joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b6c20
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
push edi
push 1
call fcn.0049dbf0
pop ecx
inc eax
mov dword [ebp - 0x24], eax
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, dword [eax + 0x30]
mov word [ebp - 0x26], 1
jmp 0x4b6c62
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edx, dword [ebx]
mov edx, dword [edx + 8]
mov eax, dword [eax]
lea ebx, [eax + edx*4]
mov eax, dword [ebp - 0x24]
lea edx, [eax - 1]
mov dword [ebp - 0x24], edx
test eax, eax
jle 0x4b6c83
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edx, ebx
mov eax, dword [eax]
cmp edx, eax
jne 0x4b6c4c
mov eax, dword [ebx]
mov di, word [eax + 0xe]
mov dword [ebp - 0x20], 0
movzx eax, di
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.004a2750
add esp, 8
lea esi, [ebx + 8]
jmp 0x4b6cc3
movzx eax, word [ebp - 0x26]
lea edx, [eax + 1]
mov word [ebp - 0x26], dx
push eax
lea eax, [ebp - 0x20]
push eax
mov eax, dword [esi]
push eax
call fcn.004b68f0
add esp, 0xc
lea esi, [esi + 4]
movzx eax, di
lea edx, [eax - 1]
mov edi, edx
test eax, eax
jne 0x4b6ca5
lea eax, [ebp - 0x20]
push eax
call fcn.004a4540
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4b6cf0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, dword [eax + 0x30]
jmp 0x4b6d1b
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edx, dword [ebx]
mov edx, dword [edx + 8]
mov eax, dword [eax]
lea ebx, [eax + edx*4]
mov eax, dword [ebp + 8]
lea edx, [eax - 1]
mov dword [ebp + 8], edx
test eax, eax
jle 0x4b6d3c
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edx, ebx
mov eax, dword [eax]
cmp edx, eax
jne 0x4b6d05
cmp dword [ebp + 0xc], 0x7fff
jle 0x4b6d54
call fcn.004b6ce0
sub dword [ebp + 0xc], 0xffff
dec dword [ebp + 0xc]
cmp dword [ebp + 0xc], 0
jl 0x4b6d6a
mov eax, dword [ebp + 0xc]
mov eax, dword [ebx + eax*4 + 4]
push eax
call fcn.004a0990
pop ecx
jmp 0x4b6d8a
mov eax, dword [ebx + 4]
mov eax, dword [eax]
and eax, 0x1000
je 0x4b6d88
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebx + 4]
push eax
call fcn.004bc850
add esp, 8
jmp 0x4b6d8a
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x4b6e00
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push 1
call fcn.0049dbf0
pop ecx
lea esi, [eax + 1]
push 2
call fcn.0049dbf0
pop ecx
mov edi, eax
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, dword [eax + 0x30]
jmp 0x4b6e45
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edx, dword [ebx]
mov edx, dword [edx + 8]
mov eax, dword [eax]
lea ebx, [eax + edx*4]
mov eax, esi
lea esi, [eax - 1]
test eax, eax
jle 0x4b6e62
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edx, ebx
mov eax, dword [eax]
cmp edx, eax
jne 0x4b6e2f
cmp edi, 0x7fff
jle 0x4b6e71
lea edi, [edi - 0xffff]
dec edi
test edi, edi
jl 0x4b6e7e
mov eax, dword [ebx + edi*4 + 4]
mov dword [ebp - 4], eax
jmp 0x4b6e8e
push edi
mov eax, dword [ebx + 4]
push eax
call fcn.004bc850
add esp, 8
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
push eax
call fcn.004a0990
pop ecx
mov dword [ebp - 8], eax
mov edx, dword [0x7d8230]
push edx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x10]
push eax
mov eax, dword [ebp - 8]
push eax
call fcn.004a4960
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4b7e70
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb8
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
push eax
push 0
call fcn.004b7770
add esp, 8
mov edi, eax
push 0
push edi
call fcn.004aed40
add esp, 8
mov ebx, eax
push edi
call fcn.0049b640
pop ecx
cmp ebx, 0xffffffff
jne 0x4b7fb6
push str.I18N
mov eax, dword [ebp + 8]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0xb0], eax
test eax, eax
je 0x4b8076
mov eax, dword [ebp - 0xb0]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xb4], eax
test eax, eax
je 0x4b8076
mov eax, dword [ebp - 0xb4]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0xb8], eax
push 0xac
mov eax, dword [ebp - 0xb8]
push eax
lea eax, [ebp - 0xac]
push eax
call fcn.00531d20
add esp, 0xc
push 0x6a6f4f
lea eax, [ebp - 0xac]
push eax
call fcn.00534750
add esp, 8
test eax, eax
je 0x4b7f4a
push 0x6a6f4a
lea eax, [ebp - 0xac]
push eax
call fcn.00534750
add esp, 8
test eax, eax
je 0x4b7f4a
xor eax, eax
jmp 0x4b8076
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 0xb8]
lea eax, [eax + 0xac]
push eax
call fcn.004b7bf0
add esp, 8
mov esi, eax
test eax, eax
je 0x4b7faf
push 0xf
mov eax, dword [ebp + 8]
push eax
push 0x7ce149
call fcn.00532800
add esp, 0xc
push 0x32
lea eax, [ebp - 0x75]
push eax
push 0x7ce116
call fcn.00532800
add esp, 0xc
mov eax, dword [0x7c1a04]
test eax, eax
je 0x4b7f9f
push eax
call fcn.0049f7d0
pop ecx
mov dword [0x7c1a04], esi
mov eax, 1
jmp 0x4b8076
xor eax, eax
jmp 0x4b8076
push 0xac
lea eax, [ebp - 0xac]
push eax
push ebx
call fcn.004af510
add esp, 0xc
movzx eax, ax
cmp eax, 0xac
je 0x4b7fe3
push ebx
call fcn.004af310
pop ecx
xor eax, eax
jmp 0x4b8076
push 0x6a6f4f
lea eax, [ebp - 0xac]
push eax
call fcn.00534750
add esp, 8
test eax, eax
je 0x4b801e
push 0x6a6f4a
lea eax, [ebp - 0xac]
push eax
call fcn.00534750
add esp, 8
test eax, eax
je 0x4b801e
push ebx
call fcn.004af310
pop ecx
xor eax, eax
jmp 0x4b8076
mov eax, dword [ebp - 4]
push eax
push ebx
call fcn.004b7a40
add esp, 8
mov esi, eax
test eax, eax
je 0x4b8074
push 0xf
mov eax, dword [ebp + 8]
push eax
push 0x7ce149
call fcn.00532800
add esp, 0xc
push 0x32
lea eax, [ebp - 0x75]
push eax
push 0x7ce116
call fcn.00532800
add esp, 0xc
mov eax, dword [0x7c1a04]
test eax, eax
je 0x4b8067
push eax
call fcn.0049f7d0
pop ecx
mov dword [0x7c1a04], esi
mov eax, 1
jmp 0x4b8076
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4b8f60
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push 0x18
call fcn.0049b580
pop ecx
mov ebx, eax
mov eax, dword [ebp + 8]
push eax
call fcn.0049f730
pop ecx
mov dword [ebx + 4], eax
call fcn.00478980
fst qword [ebp - 8]
fstp qword [ebx + 8]
mov eax, dword [ebp + 0xc]
mov dword [ebx + 0x10], eax
mov eax, dword [ebp + 0x10]
mov dword [ebx + 0x14], eax
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov eax, dword [eax + 0x1640]
test eax, eax
jne 0x4b8fed
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [eax + 0x164c], 1
mov dword [ebx], 1
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 0xc], eax
push 0x18
call fcn.0049b580
pop ecx
mov edx, dword [ebp - 0xc]
mov dword [edx + 0x1640], eax
jmp 0x4b90d4
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
lea eax, [eax + 0x164c]
mov edx, dword [eax]
inc edx
mov dword [eax], edx
mov dword [ebx], edx
mov eax, dword [ebx]
test eax, eax
jne 0x4b9078
xor esi, esi
jmp 0x4b9061
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov eax, dword [eax + 0x1640]
mov eax, dword [eax + esi*4]
mov eax, dword [eax]
cmp eax, dword [ebx]
jne 0x4b9036
add dword [ebx], 1
xor esi, esi
jmp 0x4b9061
inc esi
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edx, dword [ebx]
cmp dword [eax + 0x164c], edx
jae 0x4b9061
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edx, dword [ebx]
mov dword [eax + 0x164c], edx
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
movzx eax, word [eax + 0x164a]
cmp esi, eax
jl 0x4b9014
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 0xc], eax
mov edx, dword [0x7d8230]
push edx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 0x10], eax
mov edx, dword [0x7d8230]
push edx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 0x14], eax
mov eax, 0x18
mov edx, dword [ebp - 0x14]
movzx edx, word [edx + 0x164a]
mul edx
push eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x1640]
push eax
call fcn.0049b5d0
add esp, 8
mov edx, dword [ebp - 0xc]
mov dword [edx + 0x1640], eax
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 0xc], eax
mov edx, dword [0x7d8230]
push edx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edx, dword [ebp - 0xc]
movzx edx, word [edx + 0x164a]
mov eax, dword [eax + 0x1640]
mov dword [eax + edx*4], ebx
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
lea eax, [eax + 0x164a]
movzx edx, word [eax]
inc edx
mov word [eax], dx
mov eax, dword [ebx]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4b9130
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp dword [eax + 0x1644], 0
jne 0x4b92ce
cmp dword [0x7d80f8], 0
je 0x4b92ce
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [eax + 0x1644], 1
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 8], eax
mov edx, dword [0x7d8230]
push edx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edx, dword [ebp - 8]
movzx edx, word [edx + 0x1648]
movzx eax, word [eax + 0x164a]
cmp edx, eax
jge 0x4b925c
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 0xc], eax
mov edx, dword [0x7d8230]
push edx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edx, dword [ebp - 0xc]
movzx edx, word [edx + 0x1648]
mov eax, dword [eax + 0x1640]
mov eax, dword [eax + edx*4]
mov dword [ebp - 4], eax
cmp dword [eax + 0x14], 0
je 0x4b9241
cmp dword [eax + 0x10], 0
je 0x4b9218
fld qword [0x6a7104]
fcomp qword [eax + 8]
wait
fnstsw ax
sahf
je 0x4b9218
call fcn.00478980
fstp qword [ebp - 0x18]
mov eax, dword [ebp - 4]
fld qword [0x6a70fc]
fld qword [ebp - 0x18]
fsub qword [eax + 8]
fmulp st(1)
fild dword [eax + 0x10]
fcompp
wait
fnstsw ax
sahf
ja 0x4b9241
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call fcn.0048fb60
add esp, 8
push eax
call fcn.0049f7d0
pop ecx
call fcn.00478980
fstp qword [ebp - 0x20]
mov eax, dword [ebp - 4]
fld qword [ebp - 0x20]
fstp qword [eax + 8]
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
lea eax, [eax + 0x1648]
movzx edx, word [eax]
inc edx
mov word [eax], dx
jmp 0x4b92b8
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp word [eax + 0x164a], 0
je 0x4b92b8
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 0xc], eax
mov edx, dword [0x7d8230]
push edx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edx, dword [ebp - 0xc]
movzx edx, word [edx + 0x1648]
movzx eax, word [eax + 0x164a]
cmp edx, eax
jne 0x4b92b8
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov word [eax + 0x1648], 0
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [eax + 0x1644], 0
mov esp, ebp
pop ebp
ret

Function at 0x4b92e0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp dword [eax + 0x1644], 0
jne 0x4b9350
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [eax + 0x1644], 1
mov eax, dword [ebp + 8]
push eax
call fcn.004b9640
pop ecx
mov dword [ebp - 4], eax
test eax, eax
je 0x4b933a
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call fcn.0048fb60
add esp, 8
push eax
call fcn.0049f7d0
pop ecx
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [eax + 0x1644], 0
mov esp, ebp
pop ebp
ret
Function at 0x4b9360
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
mov edx, dword [0x7d8230]
push edx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edx, dword [ebp - 4]
movzx edx, word [edx + 0x1648]
movzx eax, word [eax + 0x164a]
cmp edx, eax
jne 0x4b93ac
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov word [eax + 0x1648], 0
mov esp, ebp
pop ebp
ret

Function at 0x4b93b0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov eax, dword [eax + 0x1640]
test eax, eax
je 0x4b9467
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
lea eax, [eax + 0x164a]
movzx edx, word [eax]
dec edx
mov word [ebp - 2], dx
mov word [eax], dx
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dx, word [ebp - 2]
movzx edx, dx
mov eax, dword [eax + 0x1640]
mov ebx, dword [eax + edx*4]
mov eax, dword [ebx + 4]
push eax
call fcn.0049f7d0
pop ecx
mov dword [ebx + 4], 0
push ebx
call fcn.0049b640
pop ecx
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp word [eax + 0x164a], 0
jne 0x4b93d1
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov eax, dword [eax + 0x1640]
push eax
call fcn.0049b640
pop ecx
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [eax + 0x1640], 0
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4b9470
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
xor edi, edi
mov eax, dword [0x7d80f8]
mov dword [ebp - 4], eax
mov dword [0x7d80f8], 0
xor bx, bx
jmp 0x4b9602
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
movsx edx, bx
mov eax, dword [eax + 0x1640]
mov esi, dword [eax + edx*4]
mov eax, dword [ebp + 8]
cmp eax, dword [esi]
jne 0x4b95fc
mov edi, dword [esi + 4]
push esi
call fcn.0049b640
pop ecx
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
lea eax, [eax + 0x164a]
movzx edx, word [eax]
dec edx
mov word [eax], dx
test dx, dx
je 0x4b95cb
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
movsx edx, bx
movzx eax, word [eax + 0x164a]
cmp edx, eax
je 0x4b956d
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 8], eax
mov edx, dword [0x7d8230]
push edx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 0xc], eax
mov edx, dword [0x7d8230]
push edx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 0x10], eax
mov eax, 0x18
mov edx, dword [ebp - 0x10]
movzx edx, word [edx + 0x164a]
movsx ecx, bx
sub edx, ecx
mul edx
push eax
movsx eax, bx
mov edx, dword [ebp - 0xc]
mov edx, dword [edx + 0x1640]
lea eax, [edx + eax*4 + 4]
push eax
movsx eax, bx
mov edx, dword [ebp - 8]
mov edx, dword [edx + 0x1640]
lea eax, [edx + eax*4]
push eax
call fcn.00532af0
add esp, 0xc
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 8], eax
mov edx, dword [0x7d8230]
push edx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 0xc], eax
mov edx, dword [0x7d8230]
push edx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 0x10], eax
mov eax, 0x18
mov edx, dword [ebp - 0x10]
movzx edx, word [edx + 0x164a]
mul edx
push eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x1640]
push eax
call fcn.0049b5d0
add esp, 8
mov edx, dword [ebp - 8]
mov dword [edx + 0x1640], eax
jmp 0x4b9620
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov eax, dword [eax + 0x1640]
push eax
call fcn.0049b640
pop ecx
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [eax + 0x1640], 0
jmp 0x4b9620
movsx eax, bx
inc eax
mov ebx, eax
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
movsx edx, bx
movzx eax, word [eax + 0x164a]
cmp edx, eax
jl 0x4b9495
mov eax, dword [ebp - 4]
mov dword [0x7d80f8], eax
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4bc480
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
push 0x4bc780
push 0x1c
call fcn.0049abe0
add esp, 8
mov dword [ebp - 4], eax
mov dword [eax], 0
mov eax, dword [ebp - 4]
mov dx, word [ebp + 0xc]
mov word [eax + 6], dx
movzx eax, word [ebp + 0xc]
test eax, eax
je 0x4bc567
mov word [ebp - 6], 1
movzx eax, word [ebp + 0xc]
inc eax
shl eax, 5
push eax
call fcn.0049b580
pop ecx
mov edx, dword [ebp - 4]
mov dword [edx + 8], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
mov dword [eax], 8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
push dword [0x6a7208]
mov esi, dword [0x6a7204]
pop edi
mov dword [eax + 8], esi
mov dword [eax + 0xc], edi
jmp 0x4bc553
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edx, dword [ebp + 0x10]
movzx edx, word [edx]
mov eax, dword [eax + 0x30]
mov ebx, dword [eax + edx*4 + 4]
mov eax, dword [ebp + 0x10]
lea eax, [eax + 2]
mov dword [ebp + 0x10], eax
push ebx
call fcn.004735f0
pop ecx
mov ebx, eax
push 0x20
push ebx
movzx eax, word [ebp - 6]
shl eax, 5
mov edx, dword [ebp - 4]
mov edx, dword [edx + 8]
add eax, edx
push eax
call fcn.00531d20
add esp, 0xc
mov eax, dword [ebx + 0x10]
push eax
call fcn.004737c0
pop ecx
movzx eax, word [ebp - 6]
inc eax
mov word [ebp - 6], ax
movzx eax, word [ebp + 0xc]
lea edx, [eax - 1]
mov word [ebp + 0xc], dx
test eax, eax
jne 0x4bc4fa
jmp 0x4bc610
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 4]
mov dword [ebp - 8], eax
mov eax, dword [eax]
and eax, 0x1000
je 0x4bc606
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
mov edx, dword [edx + 8]
mov dword [eax + 8], edx
mov eax, dword [ebp - 0xc]
mov ax, word [eax + 6]
mov word [ebp + 0xc], ax
mov edx, dword [ebp - 4]
mov word [edx + 6], ax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 8]
test eax, eax
je 0x4bc610
jmp 0x4bc5dd
movzx eax, word [ebp + 0xc]
shl eax, 5
mov edx, dword [ebp - 4]
mov edx, dword [edx + 8]
mov eax, dword [edx + eax + 0x10]
push eax
call fcn.004737c0
pop ecx
movzx eax, word [ebp + 0xc]
dec eax
mov word [ebp + 0xc], ax
cmp word [ebp + 0xc], 0
jne 0x4bc5bc
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
lea eax, [eax + 8]
push dword [eax + 4]
mov ecx, dword [eax]
pop ebx
add ecx, dword [0x6a7204]
adc ebx, dword [0x6a7208]
mov dword [eax], ecx
mov dword [eax + 4], ebx
jmp 0x4bc610
mov eax, dword [ebp - 4]
mov dword [eax + 8], 0
mov eax, dword [ebp - 4]
mov edx, dword [ebp + 8]
mov dword [eax + 0xc], edx
mov eax, dword [ebp - 4]
mov dword [eax + 0x14], 0
mov eax, dword [ebp - 4]
mov edx, dword [ebp + 0x14]
mov dword [eax], edx
mov eax, dword [ebp - 4]
mov dword [eax + 0x10], 1
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4be070
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [ebp + 8], 0
je 0x4be0af
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
mov edx, dword [0x7d8230]
push edx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov word [eax + 0x15fc], 0
mov eax, dword [ebp - 4]
mov word [eax + 0x15fe], 0
jmp 0x4be102
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [ebp - 4]
mov word [edx + 0x15fe], ax
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 8], eax
mov edx, dword [0x7d8230]
push edx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
movzx eax, word [eax + 0x15fe]
push eax
call fcn.004bdf70
pop ecx
mov edx, dword [ebp - 8]
mov word [edx + 0x15fc], ax
mov esp, ebp
pop ebp
ret
Function at 0x4be3d0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa4
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x94], 0x94
lea eax, [ebp - 0x94]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [ebp - 0x84]
cmp eax, 2
jne 0x4be446
cmp dword [ebp - 0x90], 5
jb 0x4be446
push str.winspool.drv
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test eax, eax
je 0x4be446
push str.GetDefaultPrinterA
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x98], eax
test eax, eax
je 0x4be43f
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 0x98]
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
test ebx, ebx
jne 0x4be4a9
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
push eax
mov eax, dword [ebp + 8]
push eax
push 0x6a7556
push str.device
push str.windows
call dword [sym.imp.KERNEL32.dll_GetProfileStringA]
mov esi, eax
test esi, esi
je 0x4be4a1
mov eax, dword [ebp + 0xc]
cmp esi, dword [eax]
jae 0x4be4a1
xor esi, esi
jmp 0x4be47b
inc esi
mov eax, dword [ebp + 8]
movsx eax, byte [eax + esi]
test eax, eax
je 0x4be48b
cmp eax, 0x2c
jne 0x4be47a
mov eax, dword [ebp + 8]
mov byte [eax + esi], 0
mov eax, dword [ebp + 0xc]
lea edx, [esi + 1]
mov dword [eax], edx
mov ebx, 1
jmp 0x4be4a9
mov eax, dword [ebp + 0xc]
lea edx, [esi + 1]
mov dword [eax], edx
test ebx, ebx
jne 0x4be590
mov eax, dword [ebp - 0x84]
cmp eax, 1
jne 0x4be590
lea eax, [ebp - 0x9c]
push eax
lea eax, [ebp - 0x98]
push eax
push 0
push 0
push 2
push 0
push 1
call sub.WINSPOOL.DRV_EnumPrintersA
test eax, eax
je 0x4be590
mov eax, dword [ebp - 0x98]
test eax, eax
je 0x4be590
push eax
call fcn.0049b580
pop ecx
mov dword [ebp - 0xa0], eax
test eax, eax
je 0x4be590
lea eax, [ebp - 0x9c]
push eax
lea eax, [ebp - 0x98]
push eax
mov eax, dword [ebp - 0x98]
push eax
mov eax, dword [ebp - 0xa0]
push eax
push 2
push 0
push 1
call sub.WINSPOOL.DRV_EnumPrintersA
test eax, eax
je 0x4be583
mov eax, dword [ebp - 0x9c]
test eax, eax
je 0x4be583
mov eax, dword [ebp - 0xa0]
mov eax, dword [eax + 4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 0xa4], eax
test eax, eax
je 0x4be583
mov edx, dword [ebp + 0xc]
cmp eax, dword [edx]
jae 0x4be583
mov eax, dword [ebp - 0xa0]
mov eax, dword [eax + 4]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp - 0xa4]
inc edx
mov dword [eax], edx
mov ebx, 1
mov eax, dword [ebp - 0xa0]
push eax
call fcn.0049b640
pop ecx
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret