joyce8/EMBER2024-capa huggingface dataset:
Function at 0x53add968
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 8], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.53ad4780
xor eax, eax
push ebp
push 0x53addab3
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 1
cmp dword [edi], 0
je 0x53add9b3
push 0x4021c
mov eax, dword [edi]
push eax
call sub.kernel32.dll_IsBadReadPtr
test eax, eax
je 0x53adda8b
push 0x53addacc
lea edx, [ebp - 0x2c]
mov eax, dword [ebp - 4]
call fcn.53add824
push dword [ebp - 0x2c]
push 0x53addae0
lea eax, [ebp - 8]
mov edx, 3
call fcn.53ad4694
push 1
lea eax, [ebp - 0x1c]
push eax
call sub.advapi32.dll_InitializeSecurityDescriptor
push 0
push 0
push 0xffffffffffffffff
lea eax, [ebp - 0x1c]
push eax
call sub.advapi32.dll_SetSecurityDescriptorDacl
mov dword [ebp - 0x28], 0xc
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], 0xffffffff
mov eax, dword [ebp - 8]
call fcn.53ad4790
push eax
push 0x4021c
push 0
push 4
lea eax, [ebp - 0x28]
push eax
push 0xffffffffffffffff
call sub.kernel32.dll_CreateFileMappingA
mov esi, eax
test esi, esi
jne 0x53adda75
lea eax, [ebp - 0x30]
mov ecx, 0x53addaec
mov edx, dword [ebp - 8]
call fcn.53ad4618
mov eax, dword [ebp - 0x30]
push eax
call fcn.53ad75b4
lea eax, [ebp - 8]
push eax
mov ecx, 0x7fffffff
mov edx, 8
mov eax, dword [ebp - 8]
call fcn.53ad47f0
mov eax, dword [ebp - 8]
call fcn.53ad4790
push eax
push 0x4021c
push 0
push 4
push 0
push 0xffffffffffffffff
call sub.kernel32.dll_CreateFileMappingA
mov esi, eax
push 0
push 0
push 0
push 6
push esi
call sub.kernel32.dll_MapViewOfFile
mov dword [edi], eax
cmp dword [edi], 0
setne bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x53addaba
lea eax, [ebp - 0x30]
mov edx, 2
call fcn.53ad4348
lea eax, [ebp - 8]
mov edx, 2
call fcn.53ad4348
ret
Function at 0x53ade494
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
add esp, 0xfffffff0
call fcn.53ade490
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.kernel32.dll_GetTickCount_1
mov ebx, eax
push 0x64
call sub.kernel32.dll_Sleep_1
call fcn.53ade490
sub eax, dword [esp]
sbb edx, dword [esp + 4]
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
call sub.kernel32.dll_GetTickCount_1
mov ecx, eax
sub ecx, ebx
cmp dword [esp + 0xc], 0
jne 0x53ade4e2
cmp dword [esp + 8], 0x2faf080
jb 0x53ade4ed
jmp 0x53ade4e4
jl 0x53ade4ed
cmp ecx, 0x32
jb 0x53ade4ed
xor eax, eax
jmp 0x53ade4ef
mov al, 1
add esp, 0x10
pop ebx
ret
Function at 0x53ae31a8
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
xor eax, eax
push ebp
push 0x53ae324e
push dword fs:[eax]
mov dword fs:[eax], esp
jmp 0x53ae31c9
push 0x493e0
call sub.kernel32.dll_Sleep_1
call sub.kernel32.dll_GetTickCount_1
cmp eax, 0x493e0
jb 0x53ae31bf
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [0x53b02ecc]
sub eax, dword [edx + 0x208]
cmp eax, 0x493e0
jl 0x53ae31bf
push dword [0x53b069a4]
push 0x53ae3264
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [0x53b02ecc]
sub eax, dword [edx + 0x208]
mov ecx, 0x3e8
xor edx, edx
div ecx
lea edx, [ebp - 8]
call fcn.53ad6c04
push dword [ebp - 8]
lea eax, [ebp - 4]
mov edx, 3
call fcn.53ad4694
mov eax, dword [ebp - 4]
push eax
call fcn.53ad75b4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x53ae3255
lea eax, [ebp - 8]
mov edx, 2
call fcn.53ad4348
ret

Function at 0x53ae3270
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, dword [ebp + 8]
call fcn.53ad4780
mov eax, dword [ebp + 0xc]
call fcn.53ad4780
xor eax, eax
push ebp
push 0x53ae32ec
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp + 0xc], 0
jne 0x53ae32b2
push 5
push 0
mov eax, dword [ebp + 8]
call fcn.53ad4790
push eax
call sub.kernel32.dll_MoveFileExA
cmp eax, 1
sbb ebx, ebx
inc ebx
jmp 0x53ae32d1
push 5
mov eax, dword [ebp + 0xc]
call fcn.53ad4790
push eax
mov eax, dword [ebp + 8]
call fcn.53ad4790
push eax
call sub.kernel32.dll_MoveFileExA
cmp eax, 1
sbb ebx, ebx
inc ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x53ae32f3
lea eax, [ebp + 8]
mov edx, 2
call fcn.53ad4348
ret
Function at 0x53ae32fc
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x53ae3304
xor eax, eax
push ebp
push 0x53ae347a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, dword [0x53b03214]
mov edx, dword [edx]
call fcn.53ad451c
mov eax, dword [ebp - 4]
call fcn.53ad5f20
test al, al
jne 0x53ae3355
lea eax, [ebp - 8]
mov edx, dword [0x53b03230]
mov edx, dword [edx]
call fcn.53ad451c
mov eax, dword [ebp - 8]
call fcn.53ad5f20
test al, al
je 0x53ae33e9
lea eax, [ebp - 0xc]
mov edx, dword [0x53b031bc]
mov edx, dword [edx]
call fcn.53ad451c
mov eax, dword [ebp - 0xc]
mov edx, dword [0x53b06990]
call fcn.53ad790c
push 4
push 0
lea edx, [ebp - 0x10]
mov eax, dword [0x53b06990]
call fcn.53ad732c
mov eax, dword [ebp - 0x10]
call fcn.53ad4790
push eax
call sub.kernel32.dll_MoveFileExA
lea edx, [ebp - 0x14]
mov eax, dword [0x53b06990]
call fcn.53ad73a8
mov edx, dword [ebp - 0x14]
mov eax, dword [0x53b06994]
call fcn.53ad4728
je 0x53ae33e9
lea edx, [ebp - 0x18]
mov eax, dword [0x53b06990]
call fcn.53ad73a8
mov ecx, dword [ebp - 0x18]
mov eax, dword [0x53b069cc]
mov edx, dword [eax]
mov eax, dword [0x53b069bc]
call fcn.53adb718
lea edx, [ebp - 0x1c]
mov eax, dword [0x53b06990]
call fcn.53ad73a8
mov edx, dword [ebp - 0x1c]
mov eax, 0x53b06994
call fcn.53ad4378
cmp byte [0x53b06976], 0
jne 0x53ae3419
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
mov eax, dword [0x53b06994]
call fcn.53ad4790
push eax
call sub.kernel32.dll_CreateFileA
mov dword [0x53b02ec0], eax
push dword [0x53b069a4]
push 0x53ae3490
lea edx, [ebp - 0x24]
mov eax, dword [0x53b02ec0]
call fcn.53ad6c04
push dword [ebp - 0x24]
push 0x53ae34a4
call sub.kernel32.dll_GetCurrentProcessId
lea edx, [ebp - 0x28]
call fcn.53ad6c04
push dword [ebp - 0x28]
lea eax, [ebp - 0x20]
mov edx, 5
call fcn.53ad4694
mov eax, dword [ebp - 0x20]
push eax
call fcn.53ad75b4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x53ae3481
lea eax, [ebp - 0x28]
mov edx, 0xa
call fcn.53ad4348
ret

Function at 0x53ae5cfc
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x53ae5d35
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.53ad4414
jmp 0x53ae5d3e
mov eax, ebx
mov edx, esi
call fcn.53ad4378
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x53ae5d48
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x53ae5d6a
movzx eax, byte [esp]
jmp 0x53ae5d6c
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x53ae63fc
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x53ae6274
mov eax, dword [0x53b0321c]
cmp byte [eax], 0
je 0x53ae6478
mov eax, dword [0x53b0314c]
call fcn.53ad30f4
call fcn.53ad2dbc
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.53ae51bc
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x53ae64c0
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x53ae64ae
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x53b03124]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x53b067f0]
call fcn.53ad4ea8
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret
Function at 0x450be0
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
mov edi, edi
push esi
mov esi, dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
push 0xfffffffffffffffe
push 0xfffffffffffffffe
push 0x551d48
mov dword [ebx], 0
call esi
cmp eax, 0xfffffffe
jne 0x450c6d
push edi
push 0
push 1
push 0x553a00
call esi
cmp eax, 1
jne 0x450c2a
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push 1
call edi
push 0
push 1
push 0x553a00
call esi
cmp eax, 1
je 0x450c16
push 0xfffffffffffffffe
push 0xfffffffffffffffe
push 0x551d48
call esi
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov esi, eax
cmp esi, 0xfffffffe
jne 0x450c57
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov esi, eax
cmp esi, 0xffffffff
je 0x450c57
push esi
push 0x551d48
call edi
push 0
push 0x553a00
call edi
pop edi
cmp esi, 0xffffffff
jne 0x450c6d
mov eax, 0x8007000e
pop esi
ret
mov eax, dword [0x551d48]
test eax, eax
jl 0x450c91
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x450c91
inc dword [eax + 0x128]
mov dword [ebx], 1
xor eax, eax
pop esi
ret
push 0x12c
call sub.msvcrt.dll_malloc
mov esi, eax
add esp, 4
test esi, esi
je 0x450c66
push 0x12c
push 0
push esi
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [esi + 0x128], 1
mov dword [ebx], 1
mov eax, dword [0x551d48]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
xor eax, eax
pop esi
ret

Function at 0x450d70
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x551d48]
test eax, eax
jge 0x450d7d
xor eax, eax
jmp 0x450d84
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
xor ecx, ecx
lea edx, [eax + 0x20]
lea esp, [esp]
cmp dword [ecx*4 + 0x42d1f4], edi
jne 0x450d9e
cmp dword [edx], 0
jne 0x450db3
inc ecx
add edx, 8
cmp ecx, 0xf
jb 0x450d90
mov ecx, dword [eax + 0x1c]
push 0x10
push edi
call fcn.00547721
ret
mov edx, dword [eax + ecx*8 + 0x20]
test edx, edx
je 0x450dd5
push esi
mov esi, dword [edx]
mov dword [eax + ecx*8 + 0x20], esi
test esi, esi
pop esi
jne 0x450dcf
mov dword [eax + ecx*8 + 0x24], 0
mov dword [edx], 0xfefefefe
cmp ecx, 0xf
jb 0x450de6
mov ecx, dword [eax + 0x1c]
push 0x10
push edi
call fcn.00547721
ret
mov eax, edx
ret
Function at 0x456130
Capabilities:
Get thread local storage value

Disassembly:
test esi, esi
je 0x456184
mov eax, dword [0x551d48]
push ebx
push edi
test eax, eax
jge 0x456143
xor ebx, ebx
jmp 0x45614c
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov edi, dword [esi + 4]
mov eax, dword [edi*4 + 0x42d1f4]
push eax
push 0xfe
push esi
call sub.msvcrt.dll_memset
lea ecx, [ebx + edi*8 + 0x24]
mov dword [esi], 0
mov eax, dword [ecx]
add esp, 0xc
test eax, eax
je 0x45617c
pop edi
mov dword [eax], esi
mov dword [ecx], esi
pop ebx
ret
mov dword [ebx + edi*8 + 0x20], esi
pop edi
mov dword [ecx], esi
pop ebx
ret
Function at 0x45e530
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov ebx, eax
mov eax, dword [ebp + 8]
mov ecx, 0x9e3779b9
xor esi, esi
push edi
mov dword [ebp - 4], eax
mov edi, ecx
cmp eax, 0xc
jb 0x45e5dc
mov eax, 0xaaaaaaab
mul dword [ebp + 8]
shr edx, 3
mov edi, edi
add esi, dword [ebx + 8]
add ecx, dword [ebx + 4]
mov eax, dword [ebx]
sub eax, esi
sub eax, ecx
add eax, edi
sub ecx, esi
mov edi, esi
shr edi, 0xd
xor eax, edi
sub ecx, eax
mov edi, eax
shl edi, 8
xor ecx, edi
sub esi, ecx
sub esi, eax
mov edi, ecx
shr edi, 0xd
xor esi, edi
sub eax, esi
sub eax, ecx
mov edi, esi
shr edi, 0xc
xor eax, edi
sub ecx, esi
sub ecx, eax
mov edi, eax
shl edi, 0x10
xor ecx, edi
sub dword [ebp - 4], 0xc
sub esi, ecx
sub esi, eax
mov edi, ecx
shr edi, 5
xor esi, edi
sub eax, esi
sub eax, ecx
mov edi, esi
shr edi, 3
xor eax, edi
sub ecx, esi
mov edi, eax
shl eax, 0xa
sub ecx, edi
xor ecx, eax
sub esi, ecx
mov eax, ecx
sub esi, edi
shr eax, 0xf
xor esi, eax
add ebx, 0xc
sub edx, 1
jne 0x45e560
mov eax, dword [ebp + 8]
add esi, eax
mov eax, dword [ebp - 4]
dec eax
cmp eax, 0xa
ja case.default.0x45e5e7
jmp dword [eax*4 + 0x45e6b8]
movzx edx, byte [ebx + 0xa]
shl edx, 0x18
add esi, edx
movzx eax, byte [ebx + 9]
shl eax, 0x10
add esi, eax
movzx edx, byte [ebx + 8]
shl edx, 8
add esi, edx
movzx eax, byte [ebx + 7]
shl eax, 0x18
add ecx, eax
movzx edx, byte [ebx + 6]
shl edx, 0x10
add ecx, edx
movzx eax, byte [ebx + 5]
shl eax, 8
add ecx, eax
movzx edx, byte [ebx + 4]
add ecx, edx
movzx eax, byte [ebx + 3]
shl eax, 0x18
add edi, eax
movzx edx, byte [ebx + 2]
shl edx, 0x10
add edi, edx
movzx eax, byte [ebx + 1]
shl eax, 8
add edi, eax
movzx edx, byte [ebx]
add edi, edx
sub edi, esi
sub edi, ecx
sub ecx, esi
mov eax, esi
shr eax, 0xd
xor edi, eax
sub ecx, edi
mov edx, edi
shl edx, 8
xor ecx, edx
sub esi, ecx
sub esi, edi
mov eax, ecx
shr eax, 0xd
xor esi, eax
sub edi, esi
sub edi, ecx
mov edx, esi
shr edx, 0xc
xor edi, edx
sub ecx, esi
sub ecx, edi
mov eax, edi
shl eax, 0x10
xor ecx, eax
sub esi, ecx
sub esi, edi
mov edx, ecx
shr edx, 5
xor esi, edx
mov eax, esi
sub edi, eax
sub edi, ecx
mov edx, eax
shr edx, 3
xor edi, edx
sub ecx, eax
sub ecx, edi
mov edx, edi
shl edx, 0xa
xor ecx, edx
sub eax, ecx
sub eax, edi
pop edi
shr ecx, 0xf
pop esi
xor eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4833d0
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, eax
mov eax, dword [esi + 0x3688]
push edi
mov dword [ebp - 4], eax
xor edi, edi
lea ebx, [ebp - 0x14]
fldz
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
mov eax, dword [esi + 0x3688]
sub esp, 8
fstp qword [esp]
push 0
push 0
push edi
push edx
push eax
push ebx
push esi
call fcn.00508980
test eax, eax
jl 0x483552
inc edi
add ebx, 4
cmp edi, 4
jb 0x4833eb
mov eax, dword [ebp - 4]
inc dword [eax + 0x10]
mov eax, dword [0x551d48]
xor ebx, ebx
cmp eax, ebx
jge 0x483433
xor eax, eax
jmp 0x48343a
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp dword [eax + 0x14], ebx
je 0x483460
mov ecx, dword [eax + 0x14]
cmp ecx, ebx
jne 0x48344a
xor eax, eax
jmp 0x48346c
mov edx, dword [ecx]
mov dword [eax + 0x14], edx
cmp edx, ebx
jne 0x483456
mov dword [eax + 0x18], ebx
mov dword [ecx], 0xfefefefe
mov eax, ecx
jmp 0x48346c
mov ecx, dword [eax + 0x10]
push 0x10
push 0x44
call fcn.00547721
cmp eax, ebx
je 0x4834a7
or ecx, 0xffffffff
xor edx, edx
mov dword [eax + 0x10], ecx
mov dword [eax + 0x20], ecx
mov dword [eax], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0x3c], ebx
mov dword [eax + 4], ebx
mov word [eax + 0x40], dx
mov dword [eax + 0xc], ebx
mov word [eax + 0x42], dx
mov dword [eax + 0x14], ebx
mov dword [eax + 0x18], ebx
mov dword [eax + 0x1c], ebx
mov dword [eax + 0x24], ebx
mov dword [eax + 0x34], ebx
mov dword [eax + 0x38], ebx
mov ecx, eax
jmp 0x4834a9
xor ecx, ecx
mov eax, dword [ebp + 8]
mov dword [eax], ecx
cmp ecx, ebx
jne 0x4834c0
mov eax, 0x8007000e
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov edi, dword [ebp + 0xc]
push ebx
mov eax, edi
and eax, 0xfffff
push ecx
or eax, 0x10000000
mov edx, edi
mov ecx, edi
call fcn.0050a980
cmp eax, ebx
mov dword [ebp - 4], eax
jge 0x483500
mov ecx, dword [ebp + 8]
mov esi, dword [ecx]
cmp esi, ebx
je 0x483552
call fcn.0050a890
call fcn.0050cb90
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [esi + 0xb828]
mov edx, dword [ebp + 8]
mov ecx, dword [edx]
mov edx, dword [eax + 0x34]
mov dword [ecx + 0x34], edx
mov eax, dword [eax + 0x38]
mov dword [ecx + 0x38], eax
xor eax, eax
cmp edi, ebx
jbe 0x483550
lea ecx, [ecx]
mov edi, dword [ecx + 4]
mov edx, dword [ebp + eax*4 - 0x14]
mov dword [edi + eax*4], edx
mov edi, dword [esi + 0xb828]
mov edi, dword [edi + 0xc]
mov edi, dword [edi + eax*4]
mov ebx, dword [ecx + 0xc]
mov dword [ebx + eax*4], edi
mov edi, dword [esi + 0xb828]
mov edi, dword [edi + 0xc]
mov dword [edi + eax*4], edx
inc eax
cmp eax, dword [ebp + 0xc]
jb 0x483520
xor ebx, ebx
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x48ec70
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, ecx
xor eax, eax
mov dword [ebx], 0x43fc88
mov dword [ebp - 4], eax
cmp dword [ebx + 0xb8d4], eax
jbe 0x48ecf0
push esi
push edi
mov edi, edi
mov ecx, dword [ebx + 0xb8c8]
mov esi, dword [ecx + eax*4]
test esi, esi
je 0x48ecdf
call fcn.0050a890
mov eax, dword [0x551d48]
test eax, eax
jl 0x48ecdf
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
test edi, edi
je 0x48ecdf
push 0x44
push 0xfe
push esi
call sub.msvcrt.dll_memset
mov dword [esi], 0
mov eax, dword [edi + 0x18]
add esp, 0xc
test eax, eax
je 0x48ecd9
mov dword [eax], esi
jmp 0x48ecdc
mov dword [edi + 0x14], esi
mov dword [edi + 0x18], esi
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp eax, dword [ebx + 0xb8d4]
jb 0x48ec90
pop edi
pop esi
mov edx, dword [ebx + 0xb8c8]
push edx
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
mov eax, dword [ebx + 0xb8cc]
push eax
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
mov ecx, dword [ebx + 0xb8d0]
push ecx
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
mov edx, dword [ebx + 0xb8dc]
push edx
call sub.msvcrt.dll_free
mov eax, dword [ebx + 0xb834]
push eax
mov dword [ebx], 0x43e968
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
mov ecx, dword [ebx + 0xb84c]
push ecx
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
mov eax, dword [ebx + 0xb8c0]
add esp, 0x18
test eax, eax
je 0x48ed5d
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
mov dword [ebx + 0xb8c0], 0
mov ecx, ebx
call fcn.004f92b0
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4a82d0
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x94
push ebx
push esi
xor ebx, ebx
push edi
xor edi, edi
mov dword [ebp - 8], ebx
mov dword [ebp - 4], edi
mov dword [ebp - 0x90], edi
mov dword [ebp - 0x8c], edi
mov dword [ebp - 0x88], edi
mov dword [ebp - 0x54], edi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x10], edi
cmp byte [ebp + 0xc], bl
je 0x4a833f
push 8
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
cmp eax, edi
je 0x4a832c
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
mov dword [eax], ecx
mov dword [eax + 4], edx
mov dword [ebp - 4], eax
jmp 0x4a8342
lea esi, [ebp - 0x90]
mov dword [ebp - 4], edi
call fcn.00452460
jmp 0x4a83f9
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 4]
lea eax, [ebp - 8]
push eax
mov eax, dword [ecx + 0x20]
mov ecx, dword [ecx + 0x24]
push edx
and eax, 0xc3
push eax
push ecx
lea ebx, [ebp - 0x90]
call fcn.00452500
test eax, eax
jge 0x4a8375
mov esi, ebx
call fcn.00452460
mov ebx, dword [ebp - 8]
jmp 0x4a83f7
mov ebx, dword [ebp - 8]
mov edx, dword [ebx]
mov eax, dword [edx + 0x10]
push ebx
call eax
mov edi, eax
mov eax, dword [0x551d48]
mov dword [ebp + 0xc], edi
test eax, eax
jl 0x4a83ec
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4a83ec
mov ecx, dword [eax + 0x1c]
push 1
push edi
call fcn.00547721
mov esi, eax
test esi, esi
je 0x4a83ec
mov ecx, dword [ebx]
mov edx, dword [ecx + 0xc]
push edi
push ebx
call edx
push eax
push esi
call sub.msvcrt.dll_memcpy
mov eax, dword [ebx]
mov ecx, dword [eax + 8]
add esp, 0xc
push ebx
call ecx
xor ebx, ebx
lea edi, [ebx + 0x48]
call fcn.00450d70
test eax, eax
je 0x4a83ec
mov edx, dword [ebp + 8]
push esi
add edx, 0x160
push edx
mov edx, dword [ebp + 0xc]
call fcn.004a9f90
mov edi, eax
test edi, edi
jne 0x4a8426
lea esi, [ebp - 0x90]
call fcn.00452460
xor edi, edi
mov ecx, dword [ebp - 4]
mov eax, dword [ebp + 8]
push ecx
mov byte [eax + 0x189], 1
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
add esp, 4
cmp ebx, edi
je 0x4a841b
mov edx, dword [ebx]
mov eax, dword [edx + 8]
push ebx
call eax
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
push ecx
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
add esp, 4
lea esi, [ebp - 0x90]
call fcn.00452460
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4aa0d0
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [0x551d48]
test eax, eax
jge 0x4aa0e2
xor eax, eax
jmp 0x4aa0e9
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [eax]
push 0x10
push 0x18
call fcn.00547721
test eax, eax
je 0x4aa12b
mov ecx, dword [ebp + 0xc]
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
mov dword [eax + 0x10], 0
mov dword [eax], 0x441a70
mov dword [eax + 4], 2
mov dword [eax + 0x14], 0x10
mov dword [eax + 0x14], ecx
pop ebp
ret 8
mov edx, dword [ebp + 8]
mov byte [edx + 0x188], 1
xor eax, eax
pop ebp
ret 8
Function at 0x4aa2f0
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [0x551d48]
push esi
xor esi, esi
cmp eax, esi
jge 0x4aa305
xor eax, eax
jmp 0x4aa30c
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [eax]
push 0x10
push 0x30
call fcn.00547721
cmp eax, esi
je 0x4aa366
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov dword [eax + 8], esi
mov dword [eax + 0xc], esi
mov dword [eax + 0x10], esi
mov dword [eax], 0x441ad0
mov dword [eax + 4], 6
mov dword [eax + 0x14], 0xf
mov dword [eax + 0x2c], 1
mov dword [eax + 0x14], ecx
mov ecx, dword [ebp + 0x14]
mov dword [eax + 0x18], edx
mov edx, dword [ebp + 0x18]
mov dword [eax + 0x20], ecx
mov dword [eax + 0x24], edx
mov dword [eax + 0x28], edi
cmp edi, esi
jbe 0x4aa372
mov dword [eax + 0x2c], edi
pop esi
pop ebp
ret 0x14
mov eax, dword [ebp + 8]
mov byte [eax + 0x188], 1
xor eax, eax
pop esi
pop ebp
ret 0x14