joyce8/EMBER2024-capa huggingface dataset:
Function at 0x475840
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [edx + 4]
sub esp, 0x20
push ebx
mov ebx, ecx
push esi
push edi
test eax, eax
je 0x4759c7
cmp dword [eax + 4], 0
je 0x4759c7
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
test edi, edi
je 0x47586f
cmp byte [edi], 0
jne 0x475871
xor edi, edi
test esi, esi
je 0x47587a
cmp byte [esi], 0
jne 0x47587c
xor esi, esi
push 0
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push esi
push edi
call dword [sym.imp.WS2_32.dll_getaddrinfo]
cmp eax, 0x273f
jg 0x47593c
je 0x475932
cmp eax, 0x2726
jg 0x475912
je 0x4758eb
test eax, eax
je 0x4758d3
cmp eax, 8
jne 0x47597e
push 0xe
lea ecx, [ebp - 0xc]
call fcn.004873a0
mov edx, dword [ebp + 0x18]
mov eax, dword [ebp - 0xc]
mov dword [edx], eax
mov eax, dword [ebp - 8]
jmp 0x4759de
lea ecx, [ebp - 0xc]
call fcn.0044f190
mov edx, dword [ebp + 0x18]
mov eax, dword [ebp - 0xc]
mov dword [edx], eax
mov eax, dword [ebp - 8]
jmp 0x4759de
mov edx, 0x2726
lea ecx, [ebp - 0x14]
call fcn.00472df0
mov edx, dword [ebp + 0x18]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 8], eax
mov eax, ecx
mov dword [edx], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], ecx
jmp 0x4759de
cmp eax, 0x273c
jne 0x47597e
push eax
lea ecx, [ebp - 0xc]
call fcn.004873e0
mov edx, dword [ebp + 0x18]
mov eax, dword [ebp - 0xc]
mov dword [edx], eax
mov eax, dword [ebp - 8]
jmp 0x4759de
mov edx, 0x273f
lea ecx, [ebp - 0x1c]
jmp 0x4758f3
cmp eax, 0x2afa
jg 0x475977
je 0x475970
cmp eax, 0x277d
je 0x475956
cmp eax, 0x2af9
jne 0x47597e
push eax
jmp 0x4759b2
push 0x277d
lea ecx, [ebp - 0xc]
call fcn.004873e0
mov edx, dword [ebp + 0x18]
mov eax, dword [ebp - 0xc]
mov dword [edx], eax
mov eax, dword [ebp - 8]
jmp 0x4759de
push 0x2afa
jmp 0x4759b2
cmp eax, 0x2afb
je 0x4759ad
mov eax, dword fs:[0x2c]
mov ecx, dword [eax]
mov eax, dword [0x6eb97c]
cmp eax, dword [ecx + 4]
jg 0x4759f4
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, dword [ebp + 0x18]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0x6eb958
mov dword [edx], eax
mov eax, dword [ebp - 8]
jmp 0x4759de
push 0x2afb
lea ecx, [ebp - 0xc]
call fcn.004873e0
mov edx, dword [ebp + 0x18]
mov eax, dword [ebp - 0xc]
mov dword [edx], eax
mov eax, dword [ebp - 8]
jmp 0x4759de
mov edx, 0x3e3
lea ecx, [ebp - 0x1c]
call fcn.00472df0
mov edx, dword [ebp + 0x18]
mov ecx, dword [eax]
mov dword [edx], ecx
mov eax, dword [eax + 4]
mov dword [edx + 4], eax
mov eax, dword [edx]
mov dword [ebx], eax
mov eax, dword [edx + 4]
pop edi
mov dword [ebx + 4], eax
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x6eb97c
call fcn.005ffe54
add esp, 4
cmp dword [0x6eb97c], 0xffffffff
jne 0x475993
push 0x650420
mov dword [0x6eb95c], 0x6eb958
mov dword [0x6eb958], 0x6ac23c
call fcn.005ffc91
add esp, 4
push 0x6eb97c
call fcn.005ffe0a
add esp, 4
jmp 0x475993
Function at 0x476040
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
mov eax, dword [0x6ddc7c]
xor eax, esp
mov dword [esp + 0x18], eax
push esi
push 0x6eb974
lea eax, [esp + 0x13]
mov byte [esp + 0x13], 0
push 0x450a50
push 0x6eb9ac
mov esi, ecx
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], 1
call fcn.005fbcbd
add esp, 0xc
test eax, eax
je 0x4760f6
push 0
push 0
push 0
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0
push eax
push 1
lea eax, [esp + 0x28]
push eax
push dword [esi + 4]
call dword [sym.imp.WS2_32.dll_WSASend]
mov eax, dword fs:[0x2c]
mov ecx, dword [eax]
mov eax, dword [0x6eb97c]
cmp eax, dword [ecx + 4]
jg 0x4760fb
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x40
jne 0x4760d1
mov edx, 0x2746
jmp 0x4760dd
cmp eax, 0x4d2
jne 0x4760e6
mov edx, 0x274d
lea ecx, [esp + 4]
call fcn.00472df0
mov ecx, dword [esp + 0x1c]
pop esi
xor ecx, esp
call fcn.005ff7bd
mov esp, ebp
pop ebp
ret
call fcn.0061f60e
push 0x6eb97c
call fcn.005ffe54
add esp, 4
cmp dword [0x6eb97c], 0xffffffff
jne 0x4760bf
push 0x650420
mov dword [0x6eb95c], 0x6eb958
mov dword [0x6eb958], 0x6ac23c
call fcn.005ffc91
add esp, 4
push 0x6eb97c
call fcn.005ffe0a
add esp, 4
jmp 0x4760bf
Function at 0x476150
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x434
mov eax, dword [0x6ddc7c]
xor eax, esp
mov dword [esp + 0x430], eax
push ebx
push esi
push edi
push 0x6eb974
mov ebx, ecx
mov dword [esp + 0x34], 0x400
lea eax, [esp + 0x3c]
mov dword [esp + 0x14], ebx
push 0x450a50
push 0x6eb9ac
mov dword [esp + 0x40], eax
call fcn.005fbcbd
add esp, 0xc
test eax, eax
je 0x4762d4
mov eax, dword fs:[0x2c]
mov eax, dword [eax]
mov dword [esp + 0xc], eax
nop
push 0
push 0
lea eax, [esp + 0x34]
mov dword [esp + 0x30], 0
push eax
lea eax, [esp + 0x34]
mov dword [esp + 0x38], 0
push eax
push 1
lea eax, [esp + 0x44]
push eax
push dword [ebx]
call dword [sym.imp.WS2_32.dll_WSARecv]
mov ecx, dword [0x6eb97c]
mov ebx, eax
mov eax, dword [esp + 0xc]
cmp ecx, dword [eax + 4]
jg 0x4762d9
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
mov edi, 0x6eb958
cmp esi, 0x40
jne 0x47621c
mov edx, 0x2746
lea ecx, [esp + 0x18]
call fcn.00472df0
mov esi, dword [eax]
mov edi, dword [eax + 4]
jmp 0x476249
cmp esi, 0x4d2
jne 0x476239
mov edx, 0x274d
lea ecx, [esp + 0x20]
call fcn.00472df0
mov esi, dword [eax]
mov edi, dword [eax + 4]
jmp 0x476249
cmp esi, 0x2738
je 0x47624d
cmp esi, 0xea
je 0x47624d
test ebx, ebx
jne 0x476268
mov eax, dword [esp + 0x28]
xor esi, esi
mov ebx, dword [esp + 0x10]
cmp eax, 0x400
je 0x4761b0
test eax, eax
jg 0x4762bd
je 0x4762a6
mov edx, 0x2733
lea ecx, [esp + 0x10]
call fcn.00472df0
mov ecx, dword [eax + 4]
mov edx, dword [eax]
mov eax, dword [edi + 4]
cmp eax, dword [ecx + 4]
jne 0x476287
cmp esi, edx
je 0x4762bd
mov edx, 0x4d5
lea ecx, [esp + 0x10]
call fcn.00472df0
mov ecx, dword [eax + 4]
mov edx, dword [eax]
mov eax, dword [edi + 4]
cmp eax, dword [ecx + 4]
jne 0x4762a6
cmp esi, edx
je 0x4762bd
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x430]
xor ecx, esp
call fcn.005ff7bd
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x43c]
mov al, 1
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.005ff7bd
mov esp, ebp
pop ebp
ret
call fcn.0061f60e
push 0x6eb97c
call fcn.005ffe54
add esp, 4
cmp dword [0x6eb97c], 0xffffffff
jne 0x4761f5
push 0x650420
mov dword [0x6eb95c], 0x6eb958
mov dword [0x6eb958], 0x6ac23c
call fcn.005ffc91
add esp, 4
push 0x6eb97c
call fcn.005ffe0a
add esp, 4
jmp 0x4761f5
Function at 0x4770e0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x6ddc7c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x1c]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
mov dword [ebp - 0xc], eax
mov eax, dword [edi + 4]
add eax, 0x18
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
cmp byte [ebp + 0x18], 0
push 0
je 0x477134
mov ecx, dword [edi + 4]
push 0
push ebx
call fcn.00474730
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005ff7bd
mov esp, ebp
pop ebp
ret 0x18
mov eax, dword [esi]
cmp eax, 0xffffffff
jne 0x47715c
mov ecx, dword [edi + 4]
push 0x2719
push ebx
call fcn.00474730
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005ff7bd
mov esp, ebp
pop ebp
ret 0x18
push ebx
push dword [ebp + 0x14]
lea ecx, [ebp - 8]
mov dword [ebp - 8], 0
push ecx
push dword [ebp + 0x10]
push dword [ebp - 0xc]
push eax
call dword [sym.imp.WS2_32.dll_WSASend]
mov esi, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x4d2
mov ecx, 0x274d
cmove eax, ecx
test esi, esi
je 0x4771b8
cmp eax, 0x3e5
je 0x4771b8
push dword [ebp - 8]
mov ecx, dword [edi + 4]
push eax
push ebx
call fcn.00474730
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005ff7bd
mov esp, ebp
pop ebp
ret 0x18
mov ecx, dword [edi + 4]
push ebx
call fcn.004746c0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005ff7bd
mov esp, ebp
pop ebp
ret 0x18
Function at 0x4771e0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x6ddc7c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
mov dword [ebp - 0x10], eax
push edi
mov edi, dword [ebp + 0x1c]
mov eax, dword [esi + 4]
add eax, 0x18
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
cmp byte [ebp + 0x18], 0
push 0
je 0x477234
mov ecx, dword [esi + 4]
push 0
push edi
call fcn.00474730
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005ff7bd
mov esp, ebp
pop ebp
ret 0x18
mov ecx, dword [ebx]
cmp ecx, 0xffffffff
jne 0x47725c
mov ecx, dword [esi + 4]
push 0x2719
push edi
call fcn.00474730
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005ff7bd
mov esp, ebp
pop ebp
ret 0x18
mov eax, dword [ebp + 0x14]
push edi
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push dword [ebp + 0x10]
push dword [ebp - 0x10]
push ecx
call dword [sym.imp.WS2_32.dll_WSARecv]
mov ebx, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x40
jne 0x477293
mov eax, 0x2746
jmp 0x4772a0
cmp eax, 0x4d2
mov ecx, 0x274d
cmove eax, ecx
test ebx, ebx
je 0x4772cb
cmp eax, 0x3e5
je 0x4772cb
push dword [ebp - 8]
mov ecx, dword [esi + 4]
push eax
push edi
call fcn.00474730
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005ff7bd
mov esp, ebp
pop ebp
ret 0x18
mov ecx, dword [esi + 4]
push edi
call fcn.004746c0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005ff7bd
mov esp, ebp
pop ebp
ret 0x18
Function at 0x47af50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6453b0
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x6c
mov eax, dword [0x6ddc7c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
xorps xmm0, xmm0
lea ecx, [ebp - 0x78]
push 0
movups xmmword [ebp - 0x78], xmm0
movq qword [ebp - 0x68], xmm0
call fcn.00568580
lea eax, [esi + 0x28]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0x30]
call fcn.00568280
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x78]
call fcn.0056a2b0
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0
call fcn.00568a20
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x28], 0x63726f66
mov dword [ebp - 0x24], 0x75615065
lea edx, [ecx + 1]
mov dword [ebp - 0x20], 0x6c416573
mov word [ebp - 0x1c], 0x6c
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0xf
mov byte [ebp - 0x48], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x47b007
sub ecx, edx
lea eax, [ebp - 0x28]
push ecx
push eax
lea ecx, [ebp - 0x48]
call fcn.0044e6d0
lea eax, [ebp - 0x78]
mov byte [ebp - 4], 2
push eax
lea eax, [ebp - 0x48]
mov ecx, esi
push eax
lea eax, [ebp - 0x60]
push eax
call fcn.0047c2b0
mov byte [ebp - 4], 3
lea edx, [ebp - 0x60]
cmp dword [ebp - 0x4c], 0x10
cmovae edx, dword [ebp - 0x60]
sub esp, 0x18
mov ecx, esp
call fcn.0044d9c0
mov ecx, esi
call fcn.0047c560
mov edx, dword [ebp - 0x4c]
cmp edx, 0x10
jb 0x47b088
mov ecx, dword [ebp - 0x60]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x47b07e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x47b101
push edx
push ecx
call fcn.005ff7fe
add esp, 8
mov edx, dword [ebp - 0x34]
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x4c], 0xf
mov byte [ebp - 0x60], 0
cmp edx, 0x10
jb 0x47b0ca
mov ecx, dword [ebp - 0x48]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x47b0c0
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x47b106
push edx
push ecx
call fcn.005ff7fe
add esp, 8
lea ecx, [ebp - 0x78]
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0xf
mov byte [ebp - 0x48], 0
call fcn.00568a20
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.005ff7bd
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.0061f5be
call fcn.0061f5be
int3
Function at 0x485160
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x641e10
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x6ddc7c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.005ff7ce
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.005fe3b5
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x34], esi
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x49ba80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x6ddc7c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 8], eax
cmp dword [edi + 0x14], 0x10
jb 0x49baa4
mov edi, dword [edi]
mov esi, dword [ebp + 8]
mov ecx, esi
mov edx, dword [esi + 0x14]
cmp edx, 0x10
jb 0x49bab3
mov ecx, dword [esi]
mov eax, dword [esi + 0x10]
add eax, ecx
cmp edx, 0x10
jb 0x49babf
mov esi, dword [esi]
xor ecx, ecx
mov ebx, eax
sub ebx, esi
xor edx, edx
cmp esi, eax
cmova ebx, ecx
test ebx, ebx
je 0x49bae3
mov al, byte [edx + esi]
xor al, byte [ebp + ecx - 8]
inc ecx
mov byte [edx + edi], al
and ecx, 3
inc edx
cmp edx, ebx
jne 0x49bad0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005ff7bd
mov esp, ebp
pop ebp
ret 0xc

Function at 0x49bb00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x6ddc7c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
mov dword [ebp - 0x14], eax
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0xc], esi
cmp byte [esi + 0xd], 0
mov dword [ebp - 0x10], edi
jge 0x49bb63
mov eax, dword [esi + 0x48]
xor ecx, ecx
mov edx, dword [eax + 8]
mov dword [ebp - 8], edx
test edi, edi
je 0x49bb54
nop dword [eax]
mov eax, ecx
and eax, 3
mov al, byte [ebp + eax - 8]
xor byte [ebx + ecx], al
inc ecx
cmp ecx, edi
jb 0x49bb40
mov eax, dword [esi + 0x48]
mov ecx, edi
and ecx, 3
je 0x49bb60
shl ecx, 3
ror edx, cl
mov dword [eax + 8], edx
mov eax, dword [esi + 0x48]
push edi
push ebx
mov esi, dword [eax]
mov eax, dword [esi + 0x48]
add esi, 0x38
mov ecx, esi
mov dword [ebp - 8], eax
call fcn.0044e810
mov ebx, dword [ebp - 0xc]
mov ebx, dword [ebx + 0x48]
mov eax, dword [ebx]
cmp dword [eax + 0x50], 1
jne 0x49bbfa
cmp dword [esi + 0x14], 0x10
mov ecx, esi
jb 0x49bb92
mov ecx, dword [esi]
mov edx, dword [esi + 0x10]
add edx, ecx
cmp dword [esi + 0x14], 0x10
jb 0x49bb9f
mov esi, dword [esi]
mov eax, dword [ebp - 8]
add eax, esi
cmp eax, edx
je 0x49bbfa
mov esi, dword [ebx + 0xc]
nop dword [eax + eax]
movzx edi, byte [eax]
movzx ecx, byte [edi + 0x6ac320]
mov dword [ebp - 8], ecx
test esi, esi
je 0x49bbce
mov ecx, dword [ebx + 0x10]
and edi, 0x3f
shl ecx, 6
or edi, ecx
jmp 0x49bbd7
mov esi, 0xff
sar esi, cl
and edi, esi
mov esi, dword [ebp - 8]
mov dword [ebx + 0x10], edi
mov ecx, dword [ebx + 0xc]
add ecx, ecx
movzx esi, byte [esi + ecx*8 + 0x6ac420]
mov dword [ebx + 0xc], esi
cmp esi, 1
je 0x49bc15
inc eax
cmp eax, edx
jne 0x49bbb0
mov edi, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
sub dword [eax + 0x18], edi
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005ff7bd
mov esp, ebp
pop ebp
ret 0xc
call fcn.00479320
mov ecx, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov dword [ecx + 4], eax
xor eax, eax
mov dword [ecx], 0x10
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005ff7bd
mov esp, ebp
pop ebp
ret 0xc
Function at 0x49fb70
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6487ad
mov eax, dword fs:[0]
push eax
sub esp, 0x78
push ebx
push esi
push edi
mov eax, dword [0x6ddc7c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi + 8]
lea esi, [edi + 0x10]
push esi
lea ecx, [ebp - 0x7c]
mov dword [ebp - 0x84], eax
call fcn.004a1280
mov ecx, dword [esi + 0x3c]
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x40], 0
test ecx, ecx
je 0x49fbcb
lock inc dword [ecx + 4]
mov ecx, dword [esi + 0x3c]
mov eax, dword [esi + 0x38]
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x40], ecx
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x44], eax
mov eax, dword [esi + 0x40]
mov dword [ebp - 0x3c], eax
mov eax, dword [ecx]
mov dword [ebp - 0x34], eax
mov eax, dword [ecx + 4]
mov ecx, dword [edx + 4]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
test ecx, ecx
je 0x49fc07
lock inc dword [ecx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [edx]
mov dword [ebp - 0x2c], eax
mov eax, dword [edx + 8]
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], eax
mov dword [ebp - 4], 0
lea ebx, [edi + 4]
push dword [0x6eba2c]
mov edi, dword [edi]
mov esi, dword [ebx]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x49fc42
cmp dword [eax], esi
je 0x49fd16
mov eax, dword [eax + 8]
test eax, eax
jne 0x49fc33
lea eax, [ebp - 0x84]
push eax
push 0x90
mov dword [ebp - 0x1c], eax
call fcn.004730f0
mov esi, eax
mov dword [ebp - 0x14], 0
add esp, 8
mov dword [ebp - 0x18], esi
mov byte [ebp - 4], 3
lea eax, [ebp - 0x84]
push eax
lea ecx, [esi + 0x20]
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0x4adfb0
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x1c], 0
call fcn.004ae0a0
push esi
mov byte [ebp - 4], 2
mov ecx, edi
push ebx
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
call fcn.004779f0
lea ecx, [ebp - 0x1c]
call fcn.004adf40
mov esi, dword [ebp - 0x28]
test esi, esi
je 0x49fcfa
or edi, 0xffffffff
mov eax, edi
lock xadd dword [esi + 4], eax
jne 0x49fcfa
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lock xadd dword [esi + 8], edi
dec edi
jne 0x49fcfa
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
lea ecx, [ebp - 0x7c]
call fcn.00482b10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [eax + 4], 0
je 0x49fc42
lea eax, [ebp - 0x84]
mov byte [ebp - 4], 1
push eax
push eax
call fcn.004b12e0
add esp, 8
jmp 0x49fcd2
Function at 0x4a18f0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x648b45
mov eax, dword fs:[0]
push eax
sub esp, 0x78
mov eax, dword [0x6ddc7c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
mov dword [ebp - 4], 0
lea eax, [ebp - 0x44]
xor edx, edx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x20], edx
mov byte [ebp - 4], 1
mov ecx, dword [ebp + 0x30]
test ecx, ecx
je 0x4a194a
mov eax, dword [ecx]
lea edx, [ebp - 0x44]
push edx
call dword [eax]
mov edx, eax
mov dword [ebp - 0x20], edx
mov ecx, dword [esi + 0x80]
mov eax, dword [ecx]
mov dword [ebp - 0x74], eax
mov eax, dword [ecx + 4]
mov dword [ebp - 0x70], eax
lea eax, [ebp - 0x6c]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x48], 0
mov byte [ebp - 4], 3
test edx, edx
je 0x4a19c7
lea eax, [ebp - 0x44]
cmp edx, eax
jne 0x4a19bd
mov eax, dword [edx]
lea ecx, [ebp - 0x6c]
push ecx
mov ecx, edx
call dword [eax + 4]
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x48], eax
test ecx, ecx
je 0x4a19c7
mov edx, dword [ecx]
lea eax, [ebp - 0x44]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
xor ecx, ecx
mov dword [ebp - 0x20], 0
test ecx, ecx
je 0x4a19c7
mov edx, dword [ecx]
lea eax, [ebp - 0x44]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
jmp 0x4a19c0
mov dword [ebp - 0x48], edx
mov dword [ebp - 0x20], 0
mov byte [ebp - 4], 4
mov ebx, dword [esi + 0x7c]
push dword [0x6eba2c]
mov esi, dword [ebp - 0x70]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4a19ec
cmp dword [eax], esi
je 0x4a19ec
mov eax, dword [eax + 8]
test eax, eax
jne 0x4a19e1
lea eax, [ebp - 0x74]
mov dword [ebp - 0x80], eax
lea eax, [ebp - 0x6c]
push eax
push 0x58
call fcn.004730f0
mov esi, eax
mov dword [ebp - 0x78], 0
add esp, 8
mov dword [ebp - 0x7c], esi
mov byte [ebp - 4], 6
lea eax, [ebp - 0x74]
push eax
lea ecx, [esi + 0x20]
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0x4ad1c0
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x1c], 0
call fcn.004ad380
push ecx
mov ecx, dword [ebx + 8]
push esi
call fcn.00473c00
mov ecx, dword [ebp - 0x48]
test ecx, ecx
je 0x4a1a75
mov edx, dword [ecx]
lea eax, [ebp - 0x6c]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
push 0x6eb974
push 0x450a50
push 0x6eb9ac
mov dword [edi], 0
call fcn.005fbcbd
add esp, 0xc
test eax, eax
je 0x4a1ad5
mov ecx, dword [ebp + 0x30]
mov dword [edi + 4], 0x6eb974
test ecx, ecx
je 0x4a1ab5
mov esi, dword [ecx]
lea eax, [ebp + 0xc]
cmp ecx, eax
setne dl
movzx edx, dl
push edx
call dword [esi + 0x10]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.005ff7bd
mov esp, ebp
pop ebp
ret 0x2c
call fcn.0061f60e
int3