joyce8/EMBER2024-capa huggingface dataset:
Function at 0x419490
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov edi, eax
and eax, 0xff
and edi, 0xff00
mov dword [ebp - 8], eax
shr edi, 8
mov byte [ebx], 0
mov eax, edi
mov esi, edi
mov edx, edi
and esi, 4
and edx, 1
and eax, 2
test eax, eax
mov dword [ebp - 4], edx
je 0x4194d2
mov eax, str.Ctrl_
jmp 0x4194d7
mov eax, 0x535fbb
push eax
push ebx
call fcn.004ab7dc
add esp, 8
cmp dword [ebp - 4], 0
je 0x4194ee
mov edx, str.Shift_
jmp 0x4194f3
mov edx, 0x535fbb
push edx
push ebx
call fcn.004ab7dc
add esp, 8
test esi, esi
je 0x419508
mov eax, str.Alt_
jmp 0x41950d
mov eax, 0x535fbb
push eax
push ebx
call fcn.004ab7dc
add esp, 8
push 0
mov edx, dword [ebp - 8]
push edx
call sub.USER32.DLL_MapVirtualKeyA
test edi, 8
mov esi, eax
je 0x419537
shl esi, 0x10
or esi, 0x3000000
jmp 0x419540
shl esi, 0x10
or esi, 0x2000000
push 0x64
push ebx
call fcn.004ab86c
pop ecx
add ebx, eax
push ebx
push esi
call sub.USER32.DLL_GetKeyNameTextA
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x41ac1c
Capabilities:
Get thread local storage value

Disassembly:
push ebx
mov ebx, 0x540648
push 0x5406bc
call fcn.00449c3c
pop ecx
dec dword [0x5406e0]
test byte [ebx], 2
je 0x41ac56
mov eax, dword [0x555894]
push eax
call sub.KERNEL32.DLL_TlsGetValue
cmp word [eax + 0x36], 0
jne 0x41ac56
mov word [eax + 0x36], 1
mov word [eax + 0x34], 1
test byte [ebx], 1
je 0x41ac7a
push 0x5406d8
call fcn.00449c80
pop ecx
push 0x5406bc
push 0x5406d8
call fcn.00449c90
add esp, 8
jmp 0x41ac33
inc dword [0x5406e0]
push 0x5406bc
call fcn.00449c5c
pop ecx
pop ebx
ret

Function at 0x41ac90
Capabilities:
Get thread local storage value

Disassembly:
push ebx
mov eax, dword [0x555894]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov ebx, eax
test ebx, ebx
je 0x41acfd
inc dword [ebx + 0x1c0]
mov eax, dword [ebx + 0x1c0]
dec eax
jne 0x41acfd
push 0x5406bc
call fcn.00449c3c
pop ecx
dec dword [0x5406e0]
cmp dword [0x540648], 0
je 0x41acf2
test byte [0x540648], 2
je 0x41ace7
cmp word [ebx + 0x36], 0
jne 0x41ace7
mov word [ebx + 0x36], 1
mov word [ebx + 0x34], 1
push 0x5406d8
call fcn.00449c80
pop ecx
push 0x5406bc
call fcn.00449c5c
pop ecx
pop ebx
ret

Function at 0x41ad00
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, 0x540648
mov eax, dword [0x555894]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov ebx, eax
test ebx, ebx
je 0x41ad6d
dec dword [ebx + 0x1c0]
jne 0x41ad6d
push 0x5406bc
call fcn.00449c3c
pop ecx
test byte [esi], 2
je 0x41ad43
cmp word [ebx + 0x36], 0
jne 0x41ad43
mov word [ebx + 0x36], 1
mov word [ebx + 0x34], 1
test byte [esi], 1
je 0x41ad5c
push 0x5406bc
push 0x5406d8
call fcn.00449c90
add esp, 8
jmp 0x41ad2b
inc dword [0x5406e0]
push 0x5406bc
call fcn.00449c5c
pop ecx
pop esi
pop ebx
ret
Function at 0x41ae08
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x555894]
push eax
call sub.KERNEL32.DLL_TlsGetValue
cmp eax, dword [0x5406a0]
jne 0x41ae7e
push 0x5406bc
call fcn.00449c3c
pop ecx
or dword [0x540648], 2
dec dword [0x5406e0]
call fcn.0044aa74
call fcn.0044aae0
push 0x5406d8
call fcn.00449c80
pop ecx
jmp 0x41ae5c
push 0x5406bc
push 0x5406d8
call fcn.00449c90
add esp, 8
cmp dword [0x5406dc], 1
jg 0x41ae4a
inc dword [0x5406e0]
xor edx, edx
mov dword [0x540648], edx
push 0x5406bc
call fcn.00449c5c
pop ecx
ret

Function at 0x41b034
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
push edi
mov eax, dword [0x555894]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov ebx, eax
push 0x5406bc
call fcn.00449c3c
pop ecx
inc dword [ebx + 0x1c0]
mov eax, dword [ebx + 0x1c0]
push 0
dec eax
sete dl
and edx, 1
mov eax, dword [ebx + 0x1cc]
push eax
mov edi, edx
call fcn.0041af78
add esp, 8
mov esi, eax
push 0x5406bc
call fcn.00449c5c
pop ecx
test esi, esi
je 0x41b08d
push esi
call fcn.0043dbc0
pop ecx
add ebx, 0xa0
push ebx
call fcn.00447704
pop ecx
call fcn.00432970
call fcn.0044aa74
push 0x5406bc
call fcn.00449c3c
pop ecx
test edi, edi
je 0x41b0b9
dec dword [0x5406e0]
dec dword [0x5406dc]
push 0x5406d8
call fcn.00449c80
pop ecx
push 0x5406bc
call fcn.00449c5c
pop ecx
pop edi
pop esi
pop ebx
ret

Function at 0x41b14c
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x41b15f
call fcn.00449f7c
mov ebx, eax
push ebx
call fcn.0041afe0
pop ecx
mov eax, dword [0x555894]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov esi, eax
mov eax, dword [ebx]
push eax
call fcn.00452b00
pop ecx
mov edx, dword [ebx + 4]
push edx
call fcn.0046bf3c
pop ecx
mov ecx, dword [ebx + 0x10]
push ecx
call fcn.00425848
pop ecx
xor eax, eax
mov dword [ebx + 0x10], eax
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x41b1c2
push 0x114
push eax
add esi, 0xa0
push esi
call fcn.004ab6c8
add esp, 0xc
mov eax, dword [ebx + 0xc]
push eax
call fcn.0043b450
pop ecx
xor edx, edx
mov dword [ebx + 0xc], edx
jmp 0x41b1cf
add esi, 0xa0
push esi
call fcn.00447460
pop ecx
mov eax, dword [ebx + 0x14]
push eax
call fcn.0046209c
pop ecx
xor edx, edx
mov dword [ebx + 0x14], edx
mov esi, dword [ebx + 8]
test esi, esi
je 0x41b1ec
call fcn.004331f4
mov dword [eax], esi
cmp dword [0x540680], 0
je 0x41b1fa
call fcn.0041ab9c
mov eax, dword [ebx + 0x30]
test eax, eax
je 0x41b217
push eax
call fcn.004445cc
pop ecx
mov edx, dword [ebx + 0x30]
push edx
call fcn.0043dbc0
pop ecx
xor ecx, ecx
mov dword [ebx + 0x30], ecx
pop esi
pop ebx
pop ebp
ret
Function at 0x41b21c
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
push edi
push ebp
mov eax, dword [0x555894]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov ebx, eax
mov word [ebx + 0x36], 1
mov word [ebx + 0x34], 0
mov edi, dword [ebx + 0x1cc]
lea esi, [ebx + 0x10]
test byte [esi + 1], 0x20
je 0x41b251
push esi
call fcn.0043f7e0
pop ecx
mov esi, eax
cmp dword [edi + 0x34], 0
jne 0x41b26c
push esi
call fcn.0043da24
pop ecx
mov ebp, eax
mov dword [edi + 0x34], ebp
push ebp
call fcn.0043bc84
pop ecx
jmp 0x41b279
push esi
mov eax, dword [edi + 0x34]
push eax
call fcn.0043f0d4
add esp, 8
lea edx, [ebx + 0x10]
push edx
call fcn.0043f008
pop ecx
mov word [ebx + 0x34], 0
call fcn.00482c88
push 1
call fcn.00432dc8
pop ecx
push 1
call fcn.00444280
pop ecx
push 0
call fcn.00425848
pop ecx
push 0
call fcn.004229fc
pop ecx
push 0
call fcn.0046203c
pop ecx
call fcn.0041b034
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x41b42c
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
call fcn.0044c458
call fcn.0043b5a8
call fcn.0044dcf8
call fcn.0044dd10
call fcn.00449a2c
call fcn.00449f7c
push eax
call fcn.0041afe0
pop ecx
call fcn.0044abf0
mov dword [0x54064c], eax
push 0x54079c
call fcn.0046bf3c
pop ecx
push 0x54079c
call fcn.00452b00
pop ecx
mov eax, dword [0x555894]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov dword [0x5406a0], eax
add eax, 0xa0
push eax
call fcn.00447460
pop ecx
call fcn.0044c898
call fcn.0042bfa0
call fcn.004568a4
mov edx, dword [0x540670]
push edx
call fcn.00431b8c
pop ecx
mov dword [0x54067c], eax
call fcn.00453944
push 0x5406ac
push 0x5406a8
call fcn.0044ceac
add esp, 8
mov dword [0x5406a4], eax
mov ecx, dword [0x5406ac]
push ecx
mov eax, dword [0x5406a8]
push eax
call fcn.00468c28
add esp, 8
call fcn.00462b60
mov dword [0x540680], 1
push 0x54079f
call fcn.00431a24
pop ecx
mov ebx, eax
mov dword [0x540644], ebx
test ebx, ebx
je 0x41b53b
cmp dword [0x555890], 0
jne 0x41b528
push 0
push 0
push 0
push 0
push 6
call fcn.004227d4
add esp, 0x14
cmp dword [0x555890], 0
jne 0x41b53b
mov dword [0x555890], fcn.004227d4
call fcn.00424a64
call fcn.0041ab9c
call fcn.0042c12c
call fcn.0041ab6c
push 1
call fcn.00424ac0
pop ecx
push 0
call fcn.00424ac0
pop ecx
call fcn.0041abcc
push str._APPMAIN
call fcn.00431a24
pop ecx
test eax, eax
je 0x41b587
mov edx, dword [eax]
cmp dword [edx + 8], 0
je 0x41b587
mov eax, dword [eax]
mov dword [0x54068c], eax
jmp 0x41b617
mov eax, dword [0x54066c]
test eax, eax
je 0x41b5a1
cmp byte [eax], 0x40
jne 0x41b5a1
mov ebx, eax
inc ebx
push ebx
call fcn.00431a24
pop ecx
jmp 0x41b5cc
mov ebx, 0x5407ae
push ebx
call fcn.00431a24
pop ecx
test eax, eax
je 0x41b5b9
mov edx, dword [eax]
cmp dword [edx + 8], 0
jne 0x41b5cc
mov edx, dword [0x54066c]
test edx, edx
je 0x41b5cc
mov ebx, edx
push ebx
call fcn.00431a24
pop ecx
test eax, eax
je 0x41b5df
mov edx, dword [eax]
cmp dword [edx + 8], 0
je 0x41b5df
mov eax, dword [eax]
mov dword [0x54068c], eax
test esi, esi
je 0x41b617
cmp dword [0x54068c], 0
jne 0x41b617
test ebx, ebx
je 0x41b604
push 0
push ebx
push 0
push 0x2334
call fcn.00457568
add esp, 0x10
jmp 0x41b617
push 0
push 0
push 0
push 0x2335
call fcn.00457568
add esp, 0x10
test esi, esi
je 0x41b642
cmp dword [0x54068c], 0
je 0x41b642
mov ecx, dword [0x54068c]
push ecx
call fcn.00423424
pop ecx
call fcn.00422df0
call fcn.0044c89c
push eax
call fcn.0042225c
pop ecx
pop esi
pop ebx
pop ebp
ret
Function at 0x41dd98
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
add esp, 0xfffffff0
mov eax, dword [0x555894]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov edx, dword [eax]
mov ebx, dword [edx - 4]
test byte [ebx], 2
je 0x41de5c
mov ecx, dword [ebx + 8]
cmp ecx, reloc.WS2_32.DLL_accept
jge 0x41de34
mov eax, ecx
cdq
mov dword [esp], eax
mov dword [esp + 4], edx
mov dword [ebx], 8
mov eax, dword [esp]
mov edx, dword [esp + 4]
neg eax
adc edx, 0
neg edx
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], edx
mov eax, dword [esp]
mov edx, dword [esp + 4]
neg eax
adc edx, 0
neg edx
cmp edx, 0xffffffff
jne 0x41de01
cmp eax, 0xc4653601
jb 0x41de21
jmp 0x41de03
jl 0x41de21
mov eax, dword [esp]
mov edx, dword [esp + 4]
neg eax
adc edx, 0
neg edx
cmp edx, 2
jne 0x41de1f
cmp eax, 0x540be3ff
jbe 0x41de27
jmp 0x41de21
jle 0x41de27
mov ax, 0x14
jmp 0x41de2b
mov ax, 0xa
mov word [ebx + 0x10], ax
jmp 0x41df87
mov dword [ebx], 2
mov eax, dword [ebx + 8]
neg eax
mov dword [ebx + 8], eax
cmp eax, 0xc4653601
jge 0x41de4f
mov dx, 0x14
jmp 0x41de53
mov dx, 0xa
mov word [ebx + 0xc], dx
jmp 0x41df87
test byte [ebx], 8
je 0x41df18
cmp dword [ebx + 0xc], 0x80000000
jne 0x41de76
cmp dword [ebx + 8], 1
jae 0x41dec9
jmp 0x41de78
jge 0x41dec9
fild qword [ebx + 8]
fstp qword [esp + 8]
mov dword [ebx], 0x10
fld qword [esp + 8]
fchs
fstp qword [ebx + 8]
fld qword [esp + 8]
fchs
fcomp qword [0x41df90]
fnstsw ax
sahf
ja 0x41deb0
fld qword [esp + 8]
fchs
fcomp qword [0x41df98]
fnstsw ax
sahf
jae 0x41deb6
mov dx, 0x14
jmp 0x41deba
mov dx, 0xa
mov word [ebx + 0x10], dx
mov word [ebx + 0x12], 0
jmp 0x41df87
mov dword [ebx], 8
mov eax, dword [ebx + 8]
mov edx, dword [ebx + 0xc]
neg eax
adc edx, 0
neg edx
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], edx
cmp dword [ebx + 0xc], 0xffffffff
jne 0x41def3
cmp dword [ebx + 8], 0xc4653601
jb 0x41df08
jmp 0x41def5
jl 0x41df08
cmp dword [ebx + 0xc], 2
jne 0x41df06
cmp dword [ebx + 8], 0x540be3ff
jbe 0x41df0e
jmp 0x41df08
jle 0x41df0e
mov cx, 0x14
jmp 0x41df12
mov cx, 0xa
mov word [ebx + 0x10], cx
jmp 0x41df87
test byte [ebx], 0x10
je 0x41df57
mov dword [ebx], 0x10
fld qword [ebx + 8]
fchs
fstp qword [ebx + 8]
fld qword [ebx + 8]
fcomp qword [0x41df90]
fnstsw ax
sahf
ja 0x41df47
fld qword [ebx + 8]
fcomp qword [0x41df98]
fnstsw ax
sahf
jae 0x41df4d
mov dx, 0x14
jmp 0x41df51
mov dx, 0xa
mov word [ebx + 0x10], dx
jmp 0x41df87
push ebx
push 1
push 0x5407b5
push 0
push 0x438
push 1
call fcn.00457300
add esp, 0x18
mov esi, eax
test esi, esi
je 0x41df87
push esi
push ebx
call fcn.0043f284
add esp, 8
push esi
call fcn.0043dbc0
pop ecx
add esp, 0x10
pop esi
pop ebx
ret

Function at 0x41f1c4
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x555894]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov edx, dword [eax]
mov eax, dword [edx - 4]
test byte [eax + 1], 1
jne 0x41f1f0
push 0
push str.hb_vmFuncPtr__
push 0
push 0x2337
call fcn.00457568
add esp, 0x10
ret
Function at 0x41fa74
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
push edi
mov eax, dword [0x555894]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov edi, eax
mov eax, dword [edi]
mov esi, dword [eax - 4]
mov ebx, dword [eax - 8]
test byte [ebx + 1], 4
je 0x41fad9
test byte [esi + 1], 4
je 0x41fad9
push 0
push esi
push ebx
call fcn.0043fa58
sub dword [edi], 4
mov esi, eax
mov eax, dword [edi]
add esp, 0xc
mov eax, dword [eax]
test dword [eax], 0xb405
je 0x41fabc
push eax
call fcn.0043f008
pop ecx
push ebx
call fcn.0043f008
test esi, esi
pop ecx
setl dl
and edx, 1
mov dword [ebx], 0x80
mov dword [ebx + 8], edx
jmp 0x41fc77
mov ecx, dword [ebx]
test cl, 0xa
je 0x41fb31
test byte [esi], 0xa
je 0x41fb31
test cl, 2
je 0x41faf0
mov eax, dword [ebx + 8]
cdq
jmp 0x41faf6
mov eax, dword [ebx + 8]
mov edx, dword [ebx + 0xc]
push edx
push eax
test byte [esi], 2
je 0x41fb03
mov eax, dword [esi + 8]
cdq
jmp 0x41fb09
mov eax, dword [esi + 8]
mov edx, dword [esi + 0xc]
cmp edx, dword [esp + 4]
jne 0x41fb17
cmp eax, dword [esp]
seta cl
jmp 0x41fb1a
setg cl
and ecx, 1
add esp, 8
mov dword [ebx + 8], ecx
mov dword [ebx], 0x80
sub dword [edi], 4
jmp 0x41fc77
mov ecx, dword [ebx]
test cl, 0x1a
je 0x41fb87
test byte [esi], 0x1a
je 0x41fb87
test cl, 2
je 0x41fb47
fild dword [ebx + 8]
jmp 0x41fb54
test byte [ebx], 8
je 0x41fb51
fild qword [ebx + 8]
jmp 0x41fb54
fld qword [ebx + 8]
test byte [esi], 2
je 0x41fb5e
fild dword [esi + 8]
jmp 0x41fb6b
test byte [esi], 8
je 0x41fb68
fild qword [esi + 8]
jmp 0x41fb6b
fld qword [esi + 8]
fcompp
fnstsw ax
sahf
seta dl
and edx, 1
mov dword [ebx + 8], edx
mov dword [ebx], 0x80
sub dword [edi], 4
jmp 0x41fc77
test byte [ebx], 0x60
je 0x41fbde
test byte [esi], 0x60
je 0x41fbde
test byte [ebx], 0x40
je 0x41fbc1
test byte [esi], 0x40
je 0x41fbc1
mov eax, dword [ebx + 8]
cmp eax, dword [esi + 8]
jl 0x41fbb7
mov edx, dword [ebx + 8]
cmp edx, dword [esi + 8]
jne 0x41fbb3
mov ecx, dword [ebx + 0xc]
cmp ecx, dword [esi + 0xc]
jl 0x41fbb7
xor eax, eax
jmp 0x41fbbc
mov eax, 1
mov dword [ebx + 8], eax
jmp 0x41fbd0
mov edx, dword [ebx + 8]
cmp edx, dword [esi + 8]
setl cl
and ecx, 1
mov dword [ebx + 8], ecx
mov dword [ebx], 0x80
sub dword [edi], 4
jmp 0x41fc77
test byte [ebx], 0x80
je 0x41fc05
test byte [esi], 0x80
je 0x41fc05
cmp dword [ebx + 8], 0
jne 0x41fbf4
cmp dword [esi + 8], 0
jne 0x41fbf8
xor eax, eax
jmp 0x41fbfd
mov eax, 1
mov dword [ebx + 8], eax
sub dword [edi], 4
jmp 0x41fc77
push 0
push esi
push ebx
push ebx
push 0xb
call fcn.0042d818
add esp, 0x14
test eax, eax
je 0x41fc30
sub dword [edi], 4
mov edx, dword [edi]
mov eax, dword [edx]
test dword [eax], 0xb405
je 0x41fc77
push eax
call fcn.0043f008
pop ecx
jmp 0x41fc77
push esi
push ebx
push 2
push 0x5407da
push 0
push 0x431
push 1
call fcn.00457300
add esp, 0x1c
mov esi, eax
test esi, esi
je 0x41fc77
sub dword [edi], 4
mov edx, dword [edi]
mov eax, dword [edx]
test dword [eax], 0xb405
je 0x41fc66
push eax
call fcn.0043f008
pop ecx
push esi
push ebx
call fcn.0043f284
add esp, 8
push esi
call fcn.0043dbc0
pop ecx
pop edi
pop esi
pop ebx
ret
Function at 0x41fc7c
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
push edi
mov eax, dword [0x555894]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov edi, eax
mov eax, dword [edi]
mov esi, dword [eax - 4]
mov ebx, dword [eax - 8]
test byte [ebx + 1], 4
je 0x41fce1
test byte [esi + 1], 4
je 0x41fce1
push 0
push esi
push ebx
call fcn.0043fa58
sub dword [edi], 4
mov esi, eax
mov eax, dword [edi]
add esp, 0xc
mov eax, dword [eax]
test dword [eax], 0xb405
je 0x41fcc4
push eax
call fcn.0043f008
pop ecx
push ebx
call fcn.0043f008
test esi, esi
pop ecx
setle dl
and edx, 1
mov dword [ebx], 0x80
mov dword [ebx + 8], edx
jmp 0x41fe7f
mov ecx, dword [ebx]
test cl, 0xa
je 0x41fd39
test byte [esi], 0xa
je 0x41fd39
test cl, 2
je 0x41fcf8
mov eax, dword [ebx + 8]
cdq
jmp 0x41fcfe
mov eax, dword [ebx + 8]
mov edx, dword [ebx + 0xc]
push edx
push eax
test byte [esi], 2
je 0x41fd0b
mov eax, dword [esi + 8]
cdq
jmp 0x41fd11
mov eax, dword [esi + 8]
mov edx, dword [esi + 0xc]
cmp edx, dword [esp + 4]
jne 0x41fd1f
cmp eax, dword [esp]
setae cl
jmp 0x41fd22
setge cl
and ecx, 1
add esp, 8
mov dword [ebx + 8], ecx
mov dword [ebx], 0x80
sub dword [edi], 4
jmp 0x41fe7f
mov ecx, dword [ebx]
test cl, 0x1a
je 0x41fd8f
test byte [esi], 0x1a
je 0x41fd8f
test cl, 2
je 0x41fd4f
fild dword [ebx + 8]
jmp 0x41fd5c
test byte [ebx], 8
je 0x41fd59
fild qword [ebx + 8]
jmp 0x41fd5c
fld qword [ebx + 8]
test byte [esi], 2
je 0x41fd66
fild dword [esi + 8]
jmp 0x41fd73
test byte [esi], 8
je 0x41fd70
fild qword [esi + 8]
jmp 0x41fd73
fld qword [esi + 8]
fcompp
fnstsw ax
sahf
setae dl
and edx, 1
mov dword [ebx + 8], edx
mov dword [ebx], 0x80
sub dword [edi], 4
jmp 0x41fe7f
test byte [ebx], 0x60
je 0x41fde6
test byte [esi], 0x60
je 0x41fde6
test byte [ebx], 0x40
je 0x41fdc9
test byte [esi], 0x40
je 0x41fdc9
mov eax, dword [ebx + 8]
cmp eax, dword [esi + 8]
jl 0x41fdbf
mov edx, dword [ebx + 8]
cmp edx, dword [esi + 8]
jne 0x41fdbb
mov ecx, dword [ebx + 0xc]
cmp ecx, dword [esi + 0xc]
jle 0x41fdbf
xor eax, eax
jmp 0x41fdc4
mov eax, 1
mov dword [ebx + 8], eax
jmp 0x41fdd8
mov edx, dword [ebx + 8]
cmp edx, dword [esi + 8]
setle cl
and ecx, 1
mov dword [ebx + 8], ecx
mov dword [ebx], 0x80
sub dword [edi], 4
jmp 0x41fe7f
test byte [ebx], 0x80
je 0x41fe0d
test byte [esi], 0x80
je 0x41fe0d
cmp dword [ebx + 8], 0
je 0x41fe00
cmp dword [esi + 8], 0
jne 0x41fe00
xor eax, eax
jmp 0x41fe05
mov eax, 1
mov dword [ebx + 8], eax
sub dword [edi], 4
jmp 0x41fe7f
push 0
push esi
push ebx
push ebx
push 0xc
call fcn.0042d818
add esp, 0x14
test eax, eax
je 0x41fe38
sub dword [edi], 4
mov edx, dword [edi]
mov eax, dword [edx]
test dword [eax], 0xb405
je 0x41fe7f
push eax
call fcn.0043f008
pop ecx
jmp 0x41fe7f
push esi
push ebx
push 2
push 0x5407dc
push 0
push 0x432
push 1
call fcn.00457300
add esp, 0x1c
mov esi, eax
test esi, esi
je 0x41fe7f
sub dword [edi], 4
mov edx, dword [edi]
mov eax, dword [edx]
test dword [eax], 0xb405
je 0x41fe6e
push eax
call fcn.0043f008
pop ecx
push esi
push ebx
call fcn.0043f284
add esp, 8
push esi
call fcn.0043dbc0
pop ecx
pop edi
pop esi
pop ebx
ret
Function at 0x41fe84
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
push edi
mov eax, dword [0x555894]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov edi, eax
mov eax, dword [edi]
mov esi, dword [eax - 4]
mov ebx, dword [eax - 8]
test byte [ebx + 1], 4
je 0x41fee9
test byte [esi + 1], 4
je 0x41fee9
push 0
push esi
push ebx
call fcn.0043fa58
sub dword [edi], 4
mov esi, eax
mov eax, dword [edi]
add esp, 0xc
mov eax, dword [eax]
test dword [eax], 0xb405
je 0x41fecc
push eax
call fcn.0043f008
pop ecx
push ebx
call fcn.0043f008
test esi, esi
pop ecx
setg dl
and edx, 1
mov dword [ebx], 0x80
mov dword [ebx + 8], edx
jmp 0x420087
mov ecx, dword [ebx]
test cl, 0xa
je 0x41ff41
test byte [esi], 0xa
je 0x41ff41
test cl, 2
je 0x41ff00
mov eax, dword [ebx + 8]
cdq
jmp 0x41ff06
mov eax, dword [ebx + 8]
mov edx, dword [ebx + 0xc]
push edx
push eax
test byte [esi], 2
je 0x41ff13
mov eax, dword [esi + 8]
cdq
jmp 0x41ff19
mov eax, dword [esi + 8]
mov edx, dword [esi + 0xc]
cmp edx, dword [esp + 4]
jne 0x41ff27
cmp eax, dword [esp]
setb cl
jmp 0x41ff2a
setl cl
and ecx, 1
add esp, 8
mov dword [ebx + 8], ecx
mov dword [ebx], 0x80
sub dword [edi], 4
jmp 0x420087
mov ecx, dword [ebx]
test cl, 0x1a
je 0x41ff97
test byte [esi], 0x1a
je 0x41ff97
test cl, 2
je 0x41ff57
fild dword [ebx + 8]
jmp 0x41ff64
test byte [ebx], 8
je 0x41ff61
fild qword [ebx + 8]
jmp 0x41ff64
fld qword [ebx + 8]
test byte [esi], 2
je 0x41ff6e
fild dword [esi + 8]
jmp 0x41ff7b
test byte [esi], 8
je 0x41ff78
fild qword [esi + 8]
jmp 0x41ff7b
fld qword [esi + 8]
fcompp
fnstsw ax
sahf
setb dl
and edx, 1
mov dword [ebx + 8], edx
mov dword [ebx], 0x80
sub dword [edi], 4
jmp 0x420087
test byte [ebx], 0x60
je 0x41ffee
test byte [esi], 0x60
je 0x41ffee
test byte [ebx], 0x40
je 0x41ffd1
test byte [esi], 0x40
je 0x41ffd1
mov eax, dword [ebx + 8]
cmp eax, dword [esi + 8]
jg 0x41ffc7
mov edx, dword [ebx + 8]
cmp edx, dword [esi + 8]
jne 0x41ffc3
mov ecx, dword [ebx + 0xc]
cmp ecx, dword [esi + 0xc]
jg 0x41ffc7
xor eax, eax
jmp 0x41ffcc
mov eax, 1
mov dword [ebx + 8], eax
jmp 0x41ffe0
mov edx, dword [ebx + 8]
cmp edx, dword [esi + 8]
setg cl
and ecx, 1
mov dword [ebx + 8], ecx
mov dword [ebx], 0x80
sub dword [edi], 4
jmp 0x420087
test byte [ebx], 0x80
je 0x420015
test byte [esi], 0x80
je 0x420015
cmp dword [ebx + 8], 0
je 0x420004
cmp dword [esi + 8], 0
je 0x420008
xor eax, eax
jmp 0x42000d
mov eax, 1
mov dword [ebx + 8], eax
sub dword [edi], 4
jmp 0x420087
push 0
push esi
push ebx
push ebx
push 0xd
call fcn.0042d818
add esp, 0x14
test eax, eax
je 0x420040
sub dword [edi], 4
mov edx, dword [edi]
mov eax, dword [edx]
test dword [eax], 0xb405
je 0x420087
push eax
call fcn.0043f008
pop ecx
jmp 0x420087
push esi
push ebx
push 2
push 0x5407d8
push 0
push 0x433
push 1
call fcn.00457300
add esp, 0x1c
mov esi, eax
test esi, esi
je 0x420087
sub dword [edi], 4
mov edx, dword [edi]
mov eax, dword [edx]
test dword [eax], 0xb405
je 0x420076
push eax
call fcn.0043f008
pop ecx
push esi
push ebx
call fcn.0043f284
add esp, 8
push esi
call fcn.0043dbc0
pop ecx
pop edi
pop esi
pop ebx
ret
Function at 0x42008c
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
push edi
mov eax, dword [0x555894]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov edi, eax
mov eax, dword [edi]
mov esi, dword [eax - 4]
mov ebx, dword [eax - 8]
test byte [ebx + 1], 4
je 0x4200f1
test byte [esi + 1], 4
je 0x4200f1
push 0
push esi
push ebx
call fcn.0043fa58
sub dword [edi], 4
mov esi, eax
mov eax, dword [edi]
add esp, 0xc
mov eax, dword [eax]
test dword [eax], 0xb405
je 0x4200d4
push eax
call fcn.0043f008
pop ecx
push ebx
call fcn.0043f008
test esi, esi
pop ecx
setge dl
and edx, 1
mov dword [ebx], 0x80
mov dword [ebx + 8], edx
jmp 0x42028f
mov ecx, dword [ebx]
test cl, 0xa
je 0x420149
test byte [esi], 0xa
je 0x420149
test cl, 2
je 0x420108
mov eax, dword [ebx + 8]
cdq
jmp 0x42010e
mov eax, dword [ebx + 8]
mov edx, dword [ebx + 0xc]
push edx
push eax
test byte [esi], 2
je 0x42011b
mov eax, dword [esi + 8]
cdq
jmp 0x420121
mov eax, dword [esi + 8]
mov edx, dword [esi + 0xc]
cmp edx, dword [esp + 4]
jne 0x42012f
cmp eax, dword [esp]
setbe cl
jmp 0x420132
setle cl
and ecx, 1
add esp, 8
mov dword [ebx + 8], ecx
mov dword [ebx], 0x80
sub dword [edi], 4
jmp 0x42028f
mov ecx, dword [ebx]
test cl, 0x1a
je 0x42019f
test byte [esi], 0x1a
je 0x42019f
test cl, 2
je 0x42015f
fild dword [ebx + 8]
jmp 0x42016c
test byte [ebx], 8
je 0x420169
fild qword [ebx + 8]
jmp 0x42016c
fld qword [ebx + 8]
test byte [esi], 2
je 0x420176
fild dword [esi + 8]
jmp 0x420183
test byte [esi], 8
je 0x420180
fild qword [esi + 8]
jmp 0x420183
fld qword [esi + 8]
fcompp
fnstsw ax
sahf
setbe dl
and edx, 1
mov dword [ebx + 8], edx
mov dword [ebx], 0x80
sub dword [edi], 4
jmp 0x42028f
test byte [ebx], 0x60
je 0x4201f6
test byte [esi], 0x60
je 0x4201f6
test byte [ebx], 0x40
je 0x4201d9
test byte [esi], 0x40
je 0x4201d9
mov eax, dword [ebx + 8]
cmp eax, dword [esi + 8]
jg 0x4201cf
mov edx, dword [ebx + 8]
cmp edx, dword [esi + 8]
jne 0x4201cb
mov ecx, dword [ebx + 0xc]
cmp ecx, dword [esi + 0xc]
jge 0x4201cf
xor eax, eax
jmp 0x4201d4
mov eax, 1
mov dword [ebx + 8], eax
jmp 0x4201e8
mov edx, dword [ebx + 8]
cmp edx, dword [esi + 8]
setge cl
and ecx, 1
mov dword [ebx + 8], ecx
mov dword [ebx], 0x80
sub dword [edi], 4
jmp 0x42028f
test byte [ebx], 0x80
je 0x42021d
test byte [esi], 0x80
je 0x42021d
cmp dword [ebx + 8], 0
jne 0x420210
cmp dword [esi + 8], 0
je 0x420210
xor eax, eax
jmp 0x420215
mov eax, 1
mov dword [ebx + 8], eax
sub dword [edi], 4
jmp 0x42028f
push 0
push esi
push ebx
push ebx
push 0xe
call fcn.0042d818
add esp, 0x14
test eax, eax
je 0x420248
sub dword [edi], 4
mov edx, dword [edi]
mov eax, dword [edx]
test dword [eax], 0xb405
je 0x42028f
push eax
call fcn.0043f008
pop ecx
jmp 0x42028f
push esi
push ebx
push 2
push 0x5407df
push 0
push 0x434
push 1
call fcn.00457300
add esp, 0x1c
mov esi, eax
test esi, esi
je 0x42028f
sub dword [edi], 4
mov edx, dword [edi]
mov eax, dword [edx]
test dword [eax], 0xb405
je 0x42027e
push eax
call fcn.0043f008
pop ecx
push esi
push ebx
call fcn.0043f284
add esp, 8
push esi
call fcn.0043dbc0
pop ecx
pop edi
pop esi
pop ebx
ret