joyce8/EMBER2024-capa huggingface dataset:
Function at 0x442590
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51ee50
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x56d370]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esi], vtable.plat::EventManager.0
mov eax, dword [esi + 0x10]
cmp eax, dword [esi + 0x14]
je 0x4425f0
add dword [esi + 8], 0xfffffffc
mov edx, dword [esi + 0x14]
mov edi, dword [edx - 4]
lea eax, [edx - 4]
push 0
push edx
push eax
call fcn.00481f00
add dword [esi + 0x14], 0xfffffffc
add esp, 0xc
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 4]
mov eax, dword [esi + 0x10]
cmp eax, dword [esi + 0x14]
jne 0x4425c4
push dword [esi + 0x1c]
push dword [0x5727e8]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [esi + 0x20]
mov dword [esi + 0x20], 0
test eax, eax
je 0x442614
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi + 0x10]
test eax, eax
je 0x44265c
mov ecx, dword [esi + 0x18]
sub ecx, eax
and ecx, 0xfffffffc
cmp ecx, 0x1000
jb 0x44263d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4426b5
mov eax, edx
push ecx
push eax
call fcn.0047f544
mov dword [esi + 0x10], 0
add esp, 8
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x4426a4
mov ecx, dword [esi + 0xc]
sub ecx, eax
and ecx, 0xfffffffc
cmp ecx, 0x1000
jb 0x442685
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4426b5
mov eax, edx
push ecx
push eax
call fcn.0047f544
mov dword [esi + 4], 0
add esp, 8
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
call fcn.0048ad3d
int3
Function at 0x4426c0
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51ee70
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x56d370]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esi], vtable.plat::EventManager.0
mov eax, dword [esi + 0x10]
mov dword [ebp - 4], 0
cmp eax, dword [esi + 0x14]
je 0x44272c
nop dword [eax + eax]
add dword [esi + 8], 0xfffffffc
mov edx, dword [esi + 0x14]
mov edi, dword [edx - 4]
lea eax, [edx - 4]
push 0
push edx
push eax
call fcn.00481f00
add dword [esi + 0x14], 0xfffffffc
add esp, 0xc
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 4]
mov eax, dword [esi + 0x10]
cmp eax, dword [esi + 0x14]
jne 0x442700
push dword [esi + 0x1c]
push dword [0x5727e8]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [esi + 0x20]
mov dword [esi + 0x20], 0
test eax, eax
je 0x442750
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi + 0x10]
test eax, eax
je 0x44279c
mov ecx, dword [esi + 0x18]
sub ecx, eax
and ecx, 0xfffffffc
cmp ecx, 0x1000
jb 0x44277d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x44280a
mov eax, edx
push ecx
push eax
call fcn.0047f544
mov dword [esi + 0x10], 0
add esp, 8
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x4427e4
mov ecx, dword [esi + 0xc]
sub ecx, eax
and ecx, 0xfffffffc
cmp ecx, 0x1000
jb 0x4427c5
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x44280a
mov eax, edx
push ecx
push eax
call fcn.0047f544
mov dword [esi + 4], 0
add esp, 8
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
test byte [ebp + 8], 1
je 0x4427f5
push 0x28
push esi
call fcn.0047f544
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
call fcn.0048ad3d
int3
Function at 0x448330
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51f6ee
mov eax, dword fs:[0]
push eax
sub esp, 0x15c
mov eax, dword [0x56d370]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x164], esi
mov dword [ebp - 0x168], esi
mov dword [esi], vtable.plat::TimerManager.0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
cmp byte [ebp + 8], 0
mov dword [ebp - 4], 0
mov dword [esi + 0x28], 0
jne 0x4483c5
push dword [0x572824]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0x4483ff
push dword [0x572824]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
mov dword [esi + 4], eax
push dword [0x572824]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0047fc61
mov esp, ebp
pop ebp
ret 4
push 0x13
push str.c:ent_slave_rootworkspace_vncconnect_buildsclients_vnc_7.12.xlabelcon_windows_64_rvcore_baseplat_timermanager.cxx
push str.nested___thrInst
lea ecx, [ebp - 0x160]
call fcn.00428e20
push eax
call fcn.00428ea0
int3

Function at 0x448470
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51f720
mov eax, dword fs:[0]
push eax
sub esp, 0x154
mov eax, dword [0x56d370]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 8], 0
mov dword [esi], vtable.plat::TimerManager.0
je 0x4484c0
nop dword [eax + eax]
push dword [esi + 8]
mov ecx, esi
call fcn.00448ab0
cmp dword [esi + 8], 0
jne 0x4484b0
mov eax, dword [esi + 0x1c]
cmp eax, dword [esi + 0x20]
je 0x4484e2
mov ecx, dword [esi + 0x18]
and ecx, eax
mov eax, dword [esi + 0x24]
push dword [eax + ecx*4]
mov ecx, esi
call fcn.00448ab0
mov eax, dword [esi + 0x1c]
cmp eax, dword [esi + 0x20]
jne 0x4484c8
push dword [0x572824]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, esi
jne 0x448524
push dword [esi + 4]
push dword [0x572824]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
lea ecx, [esi + 0x10]
call fcn.00448420
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0047fc61
mov esp, ebp
pop ebp
ret
push 0x1c
push str.c:ent_slave_rootworkspace_vncconnect_buildsclients_vnc_7.12.xlabelcon_windows_64_rvcore_baseplat_timermanager.cxx
push str.thrInst__this
lea ecx, [ebp - 0x160]
call fcn.00428e20
push eax
call fcn.00428ea0
int3
Function at 0x448550
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51f750
mov eax, dword fs:[0]
push eax
sub esp, 0x154
mov eax, dword [0x56d370]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 8], 0
mov dword [ebp - 4], 0
mov dword [esi], vtable.plat::TimerManager.0
je 0x4485a2
push dword [esi + 8]
mov ecx, esi
call fcn.00448ab0
cmp dword [esi + 8], 0
jne 0x448592
mov eax, dword [esi + 0x1c]
cmp eax, dword [esi + 0x20]
je 0x4485ca
nop word [eax + eax]
mov ecx, dword [esi + 0x18]
and ecx, eax
mov eax, dword [esi + 0x24]
push dword [eax + ecx*4]
mov ecx, esi
call fcn.00448ab0
mov eax, dword [esi + 0x1c]
cmp eax, dword [esi + 0x20]
jne 0x4485b0
push dword [0x572824]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, esi
jne 0x448621
push dword [esi + 4]
push dword [0x572824]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
lea ecx, [esi + 0x10]
call fcn.00448420
test byte [ebp + 8], 1
je 0x448602
push 0x2c
push esi
call fcn.0047f544
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0047fc61
mov esp, ebp
pop ebp
ret 4
push 0x1c
push str.c:ent_slave_rootworkspace_vncconnect_buildsclients_vnc_7.12.xlabelcon_windows_64_rvcore_baseplat_timermanager.cxx
push str.thrInst__this
lea ecx, [ebp - 0x160]
call fcn.00428e20
push eax
call fcn.00428ea0
int3
Function at 0x449250
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51f7c5
mov eax, dword fs:[0]
push eax
sub esp, 0x2e0
mov eax, dword [0x56d370]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp byte [0x572848], 0
jne 0x4492a5
lea eax, [ebp - 0x2e8]
push eax
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x44936e
mov byte [0x572848], 1
mov eax, dword [0x5724e0]
test eax, eax
jne 0x4492dc
push 0x11c
call fcn.0047f514
add esp, 4
mov dword [ebp - 0x2ec], eax
mov dword [ebp - 4], 0
test eax, eax
je 0x4492d5
mov ecx, eax
call fcn.004331a0
jmp 0x4492d7
xor eax, eax
mov dword [0x5724e0], eax
cmp dword [eax + 4], 6
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
ja 0x4492f7
jne 0x44930e
mov eax, dword [eax + 8]
cmp eax, 1
ja 0x4492f7
jne 0x44930e
push 0x81
push 0
push 0
push esi
push edi
push ebx
call dword [sym.imp.WS2_32.dll_WSASocketW]
cmp eax, 0xffffffff
jne 0x449352
push esi
push edi
push ebx
call dword [sym.imp.WS2_32.dll_socket]
mov edi, eax
test edi, edi
js 0x449350
push 0
push 1
push edi
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
setne bl
test eax, eax
jne 0x449347
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
mov esi, eax
call dword [sym.imp.WS2_32.dll_closesocket]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
test bl, bl
jne 0x449350
or eax, 0xffffffff
jmp 0x449352
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0047fc61
mov esp, ebp
pop ebp
ret
call sub.KERNEL32.dll_GetLastError
push eax
push str.unable_to_initialise_Winsock2
lea ecx, [ebp - 0x158]
call fcn.00402910
push 0x5582d8
lea eax, [ebp - 0x158]
push eax
call fcn.00481150
int3
Function at 0x4495d0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x158
mov eax, dword [0x56d370]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x14]
lea eax, [ebp - 0x154]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
push eax
lea eax, [ebp - 0x150]
mov dword [ebp - 0x158], ebx
push eax
push esi
push 0xffff
push edi
mov dword [ebp - 0x154], 4
call dword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x4496cb
mov ecx, dword [ebp - 0x150]
cmp dword [ebp + 0xc], ecx
jle 0x4496b8
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
test ecx, ecx
jle 0x4496b8
push 4
lea eax, [ebp + 0xc]
push eax
push esi
push 0xffff
push edi
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
je 0x449693
call ebx
cmp eax, 0x2747
jne 0x4496f7
mov ecx, dword [ebp - 0x150]
mov eax, 0x66666667
imul dword [ebp + 0xc]
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
shl eax, 2
mov dword [ebp + 0xc], eax
cmp eax, ecx
jg 0x449637
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047fc61
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x154]
push eax
lea eax, [ebp - 0x150]
push eax
push esi
push 0xffff
push edi
call dword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x449728
mov ecx, dword [ebp - 0x150]
mov eax, ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0047fc61
mov esp, ebp
pop ebp
ret
push ebx
call sub.KERNEL32.dll_GetLastError
push eax
lea eax, [ebp - 0x14c]
push str.getsockopt__s_
push eax
call fcn.0040e910
add esp, 0x10
lea eax, [ebp - 0x14c]
push 0x559830
push eax
call fcn.00481150
push dword [ebp - 0x158]
call sub.KERNEL32.dll_GetLastError
push eax
lea eax, [ebp - 0x14c]
push str.setsockopt__s_
push eax
call fcn.0040e910
add esp, 0x10
lea eax, [ebp - 0x14c]
push 0x559830
push eax
call fcn.00481150
push dword [ebp - 0x158]
call sub.KERNEL32.dll_GetLastError
push eax
lea eax, [ebp - 0x14c]
push str.getsockopt__s_
push eax
call fcn.0040e910
add esp, 0x10
lea eax, [ebp - 0x14c]
push 0x559830
push eax
call fcn.00481150
int3

Function at 0x449980
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2dc
mov eax, dword [0x56d370]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x572848], 0
jne 0x4499b6
lea eax, [ebp - 0x2dc]
push eax
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x4499c4
mov byte [0x572848], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047fc61
mov esp, ebp
pop ebp
ret
call sub.KERNEL32.dll_GetLastError
push eax
push str.unable_to_initialise_Winsock2
lea ecx, [ebp - 0x14c]
call fcn.00402910
push 0x5582d8
lea eax, [ebp - 0x14c]
push eax
call fcn.00481150
int3
Function at 0x44a7c0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51facc
mov eax, dword fs:[0]
push eax
sub esp, 0x158
mov eax, dword [0x56d370]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x160], edi
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x164], edi
mov dword [ebp - 0x15c], eax
mov dword [edi + 4], vtable.os::RegKeyExistsCallback.0
mov dword [edi], vtable.os::RegKeyExistsMonitor.0
mov dword [edi + 4], vtable.os::RegKeyExistsMonitor.1.0
mov eax, dword [0x57273c]
or eax, 0xf003f
mov dword [edi + 8], 0
mov dword [edi + 0xc], eax
mov dword [edi + 0x10], 0
mov dword [ebp - 4], 0
mov byte [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov eax, dword [0x57273c]
or eax, 0xf003f
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], eax
mov dword [edi + 0x28], 0
mov byte [edi + 0x2c], 0
mov dword [edi + 0x30], 0
push 0
push 0
push 1
lea esi, [edi + 0x38]
mov byte [edi + 0x34], 0
push 0
mov dword [ebp - 0x160], esi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi], eax
mov byte [ebp - 4], 5
test eax, eax
je 0x44a8d4
push dword [ebp + 0x10]
mov ecx, edi
mov byte [ebp - 4], 6
push dword [ebp - 0x15c]
mov byte [edi + 0x3c], 0
push ebx
call fcn.0044acc0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0047fc61
mov esp, ebp
pop ebp
ret 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CreateEvent
lea ecx, [ebp - 0x158]
call fcn.00402910
push 0x5582d8
lea eax, [ebp - 0x158]
push eax
call fcn.00481150
int3
Function at 0x44e390
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x820
mov eax, dword [0x56d370]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0x1c]
lea eax, [ebp - 0x408]
push edi
mov edi, dword [ebp + 8]
push 0x401
push 0
push eax
mov dword [ebp - 0x820], edi
mov dword [ebp - 0x814], esi
mov dword [ebp - 0x818], 0
call fcn.00481640
push 0x401
lea eax, [ebp - 0x80c]
push 0
push eax
call fcn.00481640
push 0x400
push edi
lea eax, [ebp - 0x408]
push 0x401
lea ebx, [ebp - 0x80c]
mov dword [ebp - 0x81c], eax
push eax
mov dword [ebp - 0x810], ebx
call fcn.004ad2c7
add esp, 0x28
nop dword [eax]
nop dword [eax + eax]
push dword [ebp - 0x820]
mov edi, esi
mov dword [esi], 0
mov byte [ebx], 0
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov ebx, eax
test ebx, ebx
je 0x44e589
cmp word [ebx + 8], 2
jne 0x44e47e
cmp word [ebx + 0xa], 4
jne 0x44e47e
mov esi, dword [ebx + 0xc]
mov eax, dword [esi]
test eax, eax
je 0x44e47e
push dword [eax]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.0044e5e0
mov dword [edi], eax
test eax, eax
je 0x44e52e
add esi, 4
lea edi, [eax + 0x1c]
mov eax, dword [esi]
test eax, eax
jne 0x44e458
push 0x400
push dword [ebx]
mov ebx, dword [ebp - 0x810]
push 0x401
push ebx
call fcn.004ad2c7
mov eax, dword [ebp - 0x814]
xor esi, esi
add esp, 0x10
cmp dword [eax], esi
jne 0x44e538
mov ecx, ebx
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x44e4b0
sub ecx, edx
je case.0x44e599.11003
mov edi, dword [ebp - 0x81c]
mov ecx, ebx
mov eax, edi
nop dword [eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x44e4f0
test dl, dl
je 0x44e4ec
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x44e4f0
add eax, 2
add ecx, 2
test dl, dl
jne 0x44e4d0
xor eax, eax
jmp 0x44e4f5
sbb eax, eax
or eax, 1
test eax, eax
je case.0x44e599.11003
mov esi, dword [ebp - 0x818]
inc esi
mov dword [ebp - 0x818], esi
cmp esi, 0x10
je case.0x44e599.11003
mov esi, dword [ebp - 0x814]
mov eax, edi
mov dword [ebp - 0x81c], ebx
mov ebx, eax
mov dword [ebp - 0x810], ebx
jmp 0x44e420
mov esi, 8
jmp 0x44e5b3
cmp dword [ebp + 0x18], esi
je 0x44e5b3
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x44e542
sub ecx, edx
lea ebx, [ecx + 1]
push ebx
push 1
call fcn.004ad2d2
mov edi, eax
add esp, 8
test edi, edi
je 0x44e56f
push dword [ebp - 0x810]
push ebx
push edi
call fcn.004ad0e8
add esp, 0xc
mov ecx, dword [ebp - 0x814]
mov eax, dword [ecx]
mov dword [eax + 0x14], edi
mov eax, dword [ecx]
mov ecx, 8
cmp dword [eax + 0x14], esi
cmove esi, ecx
jmp 0x44e5b3
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
add eax, 0xffffd507
cmp eax, 3
ja case.0x44e599.11001
jmp dword [eax*4 + 0x44e5c8]
mov esi, 0x2afa
jmp 0x44e5b3
mov esi, 0x2afb
jmp 0x44e5b3
mov esi, 0x2af9
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0047fc61
mov esp, ebp
pop ebp
ret 0x18
Function at 0x44ee20
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x56d370]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x57288c], 0
mov dword [ebp - 0x230], str.getaddrinfo
mov dword [ebp - 0x22c], 0x44dde0
mov dword [ebp - 0x228], str.getnameinfo
mov dword [ebp - 0x224], 0x44e150
mov dword [ebp - 0x220], str.freeaddrinfo
mov dword [ebp - 0x21c], fcn.0044dd90
jne 0x44efa2
push 0x104
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x44ef98
push ebx
push esi
push edi
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x110]
push 0x10c
push eax
call fcn.004ad0e8
push 0x532144
lea eax, [ebp - 0x110]
push 0x10c
push eax
call fcn.004ad1ab
add esp, 0x18
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov edi, eax
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
test edi, edi
je 0x44eef8
push str.getaddrinfo
push edi
call ebx
test eax, eax
jne 0x44ef4d
push edi
call esi
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x110]
push 0x10c
push eax
call fcn.004ad0e8
push str.wship6
lea eax, [ebp - 0x110]
push 0x10c
push eax
call fcn.004ad1ab
add esp, 0x18
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x44ef95
push str.getaddrinfo
push edi
call ebx
test eax, eax
jne 0x44ef4d
push edi
call esi
jmp 0x44ef95
xor esi, esi
nop
push dword [ebp + esi*8 - 0x230]
push edi
call ebx
mov dword [ebp + esi*8 - 0x22c], eax
test eax, eax
je 0x44ef8e
inc esi
cmp esi, 3
jl 0x44ef50
mov eax, dword [ebp - 0x22c]
mov dword [0x56d2cc], eax
mov eax, dword [ebp - 0x224]
mov dword [0x56d2d4], eax
mov eax, dword [ebp - 0x21c]
mov dword [fcn.0044dd90], eax
jmp 0x44ef95
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
pop ebx
mov dword [0x57288c], 1
movzx eax, word [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, dword [eax*8 + 0x56d2cc]
call fcn.0047fc61
mov esp, ebp
pop ebp
ret 4
Function at 0x458c80
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
push dword [ebp + 8]
mov esi, ecx
mov dword [ebp - 0xc], esi
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov edi, dword [ebp + 0xc]
mov edx, eax
mov dword [esi], edx
test edi, edi
je 0x458cb8
mov ecx, edi
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x458ca7
sub ecx, ebx
sar ecx, 1
jmp 0x458cba
xor ecx, ecx
lea eax, [edx + 1]
mov dword [esi + 4], 0
lea ebx, [esi + 4]
add eax, ecx
mov dword [ebp - 4], eax
mov dword [ebp + 0xc], ebx
je 0x458cef
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0047ffab
add esp, 4
mov dword [ebp + 0xc], eax
jmp 0x458cf6
mov dword [ebp + 0xc], 0
push dword [ebx]
call fcn.0047f552
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov eax, dword [ebp - 4]
add esp, 4
mov dword [ebx], ecx
mov word [ecx + eax*2 - 2], dx
xor ecx, ecx
mov eax, dword [ebx]
mov word [eax], cx
mov eax, dword [esi]
inc eax
push eax
push dword [ebx]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [ebx]
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x458d30
lea eax, [ebp - 0xc]
sub ecx, edx
push eax
lea eax, [ebp - 8]
sar ecx, 1
push eax
push 0xb0
push dword [ebp + 8]
mov dword [esi], ecx
call dword [sym.imp.USER32.dll_SendMessageW]
mov edx, dword [esi]
mov ecx, dword [ebp - 8]
cmp ecx, edx
jg 0x458d68
test ecx, ecx
js 0x458d68
mov eax, ecx
jmp 0x458d6a
xor eax, eax
mov dword [esi + 0xc], eax
mov eax, dword [ebp - 0xc]
cmp eax, ecx
jl 0x458d7c
cmp eax, edx
jg 0x458d7c
sub eax, ecx
jmp 0x458d7e
xor eax, eax
mov dword [esi + 8], eax
test edi, edi
je 0x458d8d
push edi
mov ecx, esi
call fcn.00459750
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x472880
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x523996
mov eax, dword fs:[0]
push eax
mov eax, 0x201c
call fcn.00480000
mov eax, dword [0x56d370]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x2010]
push 0x1000
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
je 0x4729ed
push 4
lea eax, [ebp - 0x2010]
push str.LOC:
push eax
call fcn.004ad3dd
add esp, 0xc
test eax, eax
jne 0x4729ed
push 1
push 0xffffffffffffffff
push 0xfde9
lea eax, [ebp - 0x2008]
push eax
lea ecx, [ebp - 0x2028]
call fcn.00411420
push 0
push 0xae
push str.c:ent_slave_rootworkspace_vncconnect_buildsclients_vnc_7.12.xlabelcon_windows_64_rvcoreuilibsuiwindialog.cxx
push dword [ebp - 0x2024]
mov dword [ebp - 4], 0
call fcn.004161f0
add esp, 0x10
mov dword [ebp - 0x201c], 0
mov dword [ebp - 0x2018], 0
mov byte [ebp - 0x2014], 0
push 1
push 0xffffffffffffffff
push 0xfde9
push eax
lea ecx, [ebp - 0x201c]
mov byte [ebp - 4], 1
call fcn.0042a6c0
push dword [ebp - 0x2018]
push esi
call dword [sym.imp.USER32.dll_SetWindowTextW]
cmp byte [ebp - 0x2014], 0
mov ecx, dword [ebp - 0x2018]
mov byte [ebp - 4], 2
je 0x472998
test ecx, ecx
je 0x472998
mov eax, dword [ebp - 0x201c]
add eax, eax
push eax
push ecx
call fcn.00408000
mov ecx, dword [ebp - 0x2018]
add esp, 8
push ecx
call fcn.0047f552
add esp, 4
mov dword [ebp - 0x201c], 0
mov dword [ebp - 0x2018], 0
cmp byte [ebp - 0x2020], 0
mov eax, dword [ebp - 0x2024]
mov dword [ebp - 4], 3
je 0x4729e4
test eax, eax
je 0x4729e4
push dword [ebp - 0x2028]
push eax
call fcn.00408000
mov eax, dword [ebp - 0x2024]
add esp, 8
push eax
call fcn.0047f552
add esp, 4
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0047fc61
mov esp, ebp
pop ebp
ret 8

Function at 0x472a10
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 8
call fcn.0047f514
mov esi, eax
add esp, 4
mov dword [ebp - 4], esi
test esi, esi
je 0x472a4e
push dword [0x572a74]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [ebp + 8]
push esi
mov dword [esi], ecx
mov dword [esi + 4], eax
push dword [0x572a74]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop esi
mov esp, ebp
pop ebp
ret
xor esi, esi
push esi
push dword [0x572a74]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop esi
mov esp, ebp
pop ebp
ret