joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47b8c7
Capabilities:
Get graphical window text

Disassembly:
push ebx
push dword [esp + 8]
push dword [0xd90b4c]
call fcn.00488bc1
mov ebx, eax
test ebx, ebx
je 0x47b92b
mov ecx, dword [ebx + 4]
mov eax, dword [ecx + 0x18]
test eax, eax
je 0x47b8f0
push dword [esp + 0xc]
push ebx
call eax
jmp 0x47b92b
push esi
push edi
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
push dword [esp + 0x14]
mov edi, eax
push edi
call fcn.004917d0
mov esi, eax
lea ecx, [edi + 1]
push ecx
xor eax, eax
push esi
mov word [esi], ax
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push esi
call fcn.004913cb
pop ecx
sub edi, eax
push edi
call fcn.004923c0
pop edi
pop esi
pop ebx
ret 8

Function at 0x47eb02
Capabilities:
Check os version

Disassembly:
sub esp, 0x34c
push ebp
push esi
push edi
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0x114
push eax
mov esi, 0xc8
xor ebp, ebp
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x47ec86
mov eax, dword [esp + 0x1c]
sub eax, 1
je 0x47ec69
sub eax, 1
jne 0x47ec86
lea eax, [esp + 0x120]
xor edi, edi
push eax
call fcn.0047ec92
pop ecx
test eax, eax
je 0x47eb76
mov ecx, dword [esp + 0x124]
mov eax, dword [esp + 0x128]
mov ebp, dword [esp + 0x12c]
cmp byte [esp + 0x23a], 1
jmp 0x47eba7
lea eax, [esp + 0x23c]
mov dword [esp + 0x23c], 0x11c
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x47ec86
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
cmp byte [esp + 0x356], 1
jne 0x47ebac
xor edi, edi
inc edi
sub ecx, 3
je 0x47ec65
sub ecx, 1
je 0x47ec61
sub ecx, 1
je 0x47ec3c
sub ecx, 1
je 0x47ebec
sub ecx, 4
jne 0x47ec86
test eax, eax
jne 0x47ec86
cmp ebp, 0x55f0
sbb esi, esi
and esi, 0xfffffff6
add esi, 0x78
jmp 0x47ec86
sub eax, 0
je 0x47ec2e
sub eax, 1
je 0x47ec20
sub eax, 1
je 0x47ec12
sub eax, 1
jne 0x47ec86
mov esi, edi
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x69
jmp 0x47ec86
mov esi, edi
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x5f
jmp 0x47ec86
mov esi, edi
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x55
jmp 0x47ec86
mov esi, edi
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x4b
jmp 0x47ec86
sub eax, 0
je 0x47ec5d
sub eax, 1
je 0x47ec59
sub eax, 1
jne 0x47ec86
mov esi, edi
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x41
jmp 0x47ec86
push 0x3c
jmp 0x47ec85
push 0x32
jmp 0x47ec85
push 0x14
jmp 0x47ec85
push 5
jmp 0x47ec85
mov eax, dword [esp + 0x14]
test eax, eax
je 0x47ec83
cmp eax, 0xa
je 0x47ec7f
cmp eax, 0x5a
jne 0x47ec86
push 0x28
jmp 0x47ec85
push 0x1e
jmp 0x47ec85
push 0xa
pop esi
pop edi
mov eax, esi
pop esi
pop ebp
add esp, 0x34c
ret
Function at 0x47ef6e
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 8]
push dword [0xd90fc4]
call fcn.00488bc1
mov esi, eax
test esi, esi
je 0x47f048
cmp dword [ebp + 0xc], 0
je 0x47efba
push 4
push dword [esi]
call dword [sym.imp.USER32.dll_GetWindow]
test eax, eax
je 0x47efab
cmp dword [esi + 0x1c], 0
jne 0x47efab
push eax
call dword [sym.imp.USER32.dll_SetActiveWindow]
push 0
push dword [esi]
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x47f048
test byte [ebp + 0x10], 3
je 0x47efd5
push 4
push dword [esi]
call dword [sym.imp.USER32.dll_GetWindow]
push eax
push dword [ebp + 0x10]
push dword [esi]
call fcn.004ed0c8
cmp dword [esi + 0x3c], 0xffffffff
push ebx
je 0x47effa
xor ebx, ebx
cmp dword [esi + 0x3c], 0x1000000
sete bl
xor ecx, ecx
cmp dword [esi + 0x3c], 0x20000000
sete cl
or dword [esi + 0x3c], 0xffffffff
jmp 0x47f00e
push dword [esi]
call dword [sym.imp.USER32.dll_IsZoomed]
push dword [esi]
mov ebx, eax
call dword [sym.imp.USER32.dll_IsIconic]
mov ecx, eax
test dword [ebp + 0x10], 0x2000000
je 0x47f02b
test ebx, ebx
je 0x47f01f
push 8
jmp 0x47f031
neg ecx
sbb ecx, ecx
and ecx, 3
add ecx, 4
jmp 0x47f03e
test ebx, ebx
je 0x47f034
push 3
pop ecx
jmp 0x47f03e
xor eax, eax
test ecx, ecx
setne al
lea ecx, [eax + 1]
push ecx
push dword [esi]
call dword [sym.imp.USER32.dll_ShowWindow]
pop ebx
pop esi
pop ebp
ret 0xc

Function at 0x47f8cd
Capabilities:
Copy file

Disassembly:
cmp dword [esp + 4], 0
je 0x47f8ed
cmp dword [esp + 8], 0
je 0x47f8ed
push 0
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
jmp 0x47f8ef
xor eax, eax
ret 8

Function at 0x47f8f2
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
cmp dword [ebp + 8], 0
je 0x47f96a
push 0x104
push dword [ebp + 8]
lea eax, [ebp - 0x20c]
push eax
call fcn.00492373
xor eax, eax
mov word [ebp - 4], ax
lea eax, [ebp - 0x20c]
push eax
call fcn.004913cb
lea ecx, [ebp - 0x20c]
add esp, 0x10
lea eax, [ecx + eax*2]
jmp 0x47f94b
movzx ecx, word [eax - 2]
cmp ecx, 0x20
je 0x47f948
cmp ecx, 0x5c
je 0x47f948
cmp ecx, 0x2f
jne 0x47f955
add eax, 0xfffffffe
lea ecx, [ebp - 0x20c]
cmp eax, ecx
ja 0x47f935
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x20c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x47f96c
xor eax, eax
leave
ret 4
Function at 0x47fcad
Capabilities:
Delete file
Set file attributes

Disassembly:
cmp dword [esp + 4], 0
je 0x47fcd6
test byte [esp + 8], 2
je 0x47fcca
push 0x80
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x47fcd8
xor eax, eax
ret 8

Function at 0x47fdbb
Capabilities:
Check if file exists

Disassembly:
xor eax, eax
push ebp
mov ebp, eax
mov eax, dword [0xd91100]
push esi
test eax, eax
jne 0x47fde0
push fcn.0047fd89
push 0x10
push 0x258
call fcn.00488ca5
mov dword [0xd91100], eax
push dword [esp + 0xc]
push eax
call fcn.00488b2d
mov esi, eax
test esi, esi
je 0x47fee1
push edi
mov edi, dword [esp + 0x14]
test edi, edi
jne 0x47fe02
mov edi, 0x57f684
push ebx
mov ebx, dword [esp + 0x1c]
test ebx, ebx
je 0x47fe12
xor eax, eax
cmp word [ebx], ax
jne 0x47fe17
mov ebx, 0x57ecf8
push edi
call fcn.004913cb
push ebx
mov dword [esp + 0x24], eax
call fcn.004913cb
add eax, dword [esp + 0x24]
pop ecx
pop ecx
lea eax, [eax*2 + 4]
push eax
xor eax, eax
push eax
push dword [0xd8fb84]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [esp + 0x18], eax
test eax, eax
je 0x47fec8
push edi
push eax
call fcn.004913a9
mov eax, dword [esp + 0x24]
pop ecx
pop ecx
test eax, eax
je 0x47fe78
cmp word [edi + eax*2 - 2], 0x5c
mov edi, dword [esp + 0x18]
je 0x47fe7c
push 0x57dc64
push edi
call fcn.004ac2ae
pop ecx
pop ecx
jmp 0x47fe7c
mov edi, dword [esp + 0x18]
push ebx
push edi
call fcn.004ac2ae
pop ecx
pop ecx
lea eax, [esi + 8]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [esi], eax
cmp eax, 0xffffffff
je 0x47fea0
xor eax, eax
mov ebp, esi
mov dword [esi + 4], eax
jmp 0x47feb6
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x47feb4
mov dword [esi + 4], 1
mov ebp, esi
xor eax, eax
push edi
push eax
push dword [0xd8fb84]
call dword [sym.imp.KERNEL32.dll_HeapFree]
test ebp, ebp
jne 0x47fedf
cmp dword [esp + 0x14], 0xffffffff
je 0x47fed3
mov esi, dword [esp + 0x14]
push esi
push dword [0xd91100]
call fcn.00488c56
pop ebx
pop edi
pop esi
mov eax, ebp
pop ebp
ret 0xc
Function at 0x47ff2c
Capabilities:
Get disk information
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x45c
push esi
or esi, 0xffffffff
push edi
mov edi, esi
test eax, eax
je 0x480074
xor ecx, ecx
cmp word [eax], cx
je 0x480074
push 0x104
push eax
lea eax, [esp + 0x10]
push eax
call fcn.00492373
xor eax, eax
mov word [esp + 0x21c], ax
lea eax, [esp + 0x14]
push eax
call fcn.004913cb
add esp, 0x10
lea ecx, [esp + eax*2 + 6]
cmp eax, 2
je 0x47ff85
cmp eax, 3
jne 0x47ffbf
cmp word [esp + 0xa], 0x3a
jne 0x47ffbf
cmp eax, 2
jne 0x47ffa3
lea eax, [esp + 8]
push 0x57dc64
push eax
call fcn.004ac2ae
pop ecx
pop ecx
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x480074
push 0xfffffffffffffffe
pop edi
jmp 0x480074
push ebx
push ebp
push 0x5c
pop ebp
push 0x2f
pop ebx
movzx eax, word [ecx]
cmp ax, bp
je 0x47ffd4
cmp ax, bx
jne 0x47ffde
xor eax, eax
mov word [ecx], ax
sub ecx, 2
jmp 0x47ffc7
lea eax, [esp + 0x21c]
push eax
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, esi
je 0x48001d
test byte [esp + 0x21c], 0x10
je 0x480004
push 0xfffffffffffffffe
pop edi
jmp 0x480014
mov esi, dword [esp + 0x238]
xor edi, edi
or edi, dword [esp + 0x23c]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x480072
cmp word [esp + 0x10], bp
jne 0x48002b
cmp word [esp + 0x12], bp
je 0x48004a
cmp word [esp + 0x10], bx
jne 0x480039
cmp word [esp + 0x12], bx
je 0x48004a
push 0x2e
pop eax
cmp word [esp + 0x10], ax
jne 0x480072
cmp word [esp + 0x12], ax
jne 0x480072
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, esi
je 0x48005f
test al, 0x10
je 0x480072
jmp 0x48006f
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x480072
push 0xfffffffffffffffe
pop edi
pop ebp
pop ebx
mov eax, edi
mov edx, esi
pop edi
pop esi
add esp, 0x45c
ret 4

Function at 0x4800d8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
cmp dword [esp + 4], 0
je 0x4800ee
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4800f1
or eax, 0xffffffff
ret 4

Function at 0x4802ad
Capabilities:
Set file attributes

Disassembly:
xor eax, eax
cmp dword [esp + 4], eax
je 0x4802bb
jmp dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
ret 8

Function at 0x480350
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
mov dword [esp + 4], 0
cmp dword [esi + 0x14], 0
jne 0x48038c
push 0
lea eax, [esp + 8]
push eax
mov eax, dword [esi + 8]
sub eax, dword [esi + 0xc]
push eax
push dword [esi + 4]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esi + 8]
mov dword [esi + 0xc], eax
mov eax, dword [esp + 4]
pop esi
pop ecx
ret 4
xor eax, eax
pop esi
pop ecx
ret 4
Function at 0x4803a0
Capabilities:
Write file on windows

Disassembly:
push edi
mov edi, dword [esp + 8]
cmp edi, 0xffffffff
jne 0x4803b9
push dword [0xd91104]
call fcn.00488cf8
pop edi
ret 4
push esi
push edi
push dword [0xd91104]
call fcn.00488bc1
mov esi, eax
test esi, esi
je 0x480423
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x48040f
cmp dword [esi + 0x14], 0
mov dword [esp + 0xc], 0
jne 0x4803fe
push 0
lea eax, [esp + 0x10]
push eax
mov eax, dword [esi + 8]
sub eax, dword [esi + 0xc]
push eax
push ecx
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esi + 8]
mov dword [esi + 0xc], eax
push dword [esi + 4]
push 0
push dword [0xd8fb84]
call dword [sym.imp.KERNEL32.dll_HeapFree]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push dword [0xd91104]
call fcn.00488c56
pop esi
pop edi
ret 4

Function at 0x4808d0
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
push esi
push dword [esp + 0x10]
mov dword [esp + 8], 0
push dword [0xd91104]
call fcn.00488bc1
mov esi, eax
test esi, esi
je 0x48094f
cmp dword [esi + 4], 0
je 0x480920
push 1
lea eax, [esp + 8]
push eax
push esi
call fcn.004edab0
test eax, eax
je 0x480914
inc dword [esi + 0xc]
xor eax, eax
pop esi
add esp, 8
ret 4
mov eax, 1
pop esi
add esp, 8
ret 4
push 0
lea eax, [esp + 0xc]
push eax
push 1
lea eax, [esp + 0x1c]
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x48095a
cmp dword [esp + 8], 0
je 0x48095a
push 1
push 0
push 0xffffffffffffffff
push dword [esi]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 4]
pop esi
add esp, 8
ret 4
or eax, 0xffffffff
pop esi
add esp, 8
ret 4

Function at 0x480a20
Capabilities:
Read file on windows

Disassembly:
push ecx
push dword [esp + 8]
mov byte [esp + 7], 0
push dword [0xd91104]
call fcn.00488bc1
test eax, eax
je 0x480a6b
cmp dword [eax + 4], 0
je 0x480a55
push 1
lea ecx, [esp + 7]
push ecx
push eax
call fcn.004edab0
movzx eax, byte [esp + 3]
pop ecx
ret 4
push 0
lea ecx, [esp + 0xc]
push ecx
push 1
lea ecx, [esp + 0xf]
push ecx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_ReadFile]
movzx eax, byte [esp + 3]
pop ecx
ret 4

Function at 0x480c90
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0x10]
mov dword [esp + 4], 0
test esi, esi
je 0x480cf5
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x480ced
push dword [esp + 0x10]
push dword [0xd91104]
call fcn.00488bc1
test eax, eax
je 0x480ce3
cmp dword [eax + 4], 0
je 0x480cd2
push edi
push esi
push eax
call fcn.004ee0b0
pop edi
pop esi
pop ecx
ret 0xc
push 0
lea ecx, [esp + 0xc]
push ecx
push edi
push esi
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 0xc
pop edi
xor eax, eax
pop esi
pop ecx
ret 0xc
xor eax, eax
pop esi
pop ecx
ret 0xc

Function at 0x480d00
Capabilities:
Write file on windows

Disassembly:
push dword [esp + 4]
push dword [0xd91104]
call fcn.00488bc1
test eax, eax
je 0x480d1c
mov dword [esp + 4], eax
jmp fcn.00480d30
xor eax, eax
ret 0xc
Function at 0x480d30
Capabilities:
Write file on windows

Disassembly:
push ecx
mov edx, dword [esp + 0xc]
mov dword [esp], 0
test edx, edx
je 0x480e2f
cmp word [edx], 0
je 0x480e2f
mov ecx, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0xc]
test ecx, ecx
jne 0x480d5e
mov ecx, dword [esi + 0x18]
push edi
cmp ecx, 0x19
jne 0x480db4
mov ecx, edx
lea edi, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x480d70
sub ecx, edi
sar ecx, 1
cmp dword [esi + 4], 0
je 0x480d96
lea eax, [ecx + ecx]
push eax
push edx
push esi
call fcn.004ee0b0
pop edi
pop esi
pop ecx
ret 0xc
push 0
lea eax, [esp + 0xc]
push eax
lea eax, [ecx + ecx]
push eax
push edx
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 0xc
lea eax, [esp + 0x14]
push eax
xor eax, eax
cmp ecx, 2
push edx
setne al
dec eax
and eax, 0xfde9
push eax
call fcn.004ee1d0
mov edi, eax
test edi, edi
je 0x480daa
cmp dword [esi + 4], 0
je 0x480e02
push dword [esp + 0x14]
push edi
push esi
call fcn.004ee0b0
push edi
push 0
push dword [0xd8fb84]
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 0xc
push 0
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x1c]
push edi
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
push 0
push dword [0xd8fb84]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 0xc
xor eax, eax
pop ecx
ret 0xc
Function at 0x482160
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
push esi
push edi
push dword [esp + 0x1c]
mov dword [esp + 0x10], 0
xor esi, esi
mov dword [esp + 0x14], 0
call fcn.004eee50
mov edi, eax
test edi, edi
je 0x482272
mov eax, dword [esp + 0x18]
test eax, eax
je 0x482272
push ebp
push esi
push 0x80
push 3
push esi
push 1
push closesocket
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x482271
push ebx
push 0x100000
push esi
push dword [0xd8fb84]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x482269
push dword [esp + 0x28]
mov eax, dword [edi + 4]
call eax
mov esi, eax
test esi, esi
je 0x48225a
mov ecx, dword [edi + 8]
push 0
push esi
call ecx
push 0
push 0
push dword [esp + 0x2c]
push edi
push esi
call fcn.004f40c0
cmp dword [esp + 0x18], 0
jl 0x482220
mov eax, dword [esp + 0x14]
jg 0x48220d
test eax, eax
je 0x482220
push 0
lea ecx, [esp + 0x1c]
push ecx
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea esp, [esp]
push 0
lea eax, [esp + 0x14]
push eax
push 0x100000
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [esp + 0x10]
mov eax, dword [edi + 0xc]
push ebx
push esi
call eax
cmp dword [esp + 0x10], 0x100000
je 0x482220
mov eax, dword [edi + 0x10]
push esi
call eax
push dword [esp + 0x24]
push edi
push esi
call fcn.004f4260
push ebx
push 0
push dword [0xd8fb84]
call dword [sym.imp.KERNEL32.dll_HeapFree]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
pop ebp
push dword [esp + 0x24]
push esi
call fcn.004f4050
test esi, esi
je 0x482286
mov eax, dword [edi + 0x14]
push esi
call eax
pop edi
pop esi
add esp, 0xc
ret 0x10

Function at 0x48263d
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [0xd91118]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
mov eax, dword [ebp + 0x18]
cmp eax, dword [esi + 0xac]
je 0x482665
push eax
push esi
mov dword [esi + 0xac], eax
call dword [esi + 0x40]
push dword [ebp + 0x14]
mov eax, dword [esi + 0x90]
push dword [ebp + 0x10]
add eax, dword [ebp + 0xc]
push eax
mov eax, dword [esi + 0x8c]
add eax, dword [ebp + 8]
push eax
push esi
call dword [esi + 4]
pop esi
pop ebp
ret 0x14

Function at 0x482688
Capabilities:
Get thread local storage value

Disassembly:
push esi
push dword [0xd91118]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
mov eax, dword [esi + 0xa4]
cmp eax, dword [esi + 0xac]
je 0x4826b0
push eax
push esi
mov dword [esi + 0xac], eax
call dword [esi + 0x40]
push dword [esp + 0x14]
mov eax, dword [esi + 0x90]
push dword [esp + 0x14]
add eax, dword [esp + 0x14]
push eax
mov eax, dword [esi + 0x8c]
add eax, dword [esp + 0x14]
push eax
push esi
call dword [esi + 4]
pop esi
ret 0x10

Function at 0x4826d6
Capabilities:
Get thread local storage value

Disassembly:
push dword [0xd91118]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edx, eax
mov ecx, dword [edx + 0x74]
cmp ecx, 2
je 0x4826fb
cmp ecx, 3
je 0x4826fb
cmp ecx, 8
je 0x4826fb
cmp ecx, 0xc
jne 0x482709
mov eax, dword [esp + 4]
test eax, eax
je 0x482709
mov dword [edx + 0xb8], eax
ret 4
Function at 0x48270c
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push dword [0xd91118]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edx, eax
mov esi, dword [edx + 0x2c]
mov edi, dword [edx + 0x90]
mov ebx, dword [edx + 0x8c]
test esi, esi
je 0x48274c
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
add ecx, edi
push 0xff
push ecx
add eax, ebx
push eax
push dword [ebp + 8]
push edx
call esi
jmp 0x48275f
mov eax, dword [ebp + 0x10]
add eax, edi
push eax
mov eax, dword [ebp + 0xc]
add eax, ebx
push eax
push dword [ebp + 8]
push edx
call dword [edx + 0x24]
pop edi
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x482766
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push dword [0xd91118]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp dword [ebp + 0x14], 0
mov ecx, eax
jle 0x4827a4
cmp dword [ebp + 0x18], 0
jle 0x4827a4
push dword [ebp + 0x18]
mov eax, dword [ecx + 0x90]
push dword [ebp + 0x14]
add eax, dword [ebp + 0x10]
push eax
mov eax, dword [ecx + 0x8c]
add eax, dword [ebp + 0xc]
push eax
push dword [ebp + 8]
push ecx
call dword [ecx + 0x28]
pop ebp
ret 0x14

Function at 0x4828d8
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [0xd91118]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
add edx, dword [eax + 0x8c]
add esi, dword [eax + 0x90]
mov ecx, dword [eax + 0x74]
cmp ecx, 2
je 0x482911
cmp ecx, 3
je 0x482911
cmp ecx, 8
je 0x482911
cmp ecx, 0xc
jne 0x482964
mov ecx, dword [ebp + 0x10]
push edi
xor edi, edi
inc edi
test ecx, ecx
jns 0x482923
neg ecx
mov dword [ebp + 0x10], ecx
jmp 0x482928
jne 0x482928
mov dword [ebp + 0x10], edi
mov ecx, dword [ebp + 0x14]
test ecx, ecx
jns 0x482936
neg ecx
mov dword [ebp + 0x14], ecx
jmp 0x48293b
jne 0x48293b
mov dword [ebp + 0x14], edi
fild dword [ebp + 0x10]
mov dword [eax + 0x118], edx
mov dword [eax + 0x11c], esi
mov dword [eax + 0xb4], 0x482863
pop edi
fstp dword [eax + 0x120]
fild dword [ebp + 0x14]
fstp dword [eax + 0x124]
pop esi
pop ebp
ret 0x10

Function at 0x482969
Capabilities:
Get thread local storage value

Disassembly:
push esi
push dword [0xd91118]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
mov eax, dword [esp + 0x14]
cmp eax, dword [esi + 0xac]
je 0x48298f
push eax
push esi
mov dword [esi + 0xac], eax
call dword [esi + 0x40]
push dword [esp + 0x10]
mov eax, dword [esi + 0x90]
add eax, dword [esp + 0x10]
push eax
mov eax, dword [esi + 0x8c]
add eax, dword [esp + 0x10]
push eax
push esi
call dword [esi + 0x3c]
pop esi
ret 0x10
Function at 0x4829b1
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push dword [0xd91118]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov ecx, dword [ebx + 0x74]
cmp ecx, 2
je 0x4829de
cmp ecx, 3
je 0x4829de
cmp ecx, 8
je 0x4829de
cmp ecx, 0xc
jne 0x482ab3
fldz
fld dword [ebp + 8]
fcom st(1)
fnstsw ax
test ah, 5
jp 0x4829f3
fstp st(0)
fstp dword [ebp + 8]
jmp 0x482a04
fstp st(1)
fld1
fcom st(1)
fnstsw ax
fstp st(1)
test ah, 5
jnp 0x4829ee
fstp st(0)
push esi
mov esi, dword [ebx + 0xbc]
push edi
xor edi, edi
jmp 0x482a30
fld dword [esi + 4]
fld dword [ebp + 8]
fld st(0)
fucom st(2)
fnstsw ax
test ah, 0x44
jnp 0x482a50
fstp st(1)
fcompp
fnstsw ax
test ah, 5
jnp 0x482a36
mov edi, esi
mov esi, dword [esi]
test esi, esi
jne 0x482a10
jmp 0x482a5c
push 0x18
push 0
push dword [0xd8fb84]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
test edx, edx
je 0x482a5c
mov dword [edx], esi
jmp 0x482a75
mov edx, esi
fstp st(2)
fstp st(1)
test edx, edx
jne 0x482a86
fstp st(0)
push 0x18
push 0
push dword [0xd8fb84]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
test edx, edx
je 0x482ab1
and dword [edx], 0
fld dword [ebp + 8]
test edi, edi
je 0x482a80
mov dword [edi], edx
jmp 0x482a86
mov dword [ebx + 0xbc], edx
mov ecx, dword [ebp + 0xc]
movzx eax, cl
mov dword [edx + 8], eax
mov eax, ecx
sar eax, 8
movzx eax, al
mov dword [edx + 0xc], eax
mov eax, ecx
sar eax, 0x10
movzx eax, al
sar ecx, 0x18
mov dword [edx + 0x10], eax
movzx eax, cl
fstp dword [edx + 4]
mov dword [edx + 0x14], eax
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x482ad1
Capabilities:
Get thread local storage value

Disassembly:
push dword [0xd91118]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push dword [esp + 0xc]
mov ecx, dword [eax + 0x90]
add ecx, dword [esp + 0xc]
push ecx
mov ecx, dword [eax + 0x8c]
add ecx, dword [esp + 0xc]
push ecx
push eax
call dword [eax + 0x50]
ret 0xc

Function at 0x482afe
Capabilities:
Get thread local storage value

Disassembly:
push dword [0xd91118]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [eax + 0x90]
add ecx, dword [esp + 8]
push ecx
mov ecx, dword [eax + 0x8c]
add ecx, dword [esp + 8]
push ecx
push eax
call dword [eax + 0x54]
ret 8