joyce8/EMBER2024-capa huggingface dataset:
Function at 0x471d00
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x34
mov eax, dword [ebp + 0x10]
movzx ecx, word [eax + 8]
movzx edx, word [eax]
push ebx
movzx ebx, word [eax + 2]
push esi
movzx esi, word [eax + 4]
push edi
movzx edi, word [eax + 0xa]
movzx eax, word [eax + 6]
mov dword [esp + 0x18], esi
mov esi, dword [ebp + 0xc]
mov dword [esp + 0x1c], eax
mov eax, dword [ebp + 8]
shl esi, 4
add esi, eax
cmp eax, esi
mov dword [esp + 0x14], edi
je 0x471e75
movzx eax, cx
mov dword [esp + 0x20], eax
movzx eax, word [esp + 0x14]
movzx ecx, cx
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x14], ecx
movzx ecx, ax
movzx eax, ax
mov dword [esp + 0x28], ecx
movzx ecx, dx
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x18], ecx
movzx ecx, dx
movzx edx, ax
mov dword [esp + 0x34], edx
movzx edx, ax
movzx eax, bx
mov dword [esp + 0x2c], ecx
movzx ecx, bx
mov dword [esp + 0x38], eax
mov eax, dword [ebp + 8]
movzx edi, di
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x3c], edx
add eax, 0xa
movzx ecx, word [eax - 2]
mov ebx, dword [esp + 0x20]
movzx edx, cx
sub ebx, edx
shr ebx, 0x1f
sub ecx, ebx
mov ebx, edi
sub ebx, edx
shr ebx, 0x1f
sub ecx, ebx
mov ebx, dword [esp + 0x14]
mov word [eax - 2], cx
movzx ecx, word [eax]
movzx edx, cx
sub ebx, edx
shr ebx, 0x1f
sub ecx, ebx
mov ebx, dword [esp + 0x24]
sub ebx, edx
shr ebx, 0x1f
sub ecx, ebx
mov ebx, dword [esp + 0x18]
mov word [eax], cx
movzx ecx, word [eax - 0xa]
movzx edx, cx
sub ebx, edx
shr ebx, 0x1f
sub ecx, ebx
mov ebx, dword [esp + 0x28]
sub ebx, edx
shr ebx, 0x1f
sub ecx, ebx
mov ebx, dword [esp + 0x2c]
mov word [eax - 0xa], cx
movzx ecx, word [eax - 6]
movzx edx, cx
sub ebx, edx
shr ebx, 0x1f
sub ecx, ebx
mov ebx, dword [esp + 0x30]
sub ebx, edx
shr ebx, 0x1f
sub ecx, ebx
mov ebx, dword [esp + 0x1c]
mov word [eax - 6], cx
movzx ecx, word [eax - 8]
movzx edx, cx
sub ebx, edx
shr ebx, 0x1f
sub ecx, ebx
mov ebx, dword [esp + 0x34]
sub ebx, edx
shr ebx, 0x1f
sub ecx, ebx
mov ebx, dword [esp + 0x38]
mov word [eax - 8], cx
movzx ecx, word [eax - 4]
movzx edx, cx
sub ebx, edx
shr ebx, 0x1f
sub ecx, ebx
mov ebx, dword [esp + 0x3c]
sub ebx, edx
shr ebx, 0x1f
sub ecx, ebx
mov word [eax - 4], cx
add eax, 0x10
lea ecx, [eax - 0xa]
cmp ecx, esi
jne 0x471da5
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x472330
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x14
mov eax, dword [ebp + 0x10]
movzx edx, word [eax + 0xa]
push ebx
mov ebx, ecx
movzx ecx, word [eax + 8]
mov dword [esp + 0x10], ecx
mov ecx, dword [ebp + 8]
sar ecx, 7
push esi
mov dword [esp + 0x18], edx
mov edx, dword [ebp + 0x18]
push edi
mov dword [esp + 0x14], ebx
mov esi, edx
js 0x47237b
fldz
mov eax, esi
fst dword [eax]
add esi, 0x10
sub ecx, 1
fst dword [eax + 4]
fst dword [eax + 8]
fst dword [eax + 0xc]
jns 0x472364
fstp st(0)
mov eax, dword [ebx + 0xac]
add eax, 4
cmp dword [ebx + 0xd0], 0
je 0x47247a
mov esi, dword [ebp + 0xc]
mov ecx, 0x10
sub ecx, dword [ebx + 0xd4]
sar esi, cl
test esi, esi
jle 0x47247a
mov eax, dword [ebx + 0xd8]
shl esi, 4
movzx ecx, word [eax + esi - 0x10]
lea esi, [eax + esi - 0x10]
mov eax, ecx
and ecx, 0x1f
mov edi, 1
shl edi, cl
sar eax, 5
xor dword [edx + eax*4], edi
mov edi, dword [esi + 8]
sub edi, 1
mov ecx, dword [esi + 4]
mov dword [esp + 0x10], ecx
js 0x472410
lea esp, [esp]
mov eax, dword [esp + 0x10]
movzx eax, word [eax]
cmp ax, word [ebp + 0x14]
je 0x472406
movzx ecx, ax
mov eax, ecx
and ecx, 0x1f
mov ebx, 1
shl ebx, cl
sar eax, 5
xor dword [edx + eax*4], ebx
mov ebx, dword [esp + 0x14]
add dword [esp + 0x10], 2
sub edi, 1
jns 0x4723e0
movzx edi, word [esi]
mov eax, dword [ebx + 0xac]
shl edi, 4
add edi, dword [ebx + 0xa0]
movzx ecx, word [edi + 8]
lea esi, [eax + ecx*4 + 4]
movzx ecx, word [edi + 0xa]
lea eax, [eax + ecx*4]
cmp esi, eax
mov dword [esp + 0x10], eax
jae 0x47246c
lea esp, [esp]
test byte [esi], 1
jne 0x472465
movzx ecx, word [esi + 2]
mov eax, ecx
and ecx, 0x1f
mov ebx, 1
shl ebx, cl
sar eax, 5
not ebx
and dword [edx + eax*4], ebx
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
add esi, 4
cmp esi, eax
jb 0x472440
movzx ecx, word [edi + 8]
mov eax, dword [ebx + 0xac]
lea eax, [eax + ecx*4 + 4]
mov esi, dword [esp + 0x18]
mov ecx, dword [ebx + 0xac]
lea ecx, [ecx + esi*4]
cmp eax, ecx
mov dword [esp + 0x18], ecx
jae 0x4724af
nop
movzx ecx, word [eax + 2]
mov esi, ecx
and ecx, 0x1f
mov edi, 1
shl edi, cl
sar esi, 5
add eax, 4
xor dword [edx + esi*4], edi
cmp eax, dword [esp + 0x18]
jb 0x472490
mov ecx, dword [ebx + 0xac]
mov esi, dword [esp + 0x1c]
add eax, 4
lea edi, [ecx + esi*4]
cmp eax, edi
jae 0x4724e5
test byte [eax], 1
jne 0x4724de
movzx ecx, word [eax + 2]
mov esi, ecx
and ecx, 0x1f
mov ebx, 1
shl ebx, cl
sar esi, 5
xor dword [edx + esi*4], ebx
add eax, 4
cmp eax, edi
jb 0x4724c3
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x477e60
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
push edi
mov esi, ecx
xor edi, edi
cmp dword [esi + 0xd0], edi
mov dword [esi], vtable.hkp3AxisSweep.0
mov dword [esp + 0x10], edi
jle 0x477edf
mov dword [esp + 0x14], edi
jmp 0x477e90
mov eax, dword [esi + 0xd8]
lea edi, [edi + eax + 4]
mov eax, dword [edi + 8]
test eax, eax
js 0x477ec1
mov ecx, dword [0x4c6060]
and eax, 0x3fffffff
push ecx
mov ebx, eax
call ebp
mov ecx, dword [edi]
push 0x17
lea edx, [ebx + ebx]
push edx
push ecx
mov ecx, eax
call fcn.004023e0
mov eax, dword [esp + 0x10]
mov edi, dword [esp + 0x14]
add eax, 1
add edi, 0x10
cmp eax, dword [esi + 0xd0]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edi
jl 0x477e90
mov edx, dword [0x4c6060]
mov edi, dword [esi + 0xd8]
push edx
call ebp
push edi
mov ecx, eax
call fcn.004025d0
lea edi, [esi + 0xd0]
mov dword [esp + 0x14], 2
mov eax, dword [edi - 4]
sub edi, 0xc
test eax, eax
js 0x477f31
and eax, 0x3fffffff
mov ebx, eax
mov eax, dword [0x4c6060]
push eax
call ebp
mov edx, dword [edi]
push 0x17
lea ecx, [ebx*4]
push ecx
push edx
mov ecx, eax
call fcn.004023e0
sub dword [esp + 0x14], 1
jns 0x477f04
mov edi, dword [esi + 0xa8]
test edi, edi
js 0x477f64
mov eax, dword [0x4c6060]
push eax
and edi, 0x3fffffff
call ebp
mov ecx, dword [esi + 0xa0]
push 0x17
shl edi, 4
push edi
push ecx
mov ecx, eax
call fcn.004023e0
pop edi
mov ecx, esi
pop esi
pop ebp
pop ebx
add esp, 8
jmp fcn.0047b190
Function at 0x479610
Capabilities:
Get thread local storage value

Disassembly:
mov ecx, dword [edi]
cmp ecx, 0x200
jae 0x47962f
mov eax, dword [edi + 8]
mov edx, dword [edi + 4]
mov eax, dword [edx + eax*4 - 4]
add eax, ecx
add ecx, 0x80
mov dword [edi], ecx
ret
mov eax, dword [0x4c6060]
push ebx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push 0x27
push 0x200
mov ecx, eax
call fcn.00402380
mov ecx, dword [edi + 0xc]
lea esi, [edi + 4]
and ecx, 0x3fffffff
cmp dword [esi + 4], ecx
mov ebx, eax
jne 0x479669
push 4
push esi
call fcn.00402730
add esp, 8
mov edx, dword [esi + 4]
mov eax, dword [esi]
mov dword [eax + edx*4], ebx
add dword [esi + 4], 1
pop esi
mov eax, ebx
mov dword [edi], 0x80
pop ebx
ret
Function at 0x479b00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
call fcn.00479610
mov ecx, dword [esp + 0x10]
mov edx, dword [ecx]
mov dword [eax], edx
mov edx, dword [ecx + 4]
mov dword [eax + 4], edx
mov edx, dword [ecx + 8]
mov dword [eax + 8], edx
mov edx, dword [ecx + 0xc]
mov dword [eax + 0xc], edx
mov edx, dword [ecx + 0x10]
mov dword [eax + 0x10], edx
mov edx, dword [ecx + 0x14]
mov dword [eax + 0x14], edx
mov edx, dword [ecx + 0x18]
mov dword [eax + 0x18], edx
mov edx, dword [ecx + 0x1c]
mov dword [eax + 0x1c], edx
mov edx, dword [ecx + 0x20]
mov dword [eax + 0x20], edx
mov edx, dword [ecx + 0x24]
mov dword [eax + 0x24], edx
mov edx, dword [ecx + 0x28]
mov dword [eax + 0x28], edx
mov edx, dword [ecx + 0x2c]
mov dword [eax + 0x2c], edx
mov edx, dword [ecx + 0x30]
mov dword [eax + 0x30], edx
mov edx, dword [ecx + 0x34]
mov dword [eax + 0x34], edx
mov edx, dword [ecx + 0x38]
mov dword [eax + 0x38], edx
mov edx, dword [ecx + 0x3c]
mov dword [eax + 0x3c], edx
mov edx, dword [ecx + 0x40]
mov dword [eax + 0x40], edx
mov edx, dword [ecx + 0x44]
mov dword [eax + 0x44], edx
mov edx, dword [ecx + 0x48]
mov dword [eax + 0x48], edx
mov edx, dword [ecx + 0x4c]
mov dword [eax + 0x4c], edx
mov edx, dword [ecx + 0x50]
mov dword [eax + 0x50], edx
mov edx, dword [ecx + 0x54]
mov dword [eax + 0x54], edx
mov edx, dword [ecx + 0x58]
mov dword [eax + 0x58], edx
mov edx, dword [ecx + 0x5c]
mov dword [eax + 0x5c], edx
mov edx, dword [ecx + 0x60]
mov dword [eax + 0x60], edx
mov edx, dword [ecx + 0x64]
mov dword [eax + 0x64], edx
mov edx, dword [ecx + 0x68]
mov dword [eax + 0x68], edx
mov edx, dword [ecx + 0x6c]
mov dword [eax + 0x6c], edx
mov edx, dword [ecx + 0x70]
mov dword [eax + 0x70], edx
mov edx, dword [ecx + 0x74]
mov dword [eax + 0x74], edx
mov edx, dword [ecx + 0x78]
mov dword [eax + 0x78], edx
mov ecx, dword [ecx + 0x7c]
mov dword [eax + 0x7c], ecx
movzx edx, word [eax + 4]
mov esi, dword [eax + 0x10]
movzx ecx, word [eax + 6]
mov esi, dword [esi + 0x4c]
mov dword [esi + edx*8], eax
mov edx, dword [eax + 0x14]
mov edx, dword [edx + 0x4c]
movzx ecx, cx
pop edi
mov dword [edx + ecx*8], eax
pop esi
ret
Function at 0x47a280
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, dword [esp + 8]
cmp dword [ebp], 0x200
push edi
mov edi, dword [esp + 0x10]
je 0x47a361
push ebx
push esi
lea esp, [esp]
cmp dword [edi + 8], 0
je 0x47a35f
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
mov edx, dword [ecx + eax*4 - 4]
mov eax, dword [edi]
lea esi, [edi + 4]
lea ecx, [edx + eax - 0x80]
push ecx
push ebp
call fcn.00479b00
add esp, 8
add dword [edi], 0xffffff80
jne 0x47a2fb
mov edx, dword [esi + 4]
mov eax, dword [esi]
mov ebx, dword [eax + edx*4 - 4]
add dword [esi + 4], 0xffffffff
mov ecx, dword [0x4c6060]
push ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push 0x27
push 0x200
push ebx
mov ecx, eax
call fcn.004023e0
mov dword [edi], 0x200
mov edx, dword [esi + 8]
test edx, edx
js 0x47a352
mov eax, dword [esi + 4]
add eax, 3
mov ecx, eax
shr ecx, 0x10
or eax, ecx
mov ecx, eax
shr ecx, 8
or eax, ecx
mov ecx, eax
shr ecx, 4
or eax, ecx
mov ecx, eax
shr ecx, 2
or eax, ecx
mov ecx, eax
shr ecx, 1
or ecx, eax
add ecx, 1
cmp ecx, 1
jge 0x47a33a
push 1
lea edx, [esi + 0xc]
push edx
jmp 0x47a347
and edx, 0x3fffffff
cmp ecx, edx
jge 0x47a352
push ecx
push 0
push 4
push esi
call fcn.004027d0
add esp, 0x10
cmp dword [ebp], 0x200
jne 0x47a2a0
pop esi
pop ebx
mov eax, dword [edi + 8]
test eax, eax
je 0x47a38b
mov ecx, dword [ebp + 8]
push eax
mov eax, dword [edi + 4]
push eax
push ecx
lea ecx, [ebp + 4]
call fcn.00471840
mov edx, dword [edi]
mov dword [ebp], edx
mov dword [edi + 8], 0
mov dword [edi], 0x200
pop edi
pop ebp
ret
Function at 0x47b0c0
Capabilities:
Get thread local storage value

Disassembly:
push ecx
push edi
mov edi, ecx
cmp dword [edi + 0x10], 0
mov dword [esp + 4], edi
jne 0x47b18b
mov eax, dword [0x4c6060]
push ebx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, dword [eax + 0x58]
or ebx, 0xffffffff
test esi, esi
je 0x47b0f4
add dword [eax + 0x5c], ebx
mov ecx, dword [esi]
mov dword [eax + 0x58], ecx
jmp 0x47b0ff
push 4
mov ecx, eax
call fcn.00402220
mov esi, eax
test esi, esi
je 0x47b17c
mov edi, dword [esp + 0x14]
mov ecx, 0x4c6080
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
call fcn.00404790
mov edx, dword [0x4c60a8]
mov eax, edx
test eax, eax
mov dword [esi + 0x28], edx
je 0x47b134
mov dword [eax + 0x24], esi
mov dword [esi + 0x24], 0x4c6080
push 0x4c6080
mov dword [0x4c60a8], esi
mov dword [0x4c6098], ebx
mov dword [0x4c609c], ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
mov edi, dword [esp + 0xc]
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
lea ecx, [edi + 8]
mov dword [edi + 0x10], esi
call fcn.00469fd0
pop esi
pop ebx
pop edi
pop ecx
ret 4
xor esi, esi
lea ecx, [edi + 8]
mov dword [edi + 0x10], esi
call fcn.00469fd0
pop esi
pop ebx
pop edi
pop ecx
ret 4

Function at 0x47b4d0
Capabilities:
Get thread local storage value

Disassembly:
push esi
mov esi, ecx
mov word [esi + 6], 1
mov dword [esi], vtable.hkpMoppCodeGenerator.0
mov eax, dword [0x4c6060]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [esp + 0xc]
push 0x28
push edi
mov ecx, eax
call fcn.004025a0
mov dword [esi + 8], edi
mov dword [esi + 0x10], eax
pop edi
mov dword [esi + 0xc], 0
mov eax, esi
pop esi
ret 4

Function at 0x47b540
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x4c6060]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_TlsGetValue]
push ebp
push esi
push edi
mov esi, ecx
mov edi, dword [esi + 8]
push eax
add edi, edi
call ebx
push 0x28
push edi
mov ecx, eax
call fcn.004025a0
mov ecx, dword [esi + 8]
push ecx
mov edi, eax
push 0xcd
push edi
call fcn.00406240
mov eax, dword [esi + 8]
mov edx, dword [esi + 0x10]
push eax
push edx
add eax, edi
push eax
call fcn.00406220
mov eax, dword [esi + 8]
mov ebp, dword [esi + 0x10]
add eax, eax
mov dword [esi + 8], eax
mov ecx, dword [0x4c6060]
add esp, 0x18
push ecx
call ebx
push ebp
mov ecx, eax
call fcn.004025d0
mov dword [esi + 0x10], edi
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x47b5b0
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x4c6060]
push ebx
push ebp
push esi
push edi
mov ebx, ecx
mov ebp, dword [ebx + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push 0x28
push 0x30
mov ecx, eax
call fcn.00402380
fldz
mov esi, eax
mov word [esi + 4], 0x30
mov word [esi + 6], 1
mov dword [esi], vtable.hkpMoppCode.0
lea edi, [esi + 0x20]
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], bind
fst dword [esi + 0x1c]
fst dword [esi + 0x18]
fst dword [esi + 0x14]
fstp dword [esi + 0x10]
mov ecx, dword [edi + 8]
and ecx, 0x3fffffff
cmp ecx, ebp
jge 0x47b622
push 1
push ebp
push edi
call fcn.004026b0
add esp, 0xc
mov eax, dword [edi + 8]
and eax, 0x3fffffff
cmp eax, ebp
jge 0x47b642
add eax, eax
cmp ebp, eax
jl 0x47b636
mov eax, ebp
push 1
push eax
push edi
call fcn.004026b0
add esp, 0xc
mov dword [edi + 4], ebp
mov edx, dword [ebx + 0x10]
sub edx, dword [ebx + 0xc]
mov eax, dword [edi]
add edx, dword [ebx + 8]
push ebp
push edx
push eax
call fcn.00406220
mov ecx, dword [0x4c6060]
mov edi, dword [ebx + 0x10]
add esp, 0xc
push ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
mov ecx, eax
call fcn.004025d0
xor eax, eax
pop edi
mov dword [ebx + 0x10], eax
mov dword [ebx + 0xc], eax
mov eax, esi
pop esi
mov dword [ebx + 8], ebp
pop ebp
pop ebx
ret
Function at 0x47db60
Capabilities:
Get thread local storage value

Disassembly:
mov ecx, dword [esp + 4]
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x14]
mov eax, dword [edi + 0xc]
neg eax
and eax, 3
cmp dword [ecx + 0x1c], 0
mov dword [esp + 0x18], eax
jne 0x47db88
mov dword [ebp + 4], 0
mov edx, dword [ebp + 4]
test edx, edx
je 0x47dc2d
mov eax, dword [ebp]
mov ecx, dword [ecx + 0x1c]
mov edi, dword [ecx]
push edx
push eax
mov eax, dword [edi + 4]
call eax
mov ebx, eax
push ebx
mov ecx, esi
call fcn.0047ba50
mov ecx, dword [0x4c6060]
push ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [eax + 0x20]
lea edx, [ebx + 0x10]
and edx, 0xfffffff0
lea ecx, [edi + edx]
cmp ecx, dword [eax + 0x2c]
ja 0x47dbcf
mov dword [eax + 0x20], ecx
jmp 0x47dbdb
mov edi, dword [eax]
push edx
mov edx, dword [edi + 0x14]
mov ecx, eax
call edx
mov edi, eax
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 0x1c]
mov eax, dword [ebp + 4]
mov edx, dword [ecx]
mov edx, dword [edx + 8]
push edi
push eax
mov eax, dword [ebp]
push eax
call edx
mov eax, dword [esi + 0x10]
sub eax, dword [esi + 0xc]
push ebx
add eax, dword [esi + 8]
push edi
push eax
call fcn.00406220
mov ecx, dword [0x4c6060]
add esp, 0xc
push ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp edi, dword [eax + 0x28]
mov dword [eax + 0x20], edi
jne 0x47dc25
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x18]
push edi
call eax
mov edi, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov ecx, dword [edi + 0xc]
mov ebx, dword [esi + 0xc]
add ecx, eax
push ecx
mov ecx, esi
call fcn.0047ba50
mov edx, dword [edi + 0x10]
mov eax, dword [edi + 0xc]
add edx, dword [edi + 8]
push eax
sub edx, eax
mov eax, dword [esi + 0x10]
add eax, dword [esi + 8]
push edx
sub eax, dword [esi + 0xc]
push eax
call fcn.00406220
mov eax, dword [esi + 0xc]
add esp, 0xc
pop edi
pop ebp
sub eax, ebx
pop ebx
ret
Function at 0x47f3d0
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x24]
push ebx
push ebp
mov ebp, dword [esp + 0x30]
push esi
mov esi, ecx
mov ecx, dword [esp + 0x2c]
push edi
mov edi, dword [esp + 0x3c]
mov dword [esi + 0x20], eax
mov dword [esi + 8], edi
mov dword [esi + 0x28], ecx
mov dword [esi + 0x24], ebp
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
call eax
mov ecx, dword [edi + 4]
mov edi, dword [esp + 0x40]
mov edx, dword [edi]
xor ebx, ebx
cmp eax, ebx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], edx
mov dword [esi + 0x38], ebx
mov ecx, eax
je 0x47f42c
xor edx, edx
mov edi, edi
sar ecx, 1
add edx, 1
cmp ecx, ebx
jne 0x47f420
mov dword [esi + 0x38], edx
mov ecx, dword [esi + 8]
cmp byte [ecx + 0x14], bl
je 0x47f43f
mov ecx, 0x1000
mov dword [esp + 0x3c], ecx
jmp 0x47f44b
mov edx, dword [esp + 0x18]
add edx, eax
mov dword [esp + 0x3c], edx
mov ecx, edx
cmp ecx, ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov eax, dword [edi + 4]
jle 0x47f478
mov edx, ecx
lea ebx, [ebx]
mov edi, dword [esi + 0x10]
mov dword [eax], edi
add dword [esi + 0x14], 1
mov dword [esi + 0x10], eax
add eax, 0x7c
sub edx, 1
jne 0x47f460
mov edi, dword [esp + 0x40]
cmp ecx, ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov eax, dword [edi + 8]
jle 0x47f499
mov edx, dword [esi + 0x18]
mov dword [eax], edx
add dword [esi + 0x1c], 1
mov dword [esi + 0x18], eax
add eax, 0x64
sub ecx, 1
jne 0x47f485
mov eax, dword [ebp]
mov edx, dword [eax + 0xc]
mov ecx, ebp
call edx
mov dword [esi + 0x30], eax
mov eax, dword [ebp]
mov edx, dword [eax + 0x10]
mov ecx, ebp
call edx
mov ebx, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [esi + 0x34], eax
mov eax, dword [esi + 8]
mov ecx, dword [0x4c6060]
mov edi, dword [eax + 8]
push ecx
add edi, 2
call ebx
push 0x28
lea edx, [edi*4]
push edx
mov ecx, eax
call fcn.004025a0
mov dword [esp + 0x24], eax
xor eax, eax
push eax
push eax
lea edx, [esp + 0x18]
lea ecx, [esp + 0x24]
push edx
mov dword [esi + 0xc], ecx
push eax
mov ecx, esi
mov dword [esp + 0x30], edi
mov dword [esp + 0x2c], eax
mov dword [esp + 0x38], eax
call fcn.0047f0e0
mov ecx, dword [esp + 0x3c]
lea edx, [ecx + ecx]
mov edi, eax
mov eax, dword [ebp]
mov eax, dword [eax + 0x14]
push edx
push esi
push edi
mov ecx, ebp
call eax
mov dword [esi + 0xc], 0
mov ecx, dword [0x4c6060]
mov esi, dword [esp + 0x24]
push ecx
call ebx
push esi
mov ecx, eax
call fcn.004025d0
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 0x14
Function at 0x480200
Capabilities:
Execute anti-debugging instructions
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
mov eax, dword [0x4c6074]
sub esp, 0x28
push esi
push edi
push eax
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, eax
mov edi, dword [ecx + 4]
cmp edi, dword [ecx + 0xc]
jae 0x48023c
mov dword [edi], str.TtRayCstCached
rdtsc
mov dword [esp + 0xc], eax
mov edx, dword [esp + 0xc]
mov dword [edi + 4], edx
add edi, 0xc
mov dword [ecx + 4], edi
mov edx, dword [ebp + 0x10]
test edx, edx
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x18]
mov dword [esi + 4], eax
mov dword [esi + 0xc], ecx
mov dword [esi + 0x10], 0
je 0x48025b
lea ecx, [edx + 0x14]
jmp 0x48025d
xor ecx, ecx
mov dword [esi + 8], ecx
cmp byte [eax + 0x20], 0
je 0x480279
test edx, edx
je 0x480272
lea ecx, [edx + 0x10]
mov dword [esi + 0x44], ecx
jmp 0x480280
xor ecx, ecx
mov dword [esi + 0x44], ecx
jmp 0x480280
mov dword [esi + 0x44], 0
fld dword [eax]
mov edx, dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
fstp dword [esp + 0x10]
fld dword [eax + 4]
add eax, 0x10
fstp dword [esp + 0x14]
push 0
fld dword [eax - 8]
mov dword [esp + 0x28], eax
fstp dword [esp + 0x1c]
mov dword [esp + 0x30], edx
fld dword [eax - 4]
mov eax, dword [ecx]
mov eax, dword [eax + 0x54]
fstp dword [esp + 0x20]
push esi
lea edx, [esp + 0x18]
push edx
mov dword [esp + 0x2c], 1
mov dword [esp + 0x34], 0x10
call eax
mov ecx, dword [0x4c6074]
push ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, eax
mov esi, dword [ecx + 4]
cmp esi, dword [ecx + 0xc]
jae 0x4802fb
mov dword [esi], 0x4b2454
rdtsc
mov dword [esp + 0xc], eax
mov edx, dword [esp + 0xc]
mov dword [esi + 4], edx
add esi, 0xc
mov dword [ecx + 4], esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x14
Function at 0x480bf0
Capabilities:
Execute anti-debugging instructions
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
mov eax, dword [0x4c6074]
sub esp, 0x24
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
push edi
push eax
mov esi, ecx
call ebx
mov ecx, eax
mov edi, dword [ecx + 4]
cmp edi, dword [ecx + 0xc]
jae 0x480c2f
mov dword [edi], str.TtRayCstCchSim
rdtsc
mov dword [esp + 0xc], eax
mov edx, dword [esp + 0xc]
mov dword [edi + 4], edx
add edi, 0xc
mov dword [ecx + 4], edi
mov edx, dword [ebp + 0x10]
test edx, edx
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x18]
mov dword [esi + 4], eax
mov dword [esi + 0xc], ecx
je 0x480c47
lea ecx, [edx + 0x14]
jmp 0x480c49
xor ecx, ecx
mov dword [esi + 8], ecx
cmp byte [eax + 0x20], 0
je 0x480c65
test edx, edx
je 0x480c5e
lea ecx, [edx + 0x10]
mov dword [esi + 0x34], ecx
jmp 0x480c6c
xor ecx, ecx
mov dword [esi + 0x34], ecx
jmp 0x480c6c
mov dword [esi + 0x34], 0
fld dword [eax]
mov edx, dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
fstp dword [esp + 0x10]
fld dword [eax + 4]
add eax, 0x10
fstp dword [esp + 0x14]
push 0
fld dword [eax - 8]
mov dword [esp + 0x28], eax
fstp dword [esp + 0x1c]
mov dword [esp + 0x30], edx
fld dword [eax - 4]
mov eax, dword [ecx]
mov eax, dword [eax + 0x54]
fstp dword [esp + 0x20]
push esi
lea edx, [esp + 0x18]
push edx
mov dword [esp + 0x2c], 1
mov dword [esp + 0x34], 0x10
call eax
mov ecx, dword [0x4c6074]
push ecx
call ebx
mov ecx, eax
mov esi, dword [ecx + 4]
cmp esi, dword [ecx + 0xc]
jae 0x480ce3
mov dword [esi], 0x4b2454
rdtsc
mov dword [esp + 0xc], eax
mov edx, dword [esp + 0xc]
mov dword [esi + 4], edx
add esi, 0xc
mov dword [ecx + 4], esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x482730
Capabilities:
Get thread local storage value

Disassembly:
push ecx
push ebx
push ebp
mov ebx, ecx
push esi
mov dword [ebx], vtable.hkpCollisionDispatcher.0
call fcn.004820e0
lea esi, [ebx + 0xc]
mov dword [esp + 0xc], 8
or ebp, 0xffffffff
push edi
mov edi, 8
mov ecx, dword [esi]
test ecx, ecx
je 0x482777
cmp word [ecx + 4], 0
je 0x482777
add word [ecx + 6], bp
movzx eax, word [ecx + 6]
test ax, ax
jne 0x482777
mov eax, dword [ecx]
mov edx, dword [eax]
push 1
call edx
add esi, 4
sub edi, 1
jne 0x482755
sub dword [esp + 0x10], 1
jne 0x482750
mov eax, dword [ebx + 0x1e2c]
test eax, eax
pop edi
js 0x4827bc
and eax, 0x3fffffff
mov esi, eax
mov eax, dword [0x4c6060]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edx, dword [ebx + 0x1e24]
push 0x17
lea ecx, [esi*8]
push ecx
push edx
mov ecx, eax
call fcn.004023e0
pop esi
pop ebp
mov dword [ebx], vtable.hkBaseObject.0
pop ebx
pop ecx
ret