joyce8/EMBER2024-capa huggingface dataset:
Function at 0x419d30
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x410015
lea edi, [esi - 0xf015]
push edi
or ebp, 0xffffffff
jmp 0x419d52
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x419d59
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x419d48
mov eax, 1
add ebx, ebx
jne 0x419d6b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x419d60
jne 0x419d7c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x419d60
xor ecx, ecx
sub eax, 3
jb 0x419d90
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x419e02
mov ebp, eax
add ebx, ebx
jne 0x419d9b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x419da8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x419dcc
inc ecx
add ebx, ebx
jne 0x419db8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x419dad
jne 0x419dc9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x419dad
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x419dec
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x419ddd
jmp 0x419d4e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x419dec
add edi, ecx
jmp 0x419d4e
pop esi
mov edi, esi
mov ecx, 0x2b3
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x419e0a
cmp byte [edi], 5
jne 0x419e0a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x419e0f
lea edi, [esi + 0x17000]
mov eax, dword [edi]
or eax, eax
je 0x419e87
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x19000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1908c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x419e3c
mov ecx, edi
jns 0x419e6b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x19090]
or eax, eax
je 0x419e81
mov dword [ebx], eax
add ebx, 4
jmp 0x419e59
call dword [esi + 0x190a0]
mov ebp, dword [esi + 0x19094]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x419ebb
sub esp, 0xffffff80
jmp 0x404c20

Function at 0x414de3
Capabilities:
Encode data using xor

Disassembly:
xor dword [ecx], esi
add ebx, edi
add ebx, 0x6367ee7
add ecx, 4
cmp ecx, eax
jne fcn.00414de3
mov edi, 0xbf875eae
inc edi
and ebx, edx
ret
Function at 0x401000
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
jmp 0x401012
mov eax, dword [0x4b6303]
shl eax, 2
mov dword [0x4b6307], eax
push edx
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov edx, eax
call fcn.004ab458
pop edx
call fcn.004aa760
call fcn.004ab45c
push 0
call fcn.004ac254
pop ecx
push 0x4b62ac
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov dword [0x4b630b], eax
push 0
jmp fcn.004b2ad0

Function at 0x407968
Capabilities:
Check os version

Disassembly:
add esp, 0xffffff6c
mov dword [esp], 0x94
push esp
call sub.KERNEL32.DLL_GetVersionExA
test eax, eax
jne 0x407983
xor eax, eax
jmp 0x4079df
cmp dword [esp + 4], 5
jb 0x4079dd
cmp dword [esp + 4], 5
jne 0x40799c
cmp dword [esp + 8], 0
jne 0x40799c
xor eax, eax
jmp 0x4079df
cmp dword [esp + 4], 5
jne 0x4079d6
cmp dword [esp + 8], 1
jne 0x4079d6
push str.Service_Pack
lea edx, [esp + 0x18]
push edx
call fcn.004ab834
add esp, 8
push str.Service_Pack_1
push eax
call sub.KERNEL32.DLL_lstrcmpiA
test eax, eax
jl 0x4079d2
mov eax, 1
jmp 0x4079df
xor eax, eax
jmp 0x4079df
mov eax, 1
jmp 0x4079df
xor eax, eax
add esp, 0x94
ret

Function at 0x40f9ec
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov eax, dword [ebp + 0xc]
push eax
mov edx, dword [ebp + 8]
push edx
push 0
call sub.KERNEL32.DLL_FindResourceA
mov ebx, eax
test ebx, ebx
jne 0x40fa0c
xor eax, eax
jmp 0x40fa76
push ebx
push 0
call sub.KERNEL32.DLL_LoadResource
mov esi, eax
test esi, esi
jne 0x40fa1e
xor eax, eax
jmp 0x40fa76
push esi
call sub.KERNEL32.DLL_LockResource
mov edi, eax
test edi, edi
jne 0x40fa2e
xor eax, eax
jmp 0x40fa76
push ebx
push 0
call sub.KERNEL32.DLL_SizeofResource
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
push edx
push 0x42
call sub.KERNEL32.DLL_GlobalAlloc
mov ebx, eax
test ebx, ebx
jne 0x40fa54
push esi
call sub.KERNEL32.DLL_FreeResource
xor eax, eax
jmp 0x40fa76
push ebx
call sub.KERNEL32.DLL_GlobalLock
mov edx, dword [ebp - 4]
push edx
push edi
push eax
call fcn.004ab480
add esp, 0xc
push ebx
call sub.KERNEL32.DLL_GlobalUnlock
push esi
call sub.KERNEL32.DLL_FreeResource
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x40fa7c
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0
push 0x80
push 3
push 0
push 0
push closesocket
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x40faa9
xor eax, eax
jmp 0x40fafc
push 0
push ebx
call sub.KERNEL32.DLL_GetFileSize
mov edi, eax
cmp edi, 0xffffffff
jne 0x40fac2
push ebx
call sub.KERNEL32.DLL_CloseHandle
xor eax, eax
jmp 0x40fafc
push edi
push 0x42
call sub.KERNEL32.DLL_GlobalAlloc
mov esi, eax
test esi, esi
jne 0x40fada
push ebx
call sub.KERNEL32.DLL_CloseHandle
xor eax, eax
jmp 0x40fafc
push esi
call sub.KERNEL32.DLL_GlobalLock
push 0
lea edx, [ebp - 4]
push edx
push edi
push eax
push ebx
call sub.KERNEL32.DLL_ReadFile
push esi
call sub.KERNEL32.DLL_GlobalUnlock
push ebx
call sub.KERNEL32.DLL_CloseHandle
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x419248
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov edi, eax
and eax, 0xff
and edi, 0xff00
mov dword [ebp - 8], eax
shr edi, 8
mov byte [ebx], 0
mov eax, edi
mov esi, edi
mov edx, edi
and esi, 4
and edx, 1
and eax, 2
test eax, eax
mov dword [ebp - 4], edx
je 0x41928a
mov eax, str.Ctrl_
jmp 0x41928f
mov eax, 0x52de77
push eax
push ebx
call fcn.004ab594
add esp, 8
cmp dword [ebp - 4], 0
je 0x4192a6
mov edx, str.Shift_
jmp 0x4192ab
mov edx, 0x52de77
push edx
push ebx
call fcn.004ab594
add esp, 8
test esi, esi
je 0x4192c0
mov eax, str.Alt_
jmp 0x4192c5
mov eax, 0x52de77
push eax
push ebx
call fcn.004ab594
add esp, 8
push 0
mov edx, dword [ebp - 8]
push edx
call sub.USER32.DLL_MapVirtualKeyA
test edi, 8
mov esi, eax
je 0x4192ef
shl esi, 0x10
or esi, 0x3000000
jmp 0x4192f8
shl esi, 0x10
or esi, 0x2000000
push 0x64
push ebx
call fcn.004ab624
pop ecx
add ebx, eax
push ebx
push esi
call sub.USER32.DLL_GetKeyNameTextA
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x41a9d4
Capabilities:
Get thread local storage value

Disassembly:
push ebx
mov ebx, 0x538504
push 0x538578
call fcn.004499f4
pop ecx
dec dword [0x53859c]
test byte [ebx], 2
je 0x41aa0e
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
cmp word [eax + 0x36], 0
jne 0x41aa0e
mov word [eax + 0x36], 1
mov word [eax + 0x34], 1
test byte [ebx], 1
je 0x41aa32
push 0x538594
call fcn.00449a38
pop ecx
push 0x538578
push 0x538594
call fcn.00449a48
add esp, 8
jmp 0x41a9eb
inc dword [0x53859c]
push 0x538578
call fcn.00449a14
pop ecx
pop ebx
ret

Function at 0x41aa48
Capabilities:
Get thread local storage value

Disassembly:
push ebx
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov ebx, eax
test ebx, ebx
je 0x41aab5
inc dword [ebx + 0x1c0]
mov eax, dword [ebx + 0x1c0]
dec eax
jne 0x41aab5
push 0x538578
call fcn.004499f4
pop ecx
dec dword [0x53859c]
cmp dword [0x538504], 0
je 0x41aaaa
test byte [0x538504], 2
je 0x41aa9f
cmp word [ebx + 0x36], 0
jne 0x41aa9f
mov word [ebx + 0x36], 1
mov word [ebx + 0x34], 1
push 0x538594
call fcn.00449a38
pop ecx
push 0x538578
call fcn.00449a14
pop ecx
pop ebx
ret

Function at 0x41aab8
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, 0x538504
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov ebx, eax
test ebx, ebx
je 0x41ab25
dec dword [ebx + 0x1c0]
jne 0x41ab25
push 0x538578
call fcn.004499f4
pop ecx
test byte [esi], 2
je 0x41aafb
cmp word [ebx + 0x36], 0
jne 0x41aafb
mov word [ebx + 0x36], 1
mov word [ebx + 0x34], 1
test byte [esi], 1
je 0x41ab14
push 0x538578
push 0x538594
call fcn.00449a48
add esp, 8
jmp 0x41aae3
inc dword [0x53859c]
push 0x538578
call fcn.00449a14
pop ecx
pop esi
pop ebx
ret
Function at 0x41abc0
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
cmp eax, dword [0x53855c]
jne 0x41ac36
push 0x538578
call fcn.004499f4
pop ecx
or dword [0x538504], 2
dec dword [0x53859c]
call fcn.0044a82c
call fcn.0044a898
push 0x538594
call fcn.00449a38
pop ecx
jmp 0x41ac14
push 0x538578
push 0x538594
call fcn.00449a48
add esp, 8
cmp dword [0x538598], 1
jg 0x41ac02
inc dword [0x53859c]
xor edx, edx
mov dword [0x538504], edx
push 0x538578
call fcn.00449a14
pop ecx
ret

Function at 0x41adec
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
push edi
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov ebx, eax
push 0x538578
call fcn.004499f4
pop ecx
inc dword [ebx + 0x1c0]
mov eax, dword [ebx + 0x1c0]
push 0
dec eax
sete dl
and edx, 1
mov eax, dword [ebx + 0x1cc]
push eax
mov edi, edx
call fcn.0041ad30
add esp, 8
mov esi, eax
push 0x538578
call fcn.00449a14
pop ecx
test esi, esi
je 0x41ae45
push esi
call fcn.0043d978
pop ecx
add ebx, 0xa0
push ebx
call fcn.004474bc
pop ecx
call fcn.00432728
call fcn.0044a82c
push 0x538578
call fcn.004499f4
pop ecx
test edi, edi
je 0x41ae71
dec dword [0x53859c]
dec dword [0x538598]
push 0x538594
call fcn.00449a38
pop ecx
push 0x538578
call fcn.00449a14
pop ecx
pop edi
pop esi
pop ebx
ret

Function at 0x41af04
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x41af17
call fcn.00449d34
mov ebx, eax
push ebx
call fcn.0041ad98
pop ecx
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov esi, eax
mov eax, dword [ebx]
push eax
call fcn.004528b8
pop ecx
mov edx, dword [ebx + 4]
push edx
call fcn.0046bcf4
pop ecx
mov ecx, dword [ebx + 0x10]
push ecx
call fcn.00425600
pop ecx
xor eax, eax
mov dword [ebx + 0x10], eax
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x41af7a
push 0x114
push eax
add esi, 0xa0
push esi
call fcn.004ab480
add esp, 0xc
mov eax, dword [ebx + 0xc]
push eax
call fcn.0043b208
pop ecx
xor edx, edx
mov dword [ebx + 0xc], edx
jmp 0x41af87
add esi, 0xa0
push esi
call fcn.00447218
pop ecx
mov eax, dword [ebx + 0x14]
push eax
call fcn.00461e54
pop ecx
xor edx, edx
mov dword [ebx + 0x14], edx
mov esi, dword [ebx + 8]
test esi, esi
je 0x41afa4
call fcn.00432fac
mov dword [eax], esi
cmp dword [0x53853c], 0
je 0x41afb2
call fcn.0041a954
mov eax, dword [ebx + 0x30]
test eax, eax
je 0x41afcf
push eax
call fcn.00444384
pop ecx
mov edx, dword [ebx + 0x30]
push edx
call fcn.0043d978
pop ecx
xor ecx, ecx
mov dword [ebx + 0x30], ecx
pop esi
pop ebx
pop ebp
ret
Function at 0x41afd4
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
push edi
push ebp
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov ebx, eax
mov word [ebx + 0x36], 1
mov word [ebx + 0x34], 0
mov edi, dword [ebx + 0x1cc]
lea esi, [ebx + 0x10]
test byte [esi + 1], 0x20
je 0x41b009
push esi
call fcn.0043f598
pop ecx
mov esi, eax
cmp dword [edi + 0x34], 0
jne 0x41b024
push esi
call fcn.0043d7dc
pop ecx
mov ebp, eax
mov dword [edi + 0x34], ebp
push ebp
call fcn.0043ba3c
pop ecx
jmp 0x41b031
push esi
mov eax, dword [edi + 0x34]
push eax
call fcn.0043ee8c
add esp, 8
lea edx, [ebx + 0x10]
push edx
call fcn.0043edc0
pop ecx
mov word [ebx + 0x34], 0
call fcn.00482a40
push 1
call fcn.00432b80
pop ecx
push 1
call fcn.00444038
pop ecx
push 0
call fcn.00425600
pop ecx
push 0
call fcn.004227b4
pop ecx
push 0
call fcn.00461df4
pop ecx
call fcn.0041adec
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x41b1e4
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
call fcn.0044c210
call fcn.0043b360
call fcn.0044dab0
call fcn.0044dac8
call fcn.004497e4
call fcn.00449d34
push eax
call fcn.0041ad98
pop ecx
call fcn.0044a9a8
mov dword [0x538508], eax
push 0x538658
call fcn.0046bcf4
pop ecx
push 0x538658
call fcn.004528b8
pop ecx
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov dword [0x53855c], eax
add eax, 0xa0
push eax
call fcn.00447218
pop ecx
call fcn.0044c650
call fcn.0042bd58
call fcn.0045665c
mov edx, dword [0x53852c]
push edx
call fcn.00431944
pop ecx
mov dword [0x538538], eax
call fcn.004536fc
push 0x538568
push 0x538564
call fcn.0044cc64
add esp, 8
mov dword [0x538560], eax
mov ecx, dword [0x538568]
push ecx
mov eax, dword [0x538564]
push eax
call fcn.004689e0
add esp, 8
call fcn.00462918
mov dword [0x53853c], 1
push 0x53865b
call fcn.004317dc
pop ecx
mov ebx, eax
mov dword [0x538500], ebx
test ebx, ebx
je 0x41b2f3
cmp dword [0x54d74c], 0
jne 0x41b2e0
push 0
push 0
push 0
push 0
push 6
call fcn.0042258c
add esp, 0x14
cmp dword [0x54d74c], 0
jne 0x41b2f3
mov dword [0x54d74c], fcn.0042258c
call fcn.0042481c
call fcn.0041a954
call fcn.0042bee4
call fcn.0041a924
push 1
call fcn.00424878
pop ecx
push 0
call fcn.00424878
pop ecx
call fcn.0041a984
push str._APPMAIN
call fcn.004317dc
pop ecx
test eax, eax
je 0x41b33f
mov edx, dword [eax]
cmp dword [edx + 8], 0
je 0x41b33f
mov eax, dword [eax]
mov dword [0x538548], eax
jmp 0x41b3cf
mov eax, dword [0x538528]
test eax, eax
je 0x41b359
cmp byte [eax], 0x40
jne 0x41b359
mov ebx, eax
inc ebx
push ebx
call fcn.004317dc
pop ecx
jmp 0x41b384
mov ebx, 0x53866a
push ebx
call fcn.004317dc
pop ecx
test eax, eax
je 0x41b371
mov edx, dword [eax]
cmp dword [edx + 8], 0
jne 0x41b384
mov edx, dword [0x538528]
test edx, edx
je 0x41b384
mov ebx, edx
push ebx
call fcn.004317dc
pop ecx
test eax, eax
je 0x41b397
mov edx, dword [eax]
cmp dword [edx + 8], 0
je 0x41b397
mov eax, dword [eax]
mov dword [0x538548], eax
test esi, esi
je 0x41b3cf
cmp dword [0x538548], 0
jne 0x41b3cf
test ebx, ebx
je 0x41b3bc
push 0
push ebx
push 0
push 0x2334
call fcn.00457320
add esp, 0x10
jmp 0x41b3cf
push 0
push 0
push 0
push 0x2335
call fcn.00457320
add esp, 0x10
test esi, esi
je 0x41b3fa
cmp dword [0x538548], 0
je 0x41b3fa
mov ecx, dword [0x538548]
push ecx
call fcn.004231dc
pop ecx
call fcn.00422ba8
call fcn.0044c654
push eax
call fcn.00422014
pop ecx
pop esi
pop ebx
pop ebp
ret
Function at 0x41db50
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
add esp, 0xfffffff0
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov edx, dword [eax]
mov ebx, dword [edx - 4]
test byte [ebx], 2
je 0x41dc14
mov ecx, dword [ebx + 8]
cmp ecx, reloc.WS2_32.DLL_accept
jge 0x41dbec
mov eax, ecx
cdq
mov dword [esp], eax
mov dword [esp + 4], edx
mov dword [ebx], 8
mov eax, dword [esp]
mov edx, dword [esp + 4]
neg eax
adc edx, 0
neg edx
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], edx
mov eax, dword [esp]
mov edx, dword [esp + 4]
neg eax
adc edx, 0
neg edx
cmp edx, 0xffffffff
jne 0x41dbb9
cmp eax, 0xc4653601
jb 0x41dbd9
jmp 0x41dbbb
jl 0x41dbd9
mov eax, dword [esp]
mov edx, dword [esp + 4]
neg eax
adc edx, 0
neg edx
cmp edx, 2
jne 0x41dbd7
cmp eax, 0x540be3ff
jbe 0x41dbdf
jmp 0x41dbd9
jle 0x41dbdf
mov ax, 0x14
jmp 0x41dbe3
mov ax, 0xa
mov word [ebx + 0x10], ax
jmp 0x41dd3f
mov dword [ebx], 2
mov eax, dword [ebx + 8]
neg eax
mov dword [ebx + 8], eax
cmp eax, 0xc4653601
jge 0x41dc07
mov dx, 0x14
jmp 0x41dc0b
mov dx, 0xa
mov word [ebx + 0xc], dx
jmp 0x41dd3f
test byte [ebx], 8
je 0x41dcd0
cmp dword [ebx + 0xc], 0x80000000
jne 0x41dc2e
cmp dword [ebx + 8], 1
jae 0x41dc81
jmp 0x41dc30
jge 0x41dc81
fild qword [ebx + 8]
fstp qword [esp + 8]
mov dword [ebx], 0x10
fld qword [esp + 8]
fchs
fstp qword [ebx + 8]
fld qword [esp + 8]
fchs
fcomp qword [0x41dd48]
fnstsw ax
sahf
ja 0x41dc68
fld qword [esp + 8]
fchs
fcomp qword [0x41dd50]
fnstsw ax
sahf
jae 0x41dc6e
mov dx, 0x14
jmp 0x41dc72
mov dx, 0xa
mov word [ebx + 0x10], dx
mov word [ebx + 0x12], 0
jmp 0x41dd3f
mov dword [ebx], 8
mov eax, dword [ebx + 8]
mov edx, dword [ebx + 0xc]
neg eax
adc edx, 0
neg edx
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], edx
cmp dword [ebx + 0xc], 0xffffffff
jne 0x41dcab
cmp dword [ebx + 8], 0xc4653601
jb 0x41dcc0
jmp 0x41dcad
jl 0x41dcc0
cmp dword [ebx + 0xc], 2
jne 0x41dcbe
cmp dword [ebx + 8], 0x540be3ff
jbe 0x41dcc6
jmp 0x41dcc0
jle 0x41dcc6
mov cx, 0x14
jmp 0x41dcca
mov cx, 0xa
mov word [ebx + 0x10], cx
jmp 0x41dd3f
test byte [ebx], 0x10
je 0x41dd0f
mov dword [ebx], 0x10
fld qword [ebx + 8]
fchs
fstp qword [ebx + 8]
fld qword [ebx + 8]
fcomp qword [0x41dd48]
fnstsw ax
sahf
ja 0x41dcff
fld qword [ebx + 8]
fcomp qword [0x41dd50]
fnstsw ax
sahf
jae 0x41dd05
mov dx, 0x14
jmp 0x41dd09
mov dx, 0xa
mov word [ebx + 0x10], dx
jmp 0x41dd3f
push ebx
push 1
push 0x538671
push 0
push 0x438
push 1
call fcn.004570b8
add esp, 0x18
mov esi, eax
test esi, esi
je 0x41dd3f
push esi
push ebx
call fcn.0043f03c
add esp, 8
push esi
call fcn.0043d978
pop ecx
add esp, 0x10
pop esi
pop ebx
ret

Function at 0x41ef7c
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov edx, dword [eax]
mov eax, dword [edx - 4]
test byte [eax + 1], 1
jne 0x41efa8
push 0
push str.hb_vmFuncPtr__
push 0
push 0x2337
call fcn.00457320
add esp, 0x10
ret
Function at 0x41f82c
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
push edi
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov edi, eax
mov eax, dword [edi]
mov esi, dword [eax - 4]
mov ebx, dword [eax - 8]
test byte [ebx + 1], 4
je 0x41f891
test byte [esi + 1], 4
je 0x41f891
push 0
push esi
push ebx
call fcn.0043f810
sub dword [edi], 4
mov esi, eax
mov eax, dword [edi]
add esp, 0xc
mov eax, dword [eax]
test dword [eax], 0xb405
je 0x41f874
push eax
call fcn.0043edc0
pop ecx
push ebx
call fcn.0043edc0
test esi, esi
pop ecx
setl dl
and edx, 1
mov dword [ebx], 0x80
mov dword [ebx + 8], edx
jmp 0x41fa2f
mov ecx, dword [ebx]
test cl, 0xa
je 0x41f8e9
test byte [esi], 0xa
je 0x41f8e9
test cl, 2
je 0x41f8a8
mov eax, dword [ebx + 8]
cdq
jmp 0x41f8ae
mov eax, dword [ebx + 8]
mov edx, dword [ebx + 0xc]
push edx
push eax
test byte [esi], 2
je 0x41f8bb
mov eax, dword [esi + 8]
cdq
jmp 0x41f8c1
mov eax, dword [esi + 8]
mov edx, dword [esi + 0xc]
cmp edx, dword [esp + 4]
jne 0x41f8cf
cmp eax, dword [esp]
seta cl
jmp 0x41f8d2
setg cl
and ecx, 1
add esp, 8
mov dword [ebx + 8], ecx
mov dword [ebx], 0x80
sub dword [edi], 4
jmp 0x41fa2f
mov ecx, dword [ebx]
test cl, 0x1a
je 0x41f93f
test byte [esi], 0x1a
je 0x41f93f
test cl, 2
je 0x41f8ff
fild dword [ebx + 8]
jmp 0x41f90c
test byte [ebx], 8
je 0x41f909
fild qword [ebx + 8]
jmp 0x41f90c
fld qword [ebx + 8]
test byte [esi], 2
je 0x41f916
fild dword [esi + 8]
jmp 0x41f923
test byte [esi], 8
je 0x41f920
fild qword [esi + 8]
jmp 0x41f923
fld qword [esi + 8]
fcompp
fnstsw ax
sahf
seta dl
and edx, 1
mov dword [ebx + 8], edx
mov dword [ebx], 0x80
sub dword [edi], 4
jmp 0x41fa2f
test byte [ebx], 0x60
je 0x41f996
test byte [esi], 0x60
je 0x41f996
test byte [ebx], 0x40
je 0x41f979
test byte [esi], 0x40
je 0x41f979
mov eax, dword [ebx + 8]
cmp eax, dword [esi + 8]
jl 0x41f96f
mov edx, dword [ebx + 8]
cmp edx, dword [esi + 8]
jne 0x41f96b
mov ecx, dword [ebx + 0xc]
cmp ecx, dword [esi + 0xc]
jl 0x41f96f
xor eax, eax
jmp 0x41f974
mov eax, 1
mov dword [ebx + 8], eax
jmp 0x41f988
mov edx, dword [ebx + 8]
cmp edx, dword [esi + 8]
setl cl
and ecx, 1
mov dword [ebx + 8], ecx
mov dword [ebx], 0x80
sub dword [edi], 4
jmp 0x41fa2f
test byte [ebx], 0x80
je 0x41f9bd
test byte [esi], 0x80
je 0x41f9bd
cmp dword [ebx + 8], 0
jne 0x41f9ac
cmp dword [esi + 8], 0
jne 0x41f9b0
xor eax, eax
jmp 0x41f9b5
mov eax, 1
mov dword [ebx + 8], eax
sub dword [edi], 4
jmp 0x41fa2f
push 0
push esi
push ebx
push ebx
push 0xb
call fcn.0042d5d0
add esp, 0x14
test eax, eax
je 0x41f9e8
sub dword [edi], 4
mov edx, dword [edi]
mov eax, dword [edx]
test dword [eax], 0xb405
je 0x41fa2f
push eax
call fcn.0043edc0
pop ecx
jmp 0x41fa2f
push esi
push ebx
push 2
push 0x538696
push 0
push 0x431
push 1
call fcn.004570b8
add esp, 0x1c
mov esi, eax
test esi, esi
je 0x41fa2f
sub dword [edi], 4
mov edx, dword [edi]
mov eax, dword [edx]
test dword [eax], 0xb405
je 0x41fa1e
push eax
call fcn.0043edc0
pop ecx
push esi
push ebx
call fcn.0043f03c
add esp, 8
push esi
call fcn.0043d978
pop ecx
pop edi
pop esi
pop ebx
ret
Function at 0x41fa34
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
push edi
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov edi, eax
mov eax, dword [edi]
mov esi, dword [eax - 4]
mov ebx, dword [eax - 8]
test byte [ebx + 1], 4
je 0x41fa99
test byte [esi + 1], 4
je 0x41fa99
push 0
push esi
push ebx
call fcn.0043f810
sub dword [edi], 4
mov esi, eax
mov eax, dword [edi]
add esp, 0xc
mov eax, dword [eax]
test dword [eax], 0xb405
je 0x41fa7c
push eax
call fcn.0043edc0
pop ecx
push ebx
call fcn.0043edc0
test esi, esi
pop ecx
setle dl
and edx, 1
mov dword [ebx], 0x80
mov dword [ebx + 8], edx
jmp 0x41fc37
mov ecx, dword [ebx]
test cl, 0xa
je 0x41faf1
test byte [esi], 0xa
je 0x41faf1
test cl, 2
je 0x41fab0
mov eax, dword [ebx + 8]
cdq
jmp 0x41fab6
mov eax, dword [ebx + 8]
mov edx, dword [ebx + 0xc]
push edx
push eax
test byte [esi], 2
je 0x41fac3
mov eax, dword [esi + 8]
cdq
jmp 0x41fac9
mov eax, dword [esi + 8]
mov edx, dword [esi + 0xc]
cmp edx, dword [esp + 4]
jne 0x41fad7
cmp eax, dword [esp]
setae cl
jmp 0x41fada
setge cl
and ecx, 1
add esp, 8
mov dword [ebx + 8], ecx
mov dword [ebx], 0x80
sub dword [edi], 4
jmp 0x41fc37
mov ecx, dword [ebx]
test cl, 0x1a
je 0x41fb47
test byte [esi], 0x1a
je 0x41fb47
test cl, 2
je 0x41fb07
fild dword [ebx + 8]
jmp 0x41fb14
test byte [ebx], 8
je 0x41fb11
fild qword [ebx + 8]
jmp 0x41fb14
fld qword [ebx + 8]
test byte [esi], 2
je 0x41fb1e
fild dword [esi + 8]
jmp 0x41fb2b
test byte [esi], 8
je 0x41fb28
fild qword [esi + 8]
jmp 0x41fb2b
fld qword [esi + 8]
fcompp
fnstsw ax
sahf
setae dl
and edx, 1
mov dword [ebx + 8], edx
mov dword [ebx], 0x80
sub dword [edi], 4
jmp 0x41fc37
test byte [ebx], 0x60
je 0x41fb9e
test byte [esi], 0x60
je 0x41fb9e
test byte [ebx], 0x40
je 0x41fb81
test byte [esi], 0x40
je 0x41fb81
mov eax, dword [ebx + 8]
cmp eax, dword [esi + 8]
jl 0x41fb77
mov edx, dword [ebx + 8]
cmp edx, dword [esi + 8]
jne 0x41fb73
mov ecx, dword [ebx + 0xc]
cmp ecx, dword [esi + 0xc]
jle 0x41fb77
xor eax, eax
jmp 0x41fb7c
mov eax, 1
mov dword [ebx + 8], eax
jmp 0x41fb90
mov edx, dword [ebx + 8]
cmp edx, dword [esi + 8]
setle cl
and ecx, 1
mov dword [ebx + 8], ecx
mov dword [ebx], 0x80
sub dword [edi], 4
jmp 0x41fc37
test byte [ebx], 0x80
je 0x41fbc5
test byte [esi], 0x80
je 0x41fbc5
cmp dword [ebx + 8], 0
je 0x41fbb8
cmp dword [esi + 8], 0
jne 0x41fbb8
xor eax, eax
jmp 0x41fbbd
mov eax, 1
mov dword [ebx + 8], eax
sub dword [edi], 4
jmp 0x41fc37
push 0
push esi
push ebx
push ebx
push 0xc
call fcn.0042d5d0
add esp, 0x14
test eax, eax
je 0x41fbf0
sub dword [edi], 4
mov edx, dword [edi]
mov eax, dword [edx]
test dword [eax], 0xb405
je 0x41fc37
push eax
call fcn.0043edc0
pop ecx
jmp 0x41fc37
push esi
push ebx
push 2
push 0x538698
push 0
push 0x432
push 1
call fcn.004570b8
add esp, 0x1c
mov esi, eax
test esi, esi
je 0x41fc37
sub dword [edi], 4
mov edx, dword [edi]
mov eax, dword [edx]
test dword [eax], 0xb405
je 0x41fc26
push eax
call fcn.0043edc0
pop ecx
push esi
push ebx
call fcn.0043f03c
add esp, 8
push esi
call fcn.0043d978
pop ecx
pop edi
pop esi
pop ebx
ret