joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4aeb10
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push 0
call fcn.004be030
pop ecx
cmp dword [ebp + 0xc], 0
jne 0x4aeb2b
xor esi, esi
jmp 0x4aeb2e
or esi, 0xffffffff
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp dword [eax + 0x7c], 0
je 0x4aeb91
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
movzx eax, word [eax + 0x80]
test eax, eax
jne 0x4aeb91
push 0x7d87d8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
dec dword [0x7d87f0]
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [eax + 0x7c], 0
push 0x7d87f8
call fcn.0048dab0
pop ecx
push 0x7d87d8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0x7d87c0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp dword [eax + 0x1654], 0
je 0x4aebc1
push 0x7d87c0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.0048d580
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [eax + 0x1658], 1
push 0x7d87c0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebp + 8]
push eax
call fcn.004ae4c0
pop ecx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 4], eax
push 0x7d87c0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [eax + 0x1658], 0
push 0x7d87c0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp dword [eax + 0x7c], 0
jne 0x4aec9a
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
movzx eax, word [eax + 0x80]
test eax, eax
jne 0x4aec9a
push 0x7d87d8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
jmp 0x4aec6d
push 0xffffffffffffffff
push 0x7d87d8
push 0x7d87f8
call fcn.0048db80
add esp, 0xc
mov eax, dword [0x7d87f4]
test eax, eax
jne 0x4aec59
inc dword [0x7d87f0]
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [eax + 0x7c], 1
push 0x7d87d8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebp - 4]
test eax, eax
jne 0x4aecdb
mov eax, dword [ebp + 8]
push eax
call fcn.004ae4c0
pop ecx
lea edx, [ebp - 4]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov edi, eax
push 0
push edi
call fcn.004be070
add esp, 8
test edi, edi
je 0x4aeccf
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
jmp 0x4aecd6
mov dword [ebp - 8], 0xfffffffe
mov ebx, dword [ebp - 8]
jmp 0x4aecde
or ebx, 0xffffffff
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4aecf0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
push eax
call fcn.004ae4c0
pop ecx
cmp dword [ebp + 0xc], 0
je 0x4aed0a
xor edi, edi
jmp 0x4aed0f
mov edi, 1
mov edx, edi
push edx
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x4aed24
mov esi, 1
jmp 0x4aed26
xor esi, esi
mov ebx, esi
push 0
push ebx
call fcn.004be070
add esp, 8
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4aed40
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
push eax
call fcn.004a9b80
pop ecx
push eax
call fcn.004b1c10
pop ecx
mov dword [ebp + 8], eax
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp dword [eax + 0x7c], 0
je 0x4aedc0
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
movzx eax, word [eax + 0x80]
test eax, eax
jne 0x4aedc0
push 0x7d87d8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
dec dword [0x7d87f0]
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [eax + 0x7c], 0
push 0x7d87f8
call fcn.0048dab0
pop ecx
push 0x7d87d8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0x7d87c0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp dword [eax + 0x1654], 0
je 0x4aedf0
push 0x7d87c0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.0048d580
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [eax + 0x1658], 1
push 0x7d87c0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
movzx eax, word [ebp + 0xc]
push eax
push 0
push 0
call fcn.004ae510
add esp, 0x1c
push 0
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 0
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
push 0
mov eax, esi
cmp eax, 0xffffffff
je 0x4aee64
mov edi, 1
jmp 0x4aee66
xor edi, edi
push edi
call fcn.004be070
add esp, 8
mov eax, esi
mov ebx, eax
push 0x7d87c0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [eax + 0x1658], 0
push 0x7d87c0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp dword [eax + 0x7c], 0
jne 0x4aef16
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
movzx eax, word [eax + 0x80]
test eax, eax
jne 0x4aef16
push 0x7d87d8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
jmp 0x4aeee9
push 0xffffffffffffffff
push 0x7d87d8
push 0x7d87f8
call fcn.0048db80
add esp, 0xc
mov eax, dword [0x7d87f4]
test eax, eax
jne 0x4aeed5
inc dword [0x7d87f0]
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [eax + 0x7c], 1
push 0x7d87d8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebp + 8]
push eax
call fcn.0049b640
pop ecx
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4aef30
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
push eax
call fcn.004a9b80
pop ecx
push eax
call fcn.004b1c10
pop ecx
mov dword [ebp + 8], eax
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp dword [eax + 0x7c], 0
je 0x4aefb0
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
movzx eax, word [eax + 0x80]
test eax, eax
jne 0x4aefb0
push 0x7d87d8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
dec dword [0x7d87f0]
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [eax + 0x7c], 0
push 0x7d87f8
call fcn.0048dab0
pop ecx
push 0x7d87d8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0x7d87c0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp dword [eax + 0x1654], 0
je 0x4aefe0
push 0x7d87c0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.0048d580
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [eax + 0x1658], 1
push 0x7d87c0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0x10
movzx eax, word [ebp + 0xc]
push eax
push 1
call fcn.004ae510
add esp, 0x1c
push 0
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 0
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
push 0
mov eax, esi
cmp eax, 0xffffffff
je 0x4af054
mov edi, 1
jmp 0x4af056
xor edi, edi
push edi
call fcn.004be070
add esp, 8
mov eax, esi
mov ebx, eax
push 0x7d87c0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [eax + 0x1658], 0
push 0x7d87c0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp dword [eax + 0x7c], 0
jne 0x4af106
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
movzx eax, word [eax + 0x80]
test eax, eax
jne 0x4af106
push 0x7d87d8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
jmp 0x4af0d9
push 0xffffffffffffffff
push 0x7d87d8
push 0x7d87f8
call fcn.0048db80
add esp, 0xc
mov eax, dword [0x7d87f4]
test eax, eax
jne 0x4af0c5
inc dword [0x7d87f0]
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [eax + 0x7c], 1
push 0x7d87d8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebp + 8]
push eax
call fcn.0049b640
pop ecx
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4af120
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
push eax
call fcn.004a9b80
pop ecx
push eax
call fcn.004b1c10
pop ecx
mov dword [ebp + 8], eax
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp dword [eax + 0x7c], 0
je 0x4af1a0
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
movzx eax, word [eax + 0x80]
test eax, eax
jne 0x4af1a0
push 0x7d87d8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
dec dword [0x7d87f0]
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [eax + 0x7c], 0
push 0x7d87f8
call fcn.0048dab0
pop ecx
push 0x7d87d8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0x7d87c0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp dword [eax + 0x1654], 0
je 0x4af1d0
push 0x7d87c0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.0048d580
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [eax + 0x1658], 1
push 0x7d87c0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
movzx eax, word [ebp + 0x10]
push eax
movzx eax, word [ebp + 0xc]
push eax
push 1
call fcn.004ae510
add esp, 0x1c
push 0
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 0
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
push 0
mov eax, esi
cmp eax, 0xffffffff
je 0x4af247
mov edi, 1
jmp 0x4af249
xor edi, edi
push edi
call fcn.004be070
add esp, 8
mov eax, esi
mov ebx, eax
push 0x7d87c0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [eax + 0x1658], 0
push 0x7d87c0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp dword [eax + 0x7c], 0
jne 0x4af2f9
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
movzx eax, word [eax + 0x80]
test eax, eax
jne 0x4af2f9
push 0x7d87d8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
jmp 0x4af2cc
push 0xffffffffffffffff
push 0x7d87d8
push 0x7d87f8
call fcn.0048db80
add esp, 0xc
mov eax, dword [0x7d87f4]
test eax, eax
jne 0x4af2b8
inc dword [0x7d87f0]
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [eax + 0x7c], 1
push 0x7d87d8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebp + 8]
push eax
call fcn.0049b640
pop ecx
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4af310
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp dword [eax + 0x7c], 0
je 0x4af376
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
movzx eax, word [eax + 0x80]
test eax, eax
jne 0x4af376
push 0x7d87d8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
dec dword [0x7d87f0]
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [eax + 0x7c], 0
push 0x7d87f8
call fcn.0048dab0
pop ecx
push 0x7d87d8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0x7d87c0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp dword [eax + 0x1654], 0
je 0x4af3a6
push 0x7d87c0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.0048d580
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [eax + 0x1658], 1
push 0x7d87c0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebp + 8]
push eax
call fcn.004ae4c0
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push eax
call fcn.004be070
add esp, 8
push 0x7d87c0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [eax + 0x1658], 0
push 0x7d87c0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp dword [eax + 0x7c], 0
jne 0x4af486
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
movzx eax, word [eax + 0x80]
test eax, eax
jne 0x4af486
push 0x7d87d8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
jmp 0x4af459
push 0xffffffffffffffff
push 0x7d87d8
push 0x7d87f8
call fcn.0048db80
add esp, 0xc
mov eax, dword [0x7d87f4]
test eax, eax
jne 0x4af445
inc dword [0x7d87f0]
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [eax + 0x7c], 1
push 0x7d87d8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop ebp
ret
Function at 0x4af510
Capabilities:
Get thread local storage value
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
push esi
push edi
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp dword [eax + 0x7c], 0
je 0x4af57c
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
movzx eax, word [eax + 0x80]
test eax, eax
jne 0x4af57c
push 0x7d87d8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
dec dword [0x7d87f0]
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [eax + 0x7c], 0
push 0x7d87f8
call fcn.0048dab0
pop ecx
push 0x7d87d8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0x7d87c0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp dword [eax + 0x1654], 0
je 0x4af5ac
push 0x7d87c0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.0048d580
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [eax + 0x1658], 1
push 0x7d87c0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebp + 8]
push eax
call fcn.004ae4c0
pop ecx
push 0
lea edx, [ebp - 4]
push edx
movzx edx, word [ebp + 0x10]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov esi, eax
push 0
push esi
call fcn.004be070
add esp, 8
push 0x7d87c0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [eax + 0x1658], 0
push 0x7d87c0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test esi, esi
je 0x4af632
mov eax, dword [ebp - 4]
movzx edi, ax
jmp 0x4af634
xor edi, edi
mov eax, edi
mov ebx, eax
movzx eax, bx
or edx, 0xffffffff
movzx edx, dx
cmp eax, edx
jne 0x4af648
xor bx, bx
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp dword [eax + 0x7c], 0
jne 0x4af6bf
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
movzx eax, word [eax + 0x80]
test eax, eax
jne 0x4af6bf
push 0x7d87d8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
jmp 0x4af692
push 0xffffffffffffffff
push 0x7d87d8
push 0x7d87f8
call fcn.0048db80
add esp, 0xc
mov eax, dword [0x7d87f4]
test eax, eax
jne 0x4af67e
inc dword [0x7d87f0]
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [eax + 0x7c], 1
push 0x7d87d8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
movzx eax, bx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4af6d0
Capabilities:
Clear file content
Get thread local storage value
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
push esi
push edi
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp dword [eax + 0x7c], 0
je 0x4af73c
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
movzx eax, word [eax + 0x80]
test eax, eax
jne 0x4af73c
push 0x7d87d8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
dec dword [0x7d87f0]
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [eax + 0x7c], 0
push 0x7d87f8
call fcn.0048dab0
pop ecx
push 0x7d87d8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [ebp - 4], 0
push 0x7d87c0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp dword [eax + 0x1654], 0
je 0x4af773
push 0x7d87c0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.0048d580
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [eax + 0x1658], 1
push 0x7d87c0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp word [ebp + 0x10], 0
je 0x4af7bf
mov eax, dword [ebp + 8]
push eax
call fcn.004ae4c0
pop ecx
push 0
lea edx, [ebp - 4]
push edx
movzx edx, word [ebp + 0x10]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov esi, eax
jmp 0x4af7d9
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push eax
call fcn.004ae4c0
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov esi, eax
push 0
push esi
call fcn.004be070
add esp, 8
push 0x7d87c0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [eax + 0x1658], 0
push 0x7d87c0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test esi, esi
je 0x4af81c
mov eax, dword [ebp - 4]
movzx edi, ax
jmp 0x4af81e
xor edi, edi
mov eax, edi
mov ebx, eax
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp dword [eax + 0x7c], 0
jne 0x4af899
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
movzx eax, word [eax + 0x80]
test eax, eax
jne 0x4af899
push 0x7d87d8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
jmp 0x4af86c
push 0xffffffffffffffff
push 0x7d87d8
push 0x7d87f8
call fcn.0048db80
add esp, 0xc
mov eax, dword [0x7d87f4]
test eax, eax
jne 0x4af858
inc dword [0x7d87f0]
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [eax + 0x7c], 1
push 0x7d87d8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
movzx eax, bx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4af8b0
Capabilities:
Get thread local storage value
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp dword [eax + 0x7c], 0
je 0x4af919
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
movzx eax, word [eax + 0x80]
test eax, eax
jne 0x4af919
push 0x7d87d8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
dec dword [0x7d87f0]
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [eax + 0x7c], 0
push 0x7d87f8
call fcn.0048dab0
pop ecx
push 0x7d87d8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0x7d87c0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp dword [eax + 0x1654], 0
je 0x4af949
push 0x7d87c0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.0048d580
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [eax + 0x1658], 1
push 0x7d87c0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebp + 8]
push eax
call fcn.004ae4c0
pop ecx
push 0
lea edx, [ebp - 4]
push edx
mov edx, dword [ebp + 0x10]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
push eax
call fcn.004be070
add esp, 8
push 0x7d87c0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [eax + 0x1658], 0
push 0x7d87c0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp dword [eax + 0x7c], 0
jne 0x4afa37
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
movzx eax, word [eax + 0x80]
test eax, eax
jne 0x4afa37
push 0x7d87d8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
jmp 0x4afa0a
push 0xffffffffffffffff
push 0x7d87d8
push 0x7d87f8
call fcn.0048db80
add esp, 0xc
mov eax, dword [0x7d87f4]
test eax, eax
jne 0x4af9f6
inc dword [0x7d87f0]
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [eax + 0x7c], 1
push 0x7d87d8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x4afa40
Capabilities:
Clear file content
Get thread local storage value
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp dword [eax + 0x7c], 0
je 0x4afaa9
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
movzx eax, word [eax + 0x80]
test eax, eax
jne 0x4afaa9
push 0x7d87d8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
dec dword [0x7d87f0]
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [eax + 0x7c], 0
push 0x7d87f8
call fcn.0048dab0
pop ecx
push 0x7d87d8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x4afae3
mov eax, dword [ebp + 8]
push eax
call fcn.004ae4c0
pop ecx
push 0
lea edx, [ebp - 4]
push edx
mov edx, dword [ebp + 0x10]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
push eax
call fcn.004be070
add esp, 8
jmp 0x4afaff
mov eax, dword [ebp + 8]
push eax
call fcn.004ae4c0
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push 0
push eax
call fcn.004be070
add esp, 8
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp dword [eax + 0x7c], 0
jne 0x4afb76
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
movzx eax, word [eax + 0x80]
test eax, eax
jne 0x4afb76
push 0x7d87d8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
jmp 0x4afb49
push 0xffffffffffffffff
push 0x7d87d8
push 0x7d87f8
call fcn.0048db80
add esp, 0xc
mov eax, dword [0x7d87f4]
test eax, eax
jne 0x4afb35
inc dword [0x7d87f0]
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [eax + 0x7c], 1
push 0x7d87d8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret