joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41b9f2
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x28
push ebx
push ebp
push esi
push edi
xor edi, edi
call dword [sym.imp.USER32.dll_GetFocus]
mov ebp, dword [esp + 0x3c]
mov ebx, eax
and dword [esp + 0x10], edi
push str.PB_WindowID
push ebp
call dword [sym.imp.USER32.dll_GetPropW]
mov esi, eax
push 9
pop eax
test esi, esi
je 0x41ba8a
lea eax, [esp + 0x14]
push eax
push ebp
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test eax, eax
je 0x41ba87
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [esp + 0x14], eax
jne 0x41ba87
lea eax, [esi - 1]
push eax
push dword [0x6d49a8]
call fcn.004286b2
mov edi, eax
mov dword [esp + 0x10], 1
xor eax, eax
push 9
cmp dword [edi + 0x10], eax
jle 0x41ba89
mov edx, dword [edi + 4]
xor ecx, ecx
pop esi
cmp word [ecx + edx + 2], si
jne 0x41ba7e
mov esi, 0xfa01
push 9
cmp word [ecx + edx + 4], si
je 0x41bb71
pop esi
inc eax
add ecx, 6
cmp eax, dword [edi + 0x10]
jl 0x41ba64
push 9
pop eax
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
test ebx, ebx
je 0x41bb30
push eax
call esi
test al, al
jns 0x41bb30
push 0x11
call esi
test al, al
js 0x41bb30
push 0x10
call esi
test al, al
js 0x41bb30
push 0x12
call esi
test al, al
js 0x41bb30
push 0x10
lea eax, [esp + 0x1c]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetClassNameW]
cmp dword [esp + 0x10], 0
jne 0x41bb30
push 5
lea eax, [esp + 0x1c]
push str.RichE
push eax
call sub.MSVCRT.dll_wcsncmp
add esp, 0xc
test eax, eax
je 0x41bb04
push 4
lea eax, [esp + 0x1c]
push str.RICHE
push eax
call sub.MSVCRT.dll_wcsncmp
add esp, 0xc
test eax, eax
jne 0x41bb1b
push 0
push 0
push 0x44e
push ebx
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, 0x800
je 0x41bb7b
lea eax, [esp + 0x18]
push str.Scintilla
push eax
call sub.MSVCRT.dll_wcscmp
pop ecx
pop ecx
test eax, eax
je 0x41bb7b
test ebp, ebp
je 0x41bb54
push 0x11
call esi
test al, al
js 0x41bb4c
push 0x10
call esi
test al, al
js 0x41bb4c
push 0x12
call esi
test al, al
jns 0x41bb54
push 1
push ebp
call fcn.0041bb87
test ebx, ebx
je 0x41bb68
push str.PB_Hotkey
push ebx
call dword [sym.imp.USER32.dll_GetPropW]
test eax, eax
jne 0x41bb7b
test edi, edi
je 0x41bb7b
mov eax, dword [edi + 8]
jmp 0x41bb7d
and dword [esp + 0x14], 0
jmp 0x41ba89
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret 4
Function at 0x41bce6
Capabilities:
Get disk information
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x45c
push esi
or esi, 0xffffffff
push edi
mov edi, esi
test eax, eax
je 0x41be2e
xor ecx, ecx
cmp word [eax], cx
je 0x41be2e
push 0x104
push eax
lea eax, [esp + 0x10]
push eax
call sub.MSVCRT.dll_wcsncpy
xor eax, eax
mov word [esp + 0x21c], ax
lea eax, [esp + 0x14]
push eax
call sub.MSVCRT.dll_wcslen
add esp, 0x10
lea ecx, [esp + eax*2 + 6]
cmp eax, 2
je 0x41bd3f
cmp eax, 3
jne 0x41bd79
cmp word [esp + 0xa], 0x3a
jne 0x41bd79
cmp eax, 2
jne 0x41bd5d
lea eax, [esp + 8]
push 0x49e550
push eax
call sub.MSVCRT.dll_wcscat
pop ecx
pop ecx
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x41be2e
push 0xfffffffffffffffe
pop edi
jmp 0x41be2e
push ebx
push ebp
push 0x5c
pop ebp
push 0x2f
pop ebx
movzx eax, word [ecx]
cmp ax, bp
je 0x41bd8e
cmp ax, bx
jne 0x41bd98
xor eax, eax
mov word [ecx], ax
sub ecx, 2
jmp 0x41bd81
lea eax, [esp + 0x21c]
push eax
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, esi
je 0x41bdd7
test byte [esp + 0x21c], 0x10
je 0x41bdbe
push 0xfffffffffffffffe
pop edi
jmp 0x41bdce
mov esi, dword [esp + 0x238]
xor edi, edi
or edi, dword [esp + 0x23c]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x41be2c
cmp word [esp + 0x10], bp
jne 0x41bde5
cmp word [esp + 0x12], bp
je 0x41be04
cmp word [esp + 0x10], bx
jne 0x41bdf3
cmp word [esp + 0x12], bx
je 0x41be04
push 0x2e
pop eax
cmp word [esp + 0x10], ax
jne 0x41be2c
cmp word [esp + 0x12], ax
jne 0x41be2c
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, esi
je 0x41be19
test al, 0x10
je 0x41be2c
jmp 0x41be29
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x41be2c
push 0xfffffffffffffffe
pop edi
pop ebp
pop ebx
mov eax, edi
mov edx, esi
pop edi
pop esi
add esp, 0x45c
ret 4
Function at 0x41c122
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
cmp dword [ebp + 8], 0
je 0x41c19a
push 0x104
push dword [ebp + 8]
lea eax, [ebp - 0x20c]
push eax
call sub.MSVCRT.dll_wcsncpy
xor eax, eax
mov word [ebp - 4], ax
lea eax, [ebp - 0x20c]
push eax
call sub.MSVCRT.dll_wcslen
lea ecx, [ebp - 0x20c]
add esp, 0x10
lea eax, [ecx + eax*2]
jmp 0x41c17b
movzx ecx, word [eax - 2]
cmp ecx, 0x20
je 0x41c178
cmp ecx, 0x5c
je 0x41c178
cmp ecx, 0x2f
jne 0x41c185
add eax, 0xfffffffe
lea ecx, [ebp - 0x20c]
cmp eax, ecx
ja 0x41c165
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x20c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x41c19c
xor eax, eax
mov esp, ebp
pop ebp
ret 4

Function at 0x41c367
Capabilities:
Timestomp file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push edi
xor edi, edi
cmp dword [ebp + 8], edi
je 0x41c43c
push ebx
push edi
push pe_nt_image_headers32
push 3
push edi
push 3
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x41c43b
push esi
mov esi, dword [ebp + 0x10]
push esi
call fcn.0041e9c0
push esi
mov word [ebp - 0x20], ax
call fcn.0041e9e6
push esi
mov word [ebp - 0x1e], ax
call fcn.0041ea08
push esi
mov word [ebp - 0x1c], ax
call fcn.0041ea29
push esi
mov word [ebp - 0x1a], ax
call fcn.0041ea4a
push esi
mov word [ebp - 0x18], ax
call fcn.0041ea6b
push esi
mov word [ebp - 0x16], ax
call fcn.0041ea8c
mov word [ebp - 0x14], ax
xor eax, eax
mov word [ebp - 0x12], ax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
cmp dword [ebp + 0xc], 1
mov eax, edi
mov ecx, edi
pop esi
jne 0x41c41a
lea eax, [ebp - 8]
jmp 0x41c428
cmp dword [ebp + 0xc], 2
jne 0x41c425
lea ecx, [ebp - 8]
jmp 0x41c428
lea edi, [ebp - 8]
push ecx
push eax
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push ebx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x41c7c0
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
mov dword [esp + 4], 0
cmp dword [esi + 0x14], 0
jne 0x41c7fc
push 0
lea eax, [esp + 8]
push eax
mov eax, dword [esi + 8]
sub eax, dword [esi + 0xc]
push eax
push dword [esi + 4]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esi + 8]
mov dword [esi + 0xc], eax
mov eax, dword [esp + 4]
pop esi
pop ecx
ret 4
xor eax, eax
pop esi
pop ecx
ret 4
Function at 0x41d0b0
Capabilities:
Write file on windows

Disassembly:
push ecx
mov edx, dword [esp + 0xc]
mov dword [esp], 0
test edx, edx
je 0x41d1b8
cmp word [edx], 0
je 0x41d1b8
mov ecx, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0xc]
test ecx, ecx
jne 0x41d0de
mov ecx, dword [esi + 0x18]
push edi
cmp ecx, 0x19
jne 0x41d13d
cmp dword [esi + 4], 0
mov ecx, edx
lea edi, [ecx + 2]
je 0x41d110
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41d0f0
sub ecx, edi
sar ecx, 1
lea eax, [ecx + ecx]
push eax
push edx
push esi
call fcn.0041d1f0
pop edi
pop esi
pop ecx
ret 0xc
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41d110
sub ecx, edi
lea eax, [esp + 8]
push 0
sar ecx, 1
push eax
lea eax, [ecx + ecx]
push eax
push edx
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 0xc
xor eax, eax
cmp ecx, 2
lea ecx, [esp + 0x14]
setne al
push ecx
dec eax
and eax, 0xfde9
push edx
push eax
call fcn.0041d8d0
mov edi, eax
test edi, edi
je 0x41d133
cmp dword [esi + 4], 0
je 0x41d18b
push dword [esp + 0x14]
push edi
push esi
call fcn.0041d1f0
push edi
push 0
push dword [0x6d3490]
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 0xc
push 0
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x1c]
push edi
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
push 0
push dword [0x6d3490]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 0xc
xor eax, eax
pop ecx
ret 0xc
Function at 0x41d1f0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0xc
push esi
mov esi, dword [esp + 0x14]
mov dword [esp + 4], 0
cmp dword [esi + 0x1c], 0
jne 0x41d2f7
cmp dword [esi + 0x14], 1
jne 0x41d23b
mov eax, dword [esi + 0xc]
lea ecx, [esp + 0xc]
push 1
neg eax
cdq
push ecx
push eax
push dword [esi]
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esi + 8]
mov dword [esi + 0x14], 0
mov dword [esi + 0xc], eax
mov eax, dword [esi + 0xc]
push edi
mov edi, dword [esp + 0x20]
cmp eax, edi
jle 0x41d2b8
mov ecx, dword [esi + 8]
add ecx, dword [esi + 4]
sub ecx, eax
mov eax, edi
dec eax
je 0x41d2a3
dec eax
je 0x41d28c
sub eax, 2
je 0x41d277
push edi
push dword [esp + 0x20]
push ecx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
add esp, 0xc
ret 0xc
mov eax, dword [esp + 0x1c]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
add esp, 0xc
ret 0xc
mov eax, dword [esp + 0x1c]
mov ax, word [eax]
mov word [ecx], ax
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
add esp, 0xc
ret 0xc
mov eax, dword [esp + 0x1c]
mov al, byte [eax]
mov byte [ecx], al
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
add esp, 0xc
ret 0xc
push esi
call fcn.0041c7c0
mov eax, dword [esi + 8]
cmp edi, eax
jl 0x41d2e5
push 0
lea eax, [esp + 0xc]
push eax
push edi
push dword [esp + 0x28]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 8]
pop edi
pop esi
add esp, 0xc
ret 0xc
mov ecx, dword [esi + 4]
sub ecx, dword [esi + 0xc]
push edi
push dword [esp + 0x20]
add ecx, eax
jmp 0x41d261
xor eax, eax
pop esi
add esp, 0xc
ret 0xc
Function at 0x41d300
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
cmp dword [esi + 0x14], 0
jne 0x41d321
push esi
call fcn.0041c7c0
mov dword [esi + 0x14], 1
mov dword [esi + 0xc], 0
mov ebx, dword [esi + 0xc]
mov edi, dword [esp + 0x18]
mov eax, dword [esi + 0x10]
cmp ebx, edi
jl 0x41d395
add eax, dword [esi + 4]
mov ecx, edi
sub eax, ebx
dec ecx
je 0x41d382
dec ecx
je 0x41d36d
sub ecx, 2
je 0x41d35a
push edi
push eax
push dword [esp + 0x1c]
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
ret 0xc
mov ecx, dword [eax]
mov eax, dword [esp + 0x14]
mov dword [eax], ecx
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
ret 0xc
mov cx, word [eax]
mov eax, dword [esp + 0x14]
mov word [eax], cx
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
ret 0xc
mov ecx, dword [esp + 0x14]
mov dl, byte [eax]
mov eax, edi
mov byte [ecx], dl
sub dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
ret 0xc
push ebp
mov ebp, dword [esp + 0x18]
sub eax, ebx
add eax, dword [esi + 4]
push ebx
push eax
push ebp
call sub.MSVCRT.dll_memcpy
mov eax, dword [esi + 8]
add esp, 0xc
sub edi, ebx
add ebp, ebx
push 0
cmp edi, eax
jl 0x41d3da
lea eax, [esp + 0x18]
push eax
push edi
push ebp
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x14]
pop ebp
pop edi
mov dword [esi + 0xc], 0
add eax, ebx
pop esi
pop ebx
ret 0xc
lea ecx, [esp + 0x18]
push ecx
push eax
push dword [esi + 4]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x14]
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
cmp edi, eax
jle 0x41d3fb
mov edi, eax
push edi
push dword [esi + 4]
push ebp
call sub.MSVCRT.dll_memcpy
sub dword [esi + 0xc], edi
lea eax, [ebx + edi]
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret 0xc
Function at 0x41d940
Capabilities:
Read file on windows

Disassembly:
push ecx
push edi
mov edi, dword [esp + 0xc]
mov dword [esp + 4], 0
cmp dword [edi + 4], 0
je 0x41d967
push 1
lea eax, [esp + 0x10]
push eax
push edi
call fcn.0041d300
mov dword [esp + 4], eax
jmp 0x41d981
push 0
lea eax, [esp + 8]
push eax
push 1
lea eax, [esp + 0x18]
push eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 4]
cmp eax, 1
je 0x41d98d
xor eax, eax
pop edi
pop ecx
ret 8
mov cl, byte [esp + 0xc]
test cl, cl
js 0x41d9a9
mov eax, dword [esp + 0x10]
pop edi
mov byte [eax], cl
mov byte [eax + 1], 0
mov eax, 1
pop ecx
ret 8
mov al, cl
and al, 0xe0
push esi
cmp al, 0xc0
jne 0x41d9b9
mov esi, 2
jmp 0x41d9d5
mov al, cl
and al, 0xf0
cmp al, 0xe0
jne 0x41d9c8
mov esi, 3
jmp 0x41d9d5
mov al, cl
and al, 0xf8
cmp al, 0xf0
jne 0x41da32
mov esi, 4
mov edx, dword [esp + 0x14]
mov byte [edx], cl
cmp dword [edi + 4], 0
je 0x41da04
lea eax, [esi - 1]
push eax
lea eax, [edx + 1]
push eax
push edi
call fcn.0041d300
mov edx, eax
lea ecx, [esi - 1]
xor eax, eax
cmp edx, ecx
setne al
dec eax
and eax, esi
pop esi
pop edi
pop ecx
ret 8
push 0
lea eax, [esp + 0xc]
push eax
lea eax, [esi - 1]
push eax
lea eax, [edx + 1]
push eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [esp + 8]
lea ecx, [esi - 1]
xor eax, eax
cmp edx, ecx
setne al
dec eax
and eax, esi
pop esi
pop edi
pop ecx
ret 8
mov eax, dword [esp + 0x14]
pop esi
pop edi
mov word [eax], 0x3f
mov eax, 1
pop ecx
ret 8

Function at 0x41f1c9
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
and dword [eax + 0x14], 0
and dword [eax + 0x10], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret

Function at 0x42189e
Capabilities:
Set thread local storage value

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
xor ebx, ebx
push edi
mov edi, ebx
test esi, esi
je 0x4218fb
push esi
call dword [esi + 0x58]
mov ecx, dword [esi + 0x80]
mov edi, eax
mov dword [esi + 0x94], ecx
mov ecx, dword [esi + 0x84]
mov dword [esi + 0x98], ecx
test edi, edi
jne 0x4218fb
mov eax, dword [esi + 0x70]
test eax, eax
je 0x4218da
push ebx
push esi
call eax
push esi
push ebx
push dword [0x6d3490]
call dword [sym.imp.KERNEL32.dll_HeapFree]
push ebx
push dword [0x6d4ab4]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [0x6d4ab8], ebx
mov eax, edi
pop edi
pop esi
pop ebx
ret 4

Function at 0x42191a
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [0x6d4ab4]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
mov eax, dword [ebp + 0x18]
cmp eax, dword [esi + 0xac]
je 0x421942
push eax
push esi
mov dword [esi + 0xac], eax
call dword [esi + 0x40]
push dword [ebp + 0x14]
mov eax, dword [esi + 0x90]
push dword [ebp + 0x10]
add eax, dword [ebp + 0xc]
push eax
mov eax, dword [esi + 0x8c]
add eax, dword [ebp + 8]
push eax
push esi
call dword [esi + 4]
pop esi
pop ebp
ret 0x14
Function at 0x421965
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push dword [0x6d4ab4]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov ecx, dword [ebx + 0x74]
cmp ecx, 2
je 0x421992
cmp ecx, 3
je 0x421992
cmp ecx, 8
je 0x421992
cmp ecx, 0xc
jne 0x421a7a
fldz
fld dword [ebp + 8]
fcom st(1)
fnstsw ax
test ah, 5
jp 0x4219a4
fstp st(0)
jmp 0x4219b3
fstp st(1)
fld1
fcom st(1)
fnstsw ax
test ah, 5
jp 0x4219bb
fstp st(1)
fstp dword [ebp + 8]
fld dword [ebp + 8]
jmp 0x4219bd
fstp st(0)
push esi
mov esi, dword [ebx + 0xbc]
push edi
xor edi, edi
jmp 0x4219e7
fld dword [esi + 4]
fld st(1)
fucompp
fnstsw ax
test ah, 0x44
jnp 0x421a38
fld dword [esi + 4]
fcomp st(1)
fnstsw ax
test ah, 0x41
je 0x421a0e
mov edi, esi
mov esi, dword [esi]
test esi, esi
jne 0x4219c9
fstp st(0)
push 0x18
push 0
push dword [0x6d3490]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
test edx, edx
je 0x421a78
and dword [edx], 0
test edi, edi
je 0x421a42
mov dword [edi], edx
jmp 0x421a48
push 0x18
push 0
push dword [0x6d3490]
fstp st(0)
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
test edx, edx
je 0x4219ed
mov dword [edx], esi
test edi, edi
je 0x421a30
mov dword [edi], edx
jmp 0x421a3c
mov dword [ebx + 0xbc], edx
jmp 0x421a3c
fstp st(0)
mov edx, esi
test edx, edx
jne 0x421a48
jmp 0x4219ed
mov dword [ebx + 0xbc], edx
mov ecx, dword [ebp + 0xc]
mov esi, 0xff
fld dword [ebp + 8]
movzx eax, cl
mov dword [edx + 8], eax
mov eax, ecx
sar eax, 8
and eax, esi
mov dword [edx + 0xc], eax
mov eax, ecx
sar eax, 0x10
and eax, esi
sar ecx, 0x18
and ecx, esi
mov dword [edx + 0x10], eax
fstp dword [edx + 4]
mov dword [edx + 0x14], ecx
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x421cca
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push ebp
push esi
push edi
push dword [0x6d4ab4]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, dword [esp + 0x14]
mov edi, eax
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x18]
mov edx, dword [edi + 0x8c]
add esi, edx
mov ecx, dword [edi + 0x90]
add ebx, edx
mov edx, dword [esp + 0x20]
add ebp, ecx
mov eax, dword [edi + 0x74]
add edx, ecx
mov dword [esp + 0x20], edx
cmp eax, 2
je 0x421d1f
cmp eax, 3
je 0x421d1f
cmp eax, 8
je 0x421d1f
cmp eax, 0xc
jne 0x421eec
mov dword [edi + 0x124], edx
mov eax, ebx
sub edx, ebp
mov dword [edi + 0x118], esi
sub eax, esi
mov dword [edi + 0x11c], ebp
mov ecx, edx
mov dword [esp + 0x14], eax
imul ecx, edx
imul eax, eax
mov dword [edi + 0x120], ebx
mov dword [esp + 0x1c], edx
add ecx, eax
mov dword [esp + 0x18], ecx
fild dword [esp + 0x18]
push ecx
fstp dword [esp + 0x1c]
fld dword [esp + 0x1c]
fstp dword [esp]
call fcn.00421ef3
mov eax, dword [esp + 0x24]
fstp dword [edi + 0x128]
pop ecx
cmp ebp, eax
jne 0x421d99
cmp esi, ebx
jg 0x421d8a
mov dword [edi + 0xb4], 0x421bc6
jmp 0x421eec
mov dword [edi + 0xb4], 0x421c07
jmp 0x421eec
cmp esi, ebx
jne 0x421dbf
cmp ebp, eax
jg 0x421db0
mov dword [edi + 0xb4], 0x421c48
jmp 0x421eec
mov dword [edi + 0xb4], 0x421c89
jmp 0x421eec
push dword [esp + 0x1c]
call sub.MSVCRT.dll_abs
push dword [esp + 0x18]
mov esi, eax
call sub.MSVCRT.dll_abs
xor edx, edx
pop ecx
inc edx
pop ecx
cmp eax, esi
jl 0x421de5
and dword [edi + 0x130], 0
jmp 0x421e33
mov eax, dword [edi + 0x11c]
xor dword [edi + 0x118], eax
mov eax, dword [edi + 0x118]
xor dword [edi + 0x11c], eax
mov eax, dword [edi + 0x11c]
xor dword [edi + 0x118], eax
mov eax, dword [edi + 0x124]
xor dword [edi + 0x120], eax
mov eax, dword [edi + 0x120]
xor dword [edi + 0x124], eax
mov eax, dword [edi + 0x124]
xor dword [edi + 0x120], eax
mov dword [edi + 0x130], edx
mov ecx, dword [edi + 0x118]
mov eax, dword [edi + 0x120]
cmp ecx, eax
jge 0x421e4c
and dword [edi + 0x12c], 0
jmp 0x421e90
xor eax, ecx
mov dword [edi + 0x12c], edx
xor dword [edi + 0x120], eax
mov dword [edi + 0x118], eax
mov eax, dword [edi + 0x120]
xor dword [edi + 0x118], eax
mov eax, dword [edi + 0x124]
xor dword [edi + 0x11c], eax
mov eax, dword [edi + 0x11c]
xor dword [edi + 0x124], eax
mov eax, dword [edi + 0x124]
xor dword [edi + 0x11c], eax
mov eax, dword [edi + 0x124]
sub eax, dword [edi + 0x11c]
mov dword [esp + 0x20], eax
fild dword [esp + 0x20]
fstp dword [esp + 0x20]
fld dword [esp + 0x20]
mov eax, dword [edi + 0x120]
sub eax, dword [edi + 0x118]
mov dword [esp + 0x20], eax
fild dword [esp + 0x20]
fstp dword [esp + 0x20]
fdiv dword [esp + 0x20]
mov dword [edi + 0xb4], 0x421ab1
fstp dword [esp + 0x20]
fld dword [esp + 0x20]
fst dword [edi + 0x134]
fdivr qword [0x4a1268]
fstp dword [edi + 0x138]
pop edi
pop esi
pop ebp
pop ebx
ret 0x10
Function at 0x421f0d
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push ebp
push esi
push edi
push dword [0x6d4ab4]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebp, dword [esp + 0x14]
mov esi, eax
mov eax, dword [esp + 0x18]
mov edi, dword [esp + 0x1c]
add eax, dword [esi + 0x90]
add ebp, dword [esi + 0x8c]
mov dword [esp + 0x18], eax
test edi, edi
jns 0x421f43
add ebp, edi
neg edi
mov ebx, dword [esp + 0x20]
test ebx, ebx
jns 0x421f53
add eax, ebx
neg ebx
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x24]
add eax, eax
cmp eax, edi
jle 0x421f68
mov eax, edi
cdq
sub eax, edx
sar eax, 1
mov dword [esp + 0x24], eax
mov ecx, dword [esp + 0x28]
add ecx, ecx
cmp ecx, ebx
jle 0x421f7d
mov eax, ebx
cdq
sub eax, edx
sar eax, 1
mov dword [esp + 0x28], eax
mov eax, dword [esi + 0xa4]
cmp eax, dword [esi + 0xac]
je 0x421f96
push eax
push esi
mov dword [esi + 0xac], eax
call dword [esi + 0x40]
push dword [esp + 0x28]
push dword [esp + 0x28]
push ebx
push edi
push dword [esp + 0x28]
push ebp
push esi
call dword [esi + 8]
pop edi
pop esi
pop ebp
pop ebx
ret 0x18

Function at 0x421fb0
Capabilities:
Get thread local storage value

Disassembly:
push esi
push dword [0x6d4ab4]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
mov eax, dword [esi + 0xa4]
cmp eax, dword [esi + 0xac]
je 0x421fd8
push eax
push esi
mov dword [esi + 0xac], eax
call dword [esi + 0x40]
push dword [esp + 0x14]
mov eax, dword [esi + 0x90]
push dword [esp + 0x14]
add eax, dword [esp + 0x14]
push eax
mov eax, dword [esi + 0x8c]
add eax, dword [esp + 0x14]
push eax
push esi
call dword [esi + 4]
pop esi
ret 0x10

Function at 0x42206e
Capabilities:
Get thread local storage value

Disassembly:
push dword [0x6d4ab4]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edx, eax
mov ecx, dword [edx + 0x74]
cmp ecx, 2
je 0x422093
cmp ecx, 3
je 0x422093
cmp ecx, 8
je 0x422093
cmp ecx, 0xc
jne 0x4220a1
mov eax, dword [esp + 4]
test eax, eax
je 0x4220a1
mov dword [edx + 0xb8], eax
ret 4

Function at 0x4220a4
Capabilities:
Get thread local storage value

Disassembly:
push dword [0x6d4ab4]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [eax + 0x90]
add ecx, dword [esp + 0xc]
push ecx
mov ecx, dword [eax + 0x8c]
add ecx, dword [esp + 0xc]
push ecx
push dword [esp + 0xc]
push eax
call dword [eax + 0x24]
ret 0xc
Function at 0x4220d1
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push ebp
push esi
push edi
push dword [0x6d4ab4]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebp, dword [esp + 0x14]
mov edi, eax
mov eax, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
add eax, dword [edi + 0x90]
add ebp, dword [edi + 0x8c]
mov dword [esp + 0x18], eax
test esi, esi
jns 0x422107
add ebp, esi
neg esi
mov ebx, dword [esp + 0x20]
test ebx, ebx
jns 0x422117
add eax, ebx
neg ebx
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x24]
add eax, eax
cmp eax, esi
jle 0x42212c
mov eax, esi
cdq
sub eax, edx
sar eax, 1
mov dword [esp + 0x24], eax
mov ecx, dword [esp + 0x28]
add ecx, ecx
cmp ecx, ebx
jle 0x422141
mov eax, ebx
cdq
sub eax, edx
sar eax, 1
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x2c]
cmp eax, dword [edi + 0xac]
je 0x422158
push eax
push edi
mov dword [edi + 0xac], eax
call dword [edi + 0x40]
push dword [esp + 0x28]
push dword [esp + 0x28]
push ebx
push esi
push dword [esp + 0x28]
push ebp
push edi
call dword [edi + 8]
pop edi
pop esi
pop ebp
pop ebx
ret 0x1c

Function at 0x424270
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0xc]
mov eax, dword [edi]
test eax, eax
je 0x4242a2
push 0
lea ecx, [esp + 0x10]
push ecx
push esi
push dword [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x42429d
cmp dword [esp + 0xc], esi
je 0x4242b9
pop edi
xor eax, eax
pop esi
ret
mov eax, dword [edi + 4]
add eax, dword [edi + 8]
push esi
push dword [esp + 0x14]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
add dword [edi + 8], esi
pop edi
mov eax, 1
pop esi
ret