joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b11c0
Capabilities:
Impersonate user

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a3642
mov eax, dword fs:[0]
push eax
sub esp, 0x188
mov eax, dword [0x613384]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
test eax, eax
je 0x4b13cf
cmp byte [eax], 0
je 0x4b13cf
push eax
lea ecx, [ebp - 0x194]
call fcn.004b0dc0
mov dword [ebp - 4], 0
mov dword [ebp - 0x17c], 0
mov dword [ebp - 0x178], 0
mov byte [ebp - 0x174], 0
push 1
push 0xffffffffffffffff
push 0xfde9
push esi
lea ecx, [ebp - 0x17c]
mov byte [ebp - 4], 1
call fcn.00481da0
mov esi, dword [ebp - 0x178]
mov dword [ebp - 0x178], 0
mov dword [ebp - 0x17c], 0
mov dword [ebp - 0x184], esi
push 0
call fcn.0054454b
add esp, 4
mov dword [ebp - 0x17c], 0
mov dword [ebp - 0x178], 0
mov dword [ebp - 0x170], 0
mov dword [ebp - 0x16c], 0
mov byte [ebp - 0x168], 0
push 1
push 0xffffffffffffffff
push 0xfde9
push dword [ebp - 0x188]
lea ecx, [ebp - 0x170]
mov byte [ebp - 4], 4
call fcn.00481da0
mov dword [ebp - 0x164], 0
mov dword [ebp - 0x160], 0
mov byte [ebp - 0x15c], 0
push 1
push 0xffffffffffffffff
push 0xfde9
push dword [ebp - 0x18c]
lea ecx, [ebp - 0x164]
mov byte [ebp - 4], 6
call fcn.00481da0
lea eax, [ebp - 0x180]
push eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push esi
push dword [ebp - 0x16c]
push dword [ebp - 0x160]
call dword [sym.imp.ADVAPI32.dll_LogonUserW]
test eax, eax
sete bl
cmp byte [ebp - 0x15c], 0
mov ecx, dword [ebp - 0x160]
mov byte [ebp - 4], 7
je 0x4b134f
test ecx, ecx
je 0x4b134f
mov eax, dword [ebp - 0x164]
add eax, eax
push eax
push ecx
call fcn.0045fa10
mov ecx, dword [ebp - 0x160]
add esp, 8
push ecx
call fcn.0054454b
add esp, 4
mov dword [ebp - 0x164], 0
mov dword [ebp - 0x160], 0
cmp byte [ebp - 0x168], 0
mov ecx, dword [ebp - 0x16c]
mov byte [ebp - 4], 8
je 0x4b139b
test ecx, ecx
je 0x4b139b
mov eax, dword [ebp - 0x170]
add eax, eax
push eax
push ecx
call fcn.0045fa10
mov ecx, dword [ebp - 0x16c]
add esp, 8
push ecx
call fcn.0054454b
add esp, 4
mov byte [ebp - 4], 2
test bl, bl
jne 0x4b13ec
mov esi, dword [ebp - 0x180]
lea ecx, [ebp - 0x184]
call fcn.00474ec0
push dword [ebp - 0x190]
call fcn.0054454b
add esp, 4
mov eax, esi
jmp 0x4b13d1
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00544c5a
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.LogonUser
lea ecx, [ebp - 0x158]
call fcn.0040a6b0
push 0x5f5000
lea eax, [ebp - 0x158]
push eax
call fcn.005461fc
int3
Function at 0x4b1920
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a3783
mov eax, dword fs:[0]
push eax
sub esp, 0x2a4
mov eax, dword [0x613384]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword fs:[0x2c]
mov ecx, dword [0x61a9fc]
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x6181b8]
cmp eax, dword [ecx + 4]
jg 0x4b1af6
mov eax, dword [0x6181b0]
test eax, eax
je 0x4b1ad4
lea ecx, [ebp - 0x2a4]
push ecx
push edi
call eax
test eax, eax
je 0x4b1b50
push dword [ebp - 0x2a4]
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
mov dword [ebp - 0x2b0], esi
mov dword [ebp - 4], 1
test esi, esi
je 0x4b1b78
lea eax, [ebp - 0x2ac]
push eax
push edi
call dword [0x6181b0]
test eax, eax
je 0x4b1ac3
mov eax, dword [ebp - 0x2a4]
cmp eax, dword [ebp - 0x2ac]
jne 0x4b1ac3
lea eax, [ebp - 0x2a0]
mov byte [ebp - 4], 2
push eax
push 0x20008
push esi
mov dword [ebp - 0x2a0], 0
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x4b1a1b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x5b9a94
jmp 0x4b1b5c
xor eax, eax
mov dword [ebp - 0x2a8], eax
mov ecx, dword [ebp - 0x2a0]
mov byte [ebp - 4], 4
test ecx, ecx
je 0x4b1a43
push ecx
lea ecx, [ebp - 0x2a8]
call fcn.00468430
mov eax, dword [ebp - 0x2a8]
mov ecx, dword [ebx]
mov byte [ebp - 4], 5
test ecx, ecx
je 0x4b1aa3
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x4b1aa3
push dword [ebp - 0x2a8]
call fcn.0054454b
mov eax, dword [ebp - 0x2a0]
add esp, 4
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x2a0], 0
test eax, eax
je 0x4b1a84
push eax
call edi
push esi
call edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00544c5a
mov esp, ebp
pop ebp
ret
push str.I_refuse_to_connect:_endpoint_had_unexpected_identity
lea ecx, [ebp - 0x29c]
call fcn.00406130
push 0x5f4710
lea eax, [ebp - 0x29c]
jmp 0x4b1b72
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.process_sync_failed_w_GetNamedPipeServerProcessId
jmp 0x4b1b5c
push str.GetNamedPipeServerProcessId
push str.Kernel32
lea ecx, [ebp - 0x29c]
call fcn.00439540
push 0x5f9fd8
lea eax, [ebp - 0x29c]
jmp 0x4b1b72
push 0x6181b8
call fcn.00544b4e
add esp, 4
cmp dword [0x6181b8], 0xffffffff
jne 0x4b1974
push 0
push str.GetNamedPipeServerProcessId
push str.Kernel32
mov ecx, 0x6181b0
mov dword [ebp - 4], 0
call fcn.00498340
push 0x5a9f10
call fcn.0054492b
push 0x6181b8
mov dword [ebp - 4], 0xffffffff
call fcn.00544b04
add esp, 8
jmp 0x4b1974
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.GetNamedPipeServerProcessId
lea ecx, [ebp - 0x158]
call fcn.0040a6b0
push 0x5f5000
lea eax, [ebp - 0x158]
push eax
call fcn.005461fc
push dword [ebp - 0x2a4]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x158]
push str.OpenProcess__lu_
push eax
call fcn.0045c7b0
add esp, 0x10
lea eax, [ebp - 0x158]
push 0x5fe430
push eax
call fcn.005461fc
int3
Function at 0x4b64f0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a3a80
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x613384]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 0x14]
test edi, edi
je 0x4b652b
mov dword [edi + 4], 0
mov dword [edi + 8], 0
push 0x5c07d8
push dword [ebp + 0xc]
call fcn.00572854
mov esi, eax
add esp, 8
mov dword [ebp - 0x10], esi
test esi, esi
jne 0x4b6576
test edi, edi
je 0x4b654e
mov dword [edi], 0xa
mov eax, dword [ebp + 8]
mov ecx, dword [0x6181d0]
mov dword [eax], ecx
test ecx, ecx
je 0x4b667b
inc dword [ecx + 0x30]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 2
push 0
push esi
call fcn.005664a4
push esi
call fcn.00566c38
mov ebx, eax
add esp, 0x10
mov dword [ebp + 0x14], ebx
test ebx, ebx
jne 0x4b65a7
test edi, edi
je 0x4b659c
mov dword [edi], 3
push esi
call fcn.00568134
add esp, 4
jmp 0x4b654e
push 0
push 0
push esi
call fcn.005664a4
lea eax, [ebx + 4]
push eax
call fcn.004b6eb0
push esi
push dword [ebp + 0x14]
mov ebx, eax
push 1
push ebx
call fcn.00566050
push dword [ebp - 0x10]
mov esi, eax
call fcn.00568134
add esp, 0x24
mov dword [ebx + esi], 0
cmp byte [0x613210], 0
je 0x4b65fd
cmp byte [ebx], 0xef
jne 0x4b6636
cmp byte [ebx + 1], 0xbb
jne 0x4b6636
cmp byte [ebx + 2], 0xbf
jne 0x4b6636
mov ecx, 3
jmp 0x4b6638
mov al, byte [ebx]
cmp al, 0xef
jne 0x4b6625
xor edx, edx
mov ecx, 2
cmp byte [ebx + 1], 0xff
cmovne ecx, edx
cmp byte [ebx + 1], 0xbb
jne 0x4b6638
cmp byte [ebx + 2], 0xbf
mov eax, 3
cmove ecx, eax
jmp 0x4b6638
cmp al, 0xff
jne 0x4b6636
cmp byte [ebx + 1], 0xfe
jne 0x4b6636
mov ecx, 2
jmp 0x4b6638
xor ecx, ecx
push edi
push dword [ebp + 0x10]
lea eax, [ebx + ecx]
push eax
lea eax, [ebp + 0x14]
push eax
call fcn.004b6690
push ebx
call fcn.0056b29c
mov esi, dword [ebp + 8]
add esp, 0x14
mov ecx, dword [ebp + 0x14]
mov dword [esi], ecx
test ecx, ecx
je 0x4b6661
inc dword [ecx + 0x30]
mov dword [ebp - 4], 0
test ecx, ecx
je 0x4b6679
dec dword [ecx + 0x30]
lea ecx, [ebp + 0x14]
push 0
call fcn.004b45c0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4b8580
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a3cf0
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
mov eax, dword [0x613384]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x12
push 1
push 0x5b9a8c
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], 0
call fcn.00467ef0
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], 1
call fcn.00467330
push dword [ebp - 0x10]
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.00467aa0
push dword [ebp - 0x18]
mov bl, al
call fcn.0054454b
push dword [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
call fcn.0054454b
add esp, 8
test bl, bl
jne 0x4b8670
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov byte [ebp - 0x1c], bl
push 1
push 0xffffffffffffffff
push 0xfde9
push dword [ebp + 8]
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], 3
call fcn.00481da0
push 0xa
push 0
push 0
push dword [ebp - 0x20]
mov dword [ebp - 4], 0xffffffff
push 0x5c0964
push 0
mov dword [ebp - 0x14], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jle 0x4b8670
mov bl, 1
jmp 0x4b8672
xor bl, bl
test byte [ebp - 0x14], 1
je 0x4b86a7
cmp byte [ebp - 0x1c], 0
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 4], 4
je 0x4b869e
test ecx, ecx
je 0x4b869e
mov eax, dword [ebp - 0x24]
add eax, eax
push eax
push ecx
call fcn.0045fa10
mov ecx, dword [ebp - 0x20]
add esp, 8
push ecx
call fcn.0054454b
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4b88b0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a3d5e
mov eax, dword fs:[0]
push eax
sub esp, 0x15c
mov eax, dword [0x613384]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x164], esi
mov dword [ebp - 0x168], esi
mov dword [esi], vtable.plat::TimerManager.0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
cmp byte [ebp + 8], 0
mov dword [ebp - 4], 0
mov dword [esi + 0x28], 0
jne 0x4b8945
push dword [0x6181f0]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0x4b897f
push dword [0x6181f0]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
mov dword [esi + 4], eax
push dword [0x6181f0]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00544c5a
mov esp, ebp
pop ebp
ret 4
push 0x13
push str.c:ent_slave_rootworkspace_vncconnect_buildsclients_vnc_7.6.xlabelcon_windows_64_rvcore_baseplat_timermanager.cxx
push str.nested___thrInst
lea ecx, [ebp - 0x160]
call fcn.00465850
push eax
call fcn.004658d0
int3
Function at 0x4b89f0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a3d90
mov eax, dword fs:[0]
push eax
sub esp, 0x154
mov eax, dword [0x613384]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 8], 0
mov dword [esi], vtable.plat::TimerManager.0
je 0x4b8a40
nop dword [eax + eax]
push dword [esi + 8]
mov ecx, esi
call fcn.004b9030
cmp dword [esi + 8], 0
jne 0x4b8a30
mov eax, dword [esi + 0x1c]
cmp eax, dword [esi + 0x20]
je 0x4b8a62
mov ecx, dword [esi + 0x18]
and ecx, eax
mov eax, dword [esi + 0x24]
push dword [eax + ecx*4]
mov ecx, esi
call fcn.004b9030
mov eax, dword [esi + 0x1c]
cmp eax, dword [esi + 0x20]
jne 0x4b8a48
push dword [0x6181f0]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, esi
jne 0x4b8aa4
push dword [esi + 4]
push dword [0x6181f0]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
lea ecx, [esi + 0x10]
call fcn.004b89a0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00544c5a
mov esp, ebp
pop ebp
ret
push 0x1c
push str.c:ent_slave_rootworkspace_vncconnect_buildsclients_vnc_7.6.xlabelcon_windows_64_rvcore_baseplat_timermanager.cxx
push str.thrInst__this
lea ecx, [ebp - 0x160]
call fcn.00465850
push eax
call fcn.004658d0
int3

Function at 0x4b8ad0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a3dc0
mov eax, dword fs:[0]
push eax
sub esp, 0x154
mov eax, dword [0x613384]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 8], 0
mov dword [ebp - 4], 0
mov dword [esi], vtable.plat::TimerManager.0
je 0x4b8b22
push dword [esi + 8]
mov ecx, esi
call fcn.004b9030
cmp dword [esi + 8], 0
jne 0x4b8b12
mov eax, dword [esi + 0x1c]
cmp eax, dword [esi + 0x20]
je 0x4b8b4a
nop word [eax + eax]
mov ecx, dword [esi + 0x18]
and ecx, eax
mov eax, dword [esi + 0x24]
push dword [eax + ecx*4]
mov ecx, esi
call fcn.004b9030
mov eax, dword [esi + 0x1c]
cmp eax, dword [esi + 0x20]
jne 0x4b8b30
push dword [0x6181f0]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, esi
jne 0x4b8ba1
push dword [esi + 4]
push dword [0x6181f0]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
lea ecx, [esi + 0x10]
call fcn.004b89a0
test byte [ebp + 8], 1
je 0x4b8b82
push 0x2c
push esi
call fcn.0054453d
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00544c5a
mov esp, ebp
pop ebp
ret 4
push 0x1c
push str.c:ent_slave_rootworkspace_vncconnect_buildsclients_vnc_7.6.xlabelcon_windows_64_rvcore_baseplat_timermanager.cxx
push str.thrInst__this
lea ecx, [ebp - 0x160]
call fcn.00465850
push eax
call fcn.004658d0
int3
Function at 0x4ba0e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x15c
mov eax, dword [0x613384]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, ecx
test edi, edi
je 0x4ba1e8
cmp dword [esi + 0x58], 0
jne 0x4ba1e8
xor eax, eax
mov dword [ebp - 0x158], ebx
test edi, edi
lea ecx, [esi + 0x4c]
push 0
cmovg eax, edi
mov dword [ebp - 0x15c], eax
lea eax, [ebp - 0x15c]
push eax
call fcn.0044ee30
lea eax, [esi + 0x34]
push eax
push 0
push edi
push ebx
push dword [esi + 0x2c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4ba1d0
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
cmp eax, 0x3e5
je 0x4ba1d0
push 0x148
call fcn.0054450d
mov edi, eax
add esp, 4
mov dword [ebp - 0x158], edi
test edi, edi
je 0x4ba186
call ebx
push eax
push 0x5c0d98
mov ecx, edi
call fcn.0040a6b0
jmp 0x4ba188
xor eax, eax
mov ecx, dword [esi + 0x5c]
mov dword [esi + 0x5c], eax
test ecx, ecx
je 0x4ba198
mov eax, dword [ecx]
push 1
call dword [eax]
push dword [ebp + 0x10]
mov ecx, esi
call fcn.004b9e80
mov eax, dword [esi + 0x5c]
add eax, 4
push eax
push 0x5abc68
push 0x618230
call fcn.00406750
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00544c5a
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp - 4]
mov eax, edi
mov dword [esi + 0x58], edi
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.00544c5a
mov esp, ebp
pop ebp
ret 0xc
push 0x67
push str.c:ent_slave_rootworkspace_vncconnect_buildsclients_vnc_7.6.xlabelcon_windows_64_rvcore_baseoswinhandleoutstream.cxx
push str.length___outstandingWrite__
lea ecx, [ebp - 0x154]
call fcn.00465850
push eax
call fcn.004658d0
int3

Function at 0x4bace0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14c
mov eax, dword [0x613384]
xor eax, ebp
mov dword [ebp - 4], eax
push dword [ecx + 0x2c]
mov eax, dword [ebp + 8]
push 1
push dword [ebp + 0xc]
push eax
call fcn.00572579
add esp, 0x10
cmp eax, 1
jne 0x4bad1f
mov ecx, dword [ebp - 4]
mov eax, dword [ebp + 0xc]
xor ecx, ebp
call fcn.00544c5a
mov esp, ebp
pop ebp
ret 0xc
lea eax, [ebp - 0x14c]
push str.writing_to_file_failed
push eax
call fcn.0046c120
add esp, 8
lea eax, [ebp - 0x14c]
push 0x5fe46c
push eax
call fcn.005461fc
int3
Function at 0x4bb010
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a4187
mov eax, dword fs:[0]
push eax
sub esp, 0x154
mov eax, dword [0x613384]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x15c], edi
mov dword [ebp - 0x160], edi
mov dword [edi], vtable.plat::EventManager.0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [ebp - 4], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
push dword [0x6182a8]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push 0
push 0
push 1
lea esi, [edi + 0x20]
mov dword [edi + 0x1c], eax
push 0
mov dword [ebp - 0x15c], esi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi], eax
mov byte [ebp - 4], 2
test eax, eax
je 0x4bb0e3
push edi
mov dword [edi + 0x24], 0
push dword [0x6182a8]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00544c5a
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CreateEvent
lea ecx, [ebp - 0x158]
call fcn.0040a6b0
push 0x5f5000
lea eax, [ebp - 0x158]
push eax
call fcn.005461fc
int3
Function at 0x4bb170
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a41b0
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x613384]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esi], vtable.plat::EventManager.0
mov eax, dword [esi + 0x10]
cmp eax, dword [esi + 0x14]
je 0x4bb1d0
add dword [esi + 8], 0xfffffffc
mov edx, dword [esi + 0x14]
mov edi, dword [edx - 4]
lea eax, [edx - 4]
push 0
push edx
push eax
call fcn.005466f0
add dword [esi + 0x14], 0xfffffffc
add esp, 0xc
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 4]
mov eax, dword [esi + 0x10]
cmp eax, dword [esi + 0x14]
jne 0x4bb1a4
push dword [esi + 0x1c]
push dword [0x6182a8]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [esi + 0x20]
mov dword [esi + 0x20], 0
test eax, eax
je 0x4bb1f4
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi + 0x10]
test eax, eax
je 0x4bb23c
mov ecx, dword [esi + 0x18]
sub ecx, eax
and ecx, 0xfffffffc
cmp ecx, 0x1000
jb 0x4bb21d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4bb295
mov eax, edx
push ecx
push eax
call fcn.0054453d
mov dword [esi + 0x10], 0
add esp, 8
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x4bb284
mov ecx, dword [esi + 0xc]
sub ecx, eax
and ecx, 0xfffffffc
cmp ecx, 0x1000
jb 0x4bb265
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4bb295
mov eax, edx
push ecx
push eax
call fcn.0054453d
mov dword [esi + 4], 0
add esp, 8
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
call fcn.0054fec6
int3
Function at 0x4bb2a0
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a41d0
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x613384]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esi], vtable.plat::EventManager.0
mov eax, dword [esi + 0x10]
mov dword [ebp - 4], 0
cmp eax, dword [esi + 0x14]
je 0x4bb30c
nop dword [eax + eax]
add dword [esi + 8], 0xfffffffc
mov edx, dword [esi + 0x14]
mov edi, dword [edx - 4]
lea eax, [edx - 4]
push 0
push edx
push eax
call fcn.005466f0
add dword [esi + 0x14], 0xfffffffc
add esp, 0xc
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 4]
mov eax, dword [esi + 0x10]
cmp eax, dword [esi + 0x14]
jne 0x4bb2e0
push dword [esi + 0x1c]
push dword [0x6182a8]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [esi + 0x20]
mov dword [esi + 0x20], 0
test eax, eax
je 0x4bb330
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi + 0x10]
test eax, eax
je 0x4bb37c
mov ecx, dword [esi + 0x18]
sub ecx, eax
and ecx, 0xfffffffc
cmp ecx, 0x1000
jb 0x4bb35d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4bb3ea
mov eax, edx
push ecx
push eax
call fcn.0054453d
mov dword [esi + 0x10], 0
add esp, 8
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x4bb3c4
mov ecx, dword [esi + 0xc]
sub ecx, eax
and ecx, 0xfffffffc
cmp ecx, 0x1000
jb 0x4bb3a5
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4bb3ea
mov eax, edx
push ecx
push eax
call fcn.0054453d
mov dword [esi + 4], 0
add esp, 8
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
test byte [ebp + 8], 1
je 0x4bb3d5
push 0x28
push esi
call fcn.0054453d
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
call fcn.0054fec6
int3
Function at 0x4be5a0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x613384]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x617c44], 0
mov dword [ebp - 0x230], str.getaddrinfo
mov dword [ebp - 0x22c], 0x4814a0
mov dword [ebp - 0x228], str.getnameinfo
mov dword [ebp - 0x224], 0x481810
mov dword [ebp - 0x220], str.freeaddrinfo
mov dword [ebp - 0x21c], fcn.00481450
jne 0x4be722
push 0x104
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x4be718
push ebx
push esi
push edi
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x110]
push 0x10c
push eax
call fcn.0056b0a7
push 0x5bbb60
lea eax, [ebp - 0x110]
push 0x10c
push eax
call fcn.0056b16a
add esp, 0x18
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov edi, eax
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
test edi, edi
je 0x4be678
push str.getaddrinfo
push edi
call ebx
test eax, eax
jne 0x4be6cd
push edi
call esi
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x110]
push 0x10c
push eax
call fcn.0056b0a7
push str.wship6
lea eax, [ebp - 0x110]
push 0x10c
push eax
call fcn.0056b16a
add esp, 0x18
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4be715
push str.getaddrinfo
push edi
call ebx
test eax, eax
jne 0x4be6cd
push edi
call esi
jmp 0x4be715
xor esi, esi
nop
push dword [ebp + esi*8 - 0x230]
push edi
call ebx
mov dword [ebp + esi*8 - 0x22c], eax
test eax, eax
je 0x4be70e
inc esi
cmp esi, 3
jl 0x4be6d0
mov eax, dword [ebp - 0x22c]
mov dword [0x611434], eax
mov eax, dword [ebp - 0x224]
mov dword [0x61143c], eax
mov eax, dword [ebp - 0x21c]
mov dword [fcn.00481450], eax
jmp 0x4be715
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
pop ebx
mov dword [0x617c44], 1
movzx eax, word [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, dword [eax*8 + 0x611434]
call fcn.00544c5a
mov esp, ebp
pop ebp
ret 4