joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41cac0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4a140d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
mov eax, dword [0x4da0cc]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [esp + 0x10], eax
test eax, eax
jne 0x41cafb
mov dword [esp + 0x10], 0x4d79e4
mov ecx, dword [0x4da0cc]
push 0x4d79e4
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, 0x4da0d0
mov dword [esp + 0x24], 0
call fcn.00434680
mov dl, byte [eax]
mov byte [esp + 0x14], dl
mov al, byte [eax + 1]
mov byte [esp + 0x15], al
mov eax, 0x4da0d0
call fcn.00434680
xor ebx, ebx
cmp byte [esp + 0x15], bl
mov eax, 0x4da0d0
setne bl
call fcn.00434680
mov byte [eax + 1], bl
mov eax, 0x4da0d0
call fcn.00434680
mov ebx, 1
mov byte [eax], bl
push 0xc
mov dword [esp + 0x28], ebx
call fcn.00445fb4
add esp, 4
test eax, eax
jne 0x41cb74
call fcn.0041cdf0
mov dword [esp + 0xc], eax
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
push ecx
mov ecx, dword [ebp + 8]
push edx
push eax
mov byte [esp + 0x30], 2
call fcn.0041c7a0
mov byte [esp + 0x24], bl
mov dword [esp + 8], eax
push 0x4caacc
lea eax, [esp + 0xc]
push eax
call fcn.00452eff
int3

Function at 0x41ced0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4a13e2
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov eax, dword [0x4da0cc]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [esp + 8], eax
test eax, eax
jne 0x41cf0b
mov dword [esp + 8], 0x4d79e4
mov ecx, dword [0x4da0cc]
push 0x4d79e4
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, 0x4da0d0
mov dword [esp + 0x1c], 0
call fcn.00434680
mov dl, byte [eax]
mov byte [esp + 0xc], dl
mov al, byte [eax + 1]
mov byte [esp + 0xd], al
mov eax, 0x4da0d0
call fcn.00434680
xor ebx, ebx
cmp byte [esp + 0xd], bl
mov eax, 0x4da0d0
setne bl
call fcn.00434680
mov byte [eax + 1], bl
mov eax, 0x4da0d0
call fcn.00434680
mov byte [eax], 1
push 4
mov dword [esp + 0x20], 1
call fcn.00445fb4
add esp, 4
test eax, eax
jne 0x41cf84
call fcn.0041cdf0
push 0x4cab4c
lea ecx, [esp + 8]
mov dword [eax], vtable.FObj::CUserException.0
push ecx
mov dword [esp + 0xc], eax
call fcn.00452eff
int3
Function at 0x41d410
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4a13ba
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
call fcn.0041dba0
cmp eax, 2
jne 0x41d447
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x41d44d
jmp 0x41d44c
cmp eax, 3
jne 0x41d44d
int3
mov eax, dword [0x4da0cc]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [esp + 0x10], eax
test eax, eax
jne 0x41d469
mov dword [esp + 0x10], 0x4d79e4
mov ecx, dword [0x4da0cc]
push 0x4d79e4
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, 0x4da0d0
mov dword [esp + 0x24], 0
call fcn.00434680
mov dl, byte [eax]
mov byte [esp + 0x14], dl
mov al, byte [eax + 1]
mov byte [esp + 0x15], al
mov eax, 0x4da0d0
call fcn.00434680
xor ebx, ebx
cmp byte [esp + 0x15], bl
mov eax, 0x4da0d0
setne bl
call fcn.00434680
mov byte [eax + 1], bl
mov eax, 0x4da0d0
call fcn.00434680
mov ebx, 1
mov byte [eax], bl
mov dword [esp + 0x24], ebx
cmp byte [0x4d746e], 0
je 0x41d4e8
mov eax, 0x4da0f8
call fcn.00434680
cmp byte [eax + 1], 0
je 0x41d567
mov ecx, dword [ebp + 0x1c]
mov edx, dword [ebp + 0x18]
mov eax, dword [ebp + 0x14]
push ecx
mov ecx, dword [ebp + 0x10]
push edx
mov edx, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push ecx
push edx
push eax
lea ecx, [esp + 0x24]
push ecx
call fcn.0041d010
add esp, 0x1c
lea edx, [esp + 0xc]
push edx
mov byte [esp + 0x28], 2
call fcn.0041cfa0
mov byte [esp + 0x28], bl
mov eax, dword [esp + 0x10]
add esp, 4
push eax
mov edi, eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x41d541
mov ebx, dword [edi + 8]
mov esi, 0x4da170
call fcn.00432310
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x28], 0xffffffff
call fcn.00434620
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
xor al, al
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
push 0x14
call fcn.00445fb4
add esp, 4
test eax, eax
jne 0x41d57a
call fcn.0041cdf0
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x18]
mov dword [eax + 4], ecx
mov ecx, dword [ebp + 8]
mov dword [eax + 8], edx
mov edx, dword [ebp + 0x1c]
mov dword [eax], vtable.FObj::CInternalError.0
mov dword [eax + 0xc], ecx
mov dword [eax + 0x10], edx
mov dword [esp + 0xc], eax
push 0x4cab8c
lea eax, [esp + 0x10]
push eax
call fcn.00452eff
int3
Function at 0x41d6b0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4a138d
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push esi
push edi
call fcn.0041dc20
cmp eax, 2
jne 0x41d6e7
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x41d6ed
jmp 0x41d6ec
cmp eax, 3
jne 0x41d6ed
int3
mov eax, dword [0x4da0cc]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
xor esi, esi
mov dword [esp + 0x18], eax
cmp eax, esi
jne 0x41d70b
mov dword [esp + 0x18], 0x4d79e4
mov ecx, dword [0x4da0cc]
push 0x4d79e4
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, 0x4da0d0
mov dword [esp + 0x2c], esi
call fcn.00434680
mov dl, byte [eax]
mov byte [esp + 0x1c], dl
mov al, byte [eax + 1]
mov byte [esp + 0x1d], al
mov eax, 0x4da0d0
call fcn.00434680
xor ebx, ebx
cmp byte [esp + 0x1d], bl
mov eax, 0x4da0d0
setne bl
call fcn.00434680
mov byte [eax + 1], bl
mov eax, 0x4da0d0
call fcn.00434680
mov ebx, 1
mov byte [eax], bl
lea ecx, [esp + 0x10]
push ecx
mov dword [esp + 0x30], ebx
push esi
mov dword [esp + 0x18], esi
call dword [sym.imp.OLEAUT32.dll_SetErrorInfo]
test eax, eax
je 0x41d785
mov dword [esp + 0x10], esi
cmp byte [0x4d746e], 0
je 0x41d79e
mov eax, 0x4da0f8
call fcn.00434680
cmp byte [eax + 1], 0
je 0x41d816
mov edx, dword [esp + 0x10]
mov ecx, dword [ebp + 8]
push edx
lea eax, [esp + 0x18]
push eax
call fcn.0041c8a0
push eax
mov byte [esp + 0x38], 2
call fcn.0041cfa0
mov byte [esp + 0x38], bl
mov eax, dword [esp + 0x20]
add esp, 0xc
push eax
mov edi, eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x41d7e2
mov ebx, dword [edi + 8]
mov esi, 0x4da170
call fcn.00432310
xor esi, esi
mov eax, dword [esp + 0x10]
cmp eax, esi
je 0x41d7f2
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x30], 0xffffffff
call fcn.00434620
mov ecx, dword [esp + 0x24]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
push 0xc
call fcn.00445fb4
add esp, 4
cmp eax, esi
jne 0x41d829
call fcn.0041cdf0
mov ecx, dword [esp + 0x10]
mov edx, dword [ebp + 8]
mov dword [eax], vtable.FObj::CCOMException.0
mov dword [eax + 4], edx
mov dword [eax + 8], ecx
mov byte [esp + 0x2c], bl
mov dword [esp + 0x14], eax
push 0x4caacc
lea eax, [esp + 0x18]
push eax
call fcn.00452eff
int3
Function at 0x41e490
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4a140d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
mov eax, dword [0x4da0cc]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [esp + 0x10], eax
test eax, eax
jne 0x41e4cb
mov dword [esp + 0x10], 0x4d79e4
mov ecx, dword [0x4da0cc]
push 0x4d79e4
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, 0x4da0d0
mov dword [esp + 0x24], 0
call fcn.00434680
mov dl, byte [eax]
mov byte [esp + 0x14], dl
mov al, byte [eax + 1]
mov byte [esp + 0x15], al
mov eax, 0x4da0d0
call fcn.00434680
xor ebx, ebx
cmp byte [esp + 0x15], bl
mov eax, 0x4da0d0
setne bl
call fcn.00434680
mov byte [eax + 1], bl
mov eax, 0x4da0d0
call fcn.00434680
mov ebx, 1
mov byte [eax], bl
push 0x10
mov dword [esp + 0x28], ebx
call fcn.00445fb4
add esp, 4
test eax, eax
jne 0x41e544
call fcn.0041cdf0
mov dword [esp + 0xc], eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp + 0xc]
push eax
mov byte [esp + 0x2c], 2
call fcn.0041deb0
push 0x4cac4c
lea edx, [esp + 0xc]
mov byte [esp + 0x28], bl
push edx
mov dword [esp + 0x10], eax
call fcn.00452eff
int3

Function at 0x41e580
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [ebp + 8]
push eax
call fcn.00445fb4
add esp, 4
test eax, eax
jne 0x41e59b
jmp fcn.0041cdf0
mov esp, ebp
pop ebp
ret

Function at 0x41fa40
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 8
cmp dword [esi + 4], 2
jne 0x41fa6f
push 0
push 0xff
push str.d:_build10_fineobjects_src_registrykey.cpp
push 0x4b84f0
push 0x4b84f0
push 0
call fcn.0041d410
add esp, 0x18
test edi, edi
jne 0x41fa91
push edi
push 0x100
push str.d:_build10_fineobjects_src_registrykey.cpp
push 0x4b84f0
push 0x4b84f0
push edi
call fcn.0041d410
add esp, 0x18
mov eax, dword [esi]
test eax, eax
je 0x41faf6
push 0
push 0
lea ecx, [esp + 0xc]
push ecx
push 0
push edi
push eax
mov dword [esp + 0x1c], 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x41fabd
cmp eax, 0xea
jne 0x41fac5
mov eax, dword [esp + 4]
mov esp, ebp
pop ebp
ret
cmp eax, 2
jb 0x41fad6
cmp eax, 3
jbe 0x41faf6
cmp eax, 0x3fa
je 0x41faf6
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 8
jne 0x41faed
call fcn.0041cdf0
push eax
call fcn.0041d5b0
add esp, 4
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x41fb00
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push esi
mov esi, eax
cmp dword [esi + 4], 2
jne 0x41fb2a
push 0
push 0x12b
push str.d:_build10_fineobjects_src_registrykey.cpp
push 0x4b84f0
push 0x4b84f0
push 0
call fcn.0041d410
add esp, 0x18
test ebx, ebx
jne 0x41fb4c
push ebx
push 0x12c
push str.d:_build10_fineobjects_src_registrykey.cpp
push 0x4b84f0
push 0x4b84f0
push ebx
call fcn.0041d410
add esp, 0x18
test edi, edi
jne 0x41fb6e
push edi
push 0x12e
push str.d:_build10_fineobjects_src_registrykey.cpp
push 0x4b84f0
push 0x4b84f0
push edi
call fcn.0041d410
add esp, 0x18
mov eax, dword [esi]
test eax, eax
jne 0x41fb81
push 6
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop esi
pop ecx
ret
lea ecx, [esp + 4]
push ecx
push edi
push 0
push 0
push ebx
push eax
mov dword [esp + 0x1c], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
neg esi
sbb esi, esi
not esi
and esi, dword [esp + 4]
mov eax, esi
pop esi
pop ecx
ret
Function at 0x41fe40
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x4a1568
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov ebx, edx
test edi, edi
je 0x41fe6b
cmp dword [esp + 0x30], 0
jne 0x41fe8b
push 0
push 0x16c
push str.d:_build10_fineobjects_src_registrykey.cpp
push 0x4b84f0
push 0x4b84f0
push 0
call fcn.0041d410
add esp, 0x18
cmp dword [ebx + 4], 1
je 0x41feb1
push 0
push 0x16d
push str.d:_build10_fineobjects_src_registrykey.cpp
push 0x4b84f0
push 0x4b84f0
push 0
call fcn.0041d410
add esp, 0x18
mov eax, dword [ebx + 0xc]
mov ecx, dword [ebx]
lea ebp, [ebx + 0xc]
add eax, 0xc
test ecx, ecx
jne 0x41fed8
push 0x4b84f0
push 0x4b84f0
push eax
push 0x4d7a24
call fcn.0041d860
add esp, 0x10
mov eax, edi
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x41fee0
sub eax, edx
sar eax, 1
push edi
lea ecx, [esp + 0x18]
push ecx
mov esi, eax
call fcn.00419c10
push 0x5c
lea edx, [esp + 0x20]
push ebp
push edx
mov dword [esp + 0x34], 0
call fcn.00402380
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
push eax
lea edx, [esp + 0x20]
push edx
mov byte [esp + 0x34], 1
call fcn.00402410
add esp, 0xc
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x30]
push ecx
push edx
push 1
mov byte [esp + 0x34], 2
mov esi, dword [eax]
mov eax, dword [ebx]
push 0
push edi
push eax
add esi, 0xc
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
sete al
test al, al
jne 0x41ff6f
push 0x4b84f0
push 0x4b84f0
push esi
push 0x4d7a24
call fcn.0041d860
add esp, 0x10
mov byte [esp + 0x28], 1
mov edi, dword [esp + 0x18]
mov ebp, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
push edi
call ebp
test eax, eax
jg 0x41ff92
mov ebx, dword [edi + 8]
mov esi, 0x4da170
call fcn.00432310
mov byte [esp + 0x28], 0
mov edi, dword [esp + 0x1c]
push edi
call ebp
test eax, eax
jg 0x41ffaf
mov ebx, dword [edi + 8]
mov esi, 0x4da170
call fcn.00432310
mov dword [esp + 0x28], 0xffffffff
mov edi, dword [esp + 0x14]
push edi
call ebp
test eax, eax
jg 0x41ffcf
mov ebx, dword [edi + 8]
mov esi, 0x4da170
call fcn.00432310
mov ecx, dword [esp + 0x20]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x1c
ret 8
Function at 0x420050
Capabilities:
Query or enumerate registry key

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4a1dc6
push eax
mov dword fs:[0], esp
sub esp, 0x238
push ebx
mov ebx, dword [esp + 0x24c]
cmp dword [ebx + 4], 2
push ebp
push esi
push edi
jne 0x42009c
push 0
push 0x17d
push str.d:_build10_fineobjects_src_registrykey.cpp
push 0x4b84f0
push 0x4b84f0
push 0
call fcn.0041d410
add esp, 0x18
mov ecx, dword [esp + 0x25c]
call fcn.00402190
xor ecx, ecx
cmp dword [ebx], ecx
jne 0x4200bb
push 6
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x420238
mov eax, 0x100
lea edx, [esp + 0x34]
mov dword [esp + 0x23c], eax
mov dword [esp + 0x234], edx
mov dword [esp + 0x250], ecx
mov ebp, eax
mov dword [esp + 0x10], ecx
mov dword [esp + 0x238], eax
mov ecx, dword [ebx]
push 0
push 0
push 0
neg eax
push 0
sbb eax, eax
and eax, dword [esp + 0x244]
lea edx, [esp + 0x28]
push edx
push eax
mov eax, dword [esp + 0x28]
push eax
push ecx
mov dword [esp + 0x38], ebp
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov ecx, eax
sub ecx, 0
je 0x420177
sub ecx, 0xea
jne 0x420200
lea esi, [esp + 0x1c]
call fcn.00420470
test al, al
je 0x42020c
mov ebp, dword [esp + 0x20]
mov esi, dword [esp + 0x23c]
inc ebp
cmp ebp, esi
jle 0x420170
mov eax, esi
cdq
sub eax, edx
sar eax, 1
cmp eax, 0x100
mov ecx, eax
jg 0x42015a
mov ecx, 0x100
mov eax, ebp
sub eax, esi
cmp eax, ecx
jg 0x420164
mov eax, ecx
add esi, eax
push esi
lea esi, [esp + 0x38]
call fcn.00420570
mov eax, ebp
jmp 0x4200df
mov ecx, dword [esp + 0x238]
neg ecx
sbb ecx, ecx
and ecx, dword [esp + 0x234]
mov eax, ecx
lea esi, [eax + 2]
mov edi, edi
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x420190
sub eax, esi
push ecx
sar eax, 1
lea ecx, [esp + 0x18]
push ecx
mov esi, eax
call fcn.00419c10
mov ecx, dword [esp + 0x25c]
lea edx, [esp + 0x14]
push edx
mov byte [esp + 0x254], 1
call fcn.00401fa0
mov byte [esp + 0x250], 0
mov edi, dword [esp + 0x14]
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x4201e9
mov ebx, dword [edi + 8]
mov esi, 0x4da170
call fcn.00432310
inc dword [esp + 0x10]
mov eax, dword [esp + 0x238]
mov ebx, dword [esp + 0x258]
jmp 0x4200e6
sub ecx, 0x19
je 0x420255
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [esp + 0x250], 0xffffffff
mov eax, dword [esp + 0x234]
lea ecx, [esp + 0x34]
cmp eax, ecx
je 0x420238
test eax, eax
je 0x420238
mov ecx, dword [eax - 8]
mov edx, dword [ecx]
add eax, 0xfffffff8
push eax
mov eax, dword [edx + 8]
call eax
xor al, al
mov ecx, dword [esp + 0x248]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x244
ret 8
mov dword [esp + 0x250], 0xffffffff
mov eax, dword [esp + 0x234]
lea ecx, [esp + 0x34]
cmp eax, ecx
je 0x420281
test eax, eax
je 0x420281
mov ecx, dword [eax - 8]
mov edx, dword [ecx]
add eax, 0xfffffff8
push eax
mov eax, dword [edx + 8]
call eax
mov al, 1
jmp 0x42023a
Function at 0x420290
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4a1d98
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
mov ebx, dword [esp + 0x34]
cmp dword [ebx + 4], 2
push ebp
push esi
push edi
jne 0x4202d6
push 0
push 0x1aa
push str.d:_build10_fineobjects_src_registrykey.cpp
push 0x4b84f0
push 0x4b84f0
push 0
call fcn.0041d410
add esp, 0x18
mov edi, dword [esp + 0x44]
mov ecx, edi
call fcn.00402190
xor ebp, ebp
cmp dword [ebx], ebp
jne 0x4202f4
push 6
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x420423
lea esi, [esp + 0x18]
call fcn.00420470
test al, al
je 0x420423
mov ebx, dword [esp + 0x28]
mov eax, dword [esp + 0x24]
inc ebx
cmp eax, dword [edi + 8]
jle 0x42031b
push eax
mov ecx, edi
call fcn.00407f90
push 0x4d9f40
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov edi, 0x4d9f40
mov dword [esp + 0x10], edi
mov dword [esp + 0x38], ebp
lea eax, [ebx + ebx + 0xe]
mov dword [esp + 0x14], ebx
cmp dword [edi + 8], eax
jge 0x42036b
cmp eax, 0x80
jle 0x420372
mov edi, dword [edi + 4]
mov eax, 0x66666667
imul edi
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
add eax, edi
cmp ebx, eax
jle 0x420362
mov eax, ebx
lea ecx, [esp + 0x10]
push ecx
mov ecx, eax
jmp 0x420379
mov edx, dword [edi]
cmp edx, 1
je 0x42037e
lea eax, [esp + 0x10]
push eax
mov ecx, ebx
call fcn.00419f20
mov edi, dword [esp + 0x10]
mov edx, dword [esp + 0x40]
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
mov word [edi + ebx*2 + 0xc], cx
mov eax, dword [edx]
lea ecx, [esp + 0x24]
push ecx
lea esi, [edi + 0xc]
push esi
push ebp
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov ecx, esi
lea esi, [ecx + 2]
lea esp, [esp]
mov dx, word [ecx]
add ecx, 2
test dx, dx
jne 0x4203b0
sub ecx, esi
sar ecx, 1
mov dword [edi + 4], ecx
xor edx, edx
mov word [edi + ecx*2 + 0xc], dx
mov ecx, eax
sub ecx, edx
je 0x4203f2
sub ecx, 0xea
jne 0x420406
mov ebx, dword [esp + 0x40]
lea esi, [esp + 0x18]
call fcn.00420470
test al, al
je 0x420412
mov ebx, dword [esp + 0x28]
inc ebx
jmp 0x420333
mov ecx, dword [esp + 0x44]
lea eax, [esp + 0x10]
push eax
call fcn.00401fa0
inc ebp
jmp 0x420333
sub ecx, 0x19
je 0x42043a
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea ecx, [esp + 0x10]
mov dword [esp + 0x38], 0xffffffff
call fcn.004021e0
xor al, al
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret 8
lea ecx, [esp + 0x10]
mov dword [esp + 0x38], 0xffffffff
call fcn.004021e0
mov ecx, dword [esp + 0x30]
pop edi
pop esi
pop ebp
mov al, 1
mov dword fs:[0], ecx
pop ebx
add esp, 0x2c
ret 8
Function at 0x420570
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [esp + 4]
cmp eax, 0x100
jle 0x420609
push ebx
push ebp
mov ebp, dword [esi + 0x200]
push edi
lea edi, [eax + eax + 8]
mov eax, dword [0x4da0cc]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test eax, eax
jne 0x4205a3
mov ebx, 0x4d79e4
mov edx, dword [ebx]
mov eax, dword [edx + 4]
push edi
mov ecx, ebx
call eax
mov edi, eax
test edi, edi
jne 0x4205b8
call fcn.0041cdf0
add edi, 8
mov dword [edi - 8], ebx
jne 0x4205c5
call fcn.0041cdf0
mov eax, dword [esi + 0x204]
mov dword [esi + 0x200], edi
test eax, eax
jle 0x4205e3
lea ecx, [eax + eax]
push ecx
push ebp
push edi
call fcn.0044c0d0
add esp, 0xc
cmp ebp, esi
je 0x4205f9
test ebp, ebp
je 0x4205f9
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
lea eax, [ebp - 8]
push eax
mov eax, dword [edx + 8]
call eax
mov ecx, dword [esp + 0x10]
pop edi
pop ebp
mov dword [esi + 0x208], ecx
pop ebx
ret 4
mov ecx, dword [esi + 0x200]
cmp ecx, esi
je 0x420653
mov eax, dword [esi + 0x204]
test eax, eax
jle 0x42062b
lea edx, [eax + eax]
push edx
push ecx
push esi
call fcn.0044c0d0
add esp, 0xc
mov eax, dword [esi + 0x200]
test eax, eax
je 0x420643
mov ecx, dword [eax - 8]
mov edx, dword [ecx]
add eax, 0xfffffff8
push eax
mov eax, dword [edx + 8]
call eax
mov dword [esi + 0x200], esi
mov dword [esi + 0x208], 0x100
ret 4

Function at 0x4206f0
Capabilities:
Query environment variable

Disassembly:
push 0xffffffffffffffff
push 0x49ede1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
push edi
push 0
mov edi, ecx
push 0
mov dword [esp + 0x20], 0
mov ebx, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push edi
call ebx
mov esi, eax
push 0x4d9f40
test esi, esi
jne 0x420751
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov eax, dword [esp + 0x2c]
mov dword [eax], 0x4d9f40
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
mov ebp, dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
call ebp
mov dword [esp + 0x14], 0x4d9f40
push esi
push ecx
push esi
lea ecx, [esp + 0x20]
mov dword [esp + 0x30], 1
call fcn.00419ec0
add esp, 4
push eax
push edi
call ebx
mov edi, dword [esp + 0x14]
lea eax, [edi + 0xc]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x420786
sub eax, edx
mov edx, dword [esp + 0x2c]
sar eax, 1
mov dword [edi + 4], eax
xor ecx, ecx
mov word [edi + eax*2 + 0xc], cx
push edi
mov dword [edx], edi
call ebp
push edi
mov dword [esp + 0x1c], 1
mov byte [esp + 0x28], 0
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x4207cd
mov ebx, dword [edi + 8]
mov esi, 0x4da170
call fcn.00432310
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x2c]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x18
ret