joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4598b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
mov ebx, ecx
sub esp, 0x14
mov ecx, dword [ecx]
mov eax, ecx
shr eax, 2
mov eax, dword [eax*4 + 0x4f41e0]
mov dword [esp + 4], eax
mov eax, 0x800
mov edx, eax
sub edx, ecx
shr edx, 2
mov edx, dword [edx*4 + 0x4f41e0]
mov dword [esp + 0xc], edx
mov edx, dword [ebx + 4]
sub eax, edx
mov ecx, edx
shr eax, 2
mov eax, dword [eax*4 + 0x4f41e0]
shr ecx, 2
mov ecx, dword [ecx*4 + 0x4f41e0]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x45996e
mov eax, dword [esp + 0x28]
xor ebp, ebp
mov dword [esp + 8], ecx
mov edx, dword [esp + 0x30]
lea edi, [eax*8]
nop
mov dword [esp], ebp
mov ecx, ebp
xor esi, esi
or ecx, 8
lea esi, [esi]
mov ebp, ecx
shr ecx, 1
and ebp, 1
lea eax, [edi + ecx]
mov eax, dword [ebx + eax*4 + 8]
sub eax, ebp
neg ebp
xor eax, ebp
and eax, 0x7fc
mov ebp, dword [eax + 0x4f41e0]
add esi, ebp
cmp ecx, 1
jne 0x459930
mov eax, dword [esp + 4]
mov ebp, dword [esp]
add esi, eax
mov dword [edx + ebp*4], esi
inc ebp
cmp ebp, 8
je 0x459980
cmp dword [esp + 0x2c], ebp
jne 0x459920
add esp, 0x14
pop ebx
pop esi
pop edi
pop ebp
ret 0xc
cmp dword [esp + 0x2c], 8
mov ecx, dword [esp + 8]
jbe 0x45996e
mov eax, dword [esp + 0xc]
xor ebp, ebp
lea edx, [ecx + eax]
mov eax, dword [esp + 0x2c]
mov dword [esp + 4], edx
mov edx, dword [esp + 0x30]
sub eax, 8
mov dword [esp + 8], eax
lea esi, [esi]
nop
mov dword [esp], ebp
mov ecx, ebp
xor esi, esi
or ecx, 8
lea esi, [esi]
mov ebp, ecx
shr ecx, 1
and ebp, 1
lea eax, [ecx + edi + 0x80]
mov eax, dword [ebx + eax*4 + 8]
sub eax, ebp
neg ebp
xor eax, ebp
and eax, 0x7fc
mov ebp, dword [eax + 0x4f41e0]
add esi, ebp
cmp ecx, 1
jne 0x4599c0
mov ebp, dword [esp]
mov eax, dword [esp + 4]
add esi, eax
cmp ebp, 7
mov dword [edx + ebp*4 + 0x20], esi
je 0x459a0d
inc ebp
cmp dword [esp + 8], ebp
jne 0x4599b0
add esp, 0x14
pop ebx
pop esi
pop edi
pop ebp
ret 0xc
cmp dword [esp + 0x2c], 0x10
jbe 0x45996e
mov eax, dword [esp + 0xc]
xor edi, edi
mov ebp, dword [esp + 0x10]
add ebp, eax
mov eax, dword [esp + 0x2c]
mov dword [esp], ebp
lea edx, [eax - 0x10]
mov dword [esp + 4], edx
mov edx, dword [esp + 0x30]
lea esi, [esi]
lea esi, [esi]
mov ecx, edi
xor esi, esi
or ecx, 0x100
lea esi, [esi]
mov ebp, ecx
shr ecx, 1
and ebp, 1
mov eax, dword [ebx + ecx*4 + 0x408]
sub eax, ebp
neg ebp
xor eax, ebp
and eax, 0x7fc
mov ebp, dword [eax + 0x4f41e0]
add esi, ebp
cmp ecx, 1
jne 0x459a50
mov eax, dword [esp]
add esi, eax
mov dword [edx + edi*4 + 0x40], esi
inc edi
cmp dword [esp + 4], edi
jne 0x459a40
add esp, 0x14
pop ebx
pop esi
pop edi
pop ebp
ret 0xc
Function at 0x45cca0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov eax, ecx
push edi
add eax, 0x28b30
push esi
push ebx
mov ebx, 4
sub esp, 0x210
mov dword [esp + 0xc], ecx
mov dword [esp + 4], eax
nop
movzx edx, byte [ebx + 0x4f39e0]
mov ebp, 0x3fffffff
mov edi, ebx
xor esi, esi
mov eax, edx
mov ecx, edx
and al, 1
sub ebp, edx
shr ecx, 1
or al, 2
dec ecx
movzx eax, al
shl eax, cl
sub edi, eax
add ebp, eax
test ecx, ecx
je 0x45cd34
mov dword [esp + 8], ebx
mov edx, 1
mov dword [esp], ecx
lea esi, [esi]
lea esi, [esi]
mov ebx, dword [esp + 4]
lea eax, [ebp + edx]
mov ecx, edi
and ecx, 1
add edx, edx
shr edi, 1
or edx, ecx
mov eax, dword [ebx + eax*4]
mov ebx, ecx
neg ebx
sub eax, ecx
xor eax, ebx
and eax, 0x7fc
mov ebx, dword [eax + 0x4f41e0]
add esi, ebx
dec dword [esp]
jne 0x45cd00
mov ebx, dword [esp + 8]
mov dword [esp + ebx*4 + 0x10], esi
inc ebx
cmp ebx, 0x80
jne 0x45ccc0
mov ebp, dword [esp + 0xc]
xor eax, eax
lea esi, [ebp + 0x32e94]
lea ecx, [ebp + 0x33294]
mov ebx, dword [ebp + 0x33ad8]
mov edi, eax
xor edx, edx
shl edi, 6
test ebx, ebx
je 0x45cdf6
mov dword [esp + 4], eax
mov eax, edx
mov dword [esp + 8], ecx
mov ecx, esi
lea esi, [esi]
nop
mov dword [esp], eax
mov ebx, eax
xor esi, esi
or ebx, 0x40
lea esi, [esi]
mov edx, ebx
shr ebx, 1
and edx, 1
lea eax, [ebx + edi + 0xa1cc]
mov eax, dword [ebp + eax*4]
sub eax, edx
neg edx
xor eax, edx
and eax, 0x7fc
mov edx, dword [eax + 0x4f41e0]
add esi, edx
cmp ebx, 1
jne 0x45cd90
mov eax, dword [esp]
mov dword [ecx + eax*4], esi
inc eax
mov ebx, dword [ebp + 0x33ad8]
cmp eax, ebx
jb 0x45cd80
cmp ebx, 0xe
mov esi, ecx
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
jbe 0x45cdf6
mov edx, 0xe
nop
mov ebx, edx
shr ebx, 1
sub ebx, 5
shl ebx, 6
add dword [esi + edx*4], ebx
inc edx
cmp edx, dword [ebp + 0x33ad8]
jb 0x45cde0
xor edx, edx
mov ebx, dword [esi + edx*4]
mov dword [ecx + edx*4], ebx
inc edx
cmp edx, 4
jne 0x45cdf8
lea esi, [esi]
lea esi, [esi]
nop
movzx edi, byte [edx + 0x4f39e0]
mov ebx, dword [esp + edx*4 + 0x10]
add ebx, dword [esi + edi*4]
mov dword [ecx + edx*4], ebx
inc edx
cmp edx, 0x80
jne 0x45ce10
inc eax
add esi, 0x100
add ecx, 0x200
cmp eax, 4
jne 0x45cd57
mov eax, dword [esp + 0xc]
xor edx, edx
mov dword [eax + 0x33af8], edx
add esp, 0x210
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x45ce60
Capabilities:
Encode data using xor

Disassembly:
push ebp
xor eax, eax
push edi
mov ebp, ecx
push esi
push ebx
sub esp, 8
lea esi, [esi]
nop
mov edi, 4
mov ebx, eax
mov dword [esp + 4], eax
xor esi, esi
mov edx, 1
mov dword [esp], edi
mov eax, dword [ebp + edx*4 + 0x28cf8]
mov ecx, ebx
add edx, edx
shr ebx, 1
and ecx, 1
mov edi, ecx
or edx, ecx
neg edi
sub eax, ecx
xor eax, edi
and eax, 0x7fc
mov edi, dword [eax + 0x4f41e0]
add esi, edi
dec dword [esp]
jne 0x45ce85
mov eax, dword [esp + 4]
mov dword [ebp + eax*4 + 0x33a94], esi
inc eax
cmp eax, 0x10
jne 0x45ce70
xor eax, eax
mov dword [ebp + 0x33ad4], eax
add esp, 8
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x46e030
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.00482990
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.00482990
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x46e090
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x4f4e2c]
test esi, esi
jle 0x46e1b0
mov eax, dword [0x4f4e30]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp ebx, edx
jb 0x46e0c4
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x46e147
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x46e0b0
mov dword [esp], ebx
call fcn.0046ea80
mov edi, eax
test eax, eax
je 0x46e1d7
mov eax, dword [0x4f4e30]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.0046ebc0
mov edx, dword [0x4f4e30]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x46e1b7
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x46e140
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x46e150
add dword [0x4f4e2c], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 4
mov eax, 0x40
mov ecx, dword [esp + 0x20]
cmove eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x4f4e30]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x46e140
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.0046e030
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x46e0ce
mov eax, dword [0x4f4e30]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.0046e030
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.0046e030
lea esi, [esi]
nop
Function at 0x46e6f0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x4f4e48
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x4f4e40]
sub esp, 4
test ebx, ebx
je 0x46e745
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x46e73e
test esi, esi
je 0x46e73e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x46e720
mov dword [esp], 0x4f4e48
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x46ea80
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x400000], 0x5a4d
jne 0x46eaa5
mov ecx, dword [0x40003c]
cmp dword [ecx + 0x400000], 0x4550
lea edx, [ecx + 0x400000]
je 0x46eab0
ret
cmp word [ecx + 0x400018], 0x10b
jne 0x46eaa5
push esi
movzx eax, word [ecx + 0x400014]
push ebx
movzx esi, word [ecx + 0x400006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x400000
test si, si
je 0x46eaf8
xor ecx, ecx
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x46eaee
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x46eafa
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x46eae0
xor eax, eax
pop ebx
pop esi
ret

Function at 0x473680
Capabilities:
Terminate process

Disassembly:
sub esp, 0x1c
mov dword [esp + 8], 0x2c
mov dword [esp + 4], str._stack_smashing_detected_:_terminated_n
mov dword [esp], 2
call sub.msvcrt.dll__write
mov dword [esp], 0x17
call sub.KERNEL32.dll_IsProcessorFeaturePresent
sub esp, 4
test eax, eax
je 0x4736b9
mov ecx, 2
int 0x29
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [esp + 4], 0xc0000409
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push eax
push eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x4850b0
Capabilities:
Print debug messages

Disassembly:
push edi
pxor xmm0, xmm0
lea edi, [esp + 8]
and esp, 0xfffffff0
push dword [edi - 4]
push ebp
mov ebp, esp
push edi
sub esp, 0x84
movups xmmword [ebp - 0x23], xmm0
movdqu xmm1, xmmword [str.Error_cleaning_up_spin_keys_for_thread]
movdqu xmm2, xmmword [0x4ccc30]
movdqu xmm3, xmmword [0x4ccc40]
movups xmmword [ebp - 0x43], xmm0
movups xmmword [ebp - 0x73], xmm1
movups xmmword [ebp - 0x63], xmm2
movups xmmword [ebp - 0x53], xmm3
movups xmmword [ebp - 0x33], xmm0
movups xmmword [ebp - 0x18], xmm0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea edx, [ebp - 0x4c]
mov dword [esp + 8], 0xa
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll__ultoa]
cmp byte [ebp - 0x4c], 0
je 0x485163
mov eax, 0x27
lea edx, [ebp - 0x73]
jmp 0x485135
cmp eax, 0x6a
je 0x485152
mov ecx, eax
add eax, 1
cmp byte [edx + eax], 0
jne 0x485130
cmp eax, 0x6a
je 0x485152
add ecx, 2
mov byte [ebp + eax - 0x73], 0xa
mov byte [ebp + ecx - 0x73], 0
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
sub esp, 4
call sub.msvcrt.dll_abort
mov ecx, 0x28
mov eax, 0x27
lea edx, [ebp - 0x73]
jmp 0x485148

Function at 0x4854f0
Capabilities:
Allocate thread local storage

Disassembly:
cmp dword [0x4f5994], 1
je 0x4855a8
push edi
mov eax, 0x4f5994
push esi
push ebx
sub esp, 0x10
call fcn.00484e90
lea esi, [eax + 4]
mov ebx, eax
mov dword [esp], esi
call fcn.00484710
mov edi, dword [0x4f5994]
test edi, edi
jne 0x485560
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x4aa7e4], eax
cmp eax, 0xffffffff
je 0x4a6815
mov dword [0x4f5994], 1
mov dword [esp], esi
call fcn.00484a50
test ebx, ebx
je 0x48559a
add esp, 0x10
mov eax, ebx
pop ebx
pop esi
pop edi
jmp fcn.00485180
cmp edi, 1
je 0x485542
mov dword [esp], 2
call dword [0x4aa7d0]
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0x4f5994
mov dword [esp + 4], str._once__p_is__d_n
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
mov dword [esp], esi
call fcn.00484a50
test ebx, ebx
jne 0x48554e
add esp, 0x10
pop ebx
pop esi
pop edi
ret
ret
call sub.msvcrt.dll_abort
Function at 0x4855b0
Capabilities:
Set thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
call fcn.00485270
mov edx, dword [entry3]
test edx, edx
je 0x4856e0
mov ebx, eax
test eax, eax
je 0x4856e0
mov dword [eax + 0x24], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebx + 0x3c], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [ebx + 0x1c], 0xffffffff
mov dword [ebx + 0x18], eax
sub esp, 0x10
lea eax, [ebx + 0x38]
mov dword [esp], eax
call fcn.00484d90
cmp eax, 1
je 0x4856ec
mov ebp, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebx + 0x38], 0xffffffff
mov dword [ebx + 0x64], 0
mov dword [ebx + 0x14], 0
call ebp
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov esi, eax
call ebp
lea edx, [ebx + 0x14]
mov dword [esp + 8], edi
mov dword [esp + 0x18], 2
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edx
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
sub esp, 0x1c
test eax, eax
je fcn.004a681a
mov eax, dword [ebx + 0x14]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [ebx + 0x68], 0
mov dword [ebx + 0x6c], eax
movzx eax, byte [ebx + 0x20]
sub esp, 4
and eax, 0xffffffcf
or eax, 0x10
mov byte [ebx + 0x20], al
mov eax, dword [0x4aa7e4]
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
je 0x4856f1
add esp, 0x2c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
add esp, 0x2c
xor ebx, ebx
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
call fcn.004850b0
jmp fcn.004a681a

Function at 0x485700
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
sub esp, 0x1c
call fcn.004854f0
mov eax, dword [0x4aa7e4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x485728
add esp, 0x1c
ret
add esp, 0x1c
jmp fcn.004855b0
Function at 0x4859f0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov eax, dword [esp + 0x34]
test eax, eax
jne 0x485a20
mov ecx, dword [esp + 0x38]
test ecx, ecx
je 0x485af0
add esp, 0x1c
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret 0xc
cmp eax, 1
je 0x485b20
cmp eax, 3
jne 0x485a0b
mov eax, dword [0x4aa7e4]
cmp eax, 0xffffffff
je 0x485a0b
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x485a0b
lea esi, [eax + 0x1c]
lea edi, [eax + 0x38]
test byte [eax + 0x20], 0x30
je 0x485b50
mov eax, dword [eax + 0xb4]
test eax, eax
je 0x485a69
call fcn.00485730
mov eax, dword [ebx + 0x14]
test eax, eax
je 0x485a9b
mov dword [esp], eax
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
call ebp
mov eax, dword [ebx + 0x18]
sub esp, 4
test eax, eax
je 0x485a8d
mov dword [esp], eax
call ebp
sub esp, 4
mov dword [ebx + 0x14], 0
mov dword [ebx + 0x18], 0
mov dword [esp], esi
call fcn.00484bd0
mov dword [esp], edi
call fcn.00484d90
cmp eax, 1
je 0x485c16
mov eax, dword [ebx + 0xb0]
mov dword [ebx + 0x38], 0xffffffff
test eax, eax
je 0x485c0a
mov eax, dword [0x4aa7e4]
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
jmp 0x485a0b
mov eax, dword [0x4f5970]
test eax, eax
je 0x485a0b
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_RemoveVectoredExceptionHandler]
mov dword [0x4f5970], 0
sub esp, 4
jmp 0x485a0b
mov dword [esp + 4], 0x484e00
mov dword [esp], 1
call dword [sym.imp.KERNEL32.dll_AddVectoredExceptionHandler]
sub esp, 8
mov dword [0x4f5970], eax
mov eax, 1
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret 0xc
mov edx, dword [ebx + 0x68]
mov eax, dword [eax + 0x18]
test edx, edx
jne 0x485bc0
test eax, eax
je 0x485b6a
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov eax, dword [ebx + 0xb4]
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x68], 1
test eax, eax
je 0x485b87
call fcn.00485730
test byte [ebx + 0x24], 4
je 0x485c00
mov eax, dword [ebx + 0x14]
mov dword [ebx], 0xdeadbeef
test eax, eax
je 0x485a9b
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebx + 0x14], 0
sub esp, 4
mov dword [esp], esi
call fcn.00484bd0
jmp 0x485aa3
test eax, eax
je 0x485c00
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebx + 0x18], 0
sub esp, 4
mov dword [esp], esi
call fcn.00484bd0
mov dword [esp], edi
call fcn.00484d90
cmp eax, 1
je 0x485c16
mov dword [ebx + 0x38], 0xffffffff
jmp 0x485a0b
mov dword [esp], esi
call fcn.00484bd0
jmp 0x485bdf
mov eax, ebx
call fcn.00485330
jmp 0x485ac9
call fcn.004850b0
lea esi, [esi]
nop
Function at 0x485eb0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, dword [esp + 0x40]
mov edx, dword [esp + 0x44]
mov eax, dword [ebx]
test edx, edx
je 0x485fd0
cmp eax, 1
je 0x485f04
mov eax, ebx
call fcn.00484e90
lea edi, [eax + 4]
mov esi, eax
mov dword [esp], edi
call fcn.00484710
mov ebp, dword [ebx]
test ebp, ebp
je 0x485f10
cmp ebp, 1
jne 0x485fa0
mov dword [esp], edi
call fcn.00484a50
test esi, esi
je 0x485f04
mov eax, esi
call fcn.00485180
add esp, 0x2c
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0x14], 0x485240
mov dword [esp + 0x18], esi
call fcn.004854f0
mov eax, dword [0x4aa7e4]
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [esp], eax
call ebp
sub esp, 4
test eax, eax
je 0x486008
mov eax, dword [eax + 0xc]
mov dword [esp + 0x1c], eax
lock or dword [esp], 0
call fcn.004854f0
mov eax, dword [0x4aa7e4]
mov dword [esp], eax
call ebp
sub esp, 4
test eax, eax
je 0x485ff0
lea edx, [esp + 0x14]
mov dword [eax + 0xc], edx
lock or dword [esp], 0
call dword [esp + 0x44]
call fcn.004854f0
mov eax, dword [0x4aa7e4]
mov dword [esp], eax
call ebp
sub esp, 4
test eax, eax
je 0x485fe0
mov edx, dword [esp + 0x1c]
mov dword [eax + 0xc], edx
mov dword [ebx], 1
jmp 0x485ef1
mov dword [esp], 2
call dword [0x4aa7d0]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], ebx
mov dword [esp + 4], str._once__p_is__d_n
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
jmp 0x485ef1
add esp, 0x2c
mov eax, 0x16
pop ebx
pop esi
pop edi
pop ebp
ret
call fcn.004855b0
test eax, eax
jne 0x485f88
jmp 0x4a682d
call fcn.004855b0
test eax, eax
jne 0x485f62
jmp 0x4a683f
call fcn.004855b0
test eax, eax
jne 0x485f3c
jmp 0x4a6838
mov eax, dword [esp + 0x1c]
mov dword [0], eax
ud2
mov eax, dword [pe_dos_header]
ud2
lea eax, [esp + 0x14]
mov dword [0], eax
ud2

Function at 0x486260
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call fcn.004854f0
mov eax, dword [0x4aa7e4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x4862d8
lea ebp, [ebx + 0x38]
xor edi, edi
mov dword [esp], ebp
call fcn.00484da0
mov eax, dword [ebx + 0x28]
cmp dword [esp + 0x30], eax
jae 0x4862b4
mov eax, dword [ebx + 0x30]
mov edx, dword [esp + 0x30]
cmp byte [eax + edx], 0
je 0x4862b4
mov eax, dword [ebx + 0x2c]
mov edi, dword [eax + edx*4]
mov dword [esp], ebp
call fcn.00484df0
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
call fcn.004855b0
mov ebx, eax
jmp 0x48628b
Function at 0x4862f0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov esi, dword [esp + 0x40]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x14], eax
call fcn.004854f0
mov eax, dword [0x4aa7e4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x486410
lea edi, [ebx + 0x38]
mov dword [esp], edi
call fcn.00484da0
cmp esi, dword [ebx + 0x28]
jae 0x486370
mov edx, dword [ebx + 0x2c]
mov eax, dword [esp + 0x44]
mov dword [edx + esi*4], eax
mov eax, dword [ebx + 0x30]
mov byte [eax + esi], 1
mov dword [esp], edi
call fcn.00484df0
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
sub esp, 4
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
lea ebp, [esi + 1]
lea eax, [ebp*4]
mov dword [esp + 4], eax
mov eax, dword [ebx + 0x2c]
mov dword [esp], eax
call sub.msvcrt.dll_realloc
test eax, eax
je 0x48641c
mov dword [esp + 0x1c], eax
mov dword [esp + 4], ebp
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
call sub.msvcrt.dll_realloc
mov edx, dword [esp + 0x1c]
test eax, eax
mov dword [esp + 0x18], eax
je 0x48641c
mov ecx, dword [ebx + 0x28]
mov eax, ebp
mov dword [esp + 4], 0
mov dword [esp + 0x1c], edx
sub eax, ecx
lea ecx, [edx + ecx*4]
shl eax, 2
mov dword [esp], ecx
mov dword [esp + 8], eax
call sub.msvcrt.dll_memset
mov eax, dword [ebx + 0x28]
mov edx, dword [esp + 0x18]
mov ecx, ebp
mov dword [esp + 4], 0
sub ecx, eax
add eax, edx
mov dword [esp + 8], ecx
mov dword [esp], eax
call sub.msvcrt.dll_memset
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
mov dword [ebx + 0x28], ebp
mov dword [ebx + 0x2c], edx
mov dword [ebx + 0x30], eax
jmp 0x486338
call fcn.004855b0
mov ebx, eax
jmp 0x486325
mov dword [esp], edi
call fcn.00484df0
mov eax, 0xc
jmp 0x486360

Function at 0x4864a0
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 0x1c
call fcn.004854f0
mov eax, dword [0x4aa7e4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x4864c8
mov eax, dword [eax + 0x18]
add esp, 0x1c
ret
call fcn.004855b0
test eax, eax
jne 0x4864bd
add esp, 0x1c
ret

Function at 0x486530
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 0x1c
call fcn.004854f0
mov eax, dword [0x4aa7e4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x486558
add eax, 0xc
add esp, 0x1c
ret
call fcn.004855b0
test eax, eax
jne 0x48654d
jmp 0x486550