joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41fc3c
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
push edi
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov edi, eax
mov eax, dword [edi]
mov esi, dword [eax - 4]
mov ebx, dword [eax - 8]
test byte [ebx + 1], 4
je 0x41fca1
test byte [esi + 1], 4
je 0x41fca1
push 0
push esi
push ebx
call fcn.0043f810
sub dword [edi], 4
mov esi, eax
mov eax, dword [edi]
add esp, 0xc
mov eax, dword [eax]
test dword [eax], 0xb405
je 0x41fc84
push eax
call fcn.0043edc0
pop ecx
push ebx
call fcn.0043edc0
test esi, esi
pop ecx
setg dl
and edx, 1
mov dword [ebx], 0x80
mov dword [ebx + 8], edx
jmp 0x41fe3f
mov ecx, dword [ebx]
test cl, 0xa
je 0x41fcf9
test byte [esi], 0xa
je 0x41fcf9
test cl, 2
je 0x41fcb8
mov eax, dword [ebx + 8]
cdq
jmp 0x41fcbe
mov eax, dword [ebx + 8]
mov edx, dword [ebx + 0xc]
push edx
push eax
test byte [esi], 2
je 0x41fccb
mov eax, dword [esi + 8]
cdq
jmp 0x41fcd1
mov eax, dword [esi + 8]
mov edx, dword [esi + 0xc]
cmp edx, dword [esp + 4]
jne 0x41fcdf
cmp eax, dword [esp]
setb cl
jmp 0x41fce2
setl cl
and ecx, 1
add esp, 8
mov dword [ebx + 8], ecx
mov dword [ebx], 0x80
sub dword [edi], 4
jmp 0x41fe3f
mov ecx, dword [ebx]
test cl, 0x1a
je 0x41fd4f
test byte [esi], 0x1a
je 0x41fd4f
test cl, 2
je 0x41fd0f
fild dword [ebx + 8]
jmp 0x41fd1c
test byte [ebx], 8
je 0x41fd19
fild qword [ebx + 8]
jmp 0x41fd1c
fld qword [ebx + 8]
test byte [esi], 2
je 0x41fd26
fild dword [esi + 8]
jmp 0x41fd33
test byte [esi], 8
je 0x41fd30
fild qword [esi + 8]
jmp 0x41fd33
fld qword [esi + 8]
fcompp
fnstsw ax
sahf
setb dl
and edx, 1
mov dword [ebx + 8], edx
mov dword [ebx], 0x80
sub dword [edi], 4
jmp 0x41fe3f
test byte [ebx], 0x60
je 0x41fda6
test byte [esi], 0x60
je 0x41fda6
test byte [ebx], 0x40
je 0x41fd89
test byte [esi], 0x40
je 0x41fd89
mov eax, dword [ebx + 8]
cmp eax, dword [esi + 8]
jg 0x41fd7f
mov edx, dword [ebx + 8]
cmp edx, dword [esi + 8]
jne 0x41fd7b
mov ecx, dword [ebx + 0xc]
cmp ecx, dword [esi + 0xc]
jg 0x41fd7f
xor eax, eax
jmp 0x41fd84
mov eax, 1
mov dword [ebx + 8], eax
jmp 0x41fd98
mov edx, dword [ebx + 8]
cmp edx, dword [esi + 8]
setg cl
and ecx, 1
mov dword [ebx + 8], ecx
mov dword [ebx], 0x80
sub dword [edi], 4
jmp 0x41fe3f
test byte [ebx], 0x80
je 0x41fdcd
test byte [esi], 0x80
je 0x41fdcd
cmp dword [ebx + 8], 0
je 0x41fdbc
cmp dword [esi + 8], 0
je 0x41fdc0
xor eax, eax
jmp 0x41fdc5
mov eax, 1
mov dword [ebx + 8], eax
sub dword [edi], 4
jmp 0x41fe3f
push 0
push esi
push ebx
push ebx
push 0xd
call fcn.0042d5d0
add esp, 0x14
test eax, eax
je 0x41fdf8
sub dword [edi], 4
mov edx, dword [edi]
mov eax, dword [edx]
test dword [eax], 0xb405
je 0x41fe3f
push eax
call fcn.0043edc0
pop ecx
jmp 0x41fe3f
push esi
push ebx
push 2
push 0x538694
push 0
push 0x433
push 1
call fcn.004570b8
add esp, 0x1c
mov esi, eax
test esi, esi
je 0x41fe3f
sub dword [edi], 4
mov edx, dword [edi]
mov eax, dword [edx]
test dword [eax], 0xb405
je 0x41fe2e
push eax
call fcn.0043edc0
pop ecx
push esi
push ebx
call fcn.0043f03c
add esp, 8
push esi
call fcn.0043d978
pop ecx
pop edi
pop esi
pop ebx
ret
Function at 0x41fe44
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
push edi
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov edi, eax
mov eax, dword [edi]
mov esi, dword [eax - 4]
mov ebx, dword [eax - 8]
test byte [ebx + 1], 4
je 0x41fea9
test byte [esi + 1], 4
je 0x41fea9
push 0
push esi
push ebx
call fcn.0043f810
sub dword [edi], 4
mov esi, eax
mov eax, dword [edi]
add esp, 0xc
mov eax, dword [eax]
test dword [eax], 0xb405
je 0x41fe8c
push eax
call fcn.0043edc0
pop ecx
push ebx
call fcn.0043edc0
test esi, esi
pop ecx
setge dl
and edx, 1
mov dword [ebx], 0x80
mov dword [ebx + 8], edx
jmp 0x420047
mov ecx, dword [ebx]
test cl, 0xa
je 0x41ff01
test byte [esi], 0xa
je 0x41ff01
test cl, 2
je 0x41fec0
mov eax, dword [ebx + 8]
cdq
jmp 0x41fec6
mov eax, dword [ebx + 8]
mov edx, dword [ebx + 0xc]
push edx
push eax
test byte [esi], 2
je 0x41fed3
mov eax, dword [esi + 8]
cdq
jmp 0x41fed9
mov eax, dword [esi + 8]
mov edx, dword [esi + 0xc]
cmp edx, dword [esp + 4]
jne 0x41fee7
cmp eax, dword [esp]
setbe cl
jmp 0x41feea
setle cl
and ecx, 1
add esp, 8
mov dword [ebx + 8], ecx
mov dword [ebx], 0x80
sub dword [edi], 4
jmp 0x420047
mov ecx, dword [ebx]
test cl, 0x1a
je 0x41ff57
test byte [esi], 0x1a
je 0x41ff57
test cl, 2
je 0x41ff17
fild dword [ebx + 8]
jmp 0x41ff24
test byte [ebx], 8
je 0x41ff21
fild qword [ebx + 8]
jmp 0x41ff24
fld qword [ebx + 8]
test byte [esi], 2
je 0x41ff2e
fild dword [esi + 8]
jmp 0x41ff3b
test byte [esi], 8
je 0x41ff38
fild qword [esi + 8]
jmp 0x41ff3b
fld qword [esi + 8]
fcompp
fnstsw ax
sahf
setbe dl
and edx, 1
mov dword [ebx + 8], edx
mov dword [ebx], 0x80
sub dword [edi], 4
jmp 0x420047
test byte [ebx], 0x60
je 0x41ffae
test byte [esi], 0x60
je 0x41ffae
test byte [ebx], 0x40
je 0x41ff91
test byte [esi], 0x40
je 0x41ff91
mov eax, dword [ebx + 8]
cmp eax, dword [esi + 8]
jg 0x41ff87
mov edx, dword [ebx + 8]
cmp edx, dword [esi + 8]
jne 0x41ff83
mov ecx, dword [ebx + 0xc]
cmp ecx, dword [esi + 0xc]
jge 0x41ff87
xor eax, eax
jmp 0x41ff8c
mov eax, 1
mov dword [ebx + 8], eax
jmp 0x41ffa0
mov edx, dword [ebx + 8]
cmp edx, dword [esi + 8]
setge cl
and ecx, 1
mov dword [ebx + 8], ecx
mov dword [ebx], 0x80
sub dword [edi], 4
jmp 0x420047
test byte [ebx], 0x80
je 0x41ffd5
test byte [esi], 0x80
je 0x41ffd5
cmp dword [ebx + 8], 0
jne 0x41ffc8
cmp dword [esi + 8], 0
je 0x41ffc8
xor eax, eax
jmp 0x41ffcd
mov eax, 1
mov dword [ebx + 8], eax
sub dword [edi], 4
jmp 0x420047
push 0
push esi
push ebx
push ebx
push 0xe
call fcn.0042d5d0
add esp, 0x14
test eax, eax
je 0x420000
sub dword [edi], 4
mov edx, dword [edi]
mov eax, dword [edx]
test dword [eax], 0xb405
je 0x420047
push eax
call fcn.0043edc0
pop ecx
jmp 0x420047
push esi
push ebx
push 2
push 0x53869b
push 0
push 0x434
push 1
call fcn.004570b8
add esp, 0x1c
mov esi, eax
test esi, esi
je 0x420047
sub dword [edi], 4
mov edx, dword [edi]
mov eax, dword [edx]
test dword [eax], 0xb405
je 0x420036
push eax
call fcn.0043edc0
pop ecx
push esi
push ebx
call fcn.0043f03c
add esp, 8
push esi
call fcn.0043d978
pop ecx
pop edi
pop esi
pop ebx
ret
Function at 0x42004c
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
push edi
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov esi, eax
mov eax, dword [esi]
mov ebx, dword [eax - 8]
mov edi, dword [eax - 4]
test byte [ebx + 1], 4
je 0x4200bd
test byte [edi + 1], 4
je 0x4200bd
mov eax, dword [edi + 8]
push eax
mov edx, dword [edi + 0x10]
push edx
mov ecx, dword [ebx + 8]
push ecx
mov eax, dword [ebx + 0x10]
push eax
call fcn.004a8498
add esp, 0x10
test eax, eax
setne dl
sub dword [esi], 4
and edx, 1
mov ecx, dword [esi]
mov edi, edx
mov eax, dword [ecx]
test dword [eax], 0xb405
je 0x4200a8
push eax
call fcn.0043edc0
pop ecx
push ebx
call fcn.0043edc0
pop ecx
mov dword [ebx], 0x80
mov dword [ebx + 8], edi
jmp 0x4201ac
test byte [edi], 4
je 0x42010f
test dword [ebx], 0x47b
jne 0x4200d6
push ebx
call fcn.0043ca74
pop ecx
cmp eax, 1
jne 0x42010f
push 0
push ebx
push edi
call fcn.0043cd28
sub dword [esi], 4
mov edi, eax
mov edx, dword [esi]
add esp, 0xc
mov eax, dword [edx]
test dword [eax], 0xb405
je 0x4200fa
push eax
call fcn.0043edc0
pop ecx
push ebx
call fcn.0043edc0
pop ecx
mov dword [ebx], 0x80
mov dword [ebx + 8], edi
jmp 0x4201ac
push 0
push ebx
push edi
push ebx
push 0x11
call fcn.0042d5d0
add esp, 0x14
test eax, eax
je 0x42013a
sub dword [esi], 4
mov edx, dword [esi]
mov eax, dword [edx]
test dword [eax], 0xb405
je 0x4201ac
push eax
call fcn.0043edc0
pop ecx
jmp 0x4201ac
push 0
push edi
push ebx
push ebx
push 0x10
call fcn.0042d5d0
add esp, 0x14
test eax, eax
je 0x420165
sub dword [esi], 4
mov edx, dword [esi]
mov eax, dword [edx]
test dword [eax], 0xb405
je 0x4201ac
push eax
call fcn.0043edc0
pop ecx
jmp 0x4201ac
push edi
push ebx
push 2
push 0x53869e
push 0
push 0x455
push 1
call fcn.004570b8
add esp, 0x1c
mov edi, eax
test edi, edi
je 0x4201ac
sub dword [esi], 4
mov edx, dword [esi]
mov eax, dword [edx]
test dword [eax], 0xb405
je 0x42019b
push eax
call fcn.0043edc0
pop ecx
push edi
push ebx
call fcn.0043f03c
add esp, 8
push edi
call fcn.0043d978
pop ecx
pop edi
pop esi
pop ebx
ret
Function at 0x4201b0
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
push edi
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov ebx, eax
mov eax, dword [ebx]
mov esi, dword [eax - 4]
mov ecx, dword [esi]
test cl, 0x1a
je 0x4201fc
test cl, 2
je 0x4201d6
fild dword [esi + 8]
jmp 0x4201e3
test byte [esi], 8
je 0x4201e0
fild qword [esi + 8]
jmp 0x4201e3
fld qword [esi + 8]
fcomp dword [0x4202b8]
fnstsw ax
sahf
setb dl
and edx, 1
sub dword [ebx], 4
mov edi, edx
jmp 0x4202a4
push 0
call fcn.00422d18
pop ecx
mov eax, dword [ebx]
mov edx, dword [eax - 4]
push edx
push esi
push 2
push 0x538696
push 0
push 0x431
push 1
call fcn.004570b8
add esp, 0x1c
mov esi, eax
test esi, esi
je 0x4202b4
test byte [esi], 0x80
je 0x42026a
mov edi, dword [esi + 8]
push esi
call fcn.0043d978
pop ecx
sub dword [ebx], 4
mov eax, dword [ebx]
mov eax, dword [eax]
test dword [eax], 0xb405
je 0x420252
push eax
call fcn.0043edc0
pop ecx
sub dword [ebx], 4
mov edx, dword [ebx]
mov eax, dword [edx]
test dword [eax], 0xb405
je 0x4202a4
push eax
call fcn.0043edc0
pop ecx
jmp 0x4202a4
push esi
mov edx, dword [ebx]
mov ecx, dword [edx - 4]
push ecx
call fcn.0043f03c
add esp, 8
push esi
call fcn.0043d978
pop ecx
mov eax, dword [ebx]
mov edx, dword [eax - 4]
push edx
push 1
push 0x32
call fcn.0046bdb8
pop ecx
push eax
push 0
push 0x42a
push 1
call fcn.00456f18
add esp, 0x18
jmp 0x4202b4
test edi, edi
je 0x4202af
call fcn.0041f82c
jmp 0x4202b4
call fcn.0041fc3c
pop edi
pop esi
pop ebx
ret

Function at 0x4202d4
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
push edi
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov edx, dword [eax]
mov ebx, dword [edx - 4]
test byte [ebx + 1], 0x10
je 0x42032f
call fcn.004565dc
mov esi, eax
push 0x5385ac
push 0x18
call fcn.0043b69c
add esp, 8
mov edi, eax
mov ecx, 6
push esi
rep movsd dword es:[edi], dword [esi]
pop esi
mov ecx, 6
push esi
mov edi, esi
mov esi, ebx
rep movsd dword es:[edi], dword [esi]
pop esi
mov dword [ebx], 1
mov dword [ebx + 8], eax
mov eax, 1
mov dword [ebx + 0x10], eax
mov dword [ebx + 0xc], eax
pop edi
pop esi
pop ebx
ret

Function at 0x42034c
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov ebx, eax
add dword [ebx], 4
mov eax, dword [ebx]
cmp eax, dword [ebx + 4]
jne 0x42036a
call fcn.00432adc
mov edx, dword [ebx]
mov esi, dword [edx - 4]
push 0x5385b4
push 4
call fcn.0043b69c
add esp, 8
mov edx, dword [ebx + 0x2c]
mov dword [eax], edx
mov dword [esi], 1
mov dword [esi + 8], eax
mov eax, 1
mov dword [esi + 0x10], eax
mov dword [esi + 0xc], eax
mov edx, dword [ebx]
sub edx, dword [ebx + 8]
test edx, edx
jns 0x4203a3
add edx, 3
sar edx, 2
add edx, 0xfffffffe
mov dword [ebx + 0x2c], edx
pop esi
pop ebx
ret
Function at 0x4203b0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov eax, dword [0x54d750]
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov ebx, eax
test edi, edi
je 0x4203d4
push edi
call fcn.0043d978
pop ecx
test byte [esi + 1], 0x80
je 0x420491
mov eax, dword [esi + 8]
cmp word [eax + 0xc], 0
je 0x420491
call fcn.00425334
test ax, ax
jne 0x420491
push 0x1b
push esi
call fcn.0042d58c
add esp, 8
test eax, eax
je 0x420491
mov edx, dword [ebx]
mov ecx, dword [edx]
push esi
mov edi, ecx
lea esi, [ebx + 0x10]
mov ecx, 6
rep movsd dword es:[edi], dword [esi]
pop esi
xor eax, eax
mov dword [ebx + 0x10], eax
add dword [ebx], 4
mov edx, dword [ebx]
cmp edx, dword [ebx + 4]
jne 0x420433
call fcn.00432adc
call fcn.00422ba8
push 0
push 0
push esi
mov ecx, dword [ebx]
mov eax, dword [ecx - 4]
push eax
push 0x1b
call fcn.0042d5d0
add esp, 0x14
sub dword [ebx], 4
mov edx, dword [ebx]
mov eax, dword [edx]
test dword [eax], 0xb405
je 0x420463
push eax
call fcn.0043edc0
pop ecx
test dword [ebx + 0x10], 0xb405
je 0x420476
lea edx, [ebx + 0x10]
push edx
call fcn.0043edc0
pop ecx
sub dword [ebx], 4
lea edi, [ebx + 0x10]
mov ecx, dword [ebx]
mov eax, dword [ecx]
mov ecx, 6
mov esi, eax
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebx]
xor ecx, ecx
mov edx, dword [eax]
mov dword [edx], ecx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4207f4
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov ebp, eax
mov eax, dword [ebp]
mov edx, dword [eax - 4]
mov edi, dword [edx + 8]
test edi, edi
jle 0x420976
mov eax, edi
mov edx, dword [ebp]
add eax, eax
neg eax
mov ecx, dword [edx + eax*4]
mov dword [esp], ecx
mov eax, dword [esp]
push eax
call fcn.0043f250
pop ecx
mov esi, eax
mov ebx, dword [esi + 8]
test byte [ebx + 1], 0x20
je 0x420844
push ebx
call fcn.0043f598
pop ecx
mov ebx, eax
test byte [ebx + 1], 0x80
je 0x4208f7
test byte [ebx + 1], 0x80
je 0x4208d0
mov eax, dword [ebx + 8]
cmp word [eax + 0xc], 0
je 0x4208d0
push 0x1a
push ebx
call fcn.0042d58c
add esp, 8
test eax, eax
je 0x4208d0
inc dword [esi + 0x10]
call fcn.00422ba8
push 0
call fcn.00422bd0
pop ecx
mov eax, dword [ebp]
mov edx, dword [eax - 4]
push edx
mov ecx, dword [esp + 4]
push ecx
push ebx
mov eax, dword [eax - 8]
push eax
push 0x1a
call fcn.0042d5d0
sub dword [ebp], 4
mov edx, dword [ebp]
add esp, 0x14
mov eax, dword [edx]
test dword [eax], 0xb405
je 0x4208b0
push eax
call fcn.0043edc0
pop ecx
call fcn.00425334
test ax, ax
jne 0x420976
call fcn.00423960
test eax, eax
je 0x420976
jmp 0x42096d
mov eax, dword [esi + 0xc]
test eax, eax
je 0x4208e3
push eax
call fcn.0043d978
pop ecx
xor edx, edx
mov dword [esi + 0xc], edx
inc dword [esi + 0x10]
mov ecx, dword [esi + 0x10]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 4]
ja 0x420976
jmp 0x42096d
test byte [ebx], 4
je 0x420922
mov eax, dword [esi + 0xc]
test eax, eax
je 0x42090f
push eax
call fcn.0043d978
pop ecx
xor edx, edx
mov dword [esi + 0xc], edx
push ebx
call fcn.0043ca74
pop ecx
inc dword [esi + 0x10]
mov ecx, dword [esi + 0x10]
cmp eax, ecx
jb 0x420976
jmp 0x42096d
test byte [ebx + 1], 4
je 0x42094e
inc dword [esi + 0x10]
mov eax, dword [esi + 0x10]
cmp eax, dword [ebx + 8]
ja 0x420976
push 1
mov edx, dword [ebx + 0x10]
add edx, dword [esi + 0x10]
dec edx
push edx
mov ecx, dword [esi + 0xc]
push ecx
call fcn.0043daa0
add esp, 0xc
mov dword [esi + 0xc], eax
jmp 0x42096d
push ebx
push 1
push 0x2e
call fcn.0046bdb8
pop ecx
push eax
push 0
push 0x42c
push 1
call fcn.00456f18
add esp, 0x18
jmp 0x420985
dec edi
test edi, edi
jg 0x420817
test edi, edi
sete al
and eax, 1
push eax
call fcn.00422bd0
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x42098c
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov ebp, eax
mov eax, dword [ebp]
mov edx, dword [eax - 4]
mov edi, dword [edx + 8]
test edi, edi
jle 0x420aec
mov eax, edi
mov edx, dword [ebp]
add eax, eax
neg eax
mov ecx, dword [edx + eax*4]
mov dword [esp], ecx
mov eax, dword [esp]
push eax
call fcn.0043f250
pop ecx
mov esi, eax
mov ebx, dword [esi + 8]
test byte [ebx + 1], 0x20
je 0x4209dc
push ebx
call fcn.0043f598
pop ecx
mov ebx, eax
test byte [ebx + 1], 0x80
je 0x420a7f
test byte [ebx + 1], 0x80
je 0x420a65
mov eax, dword [ebx + 8]
cmp word [eax + 0xc], 0
je 0x420a65
push 0x1a
push ebx
call fcn.0042d58c
add esp, 8
test eax, eax
je 0x420a65
dec dword [esi + 0x10]
call fcn.00422ba8
push 1
call fcn.00422bd0
pop ecx
mov eax, dword [ebp]
mov edx, dword [eax - 4]
push edx
mov ecx, dword [esp + 4]
push ecx
push ebx
mov eax, dword [eax - 8]
push eax
push 0x1a
call fcn.0042d5d0
sub dword [ebp], 4
mov edx, dword [ebp]
add esp, 0x14
mov eax, dword [edx]
test dword [eax], 0xb405
je 0x420a48
push eax
call fcn.0043edc0
pop ecx
call fcn.00425334
test ax, ax
jne 0x420aec
call fcn.00423960
test eax, eax
je 0x420aec
jmp 0x420ae3
mov eax, dword [esi + 0xc]
test eax, eax
je 0x420a78
push eax
call fcn.0043d978
pop ecx
xor edx, edx
mov dword [esi + 0xc], edx
dec dword [esi + 0x10]
je 0x420aec
jmp 0x420ae3
test byte [ebx], 4
je 0x420a9e
mov eax, dword [esi + 0xc]
test eax, eax
je 0x420a97
push eax
call fcn.0043d978
pop ecx
xor edx, edx
mov dword [esi + 0xc], edx
dec dword [esi + 0x10]
je 0x420aec
jmp 0x420ae3
test byte [ebx + 1], 4
je 0x420ac4
dec dword [esi + 0x10]
je 0x420aec
push 1
mov ecx, dword [ebx + 0x10]
add ecx, dword [esi + 0x10]
dec ecx
push ecx
mov eax, dword [esi + 0xc]
push eax
call fcn.0043daa0
add esp, 0xc
mov dword [esi + 0xc], eax
jmp 0x420ae3
push ebx
push 1
push 0x2e
call fcn.0046bdb8
pop ecx
push eax
push 0
push 0x42c
push 1
call fcn.00456f18
add esp, 0x18
jmp 0x420afb
dec edi
test edi, edi
jg 0x4209af
test edi, edi
sete dl
and edx, 1
push edx
call fcn.00422bd0
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x420b54
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov edx, dword [eax]
mov ebx, dword [edx - 4]
mov eax, dword [ebx]
test al, 0xa
jne 0x420ba6
test ah, 4
jne 0x420ba6
push ebx
push 1
push str.SWITCH
push 0
push 0xc20
push 1
call fcn.004570b8
add esp, 0x18
mov esi, eax
test esi, esi
jne 0x420b95
xor eax, eax
pop esi
pop ebx
ret
push esi
push ebx
call fcn.0043f03c
add esp, 8
push esi
call fcn.0043d978
pop ecx
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x420bac
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov edi, eax
call fcn.00420b54
mov esi, eax
test esi, esi
je 0x420ce7
xor eax, eax
jmp 0x420cd1
mov dl, byte [ebx]
sub dl, 0x61
je 0x420beb
sub dl, 3
je 0x420c60
sub dl, 6
je 0x420c20
jmp 0x420c66
mov ecx, dword [esi]
test cl, 0xa
je 0x420c1b
test cl, 2
je 0x420bfd
mov eax, dword [esi + 8]
cdq
jmp 0x420c03
mov eax, dword [esi + 8]
mov edx, dword [esi + 0xc]
push edx
push eax
mov eax, dword [ebx + 1]
cdq
cmp edx, dword [esp + 4]
jne 0x420c12
cmp eax, dword [esp]
sete al
and eax, 1
add esp, 8
add ebx, 5
jmp 0x420c66
test byte [esi + 1], 4
je 0x420c54
mov edx, dword [esi + 8]
xor ecx, ecx
mov cl, byte [ebx + 1]
dec ecx
cmp edx, ecx
jne 0x420c4b
mov eax, dword [esi + 8]
lea edx, [ebx + 2]
push eax
push edx
mov ecx, dword [esi + 0x10]
push ecx
call fcn.004ab718
add esp, 0xc
test eax, eax
je 0x420c4f
xor eax, eax
jmp 0x420c54
mov eax, 1
xor edx, edx
mov dl, byte [ebx + 1]
add edx, 2
add ebx, edx
jmp 0x420c66
mov eax, 1
inc ebx
mov dl, byte [ebx]
sub dl, 0x19
je 0x420c77
dec dl
je 0x420c88
dec dl
je 0x420c99
jmp 0x420cd1
test eax, eax
je 0x420c83
movsx ecx, byte [ebx + 1]
add ebx, ecx
jmp 0x420cd1
add ebx, 2
jmp 0x420cd1
test eax, eax
je 0x420c94
movsx edx, word [ebx + 1]
add ebx, edx
jmp 0x420cd1
add ebx, 3
jmp 0x420cd1
test eax, eax
je 0x420cce
xor edx, edx
xor ecx, ecx
mov dl, byte [ebx + 2]
mov cl, byte [ebx + 1]
shl edx, 8
or ecx, edx
xor edx, edx
mov dl, byte [ebx + 3]
shl edx, 0x10
or ecx, edx
test byte [ebx + 3], 0x80
je 0x420cc3
mov edx, 0xff
jmp 0x420cc5
xor edx, edx
shl edx, 0x18
or ecx, edx
add ebx, ecx
jmp 0x420cd1
add ebx, 4
test eax, eax
jne 0x420ce7
mov cx, word [ebp + 0xc]
add word [ebp + 0xc], 0xffff
test cx, cx
jne 0x420bd8
sub dword [edi], 4
mov eax, dword [edi]
mov eax, dword [eax]
test dword [eax], 0xb405
je 0x420cfd
push eax
call fcn.0043edc0
pop ecx
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x420d04
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov edx, dword [eax]
mov ebx, dword [edx - 4]
test byte [ebx], 0x80
je 0x420d31
mov dword [ebx], 0x80
mov eax, dword [ebx + 8]
cmp eax, 1
sbb edx, edx
neg edx
mov dword [ebx + 8], edx
pop esi
pop ebx
ret
push 0
push 0
push ebx
push ebx
push 0x12
call fcn.0042d5d0
add esp, 0x14
test eax, eax
jne 0x420d75
push ebx
push 1
push 0x5386a7
push 0
push 0x435
push 1
call fcn.004570b8
add esp, 0x18
mov esi, eax
test esi, esi
je 0x420d75
push esi
push ebx
call fcn.0043f03c
add esp, 8
push esi
call fcn.0043d978
pop ecx
pop esi
pop ebx
ret
Function at 0x420d78
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
push edi
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov esi, eax
mov eax, dword [esi]
mov edi, dword [eax - 4]
mov ebx, dword [eax - 8]
test byte [ebx], 0x80
je 0x420dbd
test byte [edi], 0x80
je 0x420dbd
mov dword [ebx], 0x80
cmp dword [ebx + 8], 0
je 0x420dac
cmp dword [edi + 8], 0
jne 0x420db0
xor eax, eax
jmp 0x420db5
mov eax, 1
mov dword [ebx + 8], eax
sub dword [esi], 4
jmp 0x420e2f
push 0
push edi
push ebx
push ebx
push 0x13
call fcn.0042d5d0
add esp, 0x14
test eax, eax
je 0x420de8
sub dword [esi], 4
mov edx, dword [esi]
mov eax, dword [edx]
test dword [eax], 0xb405
je 0x420e2f
push eax
call fcn.0043edc0
pop ecx
jmp 0x420e2f
push edi
push ebx
push 2
push 0x5386ad
push 0
push 0x436
push 1
call fcn.004570b8
add esp, 0x1c
mov edi, eax
test edi, edi
je 0x420e2f
sub dword [esi], 4
mov edx, dword [esi]
mov eax, dword [edx]
test dword [eax], 0xb405
je 0x420e1e
push eax
call fcn.0043edc0
pop ecx
push edi
push ebx
call fcn.0043f03c
add esp, 8
push edi
call fcn.0043d978
pop ecx
pop edi
pop esi
pop ebx
ret

Function at 0x420e34
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
push edi
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov esi, eax
mov eax, dword [esi]
mov edi, dword [eax - 4]
mov ebx, dword [eax - 8]
test byte [ebx], 0x80
je 0x420e79
test byte [edi], 0x80
je 0x420e79
mov dword [ebx], 0x80
cmp dword [ebx + 8], 0
jne 0x420e6c
cmp dword [edi + 8], 0
jne 0x420e6c
xor eax, eax
jmp 0x420e71
mov eax, 1
mov dword [ebx + 8], eax
sub dword [esi], 4
jmp 0x420eeb
push 0
push edi
push ebx
push ebx
push 0x14
call fcn.0042d5d0
add esp, 0x14
test eax, eax
je 0x420ea4
sub dword [esi], 4
mov edx, dword [esi]
mov eax, dword [edx]
test dword [eax], 0xb405
je 0x420eeb
push eax
call fcn.0043edc0
pop ecx
jmp 0x420eeb
push edi
push ebx
push 2
push 0x5386b3
push 0
push 0x437
push 1
call fcn.004570b8
add esp, 0x1c
mov edi, eax
test edi, edi
je 0x420eeb
sub dword [esi], 4
mov edx, dword [esi]
mov eax, dword [edx]
test dword [eax], 0xb405
je 0x420eda
push eax
call fcn.0043edc0
pop ecx
push edi
push ebx
call fcn.0043f03c
add esp, 8
push edi
call fcn.0043d978
pop ecx
pop edi
pop esi
pop ebx
ret