joyce8/EMBER2024-capa huggingface dataset:
Function at 0x494a10
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x14
push 0x1000
push 0
push dword [0xb3fee4]
mov dword [esp + 0x10], 0x1000
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
mov dword [esp + 0xc], edx
test edx, edx
je 0x494b60
mov eax, dword [esp + 0x1c]
mov cl, byte [esp + 3]
push ebx
push ebp
mov ebp, dword [esp + 0x20]
push esi
push edi
mov edi, dword [esp + 0x30]
mov esi, edx
cmp edi, 0xffffffff
je 0x494a5c
test edi, edi
je 0x494acd
dec edi
push esi
push ebp
call fcn.00494be0
mov dword [esp + 0x20], eax
test eax, eax
jne 0x494a6f
xor cl, cl
jmp 0x494a71
mov cl, byte [esi]
mov edx, dword [esp + 0x1c]
add esi, eax
mov eax, dword [esp + 0x14]
mov ebx, esi
sub ebx, edx
mov byte [esp + 0x13], cl
add eax, 0xfffffffb
cmp ebx, eax
jle 0x494ab4
mov eax, dword [esp + 0x14]
add eax, 0x1000
push eax
push edx
push 8
push dword [0xb3fee4]
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov cl, byte [esp + 0x13]
mov edx, eax
mov dword [esp + 0x1c], edx
lea esi, [ebx + edx]
mov eax, dword [esp + 0x2c]
test cl, cl
je 0x494acd
test eax, eax
jne 0x494a52
cmp cl, 0xd
je 0x494ad1
cmp cl, 0xa
jne 0x494a52
dec esi
jmp 0x494b43
test eax, eax
jne 0x494b43
cmp cl, 0xa
jne 0x494ad9
dec esi
jmp 0x494b43
cmp cl, 0xd
jne 0x494b43
dec esi
cmp dword [ebp + 4], 0
je 0x494af8
push 1
lea eax, [esp + 0x17]
push eax
push ebp
call fcn.004945a0
mov dword [esp + 0x20], eax
jmp 0x494b0f
push 0
lea eax, [esp + 0x24]
push eax
push 1
lea eax, [esp + 0x1f]
push eax
push dword [ebp]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp byte [esp + 0x13], 0xa
je 0x494b43
cmp dword [ebp + 4], 0
je 0x494b21
inc dword [ebp + 0xc]
jmp 0x494b43
push 1
lea eax, [esp + 0x1c]
mov dword [esp + 0x18], 0xffffffff
push eax
push 0xffffffffffffffff
push dword [ebp]
mov dword [esp + 0x28], 0xffffffff
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 0x34]
mov ecx, esi
sub ecx, dword [esp + 0x1c]
pop edi
mov dword [eax], ecx
mov eax, dword [esp + 0x18]
mov byte [esi], 0
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 0x10
xor eax, eax
add esp, 0x14
ret 0x10
Function at 0x494be0
Capabilities:
Read file on windows

Disassembly:
push ecx
push edi
mov edi, dword [esp + 0xc]
mov dword [esp + 4], 0
cmp dword [edi + 4], 0
je 0x494c07
push 1
lea eax, [esp + 0x10]
push eax
push edi
call fcn.004945a0
mov dword [esp + 4], eax
jmp 0x494c21
push 0
lea eax, [esp + 8]
push eax
push 1
lea eax, [esp + 0x18]
push eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 4]
cmp eax, 1
je 0x494c2d
xor eax, eax
pop edi
pop ecx
ret 8
mov cl, byte [esp + 0xc]
test cl, cl
js 0x494c49
mov eax, dword [esp + 0x10]
pop edi
mov byte [eax], cl
mov byte [eax + 1], 0
mov eax, 1
pop ecx
ret 8
mov al, cl
and al, 0xe0
push esi
cmp al, 0xc0
jne 0x494c59
mov esi, 2
jmp 0x494c75
mov al, cl
and al, 0xf0
cmp al, 0xe0
jne 0x494c68
mov esi, 3
jmp 0x494c75
mov al, cl
and al, 0xf8
cmp al, 0xf0
jne 0x494cd2
mov esi, 4
mov edx, dword [esp + 0x14]
mov byte [edx], cl
cmp dword [edi + 4], 0
je 0x494ca4
lea eax, [esi - 1]
push eax
lea eax, [edx + 1]
push eax
push edi
call fcn.004945a0
mov edx, eax
lea ecx, [esi - 1]
xor eax, eax
cmp edx, ecx
setne al
dec eax
and eax, esi
pop esi
pop edi
pop ecx
ret 8
push 0
lea eax, [esp + 0xc]
push eax
lea eax, [esi - 1]
push eax
lea eax, [edx + 1]
push eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [esp + 8]
lea ecx, [esi - 1]
xor eax, eax
cmp edx, ecx
setne al
dec eax
and eax, esi
pop esi
pop edi
pop ecx
ret 8
mov eax, dword [esp + 0x14]
pop esi
pop edi
mov word [eax], 0x3f
mov eax, 1
pop ecx
ret 8

Function at 0x49624c
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push edi
xor edi, edi
push edi
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x4962c1
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
test esi, esi
jne 0x49626a
mov esi, 0x5380c4
push esi
call sub.MSVCRT.dll_wcslen
pop ecx
lea ebp, [eax*2 + 2]
push ebp
push 0x2002
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
test ebx, ebx
je 0x4962b8
call dword [sym.imp.USER32.dll_EmptyClipboard]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x4962b8
push ebp
push esi
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebx
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
mov edi, eax
call dword [sym.imp.USER32.dll_CloseClipboard]
pop esi
pop ebp
pop ebx
mov eax, edi
pop edi
ret 4
Function at 0x4971d0
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
push edi
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push esi
call fcn.004973b0
mov ebp, eax
add esp, 0xc
xor ebx, ebx
lea edi, [ebp*4]
test edi, edi
jle 0x497249
mov ecx, dword [esp + 0x14]
lea esi, [esi + edi*4]
add esi, 8
add ecx, 8
mov edx, dword [ecx - 8]
lea ecx, [ecx + 0x10]
mov eax, dword [esi - 8]
lea esi, [esi - 0x10]
mov dword [ecx - 0x18], eax
add ebx, 4
mov eax, dword [esi + 0xc]
sub edi, 4
mov dword [esi + 8], edx
mov edx, dword [ecx - 0x14]
mov dword [ecx - 0x14], eax
mov eax, dword [esi + 0x10]
mov dword [esi + 0xc], edx
mov edx, dword [ecx - 0x10]
mov dword [ecx - 0x10], eax
mov eax, dword [esi + 0x14]
mov dword [esi + 0x10], edx
mov edx, dword [ecx - 0xc]
mov dword [ecx - 0xc], eax
mov dword [esi + 0x14], edx
cmp ebx, edi
jl 0x497205
mov esi, dword [esp + 0x14]
cmp ebp, 1
jle 0x4973a9
add esi, 2
lea edi, [ebp - 1]
mov edx, dword [esi + 0xe]
lea esi, [esi + 0x10]
mov eax, edx
shr eax, 0x18
movzx ecx, byte [eax*4 + str.ccccwwww]
movzx eax, byte [esi - 1]
mov ecx, dword [ecx*4 + 0x54e298]
movzx eax, byte [eax*4 + str.ccccwwww]
xor ecx, dword [eax*4 + 0x54ea98]
movzx eax, byte [esi]
movzx eax, byte [eax*4 + str.ccccwwww]
xor ecx, dword [eax*4 + 0x54e698]
movzx eax, dl
mov edx, dword [esi + 2]
movzx eax, byte [eax*4 + str.ccccwwww]
xor ecx, dword [eax*4 + 0x54ee98]
mov eax, edx
shr eax, 0x18
mov dword [esi - 2], ecx
movzx ecx, byte [eax*4 + str.ccccwwww]
movzx eax, byte [esi + 3]
mov ecx, dword [ecx*4 + 0x54e298]
movzx eax, byte [eax*4 + str.ccccwwww]
xor ecx, dword [eax*4 + 0x54ea98]
movzx eax, byte [esi + 4]
movzx eax, byte [eax*4 + str.ccccwwww]
xor ecx, dword [eax*4 + 0x54e698]
movzx eax, dl
mov edx, dword [esi + 6]
movzx eax, byte [eax*4 + str.ccccwwww]
xor ecx, dword [eax*4 + 0x54ee98]
mov eax, edx
shr eax, 0x18
mov dword [esi + 2], ecx
movzx ecx, byte [eax*4 + str.ccccwwww]
movzx eax, byte [esi + 7]
mov ecx, dword [ecx*4 + 0x54e298]
movzx eax, byte [eax*4 + str.ccccwwww]
xor ecx, dword [eax*4 + 0x54ea98]
movzx eax, byte [esi + 8]
movzx eax, byte [eax*4 + str.ccccwwww]
xor ecx, dword [eax*4 + 0x54e698]
movzx eax, dl
mov edx, dword [esi + 0xa]
movzx eax, byte [eax*4 + str.ccccwwww]
xor ecx, dword [eax*4 + 0x54ee98]
mov eax, edx
shr eax, 0x18
mov dword [esi + 6], ecx
movzx ecx, byte [eax*4 + str.ccccwwww]
movzx eax, byte [esi + 0xb]
mov ecx, dword [ecx*4 + 0x54e298]
movzx eax, byte [eax*4 + str.ccccwwww]
xor ecx, dword [eax*4 + 0x54ea98]
movzx eax, byte [esi + 0xc]
movzx eax, byte [eax*4 + str.ccccwwww]
xor ecx, dword [eax*4 + 0x54e698]
movzx eax, dl
movzx eax, byte [eax*4 + str.ccccwwww]
xor ecx, dword [eax*4 + 0x54ee98]
mov dword [esi + 0xa], ecx
dec edi
jne 0x497258
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
ret
Function at 0x4978a0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0x10]
sub esp, 0x34
cdq
and edx, 0xf
push ebx
mov ebx, dword [esp + 0x40]
push ebp
mov ebp, dword [esp + 0x4c]
push esi
push edi
lea edi, [edx + eax]
sar edi, 4
and ebp, reloc.WS2_32.dll_ntohs
jns 0x4978ca
dec ebp
or ebp, 0xfffffff0
inc ebp
mov dword [esp + 0x1c], ebp
je 0x4978df
test edi, edi
jne 0x4978de
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x34
ret
dec edi
mov eax, dword [esp + 0x58]
mov esi, dword [eax + 8]
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov dword [esp + 0x4c], esi
mov esi, dword [eax + 0xc]
mov dword [esp + 0x10], esi
mov esi, dword [esp + 0x50]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], edx
test edi, edi
je 0x497972
mov ebp, dword [esp + 0x48]
mov eax, ebx
sub eax, esi
mov dword [esp + 0x50], eax
push esi
push ebx
push dword [ebp + 4]
lea eax, [ebp + 0xf8]
push eax
call fcn.00496600
mov eax, dword [esp + 0x24]
add esp, 0x10
xor dword [esi], eax
mov eax, dword [esp + 0x18]
xor dword [esi + 4], eax
mov eax, dword [esp + 0x4c]
xor dword [esi + 8], eax
mov eax, dword [esp + 0x50]
mov ecx, dword [esp + 0x10]
xor dword [esi + 0xc], ecx
mov ecx, dword [ebx]
mov eax, dword [eax + esi + 8]
add esi, 0x10
mov edx, dword [ebx + 4]
mov dword [esp + 0x4c], eax
mov eax, dword [ebx + 0xc]
add ebx, 0x10
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], edx
mov dword [esp + 0x10], eax
dec edi
jne 0x497912
mov ebp, dword [esp + 0x1c]
mov eax, dword [esp + 0x58]
test ebp, ebp
je 0x497a3a
mov edi, dword [ebx]
mov edx, dword [ebx + 4]
mov ecx, dword [ebx + 8]
mov eax, dword [ebx + 0xc]
mov ebp, dword [esp + 0x58]
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], edx
mov dword [esp + 0x30], eax
mov dword [ebp], edi
mov edi, ebp
mov dword [esp + 0x2c], ecx
mov dword [edi + 4], edx
lea edx, [esp + 0x34]
push edx
mov dword [edi + 0xc], eax
lea edx, [esp + 0x28]
mov eax, dword [esp + 0x4c]
push edx
mov dword [edi + 8], ecx
push dword [eax + 4]
lea ecx, [eax + 0xf8]
push ecx
mov dword [esp + 0x30], ecx
call fcn.00496600
mov ebp, dword [esp + 0x2c]
add esp, 0x10
test ebp, ebp
je 0x4979fa
mov eax, esi
lea edi, [ebx + 0x10]
sub eax, ebx
lea edx, [esp + 0x34]
mov dword [esp + 0x50], eax
mov ebx, eax
mov al, byte [edi]
lea edi, [edi + 1]
mov cl, byte [edx]
lea edx, [edx + 1]
xor cl, al
mov byte [edx - 1], al
mov byte [ebx + edi - 1], cl
dec ebp
jne 0x4979e4
push esi
lea eax, [esp + 0x38]
push eax
mov eax, dword [esp + 0x50]
push dword [eax + 4]
push dword [esp + 0x2c]
call fcn.00496600
mov eax, dword [esp + 0x24]
add esp, 0x10
xor dword [esi], eax
mov eax, dword [esp + 0x18]
xor dword [esi + 4], eax
mov eax, dword [esp + 0x4c]
xor dword [esi + 8], eax
mov ecx, dword [esp + 0x10]
xor dword [esi + 0xc], ecx
mov eax, dword [esp + 0x54]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x34
ret
pop edi
mov dword [eax], ecx
mov ecx, dword [esp + 0x48]
pop esi
mov dword [eax + 8], ecx
mov ecx, dword [esp + 8]
pop ebp
mov dword [eax + 4], edx
mov dword [eax + 0xc], ecx
mov eax, dword [esp + 0x48]
pop ebx
add esp, 0x34
ret
Function at 0x49820a
Capabilities:
Set thread local storage value

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
xor ebx, ebx
push edi
mov edi, ebx
test esi, esi
je 0x498267
push esi
call dword [esi + 0x58]
mov ecx, dword [esi + 0x80]
mov edi, eax
mov dword [esi + 0x94], ecx
mov ecx, dword [esi + 0x84]
mov dword [esi + 0x98], ecx
test edi, edi
jne 0x498267
mov eax, dword [esi + 0x70]
test eax, eax
je 0x498246
push ebx
push esi
call eax
push esi
push ebx
push dword [0xb3fee4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
push ebx
push dword [0xb427e8]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [0xb427ec], ebx
mov eax, edi
pop edi
pop esi
pop ebx
ret 4

Function at 0x49837d
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [0xb427e8]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
mov eax, dword [ebp + 0x18]
cmp eax, dword [esi + 0xac]
je 0x4983a5
push eax
push esi
mov dword [esi + 0xac], eax
call dword [esi + 0x40]
push dword [ebp + 0x14]
mov eax, dword [esi + 0x90]
push dword [ebp + 0x10]
add eax, dword [ebp + 0xc]
push eax
mov eax, dword [esi + 0x8c]
add eax, dword [ebp + 8]
push eax
push esi
call dword [esi + 4]
pop esi
pop ebp
ret 0x14

Function at 0x4983c8
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push dword [0xb427e8]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov ecx, dword [ebx + 0x74]
cmp ecx, 2
je 0x4983f5
cmp ecx, 3
je 0x4983f5
cmp ecx, 8
je 0x4983f5
cmp ecx, 0xc
jne 0x4984dd
fldz
fld dword [ebp + 8]
fcom st(1)
fnstsw ax
test ah, 5
jp 0x498407
fstp st(0)
jmp 0x498416
fstp st(1)
fld1
fcom st(1)
fnstsw ax
test ah, 5
jp 0x49841e
fstp st(1)
fstp dword [ebp + 8]
fld dword [ebp + 8]
jmp 0x498420
fstp st(0)
push esi
mov esi, dword [ebx + 0xbc]
push edi
xor edi, edi
jmp 0x49844a
fld dword [esi + 4]
fld st(1)
fucompp
fnstsw ax
test ah, 0x44
jnp 0x49849b
fld dword [esi + 4]
fcomp st(1)
fnstsw ax
test ah, 0x41
je 0x498471
mov edi, esi
mov esi, dword [esi]
test esi, esi
jne 0x49842c
fstp st(0)
push 0x18
push 0
push dword [0xb3fee4]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
test edx, edx
je 0x4984db
and dword [edx], 0
test edi, edi
je 0x4984a5
mov dword [edi], edx
jmp 0x4984ab
push 0x18
push 0
push dword [0xb3fee4]
fstp st(0)
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
test edx, edx
je 0x498450
mov dword [edx], esi
test edi, edi
je 0x498493
mov dword [edi], edx
jmp 0x49849f
mov dword [ebx + 0xbc], edx
jmp 0x49849f
fstp st(0)
mov edx, esi
test edx, edx
jne 0x4984ab
jmp 0x498450
mov dword [ebx + 0xbc], edx
mov ecx, dword [ebp + 0xc]
mov esi, 0xff
fld dword [ebp + 8]
movzx eax, cl
mov dword [edx + 8], eax
mov eax, ecx
sar eax, 8
and eax, esi
mov dword [edx + 0xc], eax
mov eax, ecx
sar eax, 0x10
and eax, esi
sar ecx, 0x18
and ecx, esi
mov dword [edx + 0x10], eax
fstp dword [edx + 4]
mov dword [edx + 0x14], ecx
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x49872d
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push ebp
push esi
push edi
push dword [0xb427e8]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, dword [esp + 0x14]
mov edi, eax
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x18]
mov edx, dword [edi + 0x8c]
add esi, edx
mov ecx, dword [edi + 0x90]
add ebx, edx
mov edx, dword [esp + 0x20]
add ebp, ecx
mov eax, dword [edi + 0x74]
add edx, ecx
mov dword [esp + 0x20], edx
cmp eax, 2
je 0x498782
cmp eax, 3
je 0x498782
cmp eax, 8
je 0x498782
cmp eax, 0xc
jne 0x49894f
mov dword [edi + 0x124], edx
mov eax, ebx
sub edx, ebp
mov dword [edi + 0x118], esi
sub eax, esi
mov dword [edi + 0x11c], ebp
mov ecx, edx
mov dword [esp + 0x14], eax
imul ecx, edx
imul eax, eax
mov dword [edi + 0x120], ebx
mov dword [esp + 0x1c], edx
add ecx, eax
mov dword [esp + 0x18], ecx
fild dword [esp + 0x18]
push ecx
fstp dword [esp + 0x1c]
fld dword [esp + 0x1c]
fstp dword [esp]
call fcn.00498956
mov eax, dword [esp + 0x24]
fstp dword [edi + 0x128]
pop ecx
cmp ebp, eax
jne 0x4987fc
cmp esi, ebx
jg 0x4987ed
mov dword [edi + 0xb4], 0x498629
jmp 0x49894f
mov dword [edi + 0xb4], 0x49866a
jmp 0x49894f
cmp esi, ebx
jne 0x498822
cmp ebp, eax
jg 0x498813
mov dword [edi + 0xb4], 0x4986ab
jmp 0x49894f
mov dword [edi + 0xb4], 0x4986ec
jmp 0x49894f
push dword [esp + 0x1c]
call sub.MSVCRT.dll_abs
push dword [esp + 0x18]
mov esi, eax
call sub.MSVCRT.dll_abs
xor edx, edx
pop ecx
inc edx
pop ecx
cmp eax, esi
jl 0x498848
and dword [edi + 0x130], 0
jmp 0x498896
mov eax, dword [edi + 0x11c]
xor dword [edi + 0x118], eax
mov eax, dword [edi + 0x118]
xor dword [edi + 0x11c], eax
mov eax, dword [edi + 0x11c]
xor dword [edi + 0x118], eax
mov eax, dword [edi + 0x124]
xor dword [edi + 0x120], eax
mov eax, dword [edi + 0x120]
xor dword [edi + 0x124], eax
mov eax, dword [edi + 0x124]
xor dword [edi + 0x120], eax
mov dword [edi + 0x130], edx
mov ecx, dword [edi + 0x118]
mov eax, dword [edi + 0x120]
cmp ecx, eax
jge 0x4988af
and dword [edi + 0x12c], 0
jmp 0x4988f3
xor eax, ecx
mov dword [edi + 0x12c], edx
xor dword [edi + 0x120], eax
mov dword [edi + 0x118], eax
mov eax, dword [edi + 0x120]
xor dword [edi + 0x118], eax
mov eax, dword [edi + 0x124]
xor dword [edi + 0x11c], eax
mov eax, dword [edi + 0x11c]
xor dword [edi + 0x124], eax
mov eax, dword [edi + 0x124]
xor dword [edi + 0x11c], eax
mov eax, dword [edi + 0x124]
sub eax, dword [edi + 0x11c]
mov dword [esp + 0x20], eax
fild dword [esp + 0x20]
fstp dword [esp + 0x20]
fld dword [esp + 0x20]
mov eax, dword [edi + 0x120]
sub eax, dword [edi + 0x118]
mov dword [esp + 0x20], eax
fild dword [esp + 0x20]
fstp dword [esp + 0x20]
fdiv dword [esp + 0x20]
mov dword [edi + 0xb4], 0x498514
fstp dword [esp + 0x20]
fld dword [esp + 0x20]
fst dword [edi + 0x134]
fdivr qword [0x54f6d0]
fstp dword [edi + 0x138]
pop edi
pop esi
pop ebp
pop ebx
ret 0x10
Function at 0x498970
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push ebp
push esi
push edi
push dword [0xb427e8]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebp, dword [esp + 0x14]
mov esi, eax
mov eax, dword [esp + 0x18]
mov edi, dword [esp + 0x1c]
add eax, dword [esi + 0x90]
add ebp, dword [esi + 0x8c]
mov dword [esp + 0x18], eax
test edi, edi
jns 0x4989a6
add ebp, edi
neg edi
mov ebx, dword [esp + 0x20]
test ebx, ebx
jns 0x4989b6
add eax, ebx
neg ebx
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x24]
add eax, eax
cmp eax, edi
jle 0x4989cb
mov eax, edi
cdq
sub eax, edx
sar eax, 1
mov dword [esp + 0x24], eax
mov ecx, dword [esp + 0x28]
add ecx, ecx
cmp ecx, ebx
jle 0x4989e0
mov eax, ebx
cdq
sub eax, edx
sar eax, 1
mov dword [esp + 0x28], eax
mov eax, dword [esi + 0xa4]
cmp eax, dword [esi + 0xac]
je 0x4989f9
push eax
push esi
mov dword [esi + 0xac], eax
call dword [esi + 0x40]
push dword [esp + 0x28]
push dword [esp + 0x28]
push ebx
push edi
push dword [esp + 0x28]
push ebp
push esi
call dword [esi + 8]
pop edi
pop esi
pop ebp
pop ebx
ret 0x18

Function at 0x498a13
Capabilities:
Get thread local storage value

Disassembly:
push esi
push dword [0xb427e8]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
mov eax, dword [esi + 0xa4]
cmp eax, dword [esi + 0xac]
je 0x498a3b
push eax
push esi
mov dword [esi + 0xac], eax
call dword [esi + 0x40]
push dword [esp + 0x14]
mov eax, dword [esi + 0x90]
push dword [esp + 0x14]
add eax, dword [esp + 0x14]
push eax
mov eax, dword [esi + 0x8c]
add eax, dword [esp + 0x14]
push eax
push esi
call dword [esi + 4]
pop esi
ret 0x10

Function at 0x498a61
Capabilities:
Get thread local storage value

Disassembly:
push dword [0xb427e8]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edx, eax
mov ecx, dword [edx + 0x74]
cmp ecx, 2
je 0x498a86
cmp ecx, 3
je 0x498a86
cmp ecx, 8
je 0x498a86
cmp ecx, 0xc
jne 0x498a94
mov eax, dword [esp + 4]
test eax, eax
je 0x498a94
mov dword [edx + 0xb8], eax
ret 4

Function at 0x498a97
Capabilities:
Get thread local storage value

Disassembly:
push dword [0xb427e8]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [eax + 0x90]
add ecx, dword [esp + 0xc]
push ecx
mov ecx, dword [eax + 0x8c]
add ecx, dword [esp + 0xc]
push ecx
push dword [esp + 0xc]
push eax
call dword [eax + 0x24]
ret 0xc

Function at 0x498ac4
Capabilities:
Get thread local storage value

Disassembly:
push dword [0xb427e8]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [eax + 0x90]
add ecx, dword [esp + 8]
push ecx
mov ecx, dword [eax + 0x8c]
add ecx, dword [esp + 8]
push ecx
push eax
call dword [eax + 0x54]
ret 8

Function at 0x498aed
Capabilities:
Get thread local storage value

Disassembly:
push dword [0xb427e8]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push dword [esp + 0xc]
mov ecx, dword [eax + 0x90]
add ecx, dword [esp + 0xc]
push ecx
mov ecx, dword [eax + 0x8c]
add ecx, dword [esp + 0xc]
push ecx
push eax
call dword [eax + 0x50]
ret 0xc
Function at 0x498b1a
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push ebp
push esi
push edi
push dword [0xb427e8]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebp, dword [esp + 0x14]
mov edi, eax
mov eax, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
add eax, dword [edi + 0x90]
add ebp, dword [edi + 0x8c]
mov dword [esp + 0x18], eax
test esi, esi
jns 0x498b50
add ebp, esi
neg esi
mov ebx, dword [esp + 0x20]
test ebx, ebx
jns 0x498b60
add eax, ebx
neg ebx
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x24]
add eax, eax
cmp eax, esi
jle 0x498b75
mov eax, esi
cdq
sub eax, edx
sar eax, 1
mov dword [esp + 0x24], eax
mov ecx, dword [esp + 0x28]
add ecx, ecx
cmp ecx, ebx
jle 0x498b8a
mov eax, ebx
cdq
sub eax, edx
sar eax, 1
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x2c]
cmp eax, dword [edi + 0xac]
je 0x498ba1
push eax
push edi
mov dword [edi + 0xac], eax
call dword [edi + 0x40]
push dword [esp + 0x28]
push dword [esp + 0x28]
push ebx
push esi
push dword [esp + 0x28]
push ebp
push edi
call dword [edi + 8]
pop edi
pop esi
pop ebp
pop ebx
ret 0x1c

Function at 0x498c30
Capabilities:
Set thread local storage value

Disassembly:
push esi
push 0x184
push 8
push dword [0xb3fee4]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
push esi
push dword [0xb427e8]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push dword [esp + 8]
mov dword [0xb427ec], esi
and dword [esi + 0xa8], 0
or dword [esi + 0xac], 0xffffffff
or dword [esi + 0xb0], 0xffffffff
push esi
mov dword [esi + 0xa4], 0xffffff
mov dword [esi + 0x74], 2
mov dword [esi + 0x78], 0x3f
call fcn.0049cb71
mov dword [esi + 0x58], 0x499843
mov eax, esi
mov dword [esi + 0x5c], 0x49988f
mov dword [esi + 0x10], fcn.004993e4
mov dword [esi + 0x30], 0x4992d6
mov dword [esi + 0x64], 0x499919
mov dword [esi + 0x60], 0x4998d1
mov dword [esi + 0x34], 0x498f86
mov dword [esi + 0x24], 0x498f5d
mov dword [esi + 0x28], 0x498f32
mov dword [esi + 0x2c], 0x498e84
mov dword [esi + 0x44], 0x499649
pop esi
ret 4
Function at 0x49acbb
Capabilities:
Set thread local storage value

Disassembly:
push esi
push 0x10c
push 8
push dword [0xb3fee4]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
push esi
push dword [0xb427e8]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [0xb427ec], esi
mov eax, esi
and dword [esi + 0xa8], 0
or dword [esi + 0xac], 0xffffffff
or dword [esi + 0xb0], 0xffffffff
mov dword [esi + 0xa4], 0xffffff
mov dword [esi + 0x74], 1
mov dword [esi + 0x78], 7
mov dword [esi], 0x499d60
mov dword [esi + 4], 0x499d80
mov dword [esi + 8], 0x49aab7
mov dword [esi + 0xc], 0x499e18
mov dword [esi + 0x10], 0x49a335
mov dword [esi + 0x14], 0x49a2c7
mov dword [esi + 0x18], 0x49a305
mov dword [esi + 0x1c], 0x49a31d
mov dword [esi + 0x20], fcn.0049a391
mov dword [esi + 0x24], 0x49a196
mov dword [esi + 0x28], fcn.00499fe4
mov dword [esi + 0x2c], 0x499efb
mov dword [esi + 0x30], 0x49a25d
mov dword [esi + 0x34], 0x49a1b2
mov dword [esi + 0x38], 0x49a40e
mov dword [esi + 0x3c], 0x49a51f
mov dword [esi + 0x40], 0x49a5c3
mov dword [esi + 0x44], 0x49a65a
mov dword [esi + 0x48], 0x49a758
mov dword [esi + 0x4c], 0x49a939
mov dword [esi + 0x50], 0x49a7a9
mov dword [esi + 0x54], 0x49a9fb
mov dword [esi + 0x58], 0x49aaf6
mov dword [esi + 0x5c], 0x49abb1
mov dword [esi + 0x60], 0x49ac29
mov dword [esi + 0x64], 0x49ac6f
pop esi
ret