joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44289c
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff9c
push ebx
push esi
push edi
mov edi, 0x539488
mov ebx, dword [ebp + 8]
lea esi, [ebp - 0x50]
push ebx
call fcn.004418e0
pop ecx
test eax, eax
je 0x4429ff
mov dword [esi], 2
call fcn.004255a0
test byte [eax + 0x24], 4
je 0x4428d7
mov eax, 0x800
jmp 0x4428d9
xor eax, eax
push eax
call fcn.00441828
pop edx
or edx, eax
mov dword [esi + 4], edx
mov dword [esi + 0x14], 9
mov word [esi + 0x36], 0x3f
mov dword [esi + 0x18], 1
mov ecx, dword [ebx + 0x10]
mov dword [esi + 0xc], ecx
mov eax, dword [ebx + 8]
mov dword [esi + 0x10], eax
push esi
call fcn.00441850
pop ecx
test eax, eax
jne 0x4429f3
cmp dword [esi + 0x30], 6
jne 0x442922
lea ebx, [edi + 2]
jmp 0x4429f6
mov eax, dword [esi + 0x18]
test al, 8
je 0x442931
lea ebx, [edi + 4]
jmp 0x4429f6
test al, 4
je 0x44293d
lea ebx, [edi + 6]
jmp 0x4429f6
test al, 1
je 0x4429ee
mov dword [ebp - 0x64], 0x441968
mov dword [ebp - 0x5c], esi
lea eax, [ebp - 0x64]
push eax
call fcn.00456600
pop ecx
mov ebx, eax
push esi
call fcn.00441998
pop ecx
push ebx
call fcn.00456600
test byte [esi + 0x18], 1
pop ecx
je 0x4429c7
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov edx, dword [eax]
mov ecx, dword [edx - 4]
push ecx
call fcn.0043ecb8
pop ecx
mov ebx, eax
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
sub dword [eax], 4
mov edx, dword [0x54d750]
push edx
call sub.KERNEL32.DLL_TlsGetValue
mov ecx, dword [eax]
mov eax, dword [ecx]
test dword [eax], 0xb405
je 0x4429f6
mov edx, dword [0x54d750]
push edx
call sub.KERNEL32.DLL_TlsGetValue
mov ecx, dword [eax]
mov eax, dword [ecx]
push eax
call fcn.0043edc0
pop ecx
jmp 0x4429f6
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x4429e9
push eax
call fcn.00456a40
pop ecx
cmp eax, 0xe
je 0x4429df
cmp eax, 0xf
jne 0x4429e4
lea ebx, [edi + 4]
jmp 0x4429f6
lea ebx, [edi + 9]
jmp 0x4429f6
lea ebx, [edi + 9]
jmp 0x4429f6
lea ebx, [edi + 9]
jmp 0x4429f6
lea ebx, [edi + 9]
push esi
call fcn.004418a4
pop ecx
jmp 0x442a02
lea ebx, [edi + 4]
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44388c
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov ebx, eax
push esi
add ebx, 0x90
call fcn.00431aa0
pop ecx
mov edi, eax
test edi, edi
je 0x4438d4
mov eax, dword [ebx + 8]
mov edx, dword [ebx]
lea edx, [edx + eax*8 - 8]
jmp 0x4438c8
cmp esi, dword [edx]
je 0x4438cd
dec eax
add edx, 0xfffffff8
cmp eax, dword [ebx + 0xc]
ja 0x4438c0
cmp eax, dword [ebx + 0xc]
ja 0x4438d4
xor edi, edi
test edi, edi
jne 0x443946
mov eax, dword [ebx + 4]
cmp eax, dword [ebx + 8]
jne 0x44391a
test eax, eax
jne 0x443902
push 0x320
call fcn.0043b120
pop ecx
mov dword [ebx], eax
mov dword [ebx + 4], 0x64
xor edx, edx
mov dword [ebx + 0xc], edx
mov dword [ebx + 8], edx
jmp 0x44391a
add dword [ebx + 4], 0x32
mov eax, dword [ebx + 4]
shl eax, 3
push eax
mov ecx, dword [ebx]
push ecx
call fcn.0043b178
add esp, 8
mov dword [ebx], eax
mov eax, dword [ebx]
mov edx, dword [ebx + 8]
mov dword [eax + edx*8], esi
push esi
call fcn.00431aa0
pop ecx
mov ecx, dword [ebx + 8]
inc dword [ebx + 8]
mov edx, dword [ebx]
mov dword [edx + ecx*8 + 4], eax
call fcn.00443760
mov edi, eax
push edi
push esi
call fcn.00431ab4
add esp, 8
cmp dword [ebp + 0xc], 0
je 0x44395f
mov eax, dword [ebp + 0xc]
push eax
push edi
call fcn.0043ee8c
add esp, 8
and dword [edi], 0xfffff7ff
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4439a0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov ebx, eax
add ebx, 0x90
jmp 0x4439e3
dec dword [ebx + 8]
mov eax, dword [ebx + 8]
mov edx, dword [ebx]
mov esi, dword [edx + eax*8]
push esi
call fcn.00431aa0
pop ecx
test eax, eax
je 0x4439e3
mov eax, dword [ebx]
mov edx, dword [ebx + 8]
mov ecx, dword [eax + edx*8 + 4]
push ecx
push esi
call fcn.004437ac
add esp, 8
mov eax, dword [ebx + 8]
cmp eax, dword [ebx + 0xc]
ja 0x4439ba
mov edx, dword [ebp + 8]
mov dword [ebx + 0xc], edx
pop esi
pop ebx
pop ebp
ret

Function at 0x443a20
Capabilities:
Get thread local storage value

Disassembly:
push ebx
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov edx, dword [eax + 0xc]
mov ecx, dword [edx]
mov eax, dword [ecx + 0xc]
mov ebx, dword [eax + 4]
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov dword [eax + 0x9c], ebx
pop ebx
ret
Function at 0x443e70
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov eax, dword [ebp + 8]
test byte [eax + 1], 4
je 0x443ef0
mov edx, dword [eax + 8]
push edx
mov eax, dword [eax + 0x10]
push eax
call fcn.00443c98
add esp, 8
mov ebx, eax
test ebx, ebx
je 0x443f08
push ebx
call fcn.00431aa0
pop ecx
test eax, eax
je 0x443f08
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov esi, dword [eax + 0x98]
test esi, esi
jbe 0x443ee3
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov edx, dword [eax + 0x90]
dec esi
cmp ebx, dword [edx + esi*8]
jne 0x443edf
push ebx
call fcn.00431aa0
pop ecx
test eax, eax
je 0x443f08
push eax
call fcn.0043edc0
pop ecx
jmp 0x443f08
test esi, esi
ja 0x443eb4
push 0
push ebx
call fcn.004437ac
add esp, 8
jmp 0x443f08
push 0xffffffffffffffff
push str.RELEASE
push 0
push 0xbc0
push 1
call fcn.00456f18
add esp, 0x14
pop esi
pop ebx
pop ebp
ret

Function at 0x443f0c
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov edi, dword [eax + 0x98]
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov edx, dword [eax + 0xc]
mov ecx, dword [edx]
mov eax, dword [ecx + 0xc]
mov edx, dword [eax + 4]
mov dword [ebp - 4], edx
jmp 0x443f90
mov ecx, dword [0x54d750]
push ecx
call sub.KERNEL32.DLL_TlsGetValue
mov eax, dword [eax + 0x90]
mov ebx, dword [eax + edi*8]
push ebx
call fcn.00431aa0
pop ecx
mov esi, eax
test esi, esi
je 0x443f90
mov eax, dword [ebp + 8]
push eax
mov edx, dword [ebx]
mov ecx, dword [edx]
push ecx
call fcn.004aa418
add esp, 8
cmp dword [ebp + 0xc], 0
je 0x443f7c
mov edx, eax
jmp 0x443f85
mov edx, eax
cmp edx, 1
sbb edx, edx
neg edx
test edx, edx
je 0x443f90
push esi
call fcn.0043edc0
pop ecx
mov eax, edi
add edi, 0xffffffff
cmp eax, dword [ebp - 4]
ja 0x443f3f
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x443fa0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
mov edi, 0x54d750
push esi
call fcn.00431aa0
pop ecx
test eax, eax
jne 0x443fbe
or eax, 0xffffffff
jmp 0x44400b
mov edx, dword [edi]
push edx
call sub.KERNEL32.DLL_TlsGetValue
mov ebx, dword [eax + 0x98]
test ebx, ebx
je 0x444006
mov eax, dword [edi]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov edx, dword [eax + 0x90]
dec ebx
cmp esi, dword [edx + ebx*8]
jne 0x444002
mov ecx, dword [edi]
push ecx
call sub.KERNEL32.DLL_TlsGetValue
cmp ebx, dword [eax + 0x9c]
jb 0x443ffb
mov eax, 4
jmp 0x44400b
mov eax, 2
jmp 0x44400b
test ebx, ebx
jne 0x443fd0
mov eax, 1
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4440a8
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
jle 0x4440e6
call fcn.0043313c
cmp eax, ebx
jle 0x4440e6
sub eax, ebx
dec eax
push eax
call fcn.00433174
pop ecx
mov ebx, eax
test ebx, ebx
jle 0x4440e6
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov edx, dword [eax + 8]
mov ecx, dword [edx + ebx*4]
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + 4]
pop ebx
pop ebp
ret
mov edx, dword [0x54d750]
push edx
call sub.KERNEL32.DLL_TlsGetValue
mov ecx, dword [eax + 0xc]
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
mov eax, dword [edx + 4]
pop ebx
pop ebp
ret

Function at 0x444100
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
cmp eax, 1
jne 0x44412d
xor eax, eax
lea edx, [ebp - 4]
mov dword [ebp - 4], eax
push edx
push 0x44408c
call fcn.00431c74
add esp, 8
mov eax, dword [ebp - 4]
jmp 0x444172
cmp eax, 4
jne 0x444152
mov edx, dword [0x54d750]
push edx
call sub.KERNEL32.DLL_TlsGetValue
mov ecx, dword [eax + 0x98]
push ecx
push ebx
call fcn.004440a8
pop ecx
pop edx
xchg edx, eax
sub eax, edx
jmp 0x444172
cmp eax, 2
jne 0x444160
push ebx
call fcn.004440a8
pop ecx
jmp 0x444172
mov ecx, dword [0x54d750]
push ecx
call sub.KERNEL32.DLL_TlsGetValue
mov eax, dword [eax + 0x98]
pop ebx
pop ecx
pop ebp
ret

Function at 0x4441b0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
xor esi, esi
xor eax, eax
mov dword [edi], eax
test ebx, ebx
jle 0x44423f
dec ebx
cmp dword [ebp + 8], 1
jne 0x444206
mov dword [ebp - 0xc], ebx
xor edx, edx
mov dword [ebp - 8], edx
lea ecx, [ebp - 0xc]
push ecx
push 0x444178
call fcn.00431c74
add esp, 8
cmp dword [ebp - 8], 0
je 0x44423f
mov eax, dword [ebp - 4]
push eax
call fcn.00431aa0
mov esi, eax
mov eax, dword [ebp - 4]
pop ecx
mov edx, dword [eax]
mov ecx, dword [edx]
mov dword [edi], ecx
jmp 0x44423f
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov edx, dword [eax + 0x98]
cmp edx, ebx
jbe 0x44423f
mov ecx, dword [0x54d750]
push ecx
call sub.KERNEL32.DLL_TlsGetValue
mov eax, dword [eax + 0x90]
mov ebx, dword [eax + ebx*8]
push ebx
call fcn.00431aa0
mov esi, eax
mov eax, dword [ebx]
pop ecx
mov edx, dword [eax]
mov dword [edi], edx
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x444288
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
xor esi, esi
and ebx, 7
cmp ebx, 7
jne 0x4442a0
xor ebx, ebx
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov edx, dword [eax + 0x1c8]
shl edx, 2
push edx
call fcn.0043b120
pop ecx
mov dword [ebp - 0x10], eax
xor ecx, ecx
lea eax, [ebp - 0x14]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], ebx
push eax
push 0x444248
call fcn.00431c74
add esp, 8
mov eax, dword [ebp - 0xc]
test eax, eax
jbe 0x444371
push eax
call fcn.0043d994
pop ecx
mov esi, eax
mov eax, dword [ebp - 0xc]
push eax
push esi
call fcn.00429f58
add esp, 8
mov ebx, eax
dec dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
mov ecx, dword [edx + eax*4]
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
push eax
call fcn.00431aa0
pop ecx
mov edi, eax
push 2
push ebx
call fcn.004299e4
add esp, 8
mov eax, dword [ebp - 4]
mov edx, dword [eax]
push edx
push 1
push ebx
call fcn.0042a878
add esp, 0xc
push 2
push ebx
call fcn.00429f58
add esp, 8
mov ebx, eax
cmp dword [ebp + 0xc], 0
je 0x444357
push edi
push ebx
call fcn.0043ee8c
add esp, 8
push ebx
call fcn.004437d8
pop ecx
jmp 0x444367
mov dword [ebx], 0x6000
mov dword [ebx + 8], edi
push edi
call fcn.0043b238
pop ecx
cmp dword [ebp - 0xc], 0
jne 0x4442eb
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.0043b208
pop ecx
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x445618
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
add eax, 0xa0
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
mov ecx, dword [edx]
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 4]
mov edx, dword [ebp + 8]
mov dword [eax], edx
mov ecx, dword [ebp - 8]
cmp ecx, dword [ebp + 8]
je 0x445767
mov eax, dword [ebp - 4]
mov edi, 0xffffffff
mov ebx, edi
mov edx, dword [eax + 0x4c]
mov dword [ebp - 0x10], edx
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.004ab624
pop ecx
mov dword [ebp - 0xc], eax
xor edx, edx
mov eax, dword [ebp - 0x10]
cmp edx, dword [ebp - 0xc]
jge 0x4456b1
cmp byte [eax], 0x61
jb 0x445689
cmp byte [eax], 0x7a
ja 0x445689
movzx esi, byte [eax]
add esi, 0xffffffe0
jmp 0x44568c
movzx esi, byte [eax]
cmp esi, 0x59
jne 0x44569a
cmp ebx, 0xffffffff
jne 0x4456a6
mov ebx, edx
jmp 0x4456a6
cmp ebx, 0xffffffff
jle 0x4456a6
cmp edi, 0xffffffff
jne 0x4456a6
mov edi, edx
mov ecx, esi
inc edx
mov byte [eax], cl
inc eax
cmp edx, dword [ebp - 0xc]
jl 0x445677
test ebx, ebx
jge 0x4456bb
xor ebx, ebx
xor edi, edi
jmp 0x4456c2
test edi, edi
jge 0x4456c2
mov edi, dword [ebp - 0xc]
mov eax, edi
sub eax, ebx
sub dword [ebp - 0xc], eax
cmp dword [ebp + 8], 0
je 0x4456d5
add dword [ebp - 0xc], 4
jmp 0x4456d9
add dword [ebp - 0xc], 2
mov edx, dword [ebp - 0xc]
inc edx
push edx
call fcn.0043b120
pop ecx
mov esi, eax
test ebx, ebx
jle 0x4456f8
push ebx
mov eax, dword [ebp - 0x10]
push eax
push esi
call fcn.004ab480
add esp, 0xc
mov byte [esi + ebx], 0
mov ebx, dword [ebp - 0xc]
push ebx
push 0x5394f7
push esi
call fcn.004a90e4
add esp, 0xc
cmp dword [ebp + 8], 0
je 0x445723
push ebx
push 0x5394f7
push esi
call fcn.004a90e4
add esp, 0xc
mov eax, dword [ebp - 0x10]
push eax
call fcn.004ab624
pop ecx
cmp eax, edi
jle 0x44573f
push ebx
add edi, dword [ebp - 0x10]
push edi
push esi
call fcn.004a90e4
add esp, 0xc
push 0
push 4
call fcn.004477f8
add esp, 8
mov edx, dword [ebp - 0x10]
push edx
call fcn.0043b208
pop ecx
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x4c], esi
push 1
push 4
call fcn.004477f8
add esp, 8
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4477f8
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov eax, dword [0x54d750]
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov eax, dword [eax + 0xc0]
test eax, eax
je 0x44782e
mov ebx, dword [eax]
test ebx, ebx
je 0x44782e
push edi
push esi
call dword [ebx + 4]
add esp, 8
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x44781f
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4489fc
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
add eax, 0xa0
mov edx, dword [ebp + 8]
cmp edx, 0x75
ja case.0x448a21.0
mov dl, byte [edx + 0x448a28]
jmp dword [edx*4 + 0x448a9e]
mov eax, dword [eax + 0x28]
pop ebp
ret
mov eax, dword [eax + 0x40]
pop ebp
ret
mov eax, dword [eax + 0x4c]
pop ebp
ret
mov eax, dword [eax + 0x110]
pop ebp
ret
mov eax, dword [eax + 0x58]
pop ebp
ret
mov eax, dword [eax + 0x60]
pop ebp
ret
mov eax, dword [eax + 0x68]
pop ebp
ret
mov eax, dword [eax + 0x8c]
pop ebp
ret
mov eax, dword [eax + 0xa0]
pop ebp
ret
mov eax, dword [eax + 0xb4]
pop ebp
ret
mov eax, dword [eax + 0xc0]
pop ebp
ret
mov eax, dword [eax + 0x100]
pop ebp
ret
mov eax, dword [eax + 0x108]
pop ebp
ret
mov eax, dword [eax + 0x10c]
pop ebp
ret
cmp dword [eax + 0x18], 0
je 0x448b59
mov ecx, dword [eax + 0x18]
mov eax, dword [ecx]
jmp 0x448b95
xor eax, eax
pop ebp
ret
cmp dword [eax + 0x1c], 0
je 0x448b6a
mov edx, dword [eax + 0x1c]
mov ecx, dword [edx]
jmp 0x448b6c
xor ecx, ecx
mov eax, ecx
pop ebp
ret
call fcn.0046bd54
pop ebp
ret
call fcn.004528a8
pop ebp
ret
push 0
push 1
push 0
push 0x7e4
push 1
call fcn.00456f18
add esp, 0x14
xor eax, eax
pop ebp
ret

Function at 0x448b98
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
add eax, 0xa0
mov edx, dword [ebp + 8]
cmp edx, 0x75
ja case.0x448bbd.0
mov dl, byte [edx + 0x448bc4]
jmp dword [edx*4 + 0x448c3a]
mov eax, dword [eax + 0x30]
pop ebp
ret
mov eax, dword [eax + 0x34]
pop ebp
ret
mov eax, dword [eax + 0x54]
pop ebp
ret
mov eax, dword [eax + 0x70]
pop ebp
ret
mov eax, dword [eax + 0x78]
pop ebp
ret
mov eax, dword [eax + 0xa4]
pop ebp
ret
mov eax, dword [eax + 0xa8]
pop ebp
ret
mov eax, dword [eax + 0xb0]
pop ebp
ret
mov eax, dword [eax + 0xd4]
pop ebp
ret
mov eax, dword [eax + 0xdc]
pop ebp
ret
mov eax, dword [eax + 0xe0]
pop ebp
ret
mov eax, dword [eax + 0xe4]
pop ebp
ret
mov eax, dword [eax + 0xe8]
pop ebp
ret
mov eax, dword [eax + 0xf0]
pop ebp
ret
push 0
push 1
push 0
push 0x7e4
push 1
call fcn.00456f18
add esp, 0x14
xor eax, eax
pop ebp
ret

Function at 0x449250
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
add eax, 0xa0
cmp dword [eax + 0x1c], 0
je 0x44926d
mov edx, dword [eax + 0x1c]
mov ecx, dword [edx]
jmp 0x44926f
xor ecx, ecx
mov eax, ecx
ret
Function at 0x4492b8
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov ebx, dword [ebp + 0x10]
call fcn.0042557c
test eax, eax
je 0x449357
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov esi, dword [eax + 0xb8]
test esi, esi
je 0x449357
call fcn.004255a0
mov edi, eax
test edi, edi
je 0x449357
cmp esi, edi
je 0x449357
xor eax, eax
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 0
jne 0x449313
lea edx, [ebp + 8]
mov dword [ebp + 0xc], edx
mov ecx, dword [ebp + 8]
push ecx
call fcn.004ab624
pop ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
test ebx, ebx
mov edx, dword [eax]
mov dword [ebp - 8], edx
jne 0x449324
lea ebx, [ebp - 4]
jmp 0x44932e
mov eax, dword [ebx]
test eax, eax
jbe 0x44932e
dec eax
mov dword [ebp - 4], eax
push esi
push edi
push ebx
lea ecx, [ebp - 4]
mov edx, dword [ebp + 0xc]
push edx
push ecx
mov eax, dword [ebp - 8]
push eax
mov edx, dword [ebp + 8]
push edx
call fcn.004ab624
pop ecx
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.004511d8
add esp, 0x20
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x449364
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov ebx, dword [ebp + 0x10]
call fcn.0042557c
test eax, eax
je 0x449403
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov esi, dword [eax + 0xb8]
test esi, esi
je 0x449403
call fcn.004255a0
mov edi, eax
test edi, edi
je 0x449403
cmp esi, edi
je 0x449403
xor eax, eax
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 0
jne 0x4493bf
lea edx, [ebp + 8]
mov dword [ebp + 0xc], edx
mov ecx, dword [ebp + 8]
push ecx
call fcn.004ab624
pop ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
test ebx, ebx
mov edx, dword [eax]
mov dword [ebp - 8], edx
jne 0x4493d0
lea ebx, [ebp - 4]
jmp 0x4493da
mov eax, dword [ebx]
test eax, eax
jbe 0x4493da
dec eax
mov dword [ebp - 4], eax
push edi
push esi
push ebx
lea ecx, [ebp - 4]
mov edx, dword [ebp + 0xc]
push edx
push ecx
mov eax, dword [ebp - 8]
push eax
mov edx, dword [ebp + 8]
push edx
call fcn.004ab624
pop ecx
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.004511d8
add esp, 0x20
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x4494b0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
call fcn.0042557c
test eax, eax
je 0x4494f0
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov ebx, dword [eax + 0xb8]
test ebx, ebx
je 0x4494f0
call fcn.004255a0
test eax, eax
je 0x4494f0
cmp ebx, eax
je 0x4494f0
push eax
push ebx
push esi
call fcn.004512f8
add esp, 0xc
jmp 0x4494f7
push esi
call fcn.004a8574
pop ecx
pop esi
pop ebx
pop ebp
ret
Function at 0x449734
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov ebx, eax
add ebx, 0xa0
mov eax, dword [ebp + 8]
sub eax, 1
jb 0x449779
je 0x449764
dec eax
jne 0x449773
cmp dword [ebx + 4], 0
jne 0x449779
or eax, 0xffffffff
pop ebx
pop ebp
ret
cmp dword [ebx + 0xbc], 0
jne 0x449779
or eax, 0xffffffff
pop ebx
pop ebp
ret
or eax, 0xffffffff
pop ebx
pop ebp
ret
cmp dword [ebx + 0x10], 0xffffffff
jne 0x44979c
cmp dword [ebx + 0xc0], 0
je 0x44979c
push 0x18
push 0
mov edx, dword [ebx + 0xc0]
push edx
push ebx
call fcn.00445388
add esp, 0x10
mov eax, dword [ebx + 0x10]
pop ebx
pop ebp
ret

Function at 0x449d98
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
call fcn.00449d34
mov ebx, eax
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
test eax, eax
je 0x449e88
call fcn.004528a8
mov dword [ebx], eax
call fcn.0046bd54
mov dword [ebx + 4], eax
call fcn.004255f0
push eax
call fcn.00462920
pop ecx
mov dword [ebx + 0x10], eax
call fcn.00432fac
mov edx, dword [eax]
mov dword [ebx + 8], edx
mov ecx, dword [0x54d750]
push ecx
call sub.KERNEL32.DLL_TlsGetValue
add eax, 0xa0
push eax
call fcn.004475f8
pop ecx
mov dword [ebx + 0xc], eax
test esi, 3
je 0x449e45
xor eax, eax
test esi, 1
mov dword [ebp - 4], eax
je 0x449e1d
or dword [ebp - 4], 1
test esi, 2
je 0x449e29
or dword [ebp - 4], 6
test esi, 4
setne dl
and edx, 1
push edx
mov ecx, dword [ebp - 4]
push ecx
call fcn.00444288
add esp, 8
mov dword [ebx + 0x30], eax
test edi, edi
je 0x449e85
push edi
call fcn.00429b78
pop ecx
test eax, eax
jbe 0x449e85
push edi
call fcn.00429b78
pop ecx
mov dword [ebp - 8], eax
mov esi, 1
cmp esi, dword [ebp - 8]
ja 0x449e85
push esi
push edi
call fcn.00429f58
add esp, 8
test byte [eax + 1], 0x20
je 0x449e7f
push eax
call fcn.004437d8
pop ecx
inc esi
cmp esi, dword [ebp - 8]
jbe 0x449e68
mov dword [ebx + 0x2c], edi
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x458440
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
add esp, 0xfffffdf0
xor ebx, ebx
mov word [esp], 0
push esp
push 0x108
call sub.KERNEL32.DLL_GetCurrentDirectoryW
mov esi, eax
push 0
test esi, esi
setne al
and eax, 1
push eax
call fcn.0045a680
add esp, 8
cmp esi, 2
jb 0x4584ab
cmp word [esp + 2], 0x3a
jne 0x4584ab
mov ax, word [esp]
cmp ax, 0x61
jb 0x458496
cmp ax, 0x7a
ja 0x458496
movzx ebx, word [esp]
add ebx, 0xffffffe0
jmp 0x45849a
movzx ebx, word [esp]
cmp ebx, 0x41
jl 0x4584a9
cmp ebx, 0x5a
jg 0x4584a9
sub ebx, 0x41
jmp 0x4584ab
xor ebx, ebx
mov eax, ebx
add esp, 0x210
pop esi
pop ebx
ret

Function at 0x4584b8
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov eax, dword [ebp + 8]
test eax, eax
jl 0x45850b
cmp eax, 0x19
jg 0x45850b
add ax, 0x41
mov word [ebp - 8], ax
mov word [ebp - 6], 0x3a
mov word [ebp - 4], 0
push 1
call sub.KERNEL32.DLL_SetErrorMode
mov esi, eax
lea eax, [ebp - 8]
push eax
call sub.KERNEL32.DLL_SetCurrentDirectoryW
test eax, eax
push esi
setne bl
and ebx, 1
call sub.KERNEL32.DLL_SetErrorMode
push 0
push ebx
call fcn.0045a680
add esp, 8
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x458b88
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
call fcn.0041aa48
mov eax, dword [ebp + 0xc]
xor edx, edx
mov dword [eax], edx
xor ebx, ebx
mov eax, dword [ebp + 8]
push eax
call fcn.0045a214
pop ecx
mov esi, eax
push eax
call sub.KERNEL32.DLL_GetFileAttributesW
mov edi, eax
cmp edi, 0xffffffff
je 0x458bc6
push edi
call fcn.004a5c1c
pop ecx
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov ebx, 1
push 0
push ebx
call fcn.0045a680
add esp, 8
test esi, esi
je 0x458bdc
push esi
call fcn.0043b208
pop ecx
call fcn.0041aab8
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret