joyce8/EMBER2024-capa huggingface dataset:
Function at 0x441cc0
Capabilities:
Read file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x30
cmp dword [edx + 8], 0
mov bl, 1
jne 0x441e2e
lea ebp, [esp + 0x20]
lea eax, [edx + 8]
mov esi, edx
mov edi, ecx
lea edx, [ecx + 8]
mov ecx, ebp
mov dword [esp + 0xc], eax
call fcn.00441ea9
mov eax, dword [ebp]
mov ebp, dword [ebp + 4]
lea ebx, [edi + 0x20]
push ebx
push 0
push ebp
mov dword [esp + 0x28], eax
push eax
push dword [edi + 0x50]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x441d45
mov dword [esp], ebp
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [esp + 4]
mov ebp, eax
mov byte [ecx], 0
mov dword [ecx + 4], eax
call fcn.00441b29
test eax, eax
je 0x441dc3
cmp edx, 0x3e5
jne 0x441dc3
xor ecx, ecx
mov edx, ebp
call fcn.00444767
mov ebp, dword [esp]
lea eax, [esp + 0x2c]
and dword [eax], 0
push 0
push eax
push ebx
push dword [edi + 0x50]
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
je 0x441d61
mov bl, 1
jmp 0x441d94
mov dword [esp], ebp
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [esp + 4]
mov ebp, eax
mov byte [ecx], 0
mov dword [ecx + 4], eax
call fcn.00441b29
test eax, eax
mov bl, 1
je 0x441dc3
cmp edx, 0x3e4
jne 0x441dc3
mov ecx, dword [esp + 4]
mov edx, ebp
call fcn.00444767
mov ecx, dword [esp + 0xc]
call fcn.0044129c
movsd xmm0, qword [esp + 0x20]
mov eax, dword [esp + 0x28]
mov dword [esi + 8], 1
and dword [esi + 0xc], 0
movsd qword [esi + 0x10], xmm0
mov dword [esi + 0x18], eax
lock inc dword [edi]
jg 0x441e2e
ud2
mov ebp, dword [esp + 8]
mov edi, dword [esp + 4]
lea ecx, [esp + 0x14]
mov dword [esp + 0x18], ebp
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], 1
call fcn.00441b29
test eax, eax
sete al
cmp edx, 0x218
setne bl
or bl, al
je 0x441e19
mov ecx, dword [esp + 0xc]
call fcn.0044129c
mov edx, dword [esp + 0x44]
mov ecx, esi
mov dword [esi + 8], 3
mov dword [esi + 0x10], ebp
mov dword [esi + 0xc], edi
call fcn.00441f20
jmp 0x441e22
mov ecx, edi
mov edx, ebp
call fcn.00444767
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp]
call fcn.004a8f7f
mov eax, ebx
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4424e5
Capabilities:
Write file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [esp + 0x24]
mov esi, ecx
mov edi, edx
lea ebx, [edx + 0x38]
mov ecx, dword [eax]
mov edx, dword [eax + 8]
mov dword [esp + 8], ecx
push 0x4e0e90
push dword [esp + 0x2c]
call fcn.0043394c
pop ecx
pop ecx
push ebx
push 0
push edx
push eax
push dword [edi + 0x50]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x442554
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, esp
mov ebp, eax
mov byte [ecx], 0
mov dword [ecx + 4], eax
call fcn.00441b29
test eax, eax
je 0x442614
cmp edx, 0x3e5
jne 0x442614
xor ecx, ecx
mov edx, ebp
call fcn.00444767
lea eax, [esp + 0xc]
mov ebp, dword [esp + 0x2c]
and dword [eax], 0
push 0
push eax
push ebx
push dword [edi + 0x50]
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
je 0x4425b2
mov ebx, dword [esp + 0xc]
lea ecx, [ebp + 0x1c]
call fcn.0044129c
mov eax, dword [esp + 0x28]
mov dword [ebp + 0x1c], 2
mov dword [ebp + 0x20], eax
mov eax, dword [esp + 0x24]
movsd xmm0, qword [eax]
mov eax, dword [eax + 8]
movsd qword [ebp + 0x24], xmm0
mov dword [ebp + 0x2c], eax
lock inc dword [edi]
jle 0x44263f
mov dword [esi + 4], 1
mov dword [esi + 8], ebx
jmp 0x44260f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, esp
mov ebx, eax
mov byte [ecx], 0
mov dword [ecx + 4], eax
call fcn.00441b29
test eax, eax
je 0x442614
cmp edx, 0x3e4
jne 0x442614
mov ecx, dword [esp]
mov edx, ebx
call fcn.00444767
lea ecx, [ebp + 0x1c]
call fcn.0044129c
mov eax, dword [esp + 0x28]
mov dword [ebp + 0x1c], 1
mov dword [ebp + 0x20], eax
mov eax, dword [esp + 0x24]
movsd xmm0, qword [eax]
mov eax, dword [eax + 8]
movsd qword [ebp + 0x24], xmm0
mov dword [ebp + 0x2c], eax
lock inc dword [edi]
jle 0x44263f
and dword [esi + 4], 0
and dword [esi], 0
jmp 0x442637
mov ecx, dword [esp + 4]
mov eax, dword [esp]
mov dword [esi + 8], ecx
mov ecx, dword [esp + 0x24]
mov dword [esi + 4], eax
mov dword [esi], 1
mov edx, dword [ecx + 4]
mov ecx, dword [esp + 8]
call fcn.004a8f7f
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
ud2

Function at 0x4430dc
Capabilities:
Get system information on windows

Disassembly:
push esi
sub esp, 0x24
mov esi, esp
xorps xmm0, xmm0
and dword [esi + 0x20], 0
movups xmmword [esi + 0x10], xmm0
movups xmmword [esi], xmm0
push esi
call sub.KERNEL32.dll_GetSystemInfo
mov eax, dword [esi + 0x14]
add esp, 0x24
pop esi
ret
Function at 0x44346d
Capabilities:
Create pipe

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x24
mov esi, dword [esp + 0x38]
lea ebp, [esp + 8]
xor ebx, ebx
xor edi, edi
mov dword [esp], ecx
mov dword [esp + 4], edx
mov dword [ebp], edx
add esi, edx
mov dword [ebp + 4], esi
and word [ebp + 8], 0
mov ecx, ebp
call fcn.004432a9
inc edi
add ebx, 2
cmp ax, 1
je 0x443494
test edi, edi
je 0x4434de
xor ecx, ecx
cmp edi, 0x40000000
setb al
jae 0x4435e7
test ebx, ebx
js 0x4435e7
mov cl, al
mov edx, ebx
add ecx, ecx
mov ebp, ecx
call fcn.00407df2
test eax, eax
jne 0x4434e1
mov ecx, ebp
mov edx, ebx
call fcn.004c8580
ud2
push 2
pop eax
mov ecx, dword [esp + 4]
lea ebx, [esp + 0x18]
lea edx, [esp + 8]
mov dword [ebx], eax
mov dword [ebx + 4], edi
and dword [ebx + 8], 0
mov dword [edx], ecx
mov dword [edx + 4], esi
and word [edx + 8], 0
mov ecx, ebx
call fcn.00443249
mov edx, dword [ebx + 8]
cmp edx, dword [ebx + 4]
jne 0x44351d
lea edi, [esp + 0x18]
mov ecx, edi
call fcn.0044343a
mov edx, dword [edi + 8]
mov eax, dword [esp + 0x18]
lea ecx, [esp + 8]
and word [eax + edx*2], 0
inc edx
mov dword [esp + 0x20], edx
mov dword [ecx + 8], edx
movsd xmm0, qword [esp + 0x18]
movsd qword [ecx], xmm0
call fcn.004433e2
mov ebx, eax
movzx eax, byte [esp + 0x3c]
mov edi, edx
mov ecx, 0x10000
shl eax, 0x13
or eax, 0x40000003
push dword [esp + 0x40]
push 0
push ecx
push ecx
push 0xff
push 8
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
cmp eax, 0xffffffff
je 0x4435a5
mov ecx, eax
call fcn.00441fcd
lea ebp, [esp + 8]
mov edx, eax
mov ecx, ebp
push 0x4ed828
call fcn.004a4865
pop eax
mov eax, dword [ebp]
cmp eax, 2
jne 0x4435ba
movsd xmm0, qword [esp + 0xc]
mov edx, dword [esp]
movsd qword [edx + 4], xmm0
jmp 0x4435d4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [esp]
and dword [edx + 4], 0
mov dword [edx + 8], eax
push 2
pop eax
jmp 0x4435d4
mov ecx, dword [esp + 0xc]
mov ebp, dword [esp]
mov edx, dword [esp + 0x10]
mov esi, dword [esp + 0x14]
mov dword [ebp + 8], edx
mov dword [ebp + 4], ecx
mov edx, ebp
mov dword [ebp + 0xc], esi
mov dword [edx], eax
mov ecx, ebx
mov edx, edi
call fcn.0044344a
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.00425d50
ud2
Function at 0x443f66
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov ebp, dword [0x53cb0c]
mov esi, ecx
test ebp, ebp
jne 0x444064
push str.api_ms_win_core_synch_l1_2_0.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x443fbb
mov ebx, eax
push str.WaitOnAddress
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x443fbb
mov edi, eax
push str.WakeByAddressSingle
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x443fbb
mov ebx, eax
mov dword [esp], 0
jmp 0x444025
push 0x4e150c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x444072
mov edi, eax
push str.NtCreateKeyedEvent
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x444072
mov ebp, eax
push str.NtReleaseKeyedEvent
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x444072
mov ebx, eax
push str.NtWaitForKeyedEvent
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x444072
mov edi, eax
mov dword [esp], ebx
lea eax, [esp + 4]
push 0
push 0
push 0xc0000000
push eax
call ebp
test eax, eax
jne 0x444072
mov ebx, dword [esp + 4]
push 0xc
pop ecx
call fcn.00440be3
mov ebp, eax
mov eax, dword [esp]
mov dword [ebp], eax
mov dword [ebp + 4], edi
mov dword [ebp + 8], ebx
xor eax, eax
lock cmpxchg dword [0x53cb0c], ebp
je 0x444064
cmp dword [ebp], 0
mov edi, eax
je 0x444058
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 4
pop edx
mov ecx, ebp
call fcn.00425c30
mov ebp, edi
and dword [esi + 4], 0
mov dword [esi], ebp
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x5b
pop edx
mov ecx, str.parking_lot_requires_either_NT_Keyed_Events__WinXP__or_WaitOnAddress_WakeByAddress__Win8_C:UsersAdministrator.WIN7_2021OVWRCZ.cargo_registry_srcmirrors.ustc.edu.cn_12df342d903acd47parking_lot_core_0.9.8_src_thread_parkerwindowsmod.rs
push 0x4e162c
call fcn.004c9739
pop eax
ud2

Function at 0x444470
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
sub esp, 0x1c
mov ecx, 0x53c020
call fcn.0049f0b5
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jbe 0x444493
cmp dword [eax + 4], 0
mov esi, eax
jne 0x44450e
mov ecx, 0x53c020
call fcn.0049f0b5
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
je 0x444513
mov esi, eax
test eax, eax
jne 0x4444d5
push 0x20
pop ecx
call fcn.00440be3
mov dword [eax], 0x53c020
and dword [eax + 4], 0
mov ecx, 0x53c020
mov esi, eax
call fcn.0049f0b5
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov edi, esp
mov ecx, edi
call fcn.00444087
movsd xmm1, qword [edi + 8]
movsd xmm0, qword [edi]
cmp dword [esi + 4], 0
movsd qword [esi + 0xc], xmm1
movsd xmm1, qword [edi + 0x10]
movsd qword [esi + 0x14], xmm1
mov eax, dword [edi + 0x18]
movsd qword [esi + 4], xmm0
mov dword [esi + 0x1c], eax
je 0x44450e
lock dec dword [0x53cb04]
add esi, 4
jmp 0x444515
xor esi, esi
mov eax, esi
add esp, 0x1c
pop esi
pop edi
ret
Function at 0x44ac44
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xc0
mov esi, ecx
mov ecx, 0x53c030
call fcn.0049f0b5
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jbe 0x44ac7b
cmp dword [eax + 4], 0
mov edi, eax
je 0x44ac7b
add edi, 4
jmp 0x44adb5
mov ecx, 0x53c030
call fcn.0049f0b5
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
je 0x44adb3
mov edi, eax
test eax, eax
jne 0x44acc4
push 8
pop ecx
push 4
pop edx
call fcn.0042fa9d
mov dword [eax], 0x53c030
and dword [eax + 4], 0
mov ecx, 0x53c030
mov edi, eax
call fcn.0049f0b5
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test esi, esi
je 0x44acdc
mov ebx, dword [esi]
and dword [esi], 0
test ebx, ebx
jne 0x44ada5
xor ecx, ecx
call fcn.004489b3
lea esi, [esp + 0x10]
xorps xmm0, xmm0
mov dword [esp + 0xc], edi
mov ecx, esi
movaps xmmword [esi + 0x10], xmm0
movaps xmmword [esi], xmm0
call fcn.0044ae97
test eax, eax
jne 0x44adbf
lea ebx, [esp + 0x10]
lea esi, [esp + 0x58]
movaps xmm0, xmmword [ebx]
movaps xmm1, xmmword [ebx + 0x10]
mov ecx, esi
call fcn.004489cf
push 0xc
pop eax
lea edx, [esp + 0x88]
mov ecx, eax
mov edi, edx
rep movsd dword es:[edi], dword [esi]
lea edi, [esp + 0x54]
mov ecx, eax
mov esi, edx
rep movsd dword es:[edi], dword [esi]
push 0xd
pop ecx
lea esi, [esp + 0x50]
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
push 8
pop edx
mov ecx, 0x158
call fcn.0042fa9d
mov ebx, eax
xor eax, eax
inc eax
mov dword [ebx], eax
mov dword [ebx + 4], eax
lea eax, [ebx + 8]
push 0x100
push 0
push eax
call fcn.004bae60
add esp, 0xc
lea edi, [ebx + 0x10c]
mov dword [ebx + 0x108], 0x40
push 0xd
pop ecx
lea esi, [esp + 0x10]
mov eax, 0x10000
rep movsd dword es:[edi], dword [esi]
mov dword [ebx + 0x140], eax
mov edi, dword [esp + 0xc]
and dword [ebx + 0x144], 0
mov dword [ebx + 0x148], eax
and dword [ebx + 0x14c], 0
and dword [ebx + 0x150], 0
add edi, 4
mov ecx, dword [edi]
mov dword [edi], ebx
call fcn.004489b3
jmp 0x44adb5
xor edi, edi
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
lea ecx, [esp + 0x88]
mov edx, 0x4e2324
mov dword [ecx], eax
xor eax, eax
mov dword [esp + 0x10], ecx
mov dword [ecx + 4], 0x4e2344
lea ecx, [esp + 0x50]
mov dword [esp + 0x14], 0x44ae55
inc eax
mov dword [ecx], str.could_not_initialize_thread_rng:
mov dword [ecx + 4], eax
and dword [ecx + 0x10], 0
mov dword [ecx + 8], esi
mov dword [ecx + 0xc], eax
call fcn.004c8740
ud2
Function at 0x44c08e
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
mov esi, ecx
mov ecx, 0x53c100
call fcn.0049f0b5
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jbe 0x44c0b3
cmp dword [eax + 4], 0
je 0x44c0b3
add eax, 8
jmp 0x44c11d
mov ecx, 0x53c100
call fcn.0049f0b5
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
je 0x44c10a
mov edi, eax
test eax, eax
jne 0x44c0f8
push 0xc
pop ecx
push 4
pop edx
call fcn.004997bd
mov dword [eax], 0x53c100
and dword [eax + 4], 0
mov ecx, 0x53c100
mov edi, eax
call fcn.0049f0b5
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test esi, esi
je 0x44c10e
mov ecx, dword [esi]
and dword [esi], 0
test ecx, ecx
je 0x44c110
mov ecx, dword [esi + 4]
jmp 0x44c110
xor eax, eax
jmp 0x44c11d
xor ecx, ecx
mov dword [edi + 4], 1
lea eax, [edi + 8]
mov dword [edi + 8], ecx
pop esi
pop edi
ret
Function at 0x44d7c4
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
push ebx
push edi
push esi
mov esi, ecx
mov ecx, 0x53c040
call fcn.0049f0b5
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jbe 0x44d7ee
cmp dword [eax + 4], 0
je 0x44d7ee
add eax, 8
jmp 0x44d87a
mov ecx, 0x53c040
call fcn.0049f0b5
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
je 0x44d878
mov edi, eax
test eax, eax
jne 0x44d833
push 0x14
pop ecx
push 4
pop edx
call fcn.004997bd
mov dword [eax], 0x53c040
and dword [eax + 4], 0
mov ecx, 0x53c040
mov edi, eax
call fcn.0049f0b5
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test esi, esi
je 0x44d854
mov eax, dword [esi]
and dword [esi], 0
test eax, eax
je 0x44d854
movzx eax, word [esi + 0xa]
mov ebp, dword [esi + 4]
mov dl, byte [esi + 8]
mov bl, byte [esi + 9]
mov ecx, dword [esi + 0xc]
mov esi, eax
jmp 0x44d85c
xor ecx, ecx
xor ebx, ebx
xor edx, edx
xor ebp, ebp
mov dword [edi + 4], 1
mov dword [edi + 8], ebp
mov byte [edi + 0xc], dl
mov byte [edi + 0xd], bl
mov word [edi + 0xe], si
lea eax, [edi + 8]
mov dword [edi + 0x10], ecx
jmp 0x44d87a
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x45345c
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push ebp
push ebx
push edi
push esi
mov esi, edx
mov edi, ecx
xor ebx, ebx
mov ebp, ebx
cmp ebx, esi
jae 0x45348d
mov ecx, edi
mov edx, esi
push 0x4e4734
push ebp
call fcn.0043394c
pop ecx
pop ecx
mov ebx, edx
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_SystemFunction036]
add ebx, ebp
test al, al
jne 0x453466
cmp ebp, esi
setb al
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x47a770
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x4a9e80
lea ecx, [ebp - 0x18]
mov edx, dword fs:[0]
cmp eax, 3
mov dword [ebp - 0x18], edx
mov dword fs:[0], ecx
je 0x47a7ae
test eax, eax
jne 0x47a92a
mov ebx, dword [0x53cb98]
test ebx, ebx
je 0x47a92a
mov dword [ebp - 0x20], 0
jmp 0x47a7d7
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x47a808
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x47a97b
dec esi
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x47a7d0
push 0
push esi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x47a7d0
test byte [ebp - 0x20], 1
je 0x47a92a
mov ebx, dword [0x53cb98]
test ebx, ebx
je 0x47a92a
mov dword [ebp - 0x20], 0
jmp 0x47a837
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x47a868
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x47a97b
dec esi
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x47a830
push 0
push esi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x47a830
test byte [ebp - 0x20], 1
je 0x47a92a
mov ebx, dword [0x53cb98]
test ebx, ebx
je 0x47a92a
mov dword [ebp - 0x20], 0
jmp 0x47a897
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x47a8c8
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x47a97b
dec esi
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x47a890
push 0
push esi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x47a890
test byte [ebp - 0x20], 1
je 0x47a92a
mov ebx, dword [0x53cb98]
test ebx, ebx
je 0x47a92a
mov dword [ebp - 0x20], 0
jmp 0x47a8f7
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x47a924
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x47a97b
dec esi
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x47a8f0
push 0
push esi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x47a8f0
test byte [ebp - 0x20], 1
jne 0x47a944
movzx eax, byte [0x537600]
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
mov ebx, dword [0x53cb98]
jmp 0x47a94f
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x47a92a
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x47a97b
dec esi
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x47a94c
push 0
push esi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
call edi
add esp, 4
jmp 0x47a94c
mov dword [ebp - 0x10], 0
mov ecx, 0x4f022c
mov edx, 0x2b
push 0x4ebb2c
call fcn.004c88c0
add esp, 4
ud2
Function at 0x47b310
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
mov eax, dword [0x53c0a0]
test eax, eax
je 0x47b3d3
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jbe 0x47b33c
cmp dword [eax + 4], 0
mov edi, eax
je 0x47b33c
add edi, 8
jmp 0x47b3ce
mov eax, dword [0x53c0a0]
test eax, eax
je 0x47b3e2
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
je 0x47b3cc
mov esi, eax
test eax, eax
jne 0x47b39b
movzx eax, byte [0x53cbf0]
mov ecx, 0x10
mov edx, 4
call fcn.00425bd0
test eax, eax
je 0x47b3fd
mov dword [eax], 0x53c0a0
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0x53c0a0]
test eax, eax
je 0x47b3f1
dec eax
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [esi + 0xc]
cmp dword [esi + 4], 0
lea edi, [esi + 8]
mov dword [esi + 4], 1
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
je 0x47b3ce
test ecx, ecx
je 0x47b3ce
lock dec dword [ecx]
jne 0x47b3ce
call fcn.0047b420
jmp 0x47b3ce
xor edi, edi
mov eax, edi
pop esi
pop edi
ret
mov ecx, 0x53c0a0
call fcn.004cae20
jmp 0x47b320
mov ecx, 0x53c0a0
call fcn.004cae20
jmp 0x47b34a
mov ecx, 0x53c0a0
call fcn.004cae20
jmp 0x47b393
mov ecx, 4
mov edx, 0x10
call fcn.004c8580
ud2

Function at 0x47bc50
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
mov eax, dword [0x53c0b0]
test eax, eax
je 0x47bcd4
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jbe 0x47bc6f
cmp byte [eax + 4], 0
mov esi, eax
jne 0x47bcc9
mov eax, dword [0x53c0b0]
test eax, eax
je 0x47bce3
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
je 0x47bcce
mov esi, eax
test eax, eax
jne 0x47bcc3
movzx eax, byte [0x53cbf0]
mov ecx, 8
mov edx, 4
call fcn.00425bd0
test eax, eax
je 0x47bcfb
mov dword [eax], 0x53c0b0
mov byte [eax + 4], 0
mov esi, eax
mov eax, dword [0x53c0b0]
test eax, eax
je 0x47bcef
dec eax
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov word [esi + 4], 1
add esi, 5
jmp 0x47bcd0
xor esi, esi
mov eax, esi
pop esi
ret
mov ecx, 0x53c0b0
call fcn.004cae20
jmp 0x47bc5b
mov ecx, 0x53c0b0
call fcn.004cae20
jmp 0x47bc79
mov ecx, 0x53c0b0
call fcn.004cae20
jmp 0x47bcbb
mov ecx, 4
mov edx, 8
call fcn.004c8580
ud2
Function at 0x47ca30
Capabilities:
Write file on windows

Disassembly:
push edi
push esi
sub esp, 0x34
mov eax, dword [esp + 0x40]
mov esi, ecx
mov ecx, dword [esp + 0x44]
mov edi, edx
mov dword [esp + 8], 0
mov dword [esp + 4], 0x103
lea edx, [esp + 4]
push 0
push 0
push ecx
push eax
push edx
push 0
push 0
push 0
push edi
call dword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x47ca84
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 4]
cmp eax, 0x103
je 0x47caa7
test eax, eax
js 0x47ca93
mov eax, dword [esp + 8]
mov dword [esi + 4], eax
mov al, 4
jmp 0x47ca9f
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov dword [esi + 4], eax
xor eax, eax
mov byte [esi], al
add esp, 0x34
pop esi
pop edi
ret
mov eax, esp
mov dword [esp + 0x1c], 0x4eb388
mov dword [esp + 0x20], 1
mov dword [esp + 0x2c], 0
mov dword [esp + 0xc], 0
mov byte [esp + 0x10], 0
lea ecx, [esp + 0xc]
lea edx, [esp + 0x14]
mov dword [esp + 0x24], eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x28], 0
push eax
push ecx
push edx
call fcn.0047ad20
add esp, 0xc
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
call fcn.0047ae70
mov ecx, 7
int 0x29
ud2
Function at 0x47d0f0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
mov eax, dword [0x53c090]
test eax, eax
je 0x47d188
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jbe 0x47d116
cmp dword [eax + 4], 0
je 0x47d116
add eax, 8
pop esi
ret
mov eax, dword [0x53c090]
test eax, eax
je 0x47d197
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
je 0x47d184
mov esi, eax
test eax, eax
jne 0x47d16d
movzx eax, byte [0x53cbf0]
mov ecx, 0x10
mov edx, 4
call fcn.00425bd0
test eax, eax
je 0x47d1b2
mov dword [eax], 0x53c090
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0x53c090]
test eax, eax
je 0x47d1a6
dec eax
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [esi + 4], 1
mov dword [esi + 8], 0
lea eax, [esi + 8]
mov byte [esi + 0xc], 0
pop esi
ret
xor eax, eax
pop esi
ret
mov ecx, 0x53c090
call fcn.004cae20
jmp 0x47d0ff
mov ecx, 0x53c090
call fcn.004cae20
jmp 0x47d120
mov ecx, 0x53c090
call fcn.004cae20
jmp 0x47d165
mov ecx, 4
mov edx, 0x10
call fcn.004c8580
ud2