joyce8/EMBER2024-capa huggingface dataset:
Function at 0x478620
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1224
call fcn.004c2ee0
mov eax, dword [0x538a60]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x121c], eax
mov eax, dword [ebp + 0x14]
mov ebx, edx
mov dword [ebp - 0x1220], eax
push edi
test esi, esi
je 0x47874b
cmp dword [esi], 0x10101010
jne 0x47874b
push 0x1210
lea eax, [ebp - 0x1218]
push 0
push eax
call fcn.004c13c0
add esp, 0xc
call fcn.004802f0
mov dword [ebp - 0x14], eax
test eax, eax
je 0x478798
test bl, 3
jne 0x478692
or ebx, 3
lea edi, [esi + 0x9c]
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esi + 0xb4], 0
jne 0x4786ca
mov eax, dword [ebp + 8]
cmp eax, dword [esi + 0x18]
jne 0x4786ca
mov eax, dword [ebp + 0xc]
cmp eax, dword [esi + 0x1c]
jne 0x4786ca
movzx eax, byte [ebp - 0x10]
test bl, 4
mov ecx, 1
cmovne eax, ecx
mov byte [ebp - 0x10], al
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push dword [ebp - 0x1220]
lea edx, [ebp - 0x1218]
mov ecx, esi
push dword [ebp - 0x121c]
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004780d0
add esp, 0x14
mov edi, eax
cmp byte [ebp - 0x10], 1
jne 0x47871e
test edi, edi
je 0x478711
mov ecx, dword [ebp - 0xc]
call fcn.004810e0
mov dword [ebp - 0xc], 0
jmp 0x47871e
lea edx, [ebp - 0x1218]
mov ecx, esi
call fcn.00478070
mov esi, dword [ebp - 0x14]
push dword [esi]
call fcn.004bae83
add esp, 4
push esi
call fcn.004bae83
add esp, 4
cmp edi, 2
sete al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004bae74
mov esp, ebp
pop ebp
ret
mov edi, dword [0x56161c]
push edi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x478785
push 0xc08
call fcn.004bb5d5
add esp, 4
mov esi, eax
push 0xc08
push 0
push esi
call fcn.004c13c0
add esp, 0xc
push esi
push edi
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push str.tsk_fs_dir_walk:_called_with_NULL_or_unallocated_structures
mov dword [esi], 0x8000006
call fcn.004768f0
add esp, 4
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004bae74
mov esp, ebp
pop ebp
ret

Function at 0x479020
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
push esi
push edi
test ecx, ecx
jne 0x479087
call fcn.00476ab0
mov edi, dword [0x56161c]
push edi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x47906e
push 0xc08
call fcn.004bb5d5
add esp, 4
mov esi, eax
push 0xc08
push 0
push esi
call fcn.004c13c0
add esp, 0xc
push esi
push edi
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push str.tsk_fs_open_img:_Null_image_handle
mov dword [esi], 0x8000006
call fcn.004768f0
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
ret
push 0
push 1
push edx
push eax
push ecx
call fcn.0048e2a0
add esp, 0x14
pop edi
pop esi
pop ebp
ret
Function at 0x4795e0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, ecx
test edi, edi
je 0x479638
cmp dword [edi], 0x10101010
jne 0x479638
mov ecx, 0x10
call fcn.00479b80
mov esi, eax
test esi, esi
je 0x479682
push dword [ebp + 0xc]
mov dword [esi + 0xc], edi
push dword [ebp + 8]
mov dword [esi], 0x11212212
mov eax, dword [edi + 0xe0]
push esi
push edi
call eax
add esp, 0x10
test al, al
je 0x479632
push esi
call fcn.004bae83
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
ret
mov eax, esi
pop edi
pop esi
pop ebp
ret
mov edi, dword [0x56161c]
push edi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x47966f
push 0xc08
call fcn.004bb5d5
push 0xc08
mov esi, eax
push 0
push esi
call fcn.004c13c0
add esp, 0x10
push esi
push edi
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push str.tsk_fs_file_open_meta:_called_with_NULL_or_unallocated_structures
mov dword [esi], 0x8000006
call fcn.004768f0
add esp, 4
pop edi
xor eax, eax
pop esi
pop ebp
ret

Function at 0x479690
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
push edi
mov edi, edx
test ecx, ecx
je 0x47971e
mov eax, dword [ecx + 8]
test eax, eax
je 0x47971e
mov edx, dword [ecx + 0xc]
test edx, edx
je 0x47971e
cmp dword [eax], 0x13524635
je 0x4796d2
mov ecx, 0x8000006
call fcn.00476850
push edi
push str._s:_called_with_unallocated_structures
call fcn.004768f0
add esp, 8
mov eax, 1
pop edi
pop esi
ret
mov esi, dword [eax + 0xcc]
cmp esi, 2
jne 0x4796fb
mov ecx, 0x8000009
call fcn.00476850
push edi
push str._s:_called_for_file_with_corrupt_data
call fcn.004768f0
add esp, 8
lea eax, [esi - 1]
pop edi
pop esi
ret
cmp esi, 1
jne 0x479709
cmp dword [eax + 0xc8], 0
jne 0x479719
mov eax, dword [edx + 0xe8]
push ecx
call eax
add esp, 4
test al, al
jne 0x47976b
pop edi
xor eax, eax
pop esi
ret
push ebx
mov ebx, dword [0x56161c]
push ebx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x479756
push 0xc08
call fcn.004bb5d5
push 0xc08
mov esi, eax
push 0
push esi
call fcn.004c13c0
add esp, 0x10
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push edi
push str._s:_called_with_NULL_pointers
mov dword [esi], 0x8000006
call fcn.004768f0
add esp, 8
pop ebx
pop edi
mov eax, 1
pop esi
ret

Function at 0x479780
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
mov edx, str.tsk_fs_file_attr_getsize
mov esi, ecx
call fcn.00479690
test eax, eax
je 0x47979a
call fcn.00476ab0
xor eax, eax
pop esi
ret
mov ecx, dword [esi + 8]
pop esi
mov ecx, dword [ecx + 0xc8]
jmp fcn.00480280

Function at 0x4797b0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
push edi
mov edi, edx
mov esi, ecx
mov edx, str.tsk_fs_file_attr_get_idx
call fcn.00479690
test eax, eax
je 0x4797c9
pop edi
xor eax, eax
pop esi
ret
mov ecx, dword [esi + 8]
mov edx, edi
pop edi
pop esi
mov ecx, dword [ecx + 0xc8]
jmp fcn.004801b0
Function at 0x4797e0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
mov edx, str.tsk_fs_file_attr_get
mov esi, ecx
call fcn.00479690
test eax, eax
je 0x4797f5
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0xc]
push esi
mov eax, dword [eax + 0xe4]
call eax
mov ecx, dword [esi + 8]
add esp, 4
mov edx, eax
mov ecx, dword [ecx + 0xc8]
pop esi
jmp fcn.0047fea0

Function at 0x479820
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, edx
mov esi, ecx
mov edx, str.tsk_fs_file_attr_get_type
call fcn.00479690
test eax, eax
je 0x47983d
pop edi
xor eax, eax
pop esi
pop ebp
ret
cmp byte [ebp + 0xc], 0
mov edx, edi
mov ecx, dword [esi + 8]
mov ecx, dword [ecx + 0xc8]
je 0x47985d
push dword [ebp + 8]
call fcn.0047ffa0
add esp, 4
pop edi
pop esi
pop ebp
ret
pop edi
pop esi
pop ebp
jmp fcn.0047fea0

Function at 0x479870
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, edx
mov esi, ecx
call fcn.00476ab0
test esi, esi
je 0x479929
mov eax, dword [esi + 8]
test eax, eax
je 0x479929
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x479929
cmp dword [ecx], 0x10101010
jne 0x47990b
cmp dword [eax], 0x13524635
jne 0x47990b
cmp dword [0x561618], 0
je 0x4798d2
push dword [eax + 0xc]
push dword [eax + 8]
push str.tsk_fs_file_walk:_Processing_file__llu_n
call fcn.004bdd06
add eax, 0x40
push eax
call fcn.00479b20
add esp, 0x10
mov edi, dword [ebp + 0xc]
mov edx, ebx
mov eax, edi
mov ecx, esi
shr eax, 1
not al
and al, 1
movzx eax, al
push eax
push dword [ebp + 8]
call fcn.00479820
add esp, 8
test eax, eax
je 0x479973
push dword [ebp + 0x14]
mov edx, edi
mov ecx, eax
push dword [ebp + 0x10]
call fcn.004900e0
add esp, 8
pop edi
pop esi
pop ebx
pop ebp
ret
mov ecx, 0x8000006
call fcn.00476850
push str.tsk_fs_file_walk:_called_with_unallocated_structures
call fcn.004768f0
add esp, 4
mov al, 1
pop edi
pop esi
pop ebx
pop ebp
ret
mov edi, dword [0x56161c]
push edi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x479960
push 0xc08
call fcn.004bb5d5
push 0xc08
mov esi, eax
push 0
push esi
call fcn.004c13c0
add esp, 0x10
push esi
push edi
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push str.tsk_fs_file_walk:_called_with_NULL_pointers
mov dword [esi], 0x8000006
call fcn.004768f0
add esp, 4
pop edi
pop esi
mov al, 1
pop ebx
pop ebp
ret
Function at 0x479980
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, edx
mov esi, ecx
call fcn.00476ab0
test esi, esi
je 0x479a17
mov eax, dword [esi + 8]
test eax, eax
je 0x479a17
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x479a17
cmp dword [ecx], 0x10101010
jne 0x4799fa
cmp dword [eax], 0x13524635
jne 0x4799fa
cmp dword [0x561618], 0
je 0x4799d9
push dword [eax + 0xc]
push dword [eax + 8]
push str.tsk_fs_file_walk:_Processing_file__llu_n
call fcn.004bdd06
add eax, 0x40
push eax
call fcn.00479b20
add esp, 0x10
mov ecx, esi
call fcn.004797e0
test eax, eax
je 0x479a61
push dword [ebp + 0xc]
mov edx, edi
mov ecx, eax
push dword [ebp + 8]
call fcn.004900e0
add esp, 8
pop edi
pop esi
pop ebp
ret
mov ecx, 0x8000006
call fcn.00476850
push str.tsk_fs_file_walk:_called_with_unallocated_structures
call fcn.004768f0
add esp, 4
mov al, 1
pop edi
pop esi
pop ebp
ret
mov edi, dword [0x56161c]
push edi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x479a4e
push 0xc08
call fcn.004bb5d5
push 0xc08
mov esi, eax
push 0
push esi
call fcn.004c13c0
add esp, 0x10
push esi
push edi
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push str.tsk_fs_file_walk:_called_with_NULL_pointers
mov dword [esi], 0x8000006
call fcn.004768f0
add esp, 4
pop edi
mov al, 1
pop esi
pop ebp
ret

Function at 0x479b80
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, ecx
push edi
push ebx
call fcn.004bb5d5
mov edi, eax
add esp, 4
test edi, edi
jne 0x479c04
push esi
call fcn.00476ab0
mov eax, dword [0x56161c]
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x479bd7
push 0xc08
call fcn.004bb5d5
push 0xc08
mov esi, eax
push edi
push esi
call fcn.004c13c0
add esp, 0x10
push esi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [esi], 0x1000000
call fcn.004bf304
push ebx
push dword [eax]
call fcn.004bf268
add esp, 4
push eax
push str.tsk_malloc:__s___Iu_requested_
call fcn.004768f0
add esp, 0xc
mov eax, edi
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
push ebx
push 0
push edi
call fcn.004c13c0
add esp, 0xc
mov eax, edi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x479c20
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, edx
push edi
push eax
push ecx
mov dword [ebp - 4], eax
call fcn.004bb52a
mov edi, eax
add esp, 8
test edi, edi
jne 0x479ca1
push ebx
push esi
call fcn.00476ab0
mov ebx, dword [0x56161c]
push ebx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x479c77
push 0xc08
call fcn.004bb5d5
push 0xc08
mov esi, eax
push edi
push esi
call fcn.004c13c0
add esp, 0x10
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [esi], 0x1000000
call fcn.004bf304
push dword [ebp - 4]
push dword [eax]
call fcn.004bf268
add esp, 4
push eax
push str.tsk_realloc:__s___Iu_requested_
call fcn.004768f0
add esp, 0xc
mov eax, edi
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x47fc70
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov eax, ecx
push esi
mov esi, edx
test eax, eax
jne 0x47fcce
push edi
call fcn.00476ab0
mov edi, dword [0x56161c]
push edi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x47fcb6
push 0xc08
call fcn.004bb5d5
push 0xc08
mov esi, eax
push 0
push esi
call fcn.004c13c0
add esp, 0x10
push esi
push edi
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push str.Null_list_in_tsk_fs_attrlist_add
mov dword [esi], 0x8000006
call fcn.004768f0
add esp, 4
mov al, 1
pop edi
pop esi
ret
or dword [esi + 8], 1
mov ecx, dword [eax]
test ecx, ecx
jne 0x47fcde
mov dword [eax], esi
xor al, al
pop esi
ret
mov edx, dword [esi + 0x14]
cmp dword [ecx + 0x14], edx
jne 0x47fcf0
mov ax, word [ecx + 0x18]
cmp ax, word [esi + 0x18]
je 0x47fd00
mov eax, dword [ecx]
test eax, eax
je 0x47fd28
mov ecx, eax
test ecx, ecx
jne 0x47fce1
xor al, al
pop esi
ret
call fcn.00476ab0
mov ecx, 0x8000006
call fcn.00476850
movzx eax, word [esi + 0x18]
push eax
push dword [esi + 0x14]
push str.datalist_add:_Type__d_and_Id__d_already_in_list
call fcn.004768f0
add esp, 0xc
mov al, 1
pop esi
ret
mov dword [ecx], esi
xor al, al
pop esi
ret

Function at 0x47fd30
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebx
push esi
mov ebx, ecx
xor eax, eax
push edi
mov edi, edx
test ebx, ebx
jne 0x47fd91
call fcn.00476ab0
mov edi, dword [0x56161c]
push edi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x47fd78
push 0xc08
call fcn.004bb5d5
push 0xc08
mov esi, eax
push ebx
push esi
call fcn.004c13c0
add esp, 0x10
push esi
push edi
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push str.Null_list_in_tsk_fs_attrlist_getnew__
mov dword [esi], 0x8000006
call fcn.004768f0
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
ret
cmp edi, 2
je 0x47fdbd
cmp edi, 4
je 0x47fdbd
call fcn.00476ab0
mov ecx, 0x8000006
call fcn.00476850
push str.Invalid_Type_in_tsk_fs_attrlist_getnew__
call fcn.004768f0
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
ret
mov esi, dword [ebx]
test esi, esi
je 0x47fdff
cmp dword [esi + 8], 0
jne 0x47fde7
cmp edi, 2
jne 0x47fddc
cmp dword [esi + 0x28], 0
jne 0x47fdf3
test eax, eax
jne 0x47fde7
mov eax, esi
jmp 0x47fde7
cmp dword [esi + 0x54], 0
jne 0x47fdf3
test eax, eax
cmove eax, esi
mov esi, dword [esi]
test esi, esi
jne 0x47fdc3
test eax, eax
je 0x47fdff
mov esi, eax
or edi, 1
mov eax, esi
mov dword [esi + 8], edi
pop edi
pop esi
pop ebx
ret
mov ecx, edi
call fcn.0048f220
mov esi, eax
test esi, esi
je 0x47fd8b
mov edx, esi
mov ecx, ebx
call fcn.0047fc70
test al, al
je 0x47fdf3
mov ecx, esi
call fcn.0048f2d0
pop edi
pop esi
xor eax, eax
pop ebx
ret
Function at 0x47fea0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebx
push esi
xor esi, esi
mov ebx, edx
push edi
test ecx, ecx
jne 0x47ff00
call fcn.00476ab0
mov edi, dword [0x56161c]
push edi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x47fee7
push 0xc08
call fcn.004bb5d5
push 0xc08
mov esi, eax
push 0
push esi
call fcn.004c13c0
add esp, 0x10
push esi
push edi
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push str.tsk_fs_attrlist_get:_Null_list_pointer
mov dword [esi], 0x8000006
call fcn.004768f0
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
ret
mov ecx, dword [ecx]
test ecx, ecx
je 0x47ff46
test byte [ecx + 8], 1
je 0x47ff30
mov eax, dword [ecx + 0x14]
cmp eax, ebx
jne 0x47ff30
cmp eax, 0x80
jne 0x47ff20
cmp dword [ecx + 0xc], 0
je 0x47ff40
test esi, esi
je 0x47ff2e
mov ax, word [esi + 0x18]
cmp ax, word [ecx + 0x18]
jbe 0x47ff30
mov esi, ecx
mov ecx, dword [ecx]
test ecx, ecx
jne 0x47ff06
test esi, esi
je 0x47ff46
pop edi
mov eax, esi
pop esi
pop ebx
ret
pop edi
pop esi
mov eax, ecx
pop ebx
ret
mov edi, dword [0x56161c]
push edi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x47ff7d
push 0xc08
call fcn.004bb5d5
push 0xc08
mov esi, eax
push 0
push esi
call fcn.004c13c0
add esp, 0x10
push esi
push edi
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push ebx
push str.tsk_fs_attrlist_get:_Attribute__d_not_found
mov dword [esi], 0x8000011
call fcn.004768f0
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
ret

Function at 0x47ffa0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, edx
test ecx, ecx
jne 0x480003
call fcn.00476ab0
mov edi, dword [0x56161c]
push edi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x47ffe8
push 0xc08
call fcn.004bb5d5
push 0xc08
mov esi, eax
push 0
push esi
call fcn.004c13c0
add esp, 0x10
push esi
push edi
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push str.tsk_fs_attrlist_get_id:_Null_list_pointer
mov dword [esi], 0x8000006
call fcn.004768f0
add esp, 4
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ecx]
mov si, word [ebp + 8]
test eax, eax
je 0x480027
lea ecx, [ecx]
test byte [eax + 8], 1
je 0x480021
cmp dword [eax + 0x14], edi
jne 0x480021
cmp word [eax + 0x18], si
je 0x48007e
mov eax, dword [eax]
test eax, eax
jne 0x480010
mov eax, dword [0x56161c]
push ebx
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test ebx, ebx
jne 0x480063
push 0xc08
call fcn.004bb5d5
push 0xc08
mov ebx, eax
push 0
push ebx
call fcn.004c13c0
add esp, 0x10
push ebx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
movzx eax, si
push eax
push edi
push str.tsk_fs_attrlist_get_id:_Attribute__d__d_not_found
mov dword [ebx], 0x8000011
call fcn.004768f0
add esp, 0xc
xor eax, eax
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x480090
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
xor esi, esi
push edi
test ecx, ecx
jne 0x4800ec
call fcn.00476ab0
mov edi, dword [0x56161c]
push edi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x4800d4
push 0xc08
call fcn.004bb5d5
push 0xc08
mov esi, eax
push 0
push esi
call fcn.004c13c0
add esp, 0x10
push esi
push edi
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push str.tsk_fs_attrlist_get_name_type:_Null_list_pointer
mov dword [esi], 0x8000006
call fcn.004768f0
add esp, 4
xor eax, eax
pop edi
pop esi
ret
mov edx, dword [ecx]
test edx, edx
je 0x480159
push ebx
test byte [edx + 8], 1
je 0x480149
cmp dword [edx + 0x14], 0xa0
jne 0x480149
mov eax, dword [edx + 0xc]
test eax, eax
je 0x480149
mov ecx, str._SII
mov edi, edi
mov bl, byte [eax]
cmp bl, byte [ecx]
jne 0x480130
test bl, bl
je 0x48012c
mov bl, byte [eax + 1]
cmp bl, byte [ecx + 1]
jne 0x480130
add eax, 2
add ecx, 2
test bl, bl
jne 0x480110
xor eax, eax
jmp 0x480135
sbb eax, eax
or eax, 1
test eax, eax
jne 0x480149
test esi, esi
je 0x480147
mov ax, word [esi + 0x18]
cmp ax, word [edx + 0x18]
jbe 0x480149
mov esi, edx
mov edx, dword [edx]
test edx, edx
jne 0x4800f3
pop ebx
test esi, esi
je 0x480159
pop edi
mov eax, esi
pop esi
ret
mov edi, dword [0x56161c]
push edi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x480190
push 0xc08
call fcn.004bb5d5
push 0xc08
mov esi, eax
push 0
push esi
call fcn.004c13c0
add esp, 0x10
push esi
push edi
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push 0xa0
push str.tsk_fs_attrlist_get:_Attribute__d_not_found
mov dword [esi], 0x8000011
call fcn.004768f0
add esp, 8
xor eax, eax
pop edi
pop esi
ret

Function at 0x4801b0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
xor esi, esi
push edi
mov edi, edx
test ecx, ecx
jne 0x48020e
call fcn.00476ab0
mov edi, dword [0x56161c]
push edi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x4801f6
push 0xc08
call fcn.004bb5d5
push 0xc08
mov esi, eax
push 0
push esi
call fcn.004c13c0
add esp, 0x10
push esi
push edi
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push str.tsk_fs_attrlist_get_idx:_Null_list_pointer
mov dword [esi], 0x8000006
call fcn.004768f0
add esp, 4
xor eax, eax
pop edi
pop esi
ret
mov eax, dword [ecx]
test eax, eax
je 0x480225
test byte [eax + 8], 1
je 0x48021f
cmp esi, edi
je 0x480274
inc esi
mov eax, dword [eax]
test eax, eax
jne 0x480214
push ebx
mov ebx, dword [0x56161c]
push ebx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x48025d
push 0xc08
call fcn.004bb5d5
push 0xc08
mov esi, eax
push 0
push esi
call fcn.004c13c0
add esp, 0x10
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push edi
push str.tsk_fs_attrlist_get_idx:_Attribute_index__d_not_found
mov dword [esi], 0x8000011
call fcn.004768f0
add esp, 8
xor eax, eax
pop ebx
pop edi
pop esi
ret
Function at 0x480280
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
xor eax, eax
test ecx, ecx
jne 0x4802dc
push esi
push edi
call fcn.00476ab0
mov edi, dword [0x56161c]
push edi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x4802c4
push 0xc08
call fcn.004bb5d5
push 0xc08
mov esi, eax
push 0
push esi
call fcn.004c13c0
add esp, 0x10
push esi
push edi
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push str.tsk_fs_attrlist_get_len:_Null_list_pointer
mov dword [esi], 0x8000006
call fcn.004768f0
add esp, 4
xor eax, eax
pop edi
pop esi
ret
mov ecx, dword [ecx]
test ecx, ecx
je 0x4802ef
test byte [ecx + 8], 1
je 0x4802e9
inc eax
mov ecx, dword [ecx]
test ecx, ecx
jne 0x4802e2
ret
Function at 0x487e60
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebx
push esi
push edi
push 0
push 3
mov edi, ecx
call fcn.004795e0
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x487fb7
mov ecx, dword [ebx + 8]
mov edx, 0x70
mov ecx, dword [ecx + 0xc8]
call fcn.0047fea0
mov ecx, eax
test ecx, ecx
jne 0x487ef3
call fcn.00476ab0
mov edi, dword [0x56161c]
push edi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x487ed3
push 0xc08
call fcn.004bb5d5
add esp, 4
mov esi, eax
push 0xc08
push 0
push esi
call fcn.004c13c0
add esp, 0xc
push esi
push edi
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push str.Volume_Info_attribute_not_found_in__Volume
mov dword [esi], 0x8000009
call fcn.004768f0
add esp, 4
mov ecx, ebx
call fcn.00479590
mov al, 1
pop edi
pop esi
pop ebx
ret
test byte [ecx + 8], 4
je 0x487f9b
mov eax, dword [ecx + 0x20]
or eax, dword [ecx + 0x24]
je 0x487f9b
mov esi, dword [ecx + 0x50]
mov al, byte [esi + 8]
cmp al, 1
jne 0x487f2d
cmp byte [esi + 9], 2
jne 0x487f2d
mov ecx, ebx
mov byte [edi + 0x11c], 0x21
call fcn.00479590
xor al, al
pop edi
pop esi
pop ebx
ret
cmp al, 3
jne 0x487f68
cmp byte [esi + 9], 0
jne 0x487f4a
mov ecx, ebx
mov byte [edi + 0x11c], al
call fcn.00479590
xor al, al
pop edi
pop esi
pop ebx
ret
cmp al, 3
jne 0x487f68
cmp byte [esi + 9], 1
jne 0x487f68
mov ecx, ebx
mov byte [edi + 0x11c], 0x13
call fcn.00479590
xor al, al
pop edi
pop esi
pop ebx
ret
call fcn.00476ab0
mov ecx, 0x800000f
call fcn.00476850
movzx eax, byte [esi + 9]
push eax
movzx eax, byte [esi + 8]
push eax
push str.unknown_version:__d._d_n
call fcn.004768f0
add esp, 0xc
mov ecx, ebx
call fcn.00479590
mov al, 1
pop edi
pop esi
pop ebx
ret
call fcn.00476ab0
mov ecx, 0x800000f
call fcn.00476850
push str.load_version:_VINFO_is_a_non_resident_attribute
call fcn.004768f0
add esp, 4
pop edi
pop esi
mov al, 1
pop ebx
ret