47b5a9
call fcn.0053eb80
lea edi, [ebp - 0xb8]
mov ecx, edi
push eax
push 2
push 0x251
push str....._third_partycrashpadcrashpadclientcrash_report_database_win.cc
call fcn.0053ed50
lea eax, [ebp - 0xb0]
push 0x12
push str.GetFileAttributes
push eax
call fcn.00499a00
add esp, 0xc
push esi
push eax
call fcn.0053fb40
add esp, 8
mov ecx, edi
call fcn.0053edb0
jmp 0x47b5a9
Function at 0x47c6c0
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov eax, dword [0x5c1040]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea esi, [ebp - 0x14]
mov dword [esi], 0xffffffff
mov edx, esi
call fcn.0047b690
mov eax, dword [esi]
test eax, eax
je 0x47c713
mov ebx, dword [eax + 0x28]
mov edi, dword [eax + 0x2c]
xor esi, esi
cmp ebx, edi
jne 0x47c71a
lea ecx, [ebp - 0x14]
call fcn.0047bf90
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004f1eb0
mov eax, esi
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov esi, 3
jmp 0x47c6f5
cmp dword [ebx + 0x50], 0
jne 0x47c739
cmp byte [ebx + 0x1b], 0
js 0x47c72b
lea eax, [ebx + 0x10]
jmp 0x47c72e
mov eax, dword [ebx + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
je 0x47c73e
add ebx, 0x58
jmp 0x47c6f1
mov eax, dword [ebp + 8]
mov edx, dword [eax + 4]
cmp edx, dword [eax + 8]
jae 0x47c764
push ebx
mov dword [ebp - 0x18], edx
push edx
call fcn.005550d0
add esp, 8
mov ecx, dword [ebp - 0x18]
add ecx, 0x50
mov eax, dword [ebp + 8]
mov dword [eax + 4], ecx
jmp 0x47c739
mov ecx, dword [ebp + 8]
push ebx
call fcn.00554fb0
mov ecx, eax
jmp 0x47c75c

Function at 0x47c780
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov eax, dword [0x5c1040]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea esi, [ebp - 0x14]
mov dword [esi], 0xffffffff
mov edx, esi
call fcn.0047b690
mov eax, dword [esi]
test eax, eax
je 0x47c7d3
mov ebx, dword [eax + 0x28]
mov edi, dword [eax + 0x2c]
xor esi, esi
cmp ebx, edi
jne 0x47c7da
lea ecx, [ebp - 0x14]
call fcn.0047bf90
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004f1eb0
mov eax, esi
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov esi, 3
jmp 0x47c7b5
cmp dword [ebx + 0x50], 2
jne 0x47c7f9
cmp byte [ebx + 0x1b], 0
js 0x47c7eb
lea eax, [ebx + 0x10]
jmp 0x47c7ee
mov eax, dword [ebx + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
je 0x47c7fe
add ebx, 0x58
jmp 0x47c7b1
mov eax, dword [ebp + 8]
mov edx, dword [eax + 4]
cmp edx, dword [eax + 8]
jae 0x47c824
push ebx
mov dword [ebp - 0x18], edx
push edx
call fcn.005550d0
add esp, 8
mov ecx, dword [ebp - 0x18]
add ecx, 0x50
mov eax, dword [ebp + 8]
mov dword [eax + 4], ecx
jmp 0x47c7f9
mov ecx, dword [ebp + 8]
push ebx
call fcn.00554fb0
mov ecx, eax
jmp 0x47c81c
Function at 0x47d760
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [ebp + 0xc]
mov ecx, dword [0x5c1040]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
cmp eax, 3
je 0x47d790
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004f1eb0
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
lea eax, [ebp - 0x14]
mov dword [eax], 0x47d8a0
push 0
push eax
push 0x47d740
push 0x5d4898
call dword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x47d898
cmp dword [0x5d489c], 0
jne 0x47d77c
push dword [0x5d48a0]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x47d77c
mov esi, eax
mov eax, 0x5d48a4
push eax
call dword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
mov edi, dword [0x5d48a8]
mov ebx, dword [0x5d48ac]
mov eax, dword [0x5d48b0]
mov dword [ebp - 0x1c], eax
mov eax, dword [0x5d48b4]
mov dword [ebp - 0x20], eax
mov eax, dword [0x5d48b8]
mov dword [ebp - 0x24], eax
mov eax, 0x5d48a4
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
test edi, edi
jne 0x47d87e
test ebx, ebx
jne 0x47d86b
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
jne 0x47d836
mov ecx, dword [ebp - 0x20]
test ecx, ecx
mov ebx, dword [ebp - 0x24]
jne 0x47d847
test ebx, ebx
jne 0x47d858
push esi
call fcn.004c00c0
add esp, 4
jmp 0x47d77c
mov edi, dword [esi + 8]
call dword [0x5bb424]
push edi
call ecx
add esp, 4
jmp 0x47d81a
mov edi, dword [esi + 0xc]
call dword [0x5bb424]
push edi
call ecx
add esp, 4
jmp 0x47d824
mov edi, dword [esi + 0x10]
mov ecx, ebx
call dword [0x5bb424]
push edi
call ebx
add esp, 4
jmp 0x47d828
mov edi, dword [esi + 4]
mov ecx, ebx
call dword [0x5bb424]
push edi
call ebx
add esp, 4
jmp 0x47d813
mov eax, dword [esi]
mov dword [ebp - 0x18], eax
mov ecx, edi
call dword [0x5bb424]
push dword [ebp - 0x18]
call edi
add esp, 4
jmp 0x47d80f
call fcn.00505947
int3
Function at 0x47d8c0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [0x5c1040]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
mov dword [eax], 0x47d8a0
push 0
push eax
push 0x47d740
push 0x5d4898
call dword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x47d988
mov esi, dword [ebp + 0xc]
cmp dword [0x5d489c], 0
jne 0x47d996
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push dword [0x5d48a0]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
test edi, edi
jne 0x47d94b
push 0x14
push 1
call fcn.004c0160
add esp, 8
test eax, eax
je 0x47d996
mov edi, eax
push eax
push dword [0x5d48a0]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x47d98d
mov ebx, dword [ebp + 8]
mov esi, 0x5d48a4
push esi
call dword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
mov eax, dword [ebp + 0x10]
mov dword [ebx*4 + 0x5d48a8], eax
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov eax, dword [ebp + 0xc]
mov dword [edi + ebx*4], eax
xor esi, esi
inc esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004f1eb0
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.00505947
push edi
call fcn.004c00c0
add esp, 4
mov ecx, dword [ebp + 0x10]
call dword [0x5bb424]
push esi
call ecx
add esp, 4
xor esi, esi
jmp 0x47d974
Function at 0x47e280
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
mov eax, dword [0x5c4948]
cmp eax, 0xffffffff
je 0x47e341
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
je 0x47e341
mov eax, dword [0x5d58e8]
mov ecx, dword [0x5c4ca4]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x47e34b
mov edi, dword [0x5d58e4]
push edi
call dword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x47e393
mov ecx, dword [0x5d48dc]
inc ecx
xor edx, edx
lea eax, [ecx + edx]
movzx eax, al
mov ebx, eax
shl ebx, 4
cmp dword [ebx + 0x5d48e0], 0
jne 0x47e39f
lea ecx, [ebx + 0x5d48e0]
mov dword [ecx], 1
mov edx, dword [ebp + 8]
mov dword [ecx + 4], edx
mov edx, dword [0x5d58e0]
inc edx
mov dword [0x5d58e0], edx
mov dword [ecx + 0xc], edx
mov dword [0x5d48dc], eax
mov dword [esi], eax
mov eax, dword [ecx + 8]
mov dword [esi + 4], eax
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
cmp dword [esi], 0x100
jae 0x47e390
pop esi
pop edi
pop ebx
pop ebp
ret 4
call fcn.0047e3c0
jmp 0x47e2a5
push 0x5d58e8
call fcn.004f1981
add esp, 4
cmp dword [0x5d58e8], 0xffffffff
jne 0x47e2c6
push 4
call fcn.004f190e
add esp, 4
mov edi, eax
mov ecx, eax
call fcn.004ab310
mov dword [0x5d58e4], edi
push 0x5d58e8
call fcn.004f19fb
add esp, 4
jmp 0x47e2c6
int3
mov ecx, edi
call fcn.004ab320
jmp 0x47e2db
inc edx
cmp edx, 0x100
jne 0x47e2e4
jmp 0x47e32b

Function at 0x47e3c0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x808
mov eax, dword [0x5c1040]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x814], 0xffffffff
mov ecx, dword [0x5c4948]
mov dword [ebp - 0x814], ecx
cmp ecx, 0xffffffff
je 0x47e46d
push ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
jne 0x47e4b6
mov edi, 0x800
lea ebx, [ebp - 0x810]
push edi
push 0
push ebx
call fcn.004f5920
add esp, 0xc
lea eax, [ebp - 0x80d]
push eax
push dword [ebp - 0x814]
call fcn.00493330
add esp, 8
push edi
call fcn.004f1973
add esp, 4
mov esi, eax
push edi
push ebx
push eax
call fcn.004f53a0
add esp, 0xc
mov eax, esi
or eax, 3
push eax
push dword [ebp - 0x814]
call fcn.00493330
add esp, 8
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004f1eb0
mov eax, esi
add esp, 0x808
pop esi
pop edi
pop ebx
pop ebp
ret
lea esi, [ebp - 0x814]
push esi
call fcn.00493310
add esp, 4
test al, al
je 0x47e4b9
mov ecx, dword [ebp - 0x814]
cmp ecx, 0xffffffff
je 0x47e4bc
xor eax, eax
dec eax
lock cmpxchg dword [0x5c4948], ecx
je 0x47e3f1
push ecx
call fcn.005680d0
add esp, 4
mov ecx, dword [0x5c4948]
mov dword [ebp - 0x814], ecx
jmp 0x47e3f1
int3
int3
push esi
call fcn.00493310
add esp, 4
test al, al
je 0x47e4e4
cmp dword [ebp - 0x814], 0xffffffff
je 0x47e4e4
push 0xffffffffffffffff
call fcn.005680d0
add esp, 4
mov ecx, dword [ebp - 0x814]
jmp 0x47e48b
int3
Function at 0x47e4f0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov edi, ecx
mov eax, dword [0x5c1040]
xor eax, ebp
mov dword [esp + 0x1c], eax
push dword [0x5c4948]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, eax
and ecx, 3
cmp ecx, 2
je 0x47e535
xor esi, esi
and eax, 0xfffffffc
je 0x47e578
mov ecx, dword [edi]
mov edx, dword [eax + ecx*8 + 4]
cmp edx, dword [edi + 4]
jne 0x47e578
mov esi, dword [eax + ecx*8]
jmp 0x47e578
mov dword [esp + 0x14], 0x14
mov dword [esp + 0x10], 0x1dd76000
mov esi, esp
push 0x1f6
push str....._base_threading_thread_local_storage.cc
push 0x5b06c9
push esi
call fcn.004bbec0
add esp, 4
movsd xmm0, qword [esp + 0x1c]
movsd qword [esp + 4], xmm0
mov dword [esp], esi
call fcn.00540210
add esp, 0xc
xor esi, esi
mov ecx, dword [esp + 0x1c]
xor ecx, ebp
call fcn.004f1eb0
mov eax, esi
lea esp, [ebp - 8]
pop esi
pop edi
pop ebp
ret

Function at 0x47ee50
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, ecx
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 8]
cmp byte [edx + 0xb], 0
jns 0x47ee69
mov edx, dword [edx]
mov ebx, eax
and ebx, 0xfffffff
test al, 4
je 0x47ee81
cmp byte [esi + 0x28], 0
jne 0x47eef2
or ebx, 0x20000000
test bl, 8
jne 0x47eefa
mov dword [ebp - 0x10], 0
cmp byte [esi + 0x30], 0
mov eax, 0
je 0x47ee9b
mov eax, dword [esi + 0x2c]
cmp byte [esi + 0x24], 0
mov edi, 0
je 0x47eea9
mov edi, dword [esi + 0x20]
mov dword [ebp - 0x18], eax
cmp byte [esi + 0x1c], 0
jne 0x47ef4c
mov ecx, dword [ebp + 0xc]
xor eax, eax
cmp byte [esi + 0xc], 0
jne 0x47ef62
test ecx, ecx
jne 0x47ef1f
xor ecx, ecx
inc ecx
push dword [ebp - 0x18]
push edi
push dword [ebp - 0x10]
push eax
push ebx
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_SetNamedSecurityInfoW]
mov esi, eax
test eax, eax
jne 0x47ef16
test esi, esi
sete al
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
or ebx, 0x80000000
jmp 0x47ee81
cmp byte [esi + 0x34], 0
je 0x47ef0b
or ebx, 0x40000000
jmp 0x47ee86
or ebx, 0x10000000
jmp 0x47ee86
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x47eee3
cmp ecx, 4
jne 0x47ef2b
mov ecx, 6
jmp 0x47eecc
mov esi, ecx
add ecx, 0xfffffffe
cmp ecx, 2
jae 0x47ef3c
mov ecx, 7
jmp 0x47eecc
cmp esi, 1
jne 0x47ef48
mov ecx, 4
jmp 0x47eecc
xor ecx, ecx
jmp 0x47eecc
lea ecx, [esi + 0x10]
mov dword [ebp - 0x14], edx
call fcn.004422c0
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
jmp 0x47eeb6
mov ecx, esi
mov esi, edx
call fcn.004422c0
mov ecx, dword [ebp + 0xc]
mov edx, esi
jmp 0x47eec5
Function at 0x47ef80
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov esi, ecx
mov eax, dword [ebp + 0x10]
mov ebx, eax
and ebx, 0xfffffff
test al, 4
je 0x47efaa
cmp byte [esi + 0x28], 0
jne 0x47f030
or ebx, 0x20000000
test bl, 8
jne 0x47f03b
xor eax, eax
cmp byte [esi + 0x30], 0
mov ecx, 0
je 0x47efc3
mov ecx, dword [esi + 0x2c]
cmp byte [esi + 0x24], 0
mov edi, 0
je 0x47efd1
mov edi, dword [esi + 0x20]
mov dword [ebp - 0x14], ecx
cmp byte [esi + 0x1c], 0
jne 0x47f057
mov dword [ebp - 0x10], eax
mov edx, dword [ebp + 0xc]
xor eax, eax
cmp byte [esi + 0xc], 0
jne 0x47f06d
mov ecx, dword [ebp + 8]
cmp edx, 4
jne 0x47f01f
mov edx, 6
push dword [ebp - 0x14]
push edi
push dword [ebp - 0x10]
push eax
push ebx
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_SetSecurityInfo]
mov esi, eax
test eax, eax
jne 0x47f064
test esi, esi
sete al
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
mov esi, edx
add edx, 0xfffffffe
cmp edx, 2
jae 0x47f07d
mov edx, 7
jmp 0x47eff9
or ebx, 0x80000000
jmp 0x47efaa
cmp byte [esi + 0x34], 0
je 0x47f04c
or ebx, 0x40000000
jmp 0x47efb3
or ebx, 0x10000000
jmp 0x47efb3
lea ecx, [esi + 0x10]
call fcn.004422c0
jmp 0x47efda
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x47f010
mov ecx, esi
mov esi, edx
call fcn.004422c0
mov edx, esi
jmp 0x47efec
test esi, esi
jne 0x47f089
xor edx, edx
inc edx
jmp 0x47eff9
mov edx, esi
cmp esi, 1
jne 0x47f09a
mov edx, 4
jmp 0x47eff9
xor edx, edx
jmp 0x47eff9
Function at 0x47f560
Capabilities:
Hash data using murmur2

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov eax, dword [0x5c1040]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x5d5928]
mov ecx, dword [0x5c4ca4]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x47f6e6
mov esi, dword [0x5d5918]
lea edi, [esi + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x47f71c
mov ebx, esi
mov esi, dword [esi + 0x18]
test esi, esi
je 0x47f69d
imul eax, dword [ebp + 8], 0x5bd1e995
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul eax, ecx, 0x5bd1e995
xor eax, 0x6f47a654
mov ecx, eax
shr ecx, 0xd
xor ecx, eax
imul eax, ecx, 0x5bd1e995
mov ecx, eax
shr ecx, 0xf
xor ecx, eax
mov edx, esi
shr edx, 1
and edx, 0x55555555
mov eax, esi
sub eax, edx
mov edx, eax
and edx, 0x33333333
shr eax, 2
and eax, 0x33333333
add eax, edx
mov edx, eax
shr edx, 4
add edx, eax
add ebx, 0x14
and edx, 0xf0f0f0f
imul eax, edx, 0x1010101
shr eax, 0x18
mov dword [ebp - 0x20], eax
cmp eax, 1
jbe 0x47f6dc
mov edx, ecx
cmp ecx, esi
jb 0x47f637
mov eax, ecx
xor edx, edx
div esi
mov dword [ebp - 0x2c], ebx
mov eax, dword [ebx]
mov eax, dword [eax + edx*4]
test eax, eax
je 0x47f69d
mov ebx, dword [eax]
test ebx, ebx
je 0x47f69d
lea eax, [esi - 1]
mov dword [ebp - 0x28], eax
mov eax, dword [ebx + 4]
cmp eax, ecx
jne 0x47f6b6
mov eax, dword [ebp + 8]
cmp dword [ebx + 8], eax
jne 0x47f6d0
mov dword [ebp - 0x20], edi
lea edi, [ebp - 0x1c]
mov ecx, dword [ebp - 0x2c]
push ebx
push edi
call fcn.0047fda0
mov esi, dword [edi]
mov dword [edi], 0
test esi, esi
je 0x47f69a
cmp byte [ebp - 0x14], 0
je 0x47f691
mov eax, dword [esi + 0xc]
test eax, eax
je 0x47f691
lock dec dword [eax + 4]
je 0x47f728
push esi
call fcn.004f193e
add esp, 4
mov edi, dword [ebp - 0x20]
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004f1eb0
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
cmp dword [ebp - 0x20], 1
mov dword [ebp - 0x24], edx
jbe 0x47f736
cmp eax, esi
jb 0x47f6c9
xor edx, edx
div esi
mov eax, edx
mov edx, dword [ebp - 0x24]
cmp eax, edx
jne 0x47f69d
mov ebx, dword [ebx]
test ebx, ebx
jne 0x47f64f
jmp 0x47f69d
lea edx, [esi - 1]
and edx, ecx
jmp 0x47f637
push 0x5d5928
call fcn.004f1981
add esp, 4
cmp dword [0x5d5928], 0xffffffff
jne 0x47f594
mov ecx, 0x5d58f0
call fcn.0047f740
push 0x5d5928
call fcn.004f19fb
add esp, 4
jmp 0x47f594
mov ecx, edi
call fcn.004ab320
jmp 0x47f5ac
push eax
call fcn.004b1810
add esp, 4
jmp 0x47f691
and eax, dword [ebp - 0x28]
jmp 0x47f6c9