joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41b170
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 0x214
mov ecx, dword [esp + 0x218]
mov eax, dword [esp + 0x21c]
fld dword [ecx + 0xc]
push ebp
fstp dword [esp + 8]
mov ebp, dword [eax]
push esi
mov esi, dword [esp + 0x238]
mov edx, dword [esi + 4]
cmp edx, 1
jle 0x41b2fe
push edi
mov edi, dword [esi]
fld dword [edi + 0xc]
fsub dword [edi + 4]
fld dword [esp + 0x10]
fcompp
fnstsw ax
test ah, 0x41
jne 0x41b2fd
lea eax, [esp + 0x20]
mov ecx, 0x80000040
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], ecx
fld dword [edi + 4]
xor edi, edi
fstp dword [esp + 0xc]
test edx, edx
jle 0x41b248
push ebx
jmp 0x41b1e9
mov ecx, dword [esp + 0x20]
mov edx, dword [esi]
fld dword [edx + edi*8 + 4]
lea ebx, [edx + edi*8]
fsub dword [esp + 0x10]
fld dword [esp + 0x14]
fcompp
fnstsw ax
test ah, 5
jnp 0x41b247
and ecx, 0x3fffffff
cmp dword [esp + 0x1c], ecx
jne 0x41b21e
lea eax, [esp + 0x18]
push 8
push eax
call fcn.00402730
add esp, 8
mov ecx, dword [ebx]
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
mov dword [edx + eax*8], ecx
mov ecx, dword [ebx + 4]
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
mov dword [eax + edx*8 + 4], ecx
add dword [esp + 0x1c], 1
add edi, 1
cmp edi, dword [esi + 4]
jl 0x41b1e5
pop ebx
mov edx, dword [esp + 0x238]
fld dword [esp + 0xc]
mov eax, dword [esp + 0x234]
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x234]
push edx
mov edx, dword [esp + 0x234]
push eax
mov eax, dword [esp + 0x230]
push ecx
push edx
push ecx
fstp dword [esp]
push eax
push ebp
call fcn.00417180
fld dword [esp + 0x2c]
mov eax, dword [esp + 0x34]
mov edx, dword [eax]
mov ecx, dword [esi]
mov dword [ecx], edx
mov eax, dword [eax + 4]
mov dword [ecx + 4], eax
mov ecx, dword [esi]
fstp dword [ecx + 4]
mov eax, dword [esi + 8]
and eax, 0x3fffffff
add esp, 0x20
cmp eax, 1
jge 0x41b2c4
add eax, eax
cmp eax, 1
jg 0x41b2b8
mov eax, 1
push 8
push eax
push esi
call fcn.004026b0
add esp, 0xc
mov eax, dword [esp + 0x1c]
test eax, eax
mov dword [esi + 4], 1
js 0x41b2fd
mov edx, dword [0x4c6060]
and eax, 0x3fffffff
push edx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edx, dword [esp + 0x14]
push 0x17
lea ecx, [esi*8]
push ecx
push edx
mov ecx, eax
call fcn.004023e0
pop edi
pop esi
pop ebp
add esp, 0x214
ret
Function at 0x41b310
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 0x1c
push ebx
mov ebx, dword [esp + 0x40]
mov eax, 1
cmp dword [ebx + 4], eax
jne 0x41b44e
push ebp
mov ebp, dword [esp + 0x48]
cmp dword [ebp + 4], eax
jne 0x41b44d
mov ecx, dword [esp + 0x38]
mov eax, dword [ecx + 8]
test eax, eax
push edi
mov edi, dword [ecx]
je 0x41b359
mov dx, word [esp + 0x38]
cmp dx, 0xffff
je 0x41b359
mov eax, dword [eax + 4]
cmp word [eax], dx
jne 0x41b359
mov edi, dword [ecx + 4]
mov edx, dword [ebx]
mov ecx, dword [ebp]
fld dword [edx + 4]
fsub dword [ecx + 4]
push esi
mov esi, dword [esp + 0x30]
fstp dword [esp + 0x4c]
fld dword [esp + 0x4c]
fabs
fstp dword [esp + 0x4c]
fld dword [esp + 0x4c]
fld dword [esi + 0xc]
fcompp
fnstsw ax
test ah, 0x41
jne 0x41b44b
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], reloc.WSOCK32.dll_bind
lea eax, [esp + 0x1c]
mov dword [esp + 0x10], eax
fld dword [ecx + 4]
mov eax, dword [edx]
fstp dword [esp + 0x4c]
fld dword [esp + 0x4c]
mov dword [esp + 0x1c], eax
mov edx, dword [edx + 4]
mov dword [esp + 0x20], edx
mov dword [esp + 0x14], 1
mov eax, dword [ecx]
mov dword [esp + 0x24], eax
mov ecx, dword [ecx + 4]
mov eax, dword [esp + 0x48]
lea edx, [esp + 0x10]
push edx
mov edx, dword [esp + 0x3c]
push eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x30], ecx
mov ecx, dword [esp + 0x4c]
push ecx
push edi
push edx
push ecx
fstp dword [esp]
push esi
push eax
mov dword [esp + 0x34], 2
call fcn.00417180
mov ecx, dword [esp + 0x30]
mov eax, dword [ebx]
mov edx, dword [ecx]
add esp, 0x20
cmp edx, dword [eax]
je 0x41b40e
mov eax, dword [ebp]
fld dword [eax + 4]
fmul qword [0x4b2f68]
fstp dword [eax + 4]
mov eax, dword [esp + 0x18]
test eax, eax
js 0x41b44b
and eax, 0x3fffffff
mov esi, eax
mov eax, dword [0x4c6060]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edx, dword [esp + 0x10]
push 0x17
lea ecx, [esi*8]
push ecx
push edx
mov ecx, eax
call fcn.004023e0
pop esi
pop edi
pop ebp
pop ebx
add esp, 0x1c
ret
Function at 0x41b460
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 0x20c
mov eax, dword [esp + 0x214]
mov edx, dword [esp + 0x218]
push ebx
mov ebx, dword [eax + 4]
push ebp
push esi
lea ecx, [esp + 0x18]
mov eax, 1
push edi
mov dword [esp + 0x10], ecx
mov dword [esp + 0x18], 0x80000080
mov dword [esp + 0x1c], edx
mov dword [esp + 0x14], eax
jmp 0x41b4a0
mov ecx, dword [esp + 0x10]
mov ebp, dword [ecx + eax*4 - 4]
sub eax, 1
mov dword [esp + 0x14], eax
mov eax, ebp
movzx edx, word [eax + 4]
lea eax, [ebx + edx*8]
movzx edx, word [eax + 6]
mov ecx, edx
sub ecx, 1
je 0x41b4d1
sub ecx, 1
je 0x41b59e
sub ecx, 1
jne 0x41b4de
cmp edx, dword [esp + 0x22c]
jne 0x41b5b1
mov cx, word [esp + 0x22c]
mov word [eax + 6], cx
cmp eax, ebp
jne 0x41b4b1
mov eax, dword [esp + 0x14]
mov esi, ebp
jmp 0x41b500
movzx edx, word [esi + 4]
movzx ecx, word [ebx + edx*8 + 2]
cmp word [ebx + ecx*8 + 6], 0
lea esi, [ebx + edx*8]
lea edi, [ebx + ecx*8]
jne 0x41b54a
mov edx, dword [esp + 0x18]
and edx, 0x3fffffff
cmp eax, edx
jne 0x41b538
lea eax, [esp + 0x10]
push 4
push eax
call fcn.00402730
mov eax, dword [esp + 0x1c]
add esp, 8
mov ecx, dword [esp + 0x10]
mov dword [ecx + eax*4], edi
mov eax, dword [esp + 0x14]
add eax, 1
mov dword [esp + 0x14], eax
cmp esi, ebp
jne 0x41b500
test eax, eax
jne 0x41b4a0
mov eax, dword [esp + 0x18]
test eax, eax
mov edi, dword [esp + 0x220]
mov byte [edi], 1
js 0x41b591
and eax, 0x3fffffff
mov esi, eax
mov eax, dword [0x4c6060]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edx, dword [esp + 0x10]
push 0x17
lea ecx, [esi*4]
push ecx
push edx
mov ecx, eax
call fcn.004023e0
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20c
ret
cmp dword [esp + 0x22c], 3
je 0x41b4ea
jmp 0x41b4de
mov eax, dword [esp + 0x18]
test eax, eax
mov edi, dword [esp + 0x220]
mov byte [edi], 0
js 0x41b591
mov edx, dword [0x4c6060]
and eax, 0x3fffffff
mov esi, eax
push edx
jmp 0x41b575
Function at 0x41d530
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 8]
mov ebx, eax
push edi
mov edi, dword [esp + 0x10]
and ebx, 0x3fffffff
cmp ebx, dword [edi + 4]
jge 0x41d59d
test eax, eax
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
js 0x41d570
mov eax, dword [0x4c6060]
push eax
call ebp
mov edx, dword [esi]
push 0x17
lea ecx, [ebx*8]
push ecx
push edx
mov ecx, eax
call fcn.004023e0
mov eax, dword [0x4c6060]
push eax
call ebp
mov ecx, dword [edi + 4]
add ecx, ecx
add ecx, ecx
add ecx, ecx
push 0x17
push ecx
mov ecx, eax
call fcn.00402380
mov edx, dword [esi + 8]
and edx, 0x40000000
mov dword [esi], eax
or edx, dword [edi + 4]
pop ebp
mov dword [esi + 8], edx
mov edx, dword [edi + 4]
test edx, edx
mov eax, dword [esi]
mov dword [esi + 4], edx
mov ecx, dword [edi]
jle 0x41d5c4
sub ecx, eax
lea ecx, [ecx]
mov edi, dword [ecx + eax]
mov dword [eax], edi
mov edi, dword [ecx + eax + 4]
mov dword [eax + 4], edi
add eax, 8
sub edx, 1
jne 0x41d5b0
pop edi
mov eax, esi
pop esi
pop ebx
ret 4
Function at 0x423f40
Capabilities:
Get thread local storage value

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
mov esi, ecx
mov eax, dword [esi + 0x18]
test eax, eax
push edi
js 0x423f76
and eax, 0x3fffffff
mov edi, eax
mov eax, dword [0x4c6060]
push eax
call ebx
mov edx, dword [esi + 0x10]
push 0x17
lea ecx, [edi*8]
push ecx
push edx
mov ecx, eax
call fcn.004023e0
mov eax, dword [esi + 0xc]
test eax, eax
js 0x423fa1
and eax, 0x3fffffff
mov edi, eax
mov eax, dword [0x4c6060]
push eax
call ebx
mov edx, dword [esi + 4]
push 0x17
lea ecx, [edi*8]
push ecx
push edx
mov ecx, eax
call fcn.004023e0
pop edi
pop esi
pop ebx
ret
Function at 0x4257c0
Capabilities:
Get thread local storage value

Disassembly:
push ecx
fld dword [esp + 0x10]
push ebx
mov ebx, dword [esp + 0x10]
push ebp
xor ebp, ebp
push esi
mov esi, ecx
fstp dword [esi + 0x10]
mov word [esi + 6], 1
mov dword [esi + 8], ebp
mov dword [esi + 0xc], 7
mov dword [esi], vtable.hkpConvexVerticesShape.0
mov dword [esi + 0x40], ebp
mov dword [esi + 0x44], ebp
mov ecx, bind
mov dword [esi + 0x48], ecx
mov dword [esi + 0x50], ebp
mov dword [esi + 0x54], ebp
mov dword [esi + 0x58], ecx
mov dword [esi + 0x5c], ebp
mov eax, dword [esi + 0x58]
push edi
mov edi, eax
and edi, 0x3fffffff
cmp edi, dword [ebx + 4]
jge 0x425864
test ecx, eax
jne 0x425835
mov eax, dword [0x4c6060]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [esi + 0x50]
push 0x17
shl edi, 4
push edi
push ecx
mov ecx, eax
call fcn.004023e0
mov edx, dword [0x4c6060]
push edx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [ebx + 4]
shl ecx, 4
push 0x17
push ecx
mov ecx, eax
call fcn.00402380
mov edx, dword [esi + 0x58]
and edx, 0x40000000
mov dword [esi + 0x50], eax
or edx, dword [ebx + 4]
mov dword [esi + 0x58], edx
mov edi, dword [ebx + 4]
cmp edi, 4
mov edx, dword [esi + 0x50]
mov dword [esi + 0x54], edi
mov ebx, dword [ebx]
mov dword [esp + 0x10], edx
jl 0x425916
lea eax, [edx + 0x14]
mov ebp, ebx
sub ebp, edx
lea edx, [edi - 4]
shr edx, 2
mov dword [esp + 0x20], ebp
add edx, 1
lea ebp, [edx*4]
mov dword [esp + 0x1c], ebp
mov ebp, dword [esp + 0x20]
lea ecx, [ebx + 0x1c]
fld dword [ecx - 0x1c]
add ecx, 0x40
fstp dword [eax - 0x14]
add eax, 0x40
sub edx, 1
fld dword [ecx - 0x58]
fstp dword [eax - 0x50]
fld dword [ecx - 0x54]
fstp dword [eax - 0x4c]
fld dword [ecx - 0x50]
fstp dword [eax - 0x48]
fld dword [ecx - 0x4c]
fstp dword [eax - 0x44]
fld dword [eax + ebp - 0x40]
fstp dword [eax - 0x40]
fld dword [ecx - 0x44]
fstp dword [eax - 0x3c]
fld dword [ecx - 0x40]
fstp dword [eax - 0x38]
fld dword [ecx - 0x3c]
fstp dword [eax - 0x34]
fld dword [ecx - 0x38]
fstp dword [eax - 0x30]
fld dword [ecx - 0x34]
fstp dword [eax - 0x2c]
fld dword [ecx - 0x30]
fstp dword [eax - 0x28]
fld dword [ecx - 0x2c]
fstp dword [eax - 0x24]
fld dword [ecx - 0x28]
fstp dword [eax - 0x20]
fld dword [ecx - 0x24]
fstp dword [eax - 0x1c]
fld dword [ecx - 0x20]
fstp dword [eax - 0x18]
jne 0x4258a2
mov ebp, dword [esp + 0x1c]
mov edx, dword [esp + 0x10]
cmp ebp, edi
jge 0x425954
mov eax, ebp
shl eax, 4
lea ecx, [eax + ebx + 0xc]
sub ebx, edx
lea eax, [eax + edx + 4]
sub edi, ebp
jmp 0x425930
fld dword [ecx - 0xc]
add ecx, 0x10
fstp dword [eax - 4]
add eax, 0x10
sub edi, 1
fld dword [ebx + eax - 0x10]
fstp dword [eax - 0x10]
fld dword [ecx - 0x14]
fstp dword [eax - 0xc]
fld dword [ecx - 0x10]
fstp dword [eax - 8]
jne 0x425930
mov eax, dword [esp + 0x18]
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
mov eax, dword [eax]
push ecx
push edx
push eax
mov ecx, esi
call fcn.00425130
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc
Function at 0x425a80
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
mov ecx, dword [esi + 0x5c]
test ecx, ecx
push edi
mov dword [esi], vtable.hkpConvexVerticesShape.0
je 0x425aaf
cmp word [ecx + 4], 0
je 0x425aaf
add word [ecx + 6], 0xffff
movzx eax, word [ecx + 6]
test ax, ax
jne 0x425aaf
mov eax, dword [ecx]
mov edx, dword [eax]
push 1
call edx
mov eax, dword [esi + 0x58]
test eax, eax
mov ebx, dword [sym.imp.KERNEL32.dll_TlsGetValue]
js 0x425adc
and eax, 0x3fffffff
mov edi, eax
mov eax, dword [0x4c6060]
push eax
call ebx
mov ecx, dword [esi + 0x50]
push 0x17
shl edi, 4
push edi
push ecx
mov ecx, eax
call fcn.004023e0
mov eax, dword [esi + 0x48]
test eax, eax
js 0x425b07
mov edx, dword [0x4c6060]
and eax, 0x3fffffff
push edx
mov edi, eax
call ebx
mov edx, dword [esi + 0x40]
push 0x17
lea ecx, [edi + edi*2]
shl ecx, 4
push ecx
push edx
mov ecx, eax
call fcn.004023e0
pop edi
mov dword [esi], vtable.hkBaseObject.0
pop esi
pop ebx
ret
Function at 0x4286a0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x4c4
push ebx
push esi
push edi
mov ecx, dword [ebp + 0x10]
mov ebx, dword [ebp + 0x18]
lea eax, [esp + 0xcc]
mov dword [esp + 0xc0], eax
mov eax, 0x55555556
imul ebx
mov eax, edx
shr eax, 0x1f
add eax, edx
lea edx, [eax + eax*2]
add ecx, 0x20
mov eax, ebx
sub eax, edx
shl eax, 4
mov edx, dword [eax + ecx + 4]
add eax, ecx
mov dword [esp + 0x3c], ecx
mov ecx, dword [eax]
mov dword [esp + 0x10], ecx
mov ecx, dword [eax + 8]
fld dword [esp + 0x10]
mov dword [esp + 0x14], edx
fld st(0)
mov edx, dword [eax + 0xc]
fld qword [0x4b33d0]
mov dword [esp + 0x18], ecx
fsub st(1), st(0)
mov dword [esp + 0x1c], edx
fxch st(1)
fstp dword [esp + 0x20]
mov edi, dword [ebp + 0xc]
fld dword [esp + 0x14]
mov eax, dword [edi]
fld st(0)
mov eax, dword [eax + 0x2c]
fsub st(2)
lea ecx, [esp + 0xc0]
push ecx
lea edx, [esp + 0x44]
fstp dword [esp + 0x28]
mov dword [esp + 0xc8], 0
fld dword [esp + 0x1c]
mov dword [esp + 0xcc], 0x80000080
fld st(0)
push edx
fsub st(3)
mov ecx, edi
fstp dword [esp + 0x30]
fld dword [esp + 0x24]
fadd qword [0x4bea18]
fstp dword [esp + 0x14]
fld dword [esp + 0x14]
fst dword [esp + 0x34]
fxch st(4)
fadd st(3)
fstp dword [esp + 0x18]
fxch st(1)
fadd st(2)
fstp dword [esp + 0x1c]
faddp st(1)
fstp dword [esp + 0x20]
fstp dword [esp + 0x24]
fld dword [esp + 0x28]
fstp dword [esp + 0x48]
fld dword [esp + 0x2c]
fstp dword [esp + 0x4c]
fld dword [esp + 0x30]
fstp dword [esp + 0x50]
fld dword [esp + 0x34]
fstp dword [esp + 0x54]
fld dword [esp + 0x18]
fstp dword [esp + 0x58]
fld dword [esp + 0x1c]
fstp dword [esp + 0x5c]
fld dword [esp + 0x20]
fstp dword [esp + 0x60]
fld dword [esp + 0x24]
fstp dword [esp + 0x64]
call eax
mov eax, dword [esp + 0xc4]
mov ecx, dword [ebp + 8]
add eax, 0xffffffff
mov byte [ecx], 1
mov dword [esp + 0xc], eax
js 0x42887c
jmp 0x4287f0
mov edx, dword [esp + 0xc0]
mov esi, dword [edx + eax*4]
cmp esi, dword [ebp + 0x14]
je 0x42886b
mov eax, dword [edi]
mov edx, dword [eax + 0x14]
mov ecx, edi
call edx
mov edx, dword [eax]
mov edx, dword [edx + 0x14]
lea ecx, [esp + 0x2d0]
push ecx
push esi
mov ecx, eax
call edx
cmp dword [eax + 0xc], 4
jne 0x42886b
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x64]
push edx
add eax, 0x20
push ebx
push eax
mov eax, dword [esp + 0x4c]
push eax
call fcn.004281e0
add esp, 0x14
cmp eax, 4
jne 0x42886b
cmp byte [ebp + 0x20], 0
je 0x42884d
mov ecx, dword [ebp + 8]
mov byte [ecx], 0
lea edx, [esp + 0x60]
push edx
call fcn.00428610
mov esi, dword [ebp + 0x1c]
push eax
movzx eax, word [esi]
push ebx
push eax
call fcn.004281c0
add esp, 0x10
mov word [esi], ax
mov eax, dword [esp + 0xc]
sub eax, 1
mov dword [esp + 0xc], eax
jns 0x4287f0
mov eax, dword [esp + 0xc8]
test eax, eax
js 0x4288b4
mov ecx, dword [0x4c6060]
and eax, 0x3fffffff
push ecx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [esp + 0xc0]
push 0x17
lea edx, [esi*4]
push edx
push ecx
mov ecx, eax
call fcn.004023e0
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42aa90
Capabilities:
Execute anti-debugging instructions
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x214
mov eax, dword [0x4c6074]
push ebx
push esi
push edi
mov esi, ecx
push eax
mov dword [esp + 0x20], esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, eax
mov edi, dword [ecx + 4]
cmp edi, dword [ecx + 0xc]
jae 0x42aad4
mov dword [edi], str.TtrcShpCollect
rdtsc
mov dword [esp + 0x14], eax
mov edx, dword [esp + 0x14]
mov dword [edi + 4], edx
add edi, 0xc
mov dword [ecx + 4], edi
mov eax, dword [ebp + 0x10]
add dword [eax + 0x40], 1
mov ebx, dword [ebp + 0xc]
mov eax, dword [esi + 0x10]
mov edx, dword [eax + 8]
add esi, 0x10
cmp dword [ebx + 0x24], 0
mov dword [esp + 0x14], 0xffffffff
mov ecx, esi
jne 0x42ab44
call edx
mov edi, eax
cmp edi, 0xffffffff
je 0x42aba9
mov eax, dword [esi]
mov edx, dword [eax + 0x14]
lea ecx, [esp + 0x20]
push ecx
push edi
mov ecx, esi
call edx
mov ecx, dword [ebp + 0x10]
mov edx, dword [eax]
mov edx, dword [edx + 0x20]
push ecx
push ebx
lea ecx, [esp + 0x1b]
push ecx
mov ecx, eax
call edx
cmp byte [esp + 0x13], 0
je 0x42ab31
mov dword [esp + 0x14], edi
mov eax, dword [esi]
mov edx, dword [eax + 0xc]
push edi
mov ecx, esi
call edx
mov edi, eax
cmp edi, 0xffffffff
jne 0x42ab04
jmp 0x42aba9
call edx
mov edi, eax
cmp edi, 0xffffffff
je 0x42aba9
lea ecx, [ecx]
mov edx, dword [esp + 0x1c]
mov ecx, dword [ebx + 0x24]
mov eax, dword [ecx]
mov eax, dword [eax]
push edi
push esi
push edx
push ebx
lea edx, [esp + 0x2b]
push edx
call eax
cmp byte [eax], 0
je 0x42ab98
mov edx, dword [esi]
mov edx, dword [edx + 0x14]
lea eax, [esp + 0x20]
push eax
push edi
mov ecx, esi
call edx
mov ecx, dword [ebp + 0x10]
mov edx, dword [eax]
mov edx, dword [edx + 0x20]
push ecx
push ebx
lea ecx, [esp + 0x1b]
push ecx
mov ecx, eax
call edx
cmp byte [esp + 0x13], 0
je 0x42ab98
mov dword [esp + 0x14], edi
mov eax, dword [esi]
mov edx, dword [eax + 0xc]
push edi
mov ecx, esi
call edx
mov edi, eax
cmp edi, 0xffffffff
jne 0x42ab50
mov eax, dword [ebp + 0x10]
add dword [eax + 0x40], 0xffffffff
mov edi, dword [esp + 0x14]
cmp edi, 0xffffffff
mov ecx, dword [eax + 0x40]
je 0x42abc0
mov dword [eax + ecx*4 + 0x20], edi
mov eax, dword [0x4c6074]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
mov ecx, dword [esi + 4]
cmp ecx, dword [esi + 0xc]
jae 0x42abef
mov dword [ecx], 0x4b2454
rdtsc
mov dword [esp + 0x14], eax
mov edx, dword [esp + 0x14]
mov dword [ecx + 4], edx
add ecx, 0xc
mov dword [esi + 4], ecx
mov eax, dword [ebp + 8]
cmp edi, 0xffffffff
pop edi
setne cl
pop esi
mov byte [eax], cl
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x42ae20
Capabilities:
Execute anti-debugging instructions
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
mov eax, dword [0x4c6074]
sub esp, 0x214
push ebx
push esi
push edi
push eax
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, eax
mov esi, dword [ecx + 4]
cmp esi, dword [ecx + 0xc]
jae 0x42ae60
mov dword [esi], str.TthkpShapeCollection::getMaximumProjection
rdtsc
mov dword [esp + 0x18], eax
mov edx, dword [esp + 0x18]
mov dword [esi + 4], edx
add esi, 0xc
mov dword [ecx + 4], esi
mov eax, dword [edi + 0x10]
fld dword [0x4b33dc]
mov edx, dword [eax + 8]
fstp dword [esp + 0x18]
lea esi, [edi + 0x10]
mov ecx, esi
call edx
mov edi, eax
cmp edi, 0xffffffff
je 0x42aeca
mov ebx, dword [ebp + 8]
mov eax, dword [esi]
mov edx, dword [eax + 0x14]
lea ecx, [esp + 0x20]
push ecx
push edi
mov ecx, esi
call edx
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
push ebx
call eax
fstp dword [esp + 0x1c]
fld dword [esp + 0x18]
fld dword [esp + 0x1c]
fcom st(1)
fnstsw ax
fstp st(1)
test ah, 5
jnp 0x42aeb7
fstp dword [esp + 0x18]
jmp 0x42aeb9
fstp st(0)
mov edx, dword [esi]
mov eax, dword [edx + 0xc]
push edi
mov ecx, esi
call eax
mov edi, eax
cmp edi, 0xffffffff
jne 0x42ae81
mov ecx, dword [0x4c6074]
push ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
mov ecx, dword [esi + 4]
cmp ecx, dword [esi + 0xc]
jae 0x42aefa
mov dword [ecx], 0x4b2454
rdtsc
mov dword [esp + 0x1c], eax
mov edx, dword [esp + 0x1c]
mov dword [ecx + 4], edx
add ecx, 0xc
mov dword [esi + 4], ecx
fld dword [esp + 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x42af10
Capabilities:
Execute anti-debugging instructions
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x224
mov eax, dword [0x4c6074]
push ebx
push esi
push edi
mov edi, ecx
push eax
mov dword [esp + 0x30], edi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, eax
mov esi, dword [ecx + 4]
cmp esi, dword [ecx + 0xc]
jae 0x42af54
mov dword [esi], str.TtrcShpCollect
rdtsc
mov dword [esp + 0x14], eax
mov edx, dword [esp + 0x14]
mov dword [esi + 4], edx
add esi, 0xc
mov dword [ecx + 4], esi
mov ebx, dword [ebp + 8]
mov eax, dword [edi + 0x10]
mov edx, dword [eax + 8]
add edi, 0x10
cmp dword [ebx + 0x24], 0
mov ecx, edi
jne 0x42afc0
call edx
mov esi, eax
cmp esi, 0xffffffff
je 0x42b034
mov eax, dword [edi]
mov edx, dword [eax + 0x14]
lea ecx, [esp + 0x30]
push ecx
push esi
mov ecx, edi
call edx
mov ecx, dword [ebp + 0xc]
mov dword [esp + 0x28], ecx
mov ecx, dword [ecx + 8]
mov dword [esp + 0x24], ecx
mov ecx, dword [ebp + 0x10]
push ecx
lea ecx, [esp + 0x20]
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], esi
mov edx, dword [eax]
mov edx, dword [edx + 0x10]
push ecx
push ebx
mov ecx, eax
call edx
mov eax, dword [edi]
mov edx, dword [eax + 0xc]
push esi
mov ecx, edi
call edx
mov esi, eax
cmp esi, 0xffffffff
jne 0x42af75
jmp 0x42b034
call edx
mov esi, eax
cmp esi, 0xffffffff
je 0x42b034
lea esp, [esp]
mov edx, dword [esp + 0x2c]
mov ecx, dword [ebx + 0x24]
mov eax, dword [ecx]
mov eax, dword [eax]
push esi
push edi
push edx
push ebx
lea edx, [esp + 0x2b]
push edx
call eax
cmp byte [eax], 0
je 0x42b023
mov edx, dword [edi]
mov edx, dword [edx + 0x14]
lea eax, [esp + 0x30]
push eax
push esi
mov ecx, edi
call edx
mov ecx, dword [ebp + 0xc]
mov dword [esp + 0x28], ecx
mov ecx, dword [ecx + 8]
mov dword [esp + 0x24], ecx
mov ecx, dword [ebp + 0x10]
push ecx
lea ecx, [esp + 0x20]
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], esi
mov edx, dword [eax]
mov edx, dword [edx + 0x10]
push ecx
push ebx
mov ecx, eax
call edx
mov eax, dword [edi]
mov edx, dword [eax + 0xc]
push esi
mov ecx, edi
call edx
mov esi, eax
cmp esi, 0xffffffff
jne 0x42afd0
mov eax, dword [0x4c6074]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
mov ecx, dword [esi + 4]
cmp ecx, dword [esi + 0xc]
jae 0x42b063
mov dword [ecx], 0x4b2454
rdtsc
mov dword [esp + 0x14], eax
mov edx, dword [esp + 0x14]
mov dword [ecx + 4], edx
add ecx, 0xc
mov dword [esi + 4], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x42cae8
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4c3bf8]
jne 0x42caf2
repz ret
jmp fcn.0042f539

Function at 0x4374a3
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004334df
and dword [ebp - 4], 0
cmp dword [0x4c6d7c], 0
mov ebx, eax
jne 0x437554
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x437605
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x437605
push eax
call fcn.0043346d
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4c6d7c], eax
call esi
push eax
call fcn.0043346d
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4c6d80], eax
call esi
push eax
call fcn.0043346d
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4c6d84], eax
call esi
push eax
call fcn.0043346d
pop ecx
mov dword [0x4c6d8c], eax
test eax, eax
je 0x437554
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0043346d
pop ecx
mov dword [0x4c6d88], eax
mov eax, dword [0x4c6d88]
cmp eax, ebx
je 0x4375ac
cmp dword [0x4c6d8c], ebx
je 0x4375ac
push eax
call fcn.004334e8
push dword [0x4c6d8c]
mov esi, eax
call fcn.004334e8
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4375ac
test edi, edi
je 0x4375ac
call esi
test eax, eax
je 0x4375a3
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4375a3
test byte [ebp - 0xc], 1
jne 0x4375ac
or dword [ebp + 0x10], 0x200000
jmp 0x4375e5
mov eax, dword [0x4c6d80]
cmp eax, ebx
je 0x4375e5
push eax
call fcn.004334e8
pop ecx
test eax, eax
je 0x4375e5
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4375e5
mov eax, dword [0x4c6d84]
cmp eax, ebx
je 0x4375e5
push eax
call fcn.004334e8
pop ecx
test eax, eax
je 0x4375e5
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4c6d7c]
call fcn.004334e8
pop ecx
test eax, eax
je 0x437605
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x437607
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x43d620
Capabilities:
Get thread local storage value

Disassembly:
mov dword [ecx], vtable.hkpRigidBody.0
jmp fcn.004468b0