joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46d874
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
mov edi, dword [ebp + 8]
xor eax, eax
push ebp
push 0x46d99c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
dec eax
sub eax, 2
jb 0x46d8be
mov ecx, 0x7d
mov edx, 0x46d9b4
mov eax, 0x46d9fc
call fcn.00404078
mov eax, dword [0x48abe0]
cmp byte [eax], 0
jne 0x46d91c
cmp esi, 1
jne 0x46d8f6
lea eax, [ebp - 8]
mov edx, edi
call fcn.00404328
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.00404328
mov edx, dword [ebp - 0xc]
mov eax, ebx
pop ecx
call fcn.0042cd90
jmp 0x46d979
lea eax, [ebp - 0x10]
mov edx, edi
call fcn.00404328
mov eax, dword [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 4]
call fcn.00404328
mov edx, dword [ebp - 0x14]
mov eax, ebx
pop ecx
call fcn.0042cdbc
jmp 0x46d979
mov eax, edi
call fcn.004049bc
inc eax
add eax, eax
push eax
mov eax, edi
call fcn.004049ac
push eax
push esi
push 0
mov eax, dword [ebp - 4]
call fcn.004049ac
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegSetValueExW
test eax, eax
je 0x46d979
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0xf
lea eax, [ebp - 0x1c]
push eax
push 0
lea edx, [ebp - 0x20]
mov eax, dword [0x48ae5c]
call fcn.004061cc
mov ecx, dword [ebp - 0x20]
mov dl, 1
mov eax, dword [0x42ca3c]
call fcn.0040c614
call fcn.00403a98
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46d9a3
lea eax, [ebp - 0x20]
call fcn.004040a0
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.004040c4
ret

Function at 0x47587c
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push esi
push edi
lea eax, [ebp - 4]
push eax
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
je 0x47590f
xor eax, eax
push ebp
push 0x475908
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
push eax
push 0x47592c
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
test eax, eax
je 0x4758f1
mov dword [ebp - 0x18], 1
mov dword [ebp - 0xc], 2
xor eax, eax
mov dword [ebp - 8], eax
lea esi, [ebp - 0x18]
lea edi, [ebp - 0x28]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x28]
push eax
push 0x10
lea eax, [ebp - 0x18]
push eax
push 0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47590f
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CloseHandle
ret
push 0
push 0
push 1
call sub.ntdll.dll_RtlSetProcessIsCritical
mov eax, 0x475948
call fcn.00475bdc
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x475954
Capabilities:
Get token membership

Disassembly:
add esp, 0xfffffff8
lea eax, [esp + 4]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
push 0x47bcfc
call sub.advapi32.dll_AllocateAndInitializeSid
cmp eax, 1
sbb eax, eax
inc eax
mov byte [esp], al
cmp byte [esp], 0
je 0x4759a9
push esp
mov eax, dword [esp + 8]
push eax
push 0
call sub.advapi32.dll_CheckTokenMembership
test al, al
jne 0x47599f
mov byte [esp], 0
mov eax, dword [esp + 4]
push eax
call sub.advapi32.dll_FreeSid
mov al, byte [esp]
pop ecx
pop edx
ret

Function at 0x4759b0
Capabilities:
Get disk information via ioctl

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff8c0
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x73c], edx
mov dword [ebp - 0x740], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x475a66
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 3
push 0
push 3
push 0
lea edx, [ebp - 0x740]
mov eax, ebx
call fcn.00408964
mov ecx, dword [ebp - 0x740]
lea eax, [ebp - 0x73c]
mov edx, 0x475a80
call fcn.004043ac
mov eax, dword [ebp - 0x73c]
call fcn.00404560
push eax
call sub.kernel32.dll_CreateFileA
mov ebx, eax
push 0
lea eax, [ebp - 4]
push eax
push 0x730
lea eax, [ebp - 0x738]
push eax
push 0
push 0
push 0x70050
push ebx
call sub.kernel32.dll_DeviceIoControl
mov esi, dword [ebp - 0x738]
push ebx
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x475a6d
lea eax, [ebp - 0x740]
mov edx, 2
call fcn.004040c4
ret

Function at 0x475a94
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
push ebx
push esi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.00404d64
lea eax, [ebp - 8]
call fcn.00404d64
xor eax, eax
push ebp
push 0x475b2d
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 0x44]
xor ecx, ecx
mov edx, 0x3c
call fcn.00402cf0
mov dword [ebp - 0x44], 0x3c
mov dword [ebp - 0x40], 0x40
mov eax, dword [ebp - 4]
call fcn.004049ac
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 8]
call fcn.004049ac
mov dword [ebp - 0x30], eax
mov eax, 0x475b3c
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x28], esi
lea eax, [ebp - 0x44]
push eax
call sub.shell32.dll_ShellExecuteExW
test eax, eax
je 0x475b12
mov ebx, dword [ebp - 0xc]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x475b34
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404798
ret
Function at 0x475b48
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.00404d64
xor eax, eax
push ebp
push 0x475bcc
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00402cf0
mov dword [ebp - 0x48], 0x44
mov word [ebp - 0x18], bx
mov dword [ebp - 0x1c], 1
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0x20
push 0xffffffffffffffff
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004049ac
push eax
push 0
call sub.kernel32.dll_CreateProcessW
call sub.kernel32.dll_GetLastError
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x475bd3
lea eax, [ebp - 4]
call fcn.00404780
ret

Function at 0x475bdc
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x140], edx
mov dword [ebp - 0x148], edx
mov dword [ebp - 0x144], edx
mov dword [ebp - 0x130], edx
mov dword [ebp - 0x13c], edx
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x138], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404550
lea edi, [ebp - 0x12c]
xor eax, eax
push ebp
push 0x475d4a
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
xor edx, edx
mov eax, 2
call fcn.00473290
mov ebx, eax
mov dword [edi], 0x128
mov edx, edi
mov eax, ebx
call fcn.004732b0
jmp 0x475d16
lea eax, [ebp - 0x138]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.00404310
mov eax, dword [ebp - 0x138]
lea edx, [ebp - 0x134]
call fcn.00408ff8
mov eax, dword [ebp - 0x134]
lea edx, [ebp - 0x130]
call fcn.004083e0
mov eax, dword [ebp - 0x130]
push eax
lea edx, [ebp - 0x13c]
mov eax, dword [ebp - 4]
call fcn.004083e0
mov edx, dword [ebp - 0x13c]
pop eax
call fcn.004044ac
je 0x475cf6
lea eax, [ebp - 0x144]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.00404310
mov eax, dword [ebp - 0x144]
lea edx, [ebp - 0x140]
call fcn.004083e0
mov eax, dword [ebp - 0x140]
push eax
lea edx, [ebp - 0x148]
mov eax, dword [ebp - 4]
call fcn.004083e0
mov edx, dword [ebp - 0x148]
pop eax
call fcn.004044ac
jne 0x475d0d
push 0
mov eax, dword [edi + 8]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
mov esi, eax
mov edx, edi
mov eax, ebx
call fcn.004732d0
test eax, eax
jne 0x475c57
push ebx
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x475d51
lea eax, [ebp - 0x148]
mov edx, 7
call fcn.004040c4
lea eax, [ebp - 4]
call fcn.004040a0
ret
Function at 0x475eac
Capabilities:
Shutdown system

Disassembly:
push ebx
add esp, 0xffffffd8
mov ebx, eax
mov eax, dword [0x48b0f8]
cmp dword [eax], 2
jne 0x475f26
push esp
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
cmp eax, 1
sbb eax, eax
inc eax
test al, al
je 0x475f26
lea eax, [esp + 0xc]
push eax
push 0x475f3c
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
cmp eax, 1
sbb eax, eax
inc eax
mov dword [esp + 8], 1
mov dword [esp + 0x14], 2
mov edx, 0x10
xor ecx, ecx
mov dword [esp + 4], ecx
test al, al
je 0x475f26
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x1c]
push eax
push edx
lea eax, [esp + 0x14]
push eax
push 0
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
push 0
push ebx
call sub.user32.dll_ExitWindowsEx
cmp eax, 1
sbb eax, eax
inc eax
add esp, 0x28
pop ebx
ret
Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..pdata
nop
nop
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
je 0x430072
nop
nop
nop
nop
nop
mov ebx, 0x408f6c
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x8fc2735
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x430060
nop
nop
nop
mov eax, section..pdata_1
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4300d2
nop
nop
mov ebx, 0x42e3d0
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x11301c6f
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x40616a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, eax
xor edx, edx
xor eax, eax
cmp esi, 1
jne 0x406182
push esi
call fcn.00405ca9
jmp 0x4061f8
cmp esi, 2
jne 0x40619c
push edx
push edx
push esi
push 0x401638
push edx
push edx
call dword [0x4030a4]
xor eax, eax
inc eax
jmp 0x4061f8
cmp esi, 3
jne 0x4061b1
xor esi, esi
xor dl, byte [esi + ecx]
inc esi
cmp esi, 6
jb 0x4061a3
mov byte [ecx + 6], dl
jmp 0x4061f8
cmp esi, 4
jne 0x4061d0
mov al, byte [ecx + 6]
push 5
pop edx
xor al, byte [edx + ecx]
dec edx
cmp edx, 1
jge 0x4061bc
xor edx, edx
cmp al, byte [ecx]
sete dl
mov eax, edx
jmp 0x4061f8
cmp esi, 5
jne 0x4061f8
mov esi, dword [ecx + 8]
mov eax, dword [ecx + 0x28]
mov dword [ebp - 4], esi
cmp esi, edx
jne 0x4061eb
mov dword [ebp - 4], 0x7c59af1e
jmp 0x4061f5
push ecx
mov ecx, 0x10
rol dword [ebp - 4], cl
pop ecx
xor eax, dword [ebp - 4]
pop esi
leave
ret
Function at 0x402457
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 0x20c
push ebx
push esi
mov esi, ecx
cmp dword [esi + 0x20], 0
push edi
jne 0x4024ae
push 0x200
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x14]
call fcn.00405db0
push str.The_system_needs_to_use_a_local_stack_for_simulation._nYou_need_to_call_hkThreadMemory::setStackArea___to_set_up_a_buffer_for_this_stack._Failure_to_do_this_results_in_lots_of_heap_allocations_which_can_lead_to_large_slowdowns.
lea ecx, [esp + 0x10]
call fcn.00405640
mov ecx, dword [0x4c6070]
mov edx, dword [ecx]
mov edx, dword [edx + 0xc]
push 0x12d
push str..MemoryhkThreadMemory.cpp
lea eax, [esp + 0x20]
push eax
push 0x2bebba62
push 3
call edx
lea ecx, [esp + 0xc]
call fcn.00405990
mov ebx, dword [esp + 0x21c]
lea edi, [ebx + 0x400]
cmp edi, 0x1000
jg 0x4024c8
mov edi, 0x1000
mov eax, dword [0x4c6060]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push 0x17
lea ecx, [edi + 0x10]
push ecx
mov ecx, eax
call fcn.00402380
mov edx, dword [esi + 0x20]
mov dword [eax], edx
mov ecx, dword [esi + 0x24]
mov dword [eax + 4], ecx
mov edx, dword [esi + 0x28]
mov dword [eax + 8], edx
mov ecx, dword [esi + 0x2c]
mov dword [eax + 0xc], ecx
lea ecx, [eax + 0x10]
lea edx, [ecx + ebx]
mov dword [esi + 0x20], edx
lea edx, [ecx + edi]
pop edi
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], ecx
mov dword [esi + 0x2c], edx
pop esi
mov eax, ecx
pop ebx
add esp, 0x20c
ret 4

Function at 0x4026b0
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x4c6060]
push ebx
push ebp
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
imul ecx, ebx
push 0x17
push ecx
mov ecx, eax
call fcn.00402380
mov esi, dword [esp + 0x10]
mov edx, dword [esi + 4]
imul edx, ebx
mov ebp, eax
mov eax, dword [esi]
push edx
push eax
push ebp
call fcn.0042cb00
mov eax, dword [esi + 8]
add esp, 0xc
test eax, eax
js 0x40271a
mov ecx, dword [0x4c6060]
push edi
and eax, 0x3fffffff
push ecx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
imul edi, ebx
mov edx, dword [esi]
push 0x17
push edi
push edx
mov ecx, eax
call fcn.004023e0
pop edi
mov eax, dword [esi + 8]
and eax, 0x40000000
or eax, dword [esp + 0x14]
mov dword [esi], ebp
mov dword [esi + 8], eax
pop esi
pop ebp
pop ebx
ret
Function at 0x402730
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
mov eax, dword [esi + 4]
test eax, eax
je 0x402746
add eax, eax
mov dword [esp + 0x10], eax
jmp 0x40274e
mov dword [esp + 0x10], 1
mov ecx, dword [0x4c6060]
push ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edx, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
imul edx, ebx
push 0x17
push edx
mov ecx, eax
call fcn.00402380
mov ecx, dword [esi]
mov ebp, eax
mov eax, dword [esi + 4]
imul eax, ebx
push eax
push ecx
push ebp
call fcn.0042cb00
mov eax, dword [esi + 8]
add esp, 0xc
test eax, eax
js 0x4027b2
mov edx, dword [0x4c6060]
push edi
and eax, 0x3fffffff
push edx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
imul edi, ebx
mov ecx, dword [esi]
push 0x17
push edi
push ecx
mov ecx, eax
call fcn.004023e0
pop edi
mov edx, dword [esi + 8]
and edx, 0x40000000
or edx, dword [esp + 0x10]
mov dword [esi], ebp
mov dword [esi + 8], edx
pop esi
pop ebp
pop ebx
ret

Function at 0x4027d0
Capabilities:
Get thread local storage value

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0x14]
test ebx, ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
mov esi, dword [esp + 0x14]
push edi
mov dword [esp + 0x10], 0
je 0x402800
mov eax, dword [esi + 4]
cmp eax, dword [esp + 0x24]
jge 0x402800
mov dword [esp + 0x10], bind
jmp 0x402820
mov ecx, dword [0x4c6060]
push ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edx, ebp
imul edx, dword [esp + 0x24]
push 0x17
push edx
mov ecx, eax
call fcn.00402380
mov ebx, eax
mov eax, dword [esi + 4]
mov ecx, dword [esi]
imul eax, ebp
push eax
push ecx
push ebx
call fcn.00406220
mov edx, dword [0x4c6060]
mov edi, dword [esi + 8]
add esp, 0xc
push edx
and edi, 0x3fffffff
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
imul edi, ebp
mov ecx, dword [esi]
push 0x17
push edi
push ecx
mov ecx, eax
call fcn.004023e0
mov edx, dword [esi + 8]
and edx, 0x40000000
or edx, dword [esp + 0x10]
pop edi
or edx, dword [esp + 0x20]
mov dword [esi], ebx
mov dword [esi + 8], edx
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x404790
Capabilities:
Execute anti-debugging instructions
Get thread local storage value

Disassembly:
push ecx
push ebx
push esi
mov ebx, ecx
push ebx
call dword [sym.imp.KERNEL32.dll_TryEnterCriticalSection]
test eax, eax
jne 0x40482d
mov eax, dword [0x4c6078]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
push eax
call edi
test eax, eax
je 0x404825
mov ecx, dword [0x4c6074]
push ecx
call edi
mov esi, eax
mov ecx, dword [esi + 4]
cmp ecx, dword [esi + 0xc]
jae 0x4047e3
mov dword [ecx], str.TtCriticalLock
rdtsc
mov dword [esp + 0xc], eax
mov edx, dword [esp + 0xc]
mov dword [ecx + 4], edx
add ecx, 0xc
mov dword [esi + 4], ecx
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x4c6074]
push eax
call edi
mov ecx, eax
mov esi, dword [ecx + 4]
cmp esi, dword [ecx + 0xc]
jae 0x40482c
mov dword [esi], 0x4b2454
rdtsc
mov dword [esp + 0xc], eax
mov edx, dword [esp + 0xc]
mov dword [esi + 4], edx
add esi, 0xc
pop edi
mov dword [ecx + 4], esi
call fcn.004087f0
pop esi
mov dword [ebx + 0x18], eax
mov dword [ebx + 0x1c], edx
pop ebx
pop ecx
ret
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
pop edi
call fcn.004087f0
pop esi
mov dword [ebx + 0x18], eax
mov dword [ebx + 0x1c], edx
pop ebx
pop ecx
ret

Function at 0x4049f0
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 0xc
push ebp
push esi
mov esi, dword [0x4c60b0]
xor ebp, ebp
cmp esi, ebp
push edi
mov edi, 0x4c60b0
mov dword [esp + 0xc], ebp
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], bind
je 0x404a8c
mov eax, dword [esi + 8]
cmp dword [eax], ebp
jne 0x404a2f
mov ecx, dword [esi]
call ecx
cmp eax, ebp
je 0x404ac3
mov edx, dword [esi + 8]
mov dword [edx], eax
lea edi, [esi + 4]
mov esi, dword [edi]
cmp esi, ebp
jne 0x404a17
push ebx
mov ebx, dword [esp + 0x14]
cmp ebx, ebp
je 0x404a8b
add ebx, 0xffffffff
cmp ebx, ebp
jl 0x404a83
jmp 0x404a50
mov edx, dword [esp + 0x10]
mov esi, dword [edx + ebx*4]
mov eax, dword [esi]
call eax
cmp eax, ebp
je 0x404a7e
mov ecx, dword [esi + 8]
mov dword [ecx], eax
mov dword [edi], esi
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
sub eax, 1
mov dword [esp + 0x14], eax
mov edx, dword [ecx + eax*4]
lea edi, [esi + 4]
mov dword [ecx + ebx*4], edx
sub ebx, 1
jns 0x404a50
mov ebx, dword [esp + 0x14]
cmp ebx, ebp
jne 0x404a41
pop ebx
mov esi, dword [esp + 0x14]
test esi, esi
js 0x404abc
mov eax, dword [0x4c6060]
push eax
and esi, 0x3fffffff
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edx, dword [esp + 0xc]
push 0x17
lea ecx, [esi*4]
push ecx
push edx
mov ecx, eax
call fcn.004023e0
pop edi
pop esi
pop ebp
add esp, 0xc
ret
mov eax, dword [esp + 0x14]
and eax, 0x3fffffff
cmp dword [esp + 0x10], eax
jne 0x404ae1
lea ecx, [esp + 0xc]
push 4
push ecx
call fcn.00402730
add esp, 8
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
mov dword [edx + eax*4], esi
add dword [esp + 0x10], 1
mov ecx, dword [edi]
mov esi, dword [esi + 4]
mov dword [ecx + 4], ebp
mov dword [edi], esi
jmp 0x404a34
Function at 0x404b00
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xe0
cmp byte [0x4c6068], 0
push esi
push edi
jne 0x404bc2
mov eax, dword [ebp + 8]
test eax, eax
je 0x404bf4
push eax
call fcn.00405480
mov eax, dword [ebp + 0xc]
add esp, 4
test eax, eax
je 0x404bca
push eax
call fcn.00404950
mov eax, dword [0x4c6060]
mov esi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
add esp, 4
push eax
call esi
push 0x15
push 8
mov ecx, eax
call fcn.00402380
push eax
mov word [eax + 4], 8
mov word [eax + 6], 1
mov dword [eax], vtable.hkNativeFileSystem.0
call fcn.00404e20
mov ecx, dword [0x4c6060]
add esp, 4
push ecx
call esi
push 0x15
push 0x28
mov ecx, eax
call fcn.00402380
mov edx, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
push edx
push ecx
mov ecx, eax
mov word [eax + 4], 0x28
call fcn.004050d0
push eax
call fcn.00404dd0
add esp, 4
call fcn.004049f0
mov ecx, dword [0x4c6064]
mov edx, dword [ecx]
mov eax, dword [edx + 0xc]
call eax
mov byte [0x4c6068], 1
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, 0x1e
mov esi, str.No_thread_memory_manager_specified.__t_t_t_t_t_t_t_t_t__You_must_specify_a_thread_memory_manager_when_initializing_hkBaseSystem.
lea edi, [esp + 8]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp + 0x14]
push ecx
lea edx, [esp + 0xc]
push edx
call dword [ebp + 0x10]
add esp, 8
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x14]
mov ecx, 0x37
mov esi, str.No_memory_manager_system_specified.__t_t_t_t_t_t_t_t_You_must_specify_a_memory_manager_when_initializing_hkBaseSystem.__t_t_t_t_t_t_t_t_Use_hkPoolMemory_if_no_memory_manager_is_present_or_no_custom_memory__t_t_t_t_t_t_t_t_manager_is_available.
lea edi, [esp + 8]
rep movsd dword es:[edi], dword [esi]
push eax
lea ecx, [esp + 0xc]
push ecx
call dword [ebp + 0x10]
add esp, 8
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x405cf0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
mov esi, ecx
mov eax, dword [esi + 8]
test eax, eax
js 0x405d1f
and eax, 0x3fffffff
push edi
mov edi, eax
mov eax, dword [0x4c6060]
push eax
call ebp
mov ecx, dword [esi]
push 0x17
push edi
push ecx
mov ecx, eax
call fcn.004023e0
pop edi
test byte [esp + 0xc], 1
je 0x405d54
mov edx, dword [0x4c6060]
push edx
call ebp
mov ecx, dword [eax + 0x4c]
cmp ecx, dword [eax + 0x34]
jl 0x405d48
push esi
push 2
mov ecx, eax
call fcn.004022b0
mov eax, esi
pop esi
pop ebp
ret 4
mov edx, dword [eax + 0x48]
add dword [eax + 0x4c], 1
mov dword [esi], edx
mov dword [eax + 0x48], esi
mov eax, esi
pop esi
pop ebp
ret 4
Function at 0x405cf7
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
mov esi, ecx
mov eax, dword [esi + 8]
test eax, eax
js 0x405d1f
and eax, 0x3fffffff
push edi
mov edi, eax
mov eax, dword [0x4c6060]
push eax
call ebp
mov ecx, dword [esi]
push 0x17
push edi
push ecx
mov ecx, eax
call fcn.004023e0
pop edi
test byte [esp + 0xc], 1
je 0x405d54
mov edx, dword [0x4c6060]
push edx
call ebp
mov ecx, dword [eax + 0x4c]
cmp ecx, dword [eax + 0x34]
jl 0x405d48
push esi
push 2
mov ecx, eax
call fcn.004022b0
mov eax, esi
pop esi
pop ebp
ret 4
mov edx, dword [eax + 0x48]
add dword [eax + 0x4c], 1
mov dword [esi], edx
mov dword [eax + 0x48], esi
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x406380
Capabilities:
Get thread local storage value

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
push edi
call fcn.00406130
mov esi, eax
mov eax, dword [0x4c6060]
add esp, 4
push eax
add esi, 1
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push 0x16
push esi
mov ecx, eax
call fcn.004025a0
mov esi, eax
push edi
push esi
call fcn.004060f0
add esp, 8
pop edi
mov eax, esi
pop esi
ret

Function at 0x406960
Capabilities:
Get thread local storage value

Disassembly:
push ecx
mov eax, dword [esp + 0xc]
push ebx
push ebp
push esi
mov ebp, ecx
mov esi, dword [ebp + 4]
push edi
push eax
sub esi, 1
call fcn.00406130
mov ecx, dword [0x4c6060]
add esp, 4
mov edi, eax
push ecx
mov dword [esp + 0x14], edi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push 0x16
lea edi, [edi + esi + 1]
push edi
mov ecx, eax
call fcn.00402380
mov edx, dword [ebp]
push esi
mov ebx, eax
push edx
push ebx
call fcn.00406220
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x28]
add eax, 1
push eax
push ecx
lea edx, [ebx + esi]
push edx
call fcn.00406220
mov eax, dword [esp + 0x30]
add esp, 0x18
mov dword [eax + 4], edi
mov dword [eax + 8], edi
pop edi
pop esi
pop ebp
mov dword [eax], ebx
pop ebx
pop ecx
ret 8

Function at 0x4085e0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov eax, dword [0x4c6060]
push ebx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, dword [eax + 0x50]
xor ebx, ebx
cmp esi, ebx
je 0x408602
add dword [eax + 0x54], 0xffffffff
mov ecx, dword [esi]
mov dword [eax + 0x50], ecx
jmp 0x40860d
push 3
mov ecx, eax
call fcn.00402220
mov esi, eax
mov edx, dword [0x4c6074]
push esi
push edx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov byte [esi + 0x10], bl
mov dword [esi], ebx
mov dword [esi + 8], ebx
mov dword [esi + 4], ebx
mov dword [esi + 0xc], ebx
pop esi
pop ebx
ret

Function at 0x409070
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [esp + 4]
push esi
push edi
lea eax, [eax + eax*2]
mov esi, 4
cmp eax, esi
mov edi, ecx
mov dword [edi + 4], 0
jle 0x409096
jmp 0x409090
add esi, esi
cmp esi, eax
jl 0x409090
mov eax, dword [0x4c6060]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push 0x17
lea ecx, [esi*8]
push ecx
mov ecx, eax
call fcn.00402380
add esi, 0xffffffff
mov ecx, edi
mov dword [edi], eax
mov dword [edi + 8], esi
call fcn.00408ae0
mov eax, edi
pop edi
pop esi
ret 4