joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409180
Capabilities:
Get thread local storage value

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, ecx
mov ecx, dword [0x4c6060]
mov ebp, dword [esi + 4]
mov eax, dword [esi]
push edi
mov edi, dword [esi + 8]
push ecx
and ebp, 0x80000000
add edi, 1
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, dword [esp + 0x18]
push 0x17
lea edx, [ebx*8]
push edx
mov ecx, eax
call fcn.00402380
mov dword [esi], eax
xor eax, eax
test ebx, ebx
jle 0x4091e0
jmp 0x4091d0
mov ecx, dword [esi]
mov dword [ecx + eax*4], 0xffffffff
add eax, 1
cmp eax, ebx
jl 0x4091d0
add ebx, 0xffffffff
mov dword [esi + 8], ebx
xor ebx, ebx
test edi, edi
mov dword [esi + 4], 0
jle 0x409227
mov edx, dword [esp + 0x10]
lea eax, [edx + edi*4]
mov dword [esp + 0x18], eax
mov edi, edi
mov ecx, dword [esp + 0x10]
mov eax, dword [ecx + ebx*4]
cmp eax, 0xffffffff
je 0x40921b
mov edx, dword [esp + 0x18]
mov ecx, dword [edx]
push ecx
push eax
mov ecx, esi
call fcn.00408b70
add dword [esp + 0x18], 4
add ebx, 1
cmp ebx, edi
jl 0x409200
test ebp, ebp
jne 0x40924e
mov edx, dword [0x4c6060]
push edx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edx, dword [esp + 0x10]
push 0x17
lea ecx, [edi*8]
push ecx
push edx
mov ecx, eax
call fcn.004023e0
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 4

Function at 0x4092a0
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
mov esi, ecx
mov ebp, dword [esi + 4]
mov ecx, dword [0x4c6060]
mov eax, dword [esi]
push edi
mov edi, dword [esi + 8]
and ebp, 0x80000000
push ecx
mov dword [esp + 0x18], ebp
add edi, 1
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, dword [esp + 0x1c]
mov edx, ebx
push 0x17
shl edx, 4
push edx
mov ecx, eax
call fcn.00402380
mov dword [esi], eax
xor eax, eax
test ebx, ebx
jle 0x409308
lea ebx, [ebx]
mov ecx, dword [esi]
mov dword [ecx + eax*8], 0xffffffff
mov dword [ecx + eax*8 + 4], 0xffffffff
add eax, 1
cmp eax, ebx
jl 0x4092f0
add ebx, 0xffffffff
mov dword [esi + 8], ebx
xor ebx, ebx
test edi, edi
mov dword [esi + 4], 0
jle 0x409355
mov eax, dword [esp + 0x10]
lea ebp, [eax + edi*8]
mov ecx, dword [esp + 0x10]
mov eax, dword [ecx + ebx*8]
mov ecx, dword [ecx + ebx*8 + 4]
mov edx, eax
and edx, ecx
cmp edx, 0xffffffff
je 0x409347
mov edx, dword [ebp + 4]
push edx
mov edx, dword [ebp]
push edx
push ecx
push eax
mov ecx, esi
call fcn.00408d30
add ebx, 1
add ebp, 8
cmp ebx, edi
jl 0x409322
mov ebp, dword [esp + 0x14]
test ebp, ebp
jne 0x409377
mov eax, dword [0x4c6060]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [esp + 0x10]
push 0x17
shl edi, 4
push edi
push ecx
mov ecx, eax
call fcn.004023e0
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 4
Function at 0x409ae0
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x4c6060]
push esi
push edi
push eax
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [esp + 0xc]
mov edx, dword [eax]
push 0x1a
push edi
mov ecx, eax
mov eax, dword [edx]
push 0x40
call eax
mov dword [esi], eax
xor eax, eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
or eax, 0xffffffff
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
pop edi
mov eax, esi
pop esi
ret 4

Function at 0x409bf4
Capabilities:
Read file on windows

Disassembly:
mov edx, dword [esp + 4]
push esi
mov esi, ecx
mov eax, dword [esi + 0xc]
mov ecx, dword [esp + 0xc]
push eax
push ecx
push 1
push edx
call fcn.0042d613
add esp, 0x10
test eax, eax
jg 0x409c13
mov byte [esi + 0x10], 0
pop esi
ret 8

Function at 0x409fc4
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, ecx
mov ecx, 1
mov dword [esi + 8], eax
mov word [esi + 6], cx
mov dword [esi], vtable.hkBufferedStreamWriter.0
mov byte [esi + 0x18], cl
mov eax, dword [esi + 8]
test eax, eax
push edi
je 0x409fef
cmp word [eax + 4], 0
je 0x409fef
add word [eax + 6], cx
mov ecx, dword [0x4c6060]
push ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [esp + 0x10]
mov edx, dword [eax]
push 0x1a
push edi
mov ecx, eax
mov eax, dword [edx]
push 0x40
call eax
mov dword [esi + 0x14], edi
mov dword [esi + 0xc], eax
pop edi
mov dword [esi + 0x10], 0
mov eax, esi
pop esi
ret 8

Function at 0x40a030
Capabilities:
Get thread local storage value

Disassembly:
push esi
mov esi, ecx
mov dword [esi], vtable.hkBufferedStreamWriter.0
call fcn.00409e20
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x40a062
cmp word [ecx + 4], 0
je 0x40a062
add word [ecx + 6], 0xffff
movzx eax, word [ecx + 6]
test ax, ax
jne 0x40a062
mov eax, dword [ecx]
mov edx, dword [eax]
push 1
call edx
cmp byte [esi + 0x18], 0
je 0x40a083
mov eax, dword [0x4c6060]
push edi
mov edi, dword [esi + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 4]
push edi
call eax
pop edi
mov dword [esi], vtable.hkBaseObject.0
pop esi
ret
Function at 0x40a430
Capabilities:
Link many functions at runtime

Disassembly:
cmp dword [0x4c60dc], 0
push edi
mov edi, ecx
mov word [edi + 6], 1
mov dword [edi], vtable.hkStackTracer.0
jne 0x40a526
mov eax, dword [str.dbghelp.dll]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.SymInitialize
push eax
mov dword [0x4c60dc], eax
mov dword [0x4c60d8], 1
call esi
mov ecx, dword [0x4c60dc]
push str.SymGetOptions
push ecx
mov dword [0x4c60d4], eax
call esi
mov edx, dword [0x4c60dc]
push str.SymSetOptions
push edx
mov dword [0x4c60d0], eax
call esi
mov dword [0x4c60cc], eax
mov eax, dword [0x4c60dc]
push str.SymGetSymFromAddr
push eax
call esi
mov ecx, dword [0x4c60dc]
push str.StackWalk64
push ecx
mov dword [0x4c60c8], eax
call esi
mov edx, dword [0x4c60dc]
push str.SymFunctionTableAccess64
push edx
mov dword [0x4c60c4], eax
call esi
mov dword [0x4c60c0], eax
mov eax, dword [0x4c60dc]
push str.SymGetModuleBase64
push eax
call esi
mov ecx, dword [0x4c60dc]
push str.SymGetLineFromAddr64
push ecx
mov dword [0x4c60bc], eax
call esi
mov dword [0x4c60b8], eax
call dword [0x4c60d0]
or eax, reloc.WSOCK32.dll_recv
push eax
call dword [0x4c60cc]
push 1
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [0x4c60d4]
pop esi
mov eax, edi
pop edi
ret
add dword [0x4c60d8], 1
mov eax, edi
pop edi
ret

Function at 0x40cc50
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi]
mov edx, dword [eax + 0x10]
call edx
push 0
push 1
push 2
call sub.WSOCK32.dll_socket
xor ecx, ecx
cmp eax, 0xffffffff
sete cl
mov dword [esi + 0x20], eax
pop esi
mov eax, ecx
ret

Function at 0x40cc80
Capabilities:
Receive data
Receive data on socket

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x20]
cmp eax, 0xffffffff
je 0x40ccbb
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push 0
push ecx
push edx
push eax
call sub.WSOCK32.dll_recv
test eax, eax
jle 0x40cca6
cmp eax, 0xffffffff
jne 0x40ccbd
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, 0x2733
je 0x40ccbb
mov eax, dword [esi]
mov edx, dword [eax + 0x10]
mov ecx, esi
call edx
xor eax, eax
pop esi
ret 8

Function at 0x40ccd0
Capabilities:
Send data
Send data on socket

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x20]
cmp eax, 0xffffffff
je 0x40cd0b
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push 0
push ecx
push edx
push eax
call sub.WSOCK32.dll_send
test eax, eax
jle 0x40ccf6
cmp eax, 0xffffffff
jne 0x40cd0d
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, 0x2733
je 0x40cd0b
mov eax, dword [esi]
mov edx, dword [eax + 0x10]
mov ecx, esi
call edx
xor eax, eax
pop esi
ret 8
Function at 0x40cef6
Capabilities:
Get hostname
Get thread local storage value
Set socket configuration

Disassembly:
sub esp, 0x32c
push esi
mov esi, ecx
call fcn.0040cc50
test eax, eax
je 0x40cf11
mov eax, 1
pop esi
add esp, 0x32c
ret 4
push ebp
mov ebp, dword [esp + 0x338]
push edi
push ebp
mov word [esp + 0x2c], 2
mov dword [esp + 0x30], 0
call sub.WSOCK32.dll_htons
mov ecx, dword [esi + 0x20]
push 4
mov word [esp + 0x2e], ax
lea eax, [esp + 0x1c]
push eax
push 4
push 0xffff
mov edi, 1
push ecx
mov dword [esp + 0x2c], edi
call sub.WSOCK32.dll_setsockopt
mov eax, dword [esi + 0x20]
push 0x10
lea edx, [esp + 0x2c]
push edx
push eax
call sub.WSOCK32.dll_bind
cmp eax, 0xffffffff
je 0x40cf79
mov ecx, dword [esi + 0x20]
push 2
push ecx
call sub.WSOCK32.dll_listen
cmp eax, 0xffffffff
jne 0x40cf90
mov edx, dword [esi]
mov eax, dword [edx + 0x10]
mov ecx, esi
call eax
mov eax, edi
pop edi
pop ebp
pop esi
add esp, 0x32c
ret 4
mov ecx, dword [0x4c6060]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_TlsGetValue]
push ecx
call ebx
push 0x17
push edi
mov ecx, eax
call fcn.00402380
push 0x100
lea edx, [esp + 0x40]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], edi
push edx
mov byte [eax], 0
call sub.WSOCK32.dll_gethostname
cmp byte [esp + 0x3c], 0
je 0x40d01c
lea eax, [esp + 0x3c]
push eax
call fcn.00406130
lea esi, [eax + 1]
mov eax, dword [esp + 0x1c]
and eax, 0x3fffffff
add esp, 4
cmp eax, esi
jge 0x40d003
add eax, eax
cmp esi, eax
jl 0x40cff4
mov eax, esi
push edi
push eax
lea ecx, [esp + 0x18]
push ecx
call fcn.004026b0
add esp, 0xc
mov eax, dword [esp + 0x10]
push esi
lea edx, [esp + 0x40]
push edx
push eax
mov dword [esp + 0x20], esi
call fcn.00406220
add esp, 0xc
jmp 0x40d04b
mov eax, dword [esp + 0x18]
and eax, 0x3fffffff
cmp eax, edi
jge 0x40d040
add eax, eax
cmp eax, edi
jg 0x40d031
mov eax, edi
push edi
push eax
lea ecx, [esp + 0x18]
push ecx
call fcn.004026b0
add esp, 0xc
mov edx, dword [esp + 0x10]
mov dword [esp + 0x14], edi
mov byte [edx], 0
push 0x200
lea eax, [esp + 0x140]
push eax
lea ecx, [esp + 0x28]
call fcn.00405db0
push ebp
push str.__port
lea ecx, [esp + 0x18]
push ecx
push str.Listening_on_host_
lea ecx, [esp + 0x30]
call fcn.00405640
mov ecx, eax
call fcn.00405ab0
mov ecx, eax
call fcn.00405640
mov ecx, eax
call fcn.00405700
mov ecx, dword [0x4c6070]
mov edx, dword [ecx]
mov edx, dword [edx + 0xc]
push 0x16c
push str..SystemIoSocketBsdhkBsdSocket.cpp
lea eax, [esp + 0x144]
push eax
push 0xffffffffffffffff
push 0
call edx
lea ecx, [esp + 0x20]
call fcn.00405990
mov eax, dword [esp + 0x18]
test eax, eax
js 0x40d0e1
and eax, 0x3fffffff
mov esi, eax
mov eax, dword [0x4c6060]
push eax
call ebx
mov ecx, dword [esp + 0x10]
push 0x17
push esi
push ecx
mov ecx, eax
call fcn.004023e0
pop ebx
pop edi
pop ebp
xor eax, eax
pop esi
add esp, 0x32c
ret 4
Function at 0x40d0f8
Capabilities:
Get socket status
Get thread local storage value
Set socket configuration

Disassembly:
sub esp, 0x440
push ebx
push ebp
push esi
mov esi, ecx
mov eax, dword [esi + 0x20]
cmp eax, 0xffffffff
push edi
je 0x40d24f
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x150]
push edx
xor ebx, ebx
mov ebp, 1
push ebx
lea ecx, [esp + 0x54]
mov dword [esp + 0x58], eax
mov dword [esp + 0x15c], eax
add eax, ebp
push ecx
push eax
mov dword [esp + 0x5c], ebp
mov dword [esp + 0x160], ebp
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
call sub.WSOCK32.dll_select
test eax, eax
jle 0x40d24f
mov eax, dword [esi + 0x20]
lea edx, [esp + 0x48]
push edx
push eax
call sub.WSOCK32.dll___WSAFDIsSet
test eax, eax
je 0x40d24f
mov eax, dword [esi + 0x20]
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x3c]
push edx
push eax
mov dword [esp + 0x2c], 0x10
call sub.WSOCK32.dll_accept
mov ecx, dword [0x4c6060]
mov edi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
push ecx
mov esi, eax
call edi
push 0x17
push ebp
mov ecx, eax
call fcn.00402380
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], ebp
mov byte [eax], bl
mov edx, dword [esp + 0x3a]
push edx
call sub.WSOCK32.dll_ntohs
mov ecx, dword [esp + 0x3c]
movzx eax, ax
push eax
push ecx
call sub.WSOCK32.dll_inet_ntoa
push eax
lea edx, [esp + 0x18]
push str.Socket_got_connection_from___s:_d__n
push edx
call fcn.00406410
add esp, 0x10
push 0x200
lea eax, [esp + 0x254]
push eax
lea ecx, [esp + 0x34]
call fcn.00405db0
lea ecx, [esp + 0x10]
push ecx
lea ecx, [esp + 0x30]
call fcn.00405ab0
mov ecx, dword [0x4c6070]
mov edx, dword [ecx]
mov edx, dword [edx + 0xc]
push 0x194
push str..SystemIoSocketBsdhkBsdSocket.cpp
lea eax, [esp + 0x258]
push eax
push 0xffffffffffffffff
push ebx
call edx
lea ecx, [esp + 0x2c]
call fcn.00405990
cmp esi, 0xffffffff
jne 0x40d25c
mov eax, dword [esp + 0x18]
test eax, eax
js 0x40d24f
and eax, 0x3fffffff
mov esi, eax
mov eax, dword [0x4c6060]
push eax
call edi
mov ecx, dword [esp + 0x10]
push 0x17
push esi
push ecx
mov ecx, eax
call fcn.004023e0
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x440
ret
push 4
lea edx, [esp + 0x20]
push edx
push ebp
push 6
push esi
mov dword [esp + 0x30], ebp
call sub.WSOCK32.dll_setsockopt
mov eax, dword [0x4c6060]
push eax
call edi
push 0x15
push 0x24
mov ecx, eax
call fcn.00402380
push esi
mov ecx, eax
mov word [eax + 4], 0x24
call fcn.0040cec0
mov ebx, eax
mov eax, dword [esp + 0x18]
test eax, eax
js 0x40d2ba
mov ecx, dword [0x4c6060]
and eax, 0x3fffffff
push ecx
mov esi, eax
call edi
mov edx, dword [esp + 0x10]
push 0x17
push esi
push edx
mov ecx, eax
call fcn.004023e0
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x440
ret
Function at 0x412980
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
push ecx
mov eax, dword [0x4c6060]
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [esi + 4]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push 7
shl edi, 4
push edi
mov ecx, eax
call fcn.004025a0
mov ebx, eax
mov eax, dword [esi + 8]
cdq
and edx, 3
add eax, edx
xor edx, edx
sar eax, 2
cmp dword [esi + 4], edx
mov dword [esp + 0xc], ebx
jle 0x4129fb
lea edi, [eax*4]
xor ecx, ecx
lea eax, [ebx + 8]
mov edi, edi
mov ebx, dword [esi]
fld dword [ecx + ebx]
add edx, 1
fstp dword [eax - 8]
mov ebx, dword [esi]
fld dword [ecx + ebx + 4]
add eax, 0x10
fstp dword [eax - 0x14]
mov ebx, dword [esi]
fld dword [ecx + ebx + 8]
add ecx, edi
fstp dword [eax - 0x10]
cmp edx, dword [esi + 4]
jl 0x4129d0
mov ebx, dword [esp + 0xc]
fld dword [ebp + 0x10]
push ecx
mov ecx, dword [esi + 4]
fstp dword [esp]
mov esi, dword [ebp + 8]
push 0
push ecx
push ebx
push esi
call fcn.00411e00
mov edx, dword [0x4c6060]
add esp, 0x14
push edx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push ebx
mov ecx, eax
call fcn.004025d0
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x412a40
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 0x10
push edi
mov edi, dword [esp + 0x18]
mov eax, dword [edi + 8]
cmp eax, 0x10
jne 0x412a78
mov ecx, dword [edi]
test cl, 0xf
jne 0x412a78
mov eax, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
push eax
mov eax, dword [esp + 0x20]
push edx
mov edx, dword [edi + 4]
push eax
push edx
push ecx
call fcn.0041ce30
add esp, 0x14
pop edi
add esp, 0x10
ret
cdq
and edx, 3
add eax, edx
push esi
xor esi, esi
mov ecx, bind
sar eax, 2
cmp dword [edi + 4], esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], ecx
mov dword [esp + 0x1c], esi
jle 0x412b18
push ebx
add eax, eax
xor ebx, ebx
add eax, eax
push ebp
mov dword [esp + 0x10], eax
jmp 0x412ab8
mov ecx, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
lea ebp, [esi + 1]
and ecx, 0x3fffffff
cmp ecx, ebp
jge 0x412ade
lea eax, [ecx + ecx]
cmp ebp, eax
jl 0x412ace
mov eax, ebp
push 0x10
push eax
lea ecx, [esp + 0x1c]
push ecx
call fcn.004026b0
add esp, 0xc
mov edx, dword [edi]
mov dword [esp + 0x18], ebp
fld dword [ebx + edx]
shl esi, 4
add esi, dword [esp + 0x14]
fstp dword [esi]
mov eax, dword [edi]
fld dword [eax + ebx + 4]
mov eax, dword [esp + 0x24]
fstp dword [esi + 4]
mov ecx, dword [edi]
fld dword [ecx + ebx + 8]
add ebx, dword [esp + 0x10]
add eax, 1
fstp dword [esi + 8]
cmp eax, dword [edi + 4]
mov dword [esp + 0x24], eax
jl 0x412ab0
pop ebp
pop ebx
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
push edx
mov edx, dword [edi + 4]
push eax
mov eax, dword [esp + 0x14]
push ecx
push edx
push eax
call fcn.0041ce30
mov esi, dword [esp + 0x28]
add esp, 0x14
test esi, esi
js 0x412b65
mov ecx, dword [0x4c6060]
push ecx
and esi, 0x3fffffff
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edx, dword [esp + 0xc]
push 0x17
shl esi, 4
push esi
push edx
mov ecx, eax
call fcn.004023e0
pop esi
pop edi
add esp, 0x10
ret
Function at 0x413910
Capabilities:
Execute anti-debugging instructions
Get thread local storage value

Disassembly:
mov eax, dword [0x4c6074]
sub esp, 0x44c
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
push eax
call ebx
mov esi, eax
mov ecx, dword [esi + 4]
cmp ecx, dword [esi + 0xc]
jae 0x413950
mov dword [ecx], str.LtCreateConvex
mov dword [ecx + 0xc], str.StHull
rdtsc
mov dword [esp + 8], eax
mov edx, dword [esp + 8]
mov dword [ecx + 4], edx
add ecx, 0x10
mov dword [esi + 4], ecx
push ebp
push edi
lea ecx, [esp + 0x4c]
call fcn.0041dbc0
mov ebp, dword [esp + 0x46c]
mov edi, dword [esp + 0x464]
mov ecx, dword [esp + 0x460]
push ebp
push edi
lea eax, [esp + 0x54]
push eax
push ecx
call fcn.00412a40
lea edx, [esp + 0x5c]
push edi
push edx
call fcn.0041abc0
mov eax, dword [0x4c6074]
add esp, 0x18
push eax
call ebx
mov ecx, eax
mov esi, dword [ecx + 4]
cmp esi, dword [ecx + 0xc]
jae 0x4139b6
mov dword [esi], str.Stplanes
rdtsc
mov dword [esp + 0x10], eax
mov edx, dword [esp + 0x10]
mov dword [esi + 4], edx
add esi, 0xc
mov dword [ecx + 4], esi
fld dword [0x4b3344]
mov ecx, dword [esp + 0x468]
fst dword [esp + 0x1c]
push ecx
fld dword [0x4b3340]
cmp ebp, 2
fstp dword [esp + 0x24]
sete al
fld dword [0x4b333c]
push edi
fst dword [esp + 0x2c]
lea edx, [esp + 0x54]
fld dword [0x4b3338]
mov byte [esp + 0x22], al
fst dword [esp + 0x30]
push edx
fld dword [0x4b3334]
lea eax, [esp + 0x24]
fstp dword [esp + 0x38]
push eax
fxch st(1)
lea ecx, [esp + 0x27]
fst dword [esp + 0x40]
push ecx
fst dword [esp + 0x48]
mov byte [esp + 0x2c], 1
fld dword [0x4b3330]
fstp dword [esp + 0x4c]
fstp dword [esp + 0x50]
fld dword [0x4b332c]
fstp dword [esp + 0x54]
fstp dword [esp + 0x58]
fstp dword [esp + 0x5c]
call fcn.0041ac90
mov edx, dword [0x4c6074]
add esp, 0x14
push edx
call ebx
mov ecx, eax
mov esi, dword [ecx + 4]
cmp esi, dword [ecx + 0xc]
pop edi
pop ebp
jae 0x413a6f
mov dword [esi], 0x4b3398
rdtsc
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
mov dword [esi + 4], eax
add esi, 0xc
mov dword [ecx + 4], esi
mov eax, dword [esp + 0x50]
test eax, eax
js 0x413a9d
mov ecx, dword [0x4c6060]
and eax, 0x3fffffff
push ecx
mov esi, eax
call ebx
mov ecx, dword [esp + 0x48]
push 0x17
lea edx, [esi*8]
push edx
push ecx
mov ecx, eax
call fcn.004023e0
pop esi
pop ebx
add esp, 0x44c
ret

Function at 0x413ab0
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 0x410
push esi
lea ecx, [esp + 4]
call fcn.0041dbc0
mov eax, dword [esp + 0x420]
mov esi, dword [esp + 0x41c]
mov edx, dword [esp + 0x418]
push eax
push esi
lea ecx, [esp + 0xc]
push ecx
push edx
call fcn.00412a40
lea eax, [esp + 0x14]
push esi
push eax
call fcn.0041abc0
mov eax, dword [esp + 0x28]
add esp, 0x18
test eax, eax
js 0x413b22
mov ecx, dword [0x4c6060]
and eax, 0x3fffffff
push ecx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [esp + 8]
push 0x17
lea edx, [esi*8]
push edx
push ecx
mov ecx, eax
call fcn.004023e0
pop esi
add esp, 0x410
ret
Function at 0x41a920
Capabilities:
Get thread local storage value

Disassembly:
mov ecx, dword [esp + 4]
fld dword [0x4b3440]
sub esp, 0x10
xor eax, eax
cmp dword [ecx + 8], eax
push esi
jle 0x41a951
mov edx, dword [ecx + 4]
movzx edx, word [edx + eax*8]
mov esi, dword [esp + 0x1c]
mov esi, dword [esi]
shl edx, 4
add eax, 1
fst dword [edx + esi + 0xc]
cmp eax, dword [ecx + 8]
jl 0x41a935
mov ecx, dword [0x4c6060]
fstp st(0)
mov eax, dword [esp + 0x1c]
mov esi, dword [eax + 4]
push ebx
push ebp
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebp, dword [eax + 0x20]
lea ecx, [esi*4 + 0x10]
and ecx, 0xfffffff0
lea edx, [ecx + ebp]
cmp edx, dword [eax + 0x2c]
ja 0x41a984
mov dword [eax + 0x20], edx
jmp 0x41a990
mov edx, dword [eax]
push ecx
mov ecx, eax
mov eax, dword [edx + 0x14]
call eax
mov ebp, eax
mov ecx, dword [esp + 0x28]
or esi, 0x80000000
xor ebx, ebx
xor edi, edi
cmp dword [ecx + 4], ebx
mov dword [esp + 0x18], esi
jle 0x41aa01
fld dword [0x4b3440]
xor edx, edx
xor esi, esi
mov ecx, dword [ecx]
fcom dword [esi + ecx + 0xc]
fnstsw ax
test ah, 0x44
jp 0x41a9e8
fld dword [esi + ecx]
fstp dword [edx + ecx]
fld dword [esi + ecx + 4]
fstp dword [edx + ecx + 4]
fld dword [esi + ecx + 8]
fstp dword [edx + ecx + 8]
fld dword [esi + ecx + 0xc]
fstp dword [edx + ecx + 0xc]
mov dword [ebp + edi*4], ebx
add ebx, 1
add edx, 0x10
jmp 0x41a9f0
mov dword [ebp + edi*4], 0xffffffff
mov ecx, dword [esp + 0x28]
add edi, 1
add esi, 0x10
cmp edi, dword [ecx + 4]
jl 0x41a9b1
fstp st(0)
mov eax, dword [ecx + 8]
and eax, 0x3fffffff
cmp eax, ebx
jge 0x41aa25
add eax, eax
cmp ebx, eax
jl 0x41aa15
mov eax, ebx
push 0x10
push eax
push ecx
call fcn.004026b0
mov ecx, dword [esp + 0x34]
add esp, 0xc
mov esi, dword [esp + 0x24]
xor eax, eax
mov dword [ecx + 4], ebx
cmp dword [esi + 8], eax
jle 0x41aa4c
mov edx, dword [esi + 4]
lea ecx, [edx + eax*8]
movzx edx, word [ecx]
mov dx, word [ebp + edx*4]
add eax, 1
mov word [ecx], dx
cmp eax, dword [esi + 8]
jl 0x41aa33
mov eax, dword [0x4c6060]
mov ebx, dword [sym.imp.KERNEL32.dll_TlsGetValue]
push eax
call ebx
cmp ebp, dword [eax + 0x28]
mov dword [eax + 0x20], ebp
jne 0x41aa6c
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x18]
push ebp
call eax
mov edi, dword [esp + 0x18]
test edi, edi
js 0x41aa92
mov ecx, dword [0x4c6060]
push ecx
call ebx
and edi, 0x3fffffff
add edi, edi
push 0x17
add edi, edi
push edi
push ebp
mov ecx, eax
call fcn.004023e0
pop edi
xor eax, eax
cmp dword [esi + 8], eax
pop ebp
pop ebx
jle 0x41aabc
fldz
mov edx, dword [esi + 4]
movzx ecx, word [edx + eax*8]
mov edx, dword [esp + 0x1c]
mov edx, dword [edx]
shl ecx, 4
add eax, 1
fst dword [ecx + edx + 0xc]
cmp eax, dword [esi + 8]
jl 0x41aa9e
fstp st(0)
pop esi
add esp, 0x10
ret
Function at 0x41ac90
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x28
mov ecx, dword [ebp + 0x18]
push esi
push edi
mov edi, dword [ebp + 8]
xor eax, eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
lea eax, [esp + 0x14]
push eax
mov eax, dword [ebp + 0x14]
push ecx
mov ecx, dword [ebp + 0x10]
push edi
lea edx, [esp + 0x2c]
push edx
mov edx, dword [ebp + 0xc]
push eax
push ecx
push edx
lea eax, [esp + 0x2f]
push eax
mov dword [esp + 0x3c], bind
call fcn.00419720
mov esi, dword [esp + 0x3c]
add esp, 0x20
test esi, esi
js 0x41ad05
mov ecx, dword [0x4c6060]
push ecx
and esi, 0x3fffffff
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edx, dword [esp + 0x14]
push 0x17
shl esi, 5
push esi
push edx
mov ecx, eax
call fcn.004023e0
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret