Function at 0x4a3140
Capabilities:
Allocate thread local storage
Execute anti-debugging instructions
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push edi
push esi
mov byte [ebp - 0xc], 0
xor edi, edi
cmp byte [0x4fddf4], 0
jne 0x4a315f
mov byte [0x4fddf4], 1
cmp dword [0x4fde28], 0
jne 0x4a318a
push 0x4fddf8
mov eax, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
call eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsAlloc]
call eax
mov dword [0x4fddec], eax
mov eax, 0x4fddec
mov dword [0x4fddf0], eax
push 0x4fddf8
mov eax, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call eax
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call eax
xor ebx, ebx
mov dword [ebp - 8], eax
mov edx, dword [0x4fde2c]
mov eax, dword [0x4fde28]
cmp ebx, edx
jge 0x4a330b
mov ecx, dword [eax + ebx*4]
or ecx, ecx
jne 0x4a32e1
cmp byte [ebp - 0xc], 0
jne 0x4a3302
push 1
push 0x20
call fcn.004a8449
add esp, 8
mov edi, eax
or edi, edi
jne 0x4a31f1
push 0x4fddf8
mov eax, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call eax
xor ebx, ebx
mov eax, ebx
pop esi
pop edi
pop ebx
leave
ret
mov eax, dword [0x4fde28]
mov dword [eax + ebx*4], edi
mov byte [ebp - 0xc], 1
mov edx, dword [0x4fde2c]
inc ebx
cmp ebx, edx
jl 0x4a31b5
jmp 0x4a330b
sub eax, 0
je 0x4a3256
sub eax, 0x1a
je 0x4a3271
sub eax, 4
je 0x4a323b
sub eax, 2
je 0x4a3256
mov byte [ebp - 0x10], 0
call fcn.004a6a4b
mov edx, dword [ebp - 4]
mov dword [eax], edx
cmp byte [ebp - 0x10], 0
je 0x4a33e5
jmp 0x4a328a
mov ebx, 0xa
call fcn.004a6a4b
mov edx, dword [ebp - 4]
mov dword [eax], edx
cmp byte [ebp - 0x10], 0
je 0x4a33e5
jmp 0x4a328a
mov ebx, 0x14
call fcn.004a6a4b
mov edx, dword [ebp - 4]
mov dword [eax], edx
cmp byte [ebp - 0x10], 0
je 0x4a33e5
jmp 0x4a328a
mov ebx, 0x1e
call fcn.004a6a4b
mov edx, dword [ebp - 4]
mov dword [eax], edx
cmp byte [ebp - 0x10], 0
je 0x4a33e5
mov ecx, ebx
mov eax, dword [ebp - 0x20]
shl eax, cl
mov edx, eax
shr edx, cl
xor edx, dword [ebp - 0x20]
or edx, dword [ebp - 0x1c]
or edx, edx
jne 0x4a33e5
cmp eax, 0x4110
jb 0x4a33e5
mov dword [0x4ec080], eax
push 0x4fde20
mov eax, dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
call eax
rdtsc
mov dword [0x4fde1c], edx
mov dword [0x4fde18], eax
cmp byte [ebp - 0xc], 0
sete al
movzx esi, al
je 0x4a349f
jmp 0x4a351a
mov esi, dword [ecx + 0x14]
cmp esi, dword [ebp - 8]
jne 0x4a3302
push 0x4fddf8
mov eax, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call eax
mov eax, dword [0x4fde28]
mov eax, dword [eax + ebx*4]
pop esi
pop edi
pop ebx
leave
ret
inc ebx
cmp ebx, edx
jl 0x4a31b5
test eax, eax
jne 0x4a3493
push str.GHS_EAGLE_LOG_SIZE
call fcn.004a653a
mov esi, eax
add esp, 4
or esi, esi
mov byte [ebp - 0x10], 0
je 0x4a33e5
xor ebx, ebx
mov dword [ebp - 0x18], 0
call fcn.004a6a4b
mov edx, dword [eax]
mov dword [ebp - 4], edx
call fcn.004a6a4b
mov dword [eax], 0
lea eax, [ebp - 0x18]
push 0xa
push eax
push esi
call fcn.004a5954
add esp, 0xc
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
cmp eax, esi
je 0x4a3276
cmp byte [eax], 0
je 0x4a337b
cmp byte [eax + 1], 0
jne 0x4a3276
cmp dword [ebp - 0x1c], 0
jl 0x4a3276
jg 0x4a3391
cmp dword [ebp - 0x20], 0
jbe 0x4a3276
call fcn.004a6a4b
cmp dword [eax], 0
jne 0x4a3276
mov byte [ebp - 0x10], 1
mov eax, dword [ebp - 0x18]
movsx eax, byte [eax]
sub eax, 0x4d
jae 0x4a320d
sub eax, 0xfffffffe
je 0x4a323b
sub eax, 0xfffffffc
je 0x4a3271
sub eax, 0xffffffb9
je 0x4a3276
mov byte [ebp - 0x10], 0
call fcn.004a6a4b
mov edx, dword [ebp - 4]
mov dword [eax], edx
cmp byte [ebp - 0x10], 0
jne 0x4a328a
push str.GHS_EAGLE_LOG_BYTES
call fcn.004a653a
add esp, 4
mov esi, eax
or esi, esi
je 0x4a347a
mov dword [ebp - 0x14], 0
call fcn.004a6a4b
mov edx, dword [eax]
mov dword [ebp - 4], edx
call fcn.004a6a4b
mov dword [eax], 0
push 0xa
lea eax, [ebp - 0x14]
push eax
push esi
call fcn.004a5954
sub esp, 0xfffffff4
mov ebx, eax
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x14]
cmp eax, esi
je 0x4a3470
cmp byte [eax], 0
jne 0x4a3470
cmp dword [ebp - 0x1c], 0
jl 0x4a3470
jg 0x4a3449
cmp dword [ebp - 0x20], 0
jbe 0x4a3470
call fcn.004a6a4b
cmp dword [eax], 0
jne 0x4a3470
xor dword [ebp - 0x20], ebx
mov eax, dword [ebp - 0x1c]
or dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x4a3470
cmp ebx, 0x4110
jb 0x4a3470
mov dword [0x4ec080], ebx
call fcn.004a6a4b
mov edx, dword [ebp - 4]
mov dword [eax], edx
push 0x4fde20
mov eax, dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
call eax
rdtsc
mov dword [0x4fde1c], edx
mov dword [0x4fde18], eax
cmp byte [ebp - 0xc], 0
sete al
movzx esi, al
jne 0x4a351a
push 4
mov eax, dword [0x4fde2c]
inc eax
push eax
call fcn.004a8449
sub esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x4fde2c]
shl eax, 2
push eax
push dword [0x4fde28]
push ebx
call fcn.004a86b0
sub esp, 0xfffffff4
push 1
push 0x20
call fcn.004a8449
sub esp, 0xfffffff8
mov edi, eax
or edi, edi
jne 0x4a34fa
push ebx
call fcn.004a7a46
add esp, 4
push 0x4fddf8
mov eax, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call eax
xor esi, esi
mov eax, esi
pop esi
pop edi
pop ebx
leave
ret
mov eax, dword [0x4fde2c]
mov dword [ebx + eax*4], edi
mov eax, dword [0x4fde28]
mov dword [0x4fde28], ebx
test eax, eax
je 0x4a351a
push eax
call fcn.004a7a46
sub esp, 0xfffffffc
mov eax, dword [ebp - 8]
mov dword [edi + 0x14], eax
push 1
push dword [0x4ec080]
call fcn.004a8449
add esp, 8
mov dword [edi + 8], eax
mov edx, dword [0x4ec080]
add edx, eax
add edx, 0xffffbee8
mov dword [edi + 0xc], edx
mov dword [edi], eax
rdtsc
mov dword [edi + 0x10], edx
mov byte [edi + 0x1c], 1
mov byte [edi + 4], 1
mov dword [edi + 0x18], 0
mov ebx, dword [edi + 8]
test ebx, ebx
jne 0x4a35c6
mov edx, dword [0x4fde2c]
push edi
push dword [0x4fddec]
mov eax, dword [sym.imp.KERNEL32.dll_TlsSetValue]
call eax
test esi, esi
je 0x4a35de
inc dword [0x4fde2c]
push 0x4fddf8
mov eax, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call eax
mov eax, edi
pop esi
pop edi
pop ebx
leave
ret