joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46bf20
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov eax, dword [ebx + 4]
mov eax, dword [eax - 4]
mov dword [ebp - 4], eax
lea eax, [ebx + 4]
mov edx, dword [eax]
lea edx, [edx - 4]
mov dword [eax], edx
mov eax, edx
mov edx, dword [ebx]
cmp eax, edx
jae 0x46bf63
push 0
push 0
push 0
push 0x233b
call fcn.00492ef0
add esp, 0x10
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
cmp eax, 8
je 0x46bf95
jg 0x46bf7c
mov eax, dword [ebp - 0x14]
cmp eax, 2
je 0x46bf86
jmp 0x46bfba
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
je 0x46bfa7
jmp 0x46bfba
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
cdq
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
jmp 0x46bfe2
mov eax, dword [ebp - 4]
push dword [eax + 0xc]
mov eax, dword [eax + 8]
pop edx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
jmp 0x46bfe2
mov eax, dword [ebp - 4]
fld qword [eax + 8]
call fcn.00532060
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
jmp 0x46bfe2
push dword [0x696ed8]
mov eax, dword [0x696ed4]
pop edx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
push 0
push str.hb_vmPopNumber__
push 0
push 0x233a
call fcn.00492ef0
add esp, 0x10
mov eax, dword [ebx + 4]
mov eax, dword [eax]
mov dword [eax], 0
push dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
pop edx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x46c000
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov eax, dword [ebx + 4]
mov esi, dword [eax - 4]
lea eax, [ebx + 4]
mov edx, dword [eax]
lea edx, [edx - 4]
mov dword [eax], edx
mov eax, edx
mov edx, dword [ebx]
cmp eax, edx
jae 0x46c041
push 0
push 0
push 0
push 0x233b
call fcn.00492ef0
add esp, 0x10
mov eax, dword [ebp + 8]
push eax
push esi
call fcn.0049fe30
add esp, 8
fst qword [ebp - 0x10]
fstp qword [ebp - 8]
mov eax, dword [ebx + 4]
mov eax, dword [eax]
mov dword [eax], 0
fld qword [ebp - 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x46c070
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
push 0
mov eax, dword [ebx + 4]
mov eax, dword [eax - 4]
push eax
call fcn.00468b20
add esp, 8
lea eax, [ebx + 4]
mov edx, dword [eax]
lea edx, [edx - 4]
mov dword [eax], edx
mov eax, edx
mov edx, dword [ebx]
cmp eax, edx
jae 0x46c0b8
push 0
push 0
push 0
push 0x233b
call fcn.00492ef0
add esp, 0x10
pop ebx
pop ebp
ret
Function at 0x46c0c0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
call fcn.004f11df
mov esi, eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebx + 4]
mov eax, dword [eax - 4]
push eax
call fcn.00468b20
add esp, 8
test ax, ax
jne 0x46c105
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebx + 4]
mov eax, dword [eax - 8]
push eax
call fcn.004f1f7e
add esp, 8
push esi
call fcn.004f11eb
pop ecx
lea eax, [ebx + 4]
mov edx, dword [eax]
lea edx, [edx - 4]
mov dword [eax], edx
mov eax, edx
mov edx, dword [ebx]
cmp eax, edx
jae 0x46c131
push 0
push 0
push 0
push 0x233b
call fcn.00492ef0
add esp, 0x10
mov eax, dword [ebx + 4]
mov eax, dword [eax - 4]
mov eax, dword [eax]
and eax, 0xf405
je 0x46c14f
mov eax, dword [ebx + 4]
mov eax, dword [eax - 4]
push eax
call fcn.004a45e0
pop ecx
jmp 0x46c15b
mov eax, dword [ebx + 4]
mov eax, dword [eax - 4]
mov dword [eax], 0
lea eax, [ebx + 4]
mov edx, dword [eax]
lea edx, [edx - 4]
mov dword [eax], edx
mov eax, edx
mov edx, dword [ebx]
cmp eax, edx
jae 0x46c180
push 0
push 0
push 0
push 0x233b
call fcn.00492ef0
add esp, 0x10
pop esi
pop ebx
pop ebp
ret
Function at 0x46c190
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov eax, dword [ebx + 4]
mov esi, dword [eax - 4]
mov eax, dword [esi]
and eax, 0x400
je 0x46c384
mov edi, dword [esi + 0x10]
movsx eax, byte [edi]
cmp eax, 0x4d
je 0x46c1cb
cmp eax, 0x6d
jne 0x46c2ae
cmp byte [edi + 1], 0
je 0x46c1f4
mov eax, dword [esi + 8]
cmp eax, 4
jb 0x46c384
push eax
push 0x696b72
push edi
call fcn.004a9d10
add esp, 0xc
test eax, eax
jne 0x46c384
mov eax, dword [ebx + 4]
mov eax, dword [eax - 8]
push eax
mov eax, dword [ebp + 8]
push eax
call fcn.004739c0
add esp, 8
mov eax, dword [ebx + 4]
mov eax, dword [eax - 4]
mov eax, dword [eax]
and eax, 0xf405
je 0x46c225
mov eax, dword [ebx + 4]
mov eax, dword [eax - 4]
push eax
call fcn.004a45e0
pop ecx
jmp 0x46c231
mov eax, dword [ebx + 4]
mov eax, dword [eax - 4]
mov dword [eax], 0
lea eax, [ebx + 4]
mov edx, dword [eax]
lea edx, [edx - 4]
mov dword [eax], edx
mov eax, edx
mov edx, dword [ebx]
cmp eax, edx
jae 0x46c256
push 0
push 0
push 0
push 0x233b
call fcn.00492ef0
add esp, 0x10
mov eax, dword [ebx + 4]
mov eax, dword [eax - 4]
mov eax, dword [eax]
and eax, 0xf405
je 0x46c274
mov eax, dword [ebx + 4]
mov eax, dword [eax - 4]
push eax
call fcn.004a45e0
pop ecx
jmp 0x46c280
mov eax, dword [ebx + 4]
mov eax, dword [eax - 4]
mov dword [eax], 0
lea eax, [ebx + 4]
mov edx, dword [eax]
lea edx, [edx - 4]
mov dword [eax], edx
mov eax, edx
mov edx, dword [ebx]
cmp eax, edx
jae 0x46c38e
push 0
push 0
push 0
push 0x233b
call fcn.00492ef0
add esp, 0x10
jmp 0x46c38e
mov eax, dword [esi + 8]
cmp eax, 4
jb 0x46c384
push eax
push 0x696b6c
push edi
call fcn.004a9d10
add esp, 0xc
test eax, eax
jne 0x46c384
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebx + 4]
mov eax, dword [eax - 8]
push eax
call fcn.004f1f7e
add esp, 8
mov eax, dword [ebx + 4]
mov eax, dword [eax - 4]
mov eax, dword [eax]
and eax, 0xf405
je 0x46c302
mov eax, dword [ebx + 4]
mov eax, dword [eax - 4]
push eax
call fcn.004a45e0
pop ecx
jmp 0x46c30e
mov eax, dword [ebx + 4]
mov eax, dword [eax - 4]
mov dword [eax], 0
lea eax, [ebx + 4]
mov edx, dword [eax]
lea edx, [edx - 4]
mov dword [eax], edx
mov eax, edx
mov edx, dword [ebx]
cmp eax, edx
jae 0x46c333
push 0
push 0
push 0
push 0x233b
call fcn.00492ef0
add esp, 0x10
mov eax, dword [ebx + 4]
mov eax, dword [eax - 4]
mov eax, dword [eax]
and eax, 0xf405
je 0x46c351
mov eax, dword [ebx + 4]
mov eax, dword [eax - 4]
push eax
call fcn.004a45e0
pop ecx
jmp 0x46c35d
mov eax, dword [ebx + 4]
mov eax, dword [eax - 4]
mov dword [eax], 0
lea eax, [ebx + 4]
mov edx, dword [eax]
lea edx, [edx - 4]
mov dword [eax], edx
mov eax, edx
mov edx, dword [ebx]
cmp eax, edx
jae 0x46c38e
push 0
push 0
push 0
push 0x233b
call fcn.00492ef0
add esp, 0x10
jmp 0x46c38e
mov eax, dword [ebp + 8]
push eax
call fcn.0046c0c0
pop ecx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x46c3a0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov eax, dword [ebx + 4]
mov edi, dword [eax - 4]
and dword [edi], 0xfffff7ff
movsx eax, word [ebp + 8]
test eax, eax
jl 0x46c3e7
movsx eax, word [ebp + 8]
mov edx, dword [ebx + 0x30]
mov esi, dword [edx + eax*4 + 4]
mov eax, dword [esi]
and eax, 0x2000
je 0x46c3fd
push esi
call fcn.004a0990
pop ecx
mov esi, eax
jmp 0x46c3fd
movsx eax, word [ebp + 8]
push eax
mov eax, dword [ebx + 0x30]
mov eax, dword [eax + 4]
push eax
call fcn.004bc850
add esp, 8
mov esi, eax
mov eax, dword [edi]
and eax, 0x2000
je 0x46c459
push edi
call fcn.004a0990
pop ecx
mov edx, esi
cmp eax, edx
jne 0x46c459
push 0
push str.Cyclic_Reference_assignment_
push 0
push 0x232c
push 1
call fcn.00492870
add esp, 0x14
lea eax, [ebx + 4]
mov edx, dword [eax]
lea edx, [edx - 4]
mov dword [eax], edx
mov eax, edx
mov edx, dword [ebx]
cmp eax, edx
jae 0x46c4d3
push 0
push 0
push 0
push 0x233b
call fcn.00492ef0
add esp, 0x10
jmp 0x46c4d3
mov eax, dword [esi]
and eax, 0x1a
je 0x46c467
mov eax, dword [edi]
and eax, 0x1a
jne 0x46c46d
mov eax, dword [esi]
cmp eax, dword [edi]
jne 0x46c479
push edi
push esi
call fcn.004a44a0
add esp, 8
jmp 0x46c4ae
push esi
call fcn.004874e0
pop ecx
and eax, 0x8000
je 0x46c4a4
push esi
push 0
push 0
push 0x696ea5
push edi
push esi
call fcn.004689e0
add esp, 0x18
push edi
call fcn.004a45e0
pop ecx
jmp 0x46c4ae
push edi
push esi
call fcn.004a44a0
add esp, 8
lea eax, [ebx + 4]
mov edx, dword [eax]
lea edx, [edx - 4]
mov dword [eax], edx
mov eax, edx
mov edx, dword [ebx]
cmp eax, edx
jae 0x46c4d3
push 0
push 0
push 0
push 0x233b
call fcn.00492ef0
add esp, 0x10
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x46c4e0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov eax, dword [ebx + 4]
mov esi, dword [eax - 4]
and dword [esi], 0xfffff7ff
movzx eax, word [ebp + 8]
shl eax, 5
mov edx, dword [ebx + 0x38]
shl edx, 5
mov ecx, dword [0x7cd4d4]
mov ecx, dword [ecx]
add edx, ecx
lea edi, [edx + eax - 0x20]
mov eax, dword [esi]
and eax, 0x2000
je 0x46c577
push esi
call fcn.004a0990
pop ecx
mov edx, edi
cmp eax, edx
jne 0x46c577
push 0
push str.Cyclic_Reference_assignment_
push 0
push 0x232c
push 1
call fcn.00492870
add esp, 0x14
lea eax, [ebx + 4]
mov edx, dword [eax]
lea edx, [edx - 4]
mov dword [eax], edx
mov eax, edx
mov edx, dword [ebx]
cmp eax, edx
jae 0x46c5f1
push 0
push 0
push 0
push 0x233b
call fcn.00492ef0
add esp, 0x10
jmp 0x46c5f1
mov eax, dword [edi]
and eax, 0x1a
je 0x46c585
mov eax, dword [esi]
and eax, 0x1a
jne 0x46c58b
mov eax, dword [edi]
cmp eax, dword [esi]
jne 0x46c597
push esi
push edi
call fcn.004a44a0
add esp, 8
jmp 0x46c5cc
push edi
call fcn.004874e0
pop ecx
and eax, 0x8000
je 0x46c5c2
push edi
push 0
push 0
push 0x696ea5
push esi
push edi
call fcn.004689e0
add esp, 0x18
push esi
call fcn.004a45e0
pop ecx
jmp 0x46c5cc
push esi
push edi
call fcn.004a44a0
add esp, 8
lea eax, [ebx + 4]
mov edx, dword [eax]
lea edx, [edx - 4]
mov dword [eax], edx
mov eax, edx
mov edx, dword [ebx]
cmp eax, edx
jae 0x46c5f1
push 0
push 0
push 0
push 0x233b
call fcn.00492ef0
add esp, 0x10
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x46cf60
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
push esi
push edi
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
mov ebx, dword [0x7be27c]
jmp 0x46cfdd
cmp dword [ebx + 0x18], 0
je 0x46cfda
movsx eax, word [ebx + 0xc]
and eax, 0x10
je 0x46cfda
xor esi, esi
jmp 0x46cfd5
mov eax, esi
shl eax, 4
mov edx, dword [ebx]
movsx eax, word [edx + eax + 4]
and eax, 0x18
mov edi, eax
movsx eax, di
cmp eax, 0x10
jne 0x46cfd4
mov eax, esi
shl eax, 4
mov edx, dword [ebx]
add eax, edx
push eax
call fcn.0046b2e0
pop ecx
call fcn.0046a9c0
push 0
call fcn.00468e20
pop ecx
mov eax, dword [ebp - 4]
movzx eax, word [eax + 0x44]
test eax, eax
jne 0x46cfe7
inc esi
cmp esi, dword [ebx + 4]
jb 0x46cf93
mov ebx, dword [ebx + 8]
mov eax, ebx
test eax, eax
jne 0x46cf80
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46d240
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x46d29e
mov eax, dword [ebx + 0x15f4]
test eax, eax
je 0x46d29e
mov eax, dword [ebx + 0x15f4]
mov dword [ebp - 4], eax
test eax, eax
je 0x46d29e
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
dec eax
mov edx, dword [ebx]
mov eax, dword [edx + eax*4]
mov eax, dword [eax]
test eax, eax
jne 0x46d29e
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
dec eax
mov edx, dword [ebx]
mov eax, dword [edx + eax*4]
push eax
call fcn.004a44a0
add esp, 8
mov word [ebx + 0x44], 2
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x46d2b0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc8
push ebx
push esi
push edi
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
cmp dword [0x7d7ef8], 0
je 0x46d3cd
mov esi, 1
mov word [ebp - 0xc6], 0
call fcn.004ac060
push 0
push eax
call fcn.004ac0e0
add esp, 8
mov eax, dword [ebx + 0x30]
mov eax, dword [eax]
movzx edx, word [eax + 0xc]
push edx
mov eax, dword [eax + 0x14]
mov eax, dword [eax]
push eax
push str.Cancelled_at:__s___i_
lea eax, [ebp - 0xc3]
push eax
call fcn.00531da0
add esp, 0x10
push 0
lea eax, [ebp - 0xc3]
push eax
call fcn.004ac0e0
add esp, 8
call fcn.004ac060
push 0
push eax
call fcn.004ac0e0
add esp, 8
jmp 0x46d3b8
push 0
lea eax, [ebp - 0xc6]
push eax
lea eax, [ebp - 0xc3]
push eax
mov eax, esi
inc esi
push eax
call fcn.0049cc00
add esp, 0x10
movsx eax, byte [ebp - 0xc3]
test eax, eax
je 0x46d3c7
lea eax, [ebp - 0xc3]
mov edx, eax
or eax, 0xffffffff
inc eax
cmp byte [edx + eax], 0
jne 0x46d371
mov edi, eax
movzx eax, word [ebp - 0xc6]
push eax
push str.___u_
lea eax, [ebp + edi - 0xc3]
push eax
call fcn.00531da0
add esp, 0xc
push 0
lea eax, [ebp - 0xc3]
push eax
call fcn.004ac0e0
add esp, 8
call fcn.004ac060
push 0
push eax
call fcn.004ac0e0
add esp, 8
movsx eax, byte [ebp - 0xc3]
test eax, eax
jne 0x46d33f
mov word [ebx + 0x44], 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x46d400
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
lea eax, [ebx + 0x10]
push eax
mov eax, dword [ebx + 4]
mov eax, dword [eax]
push eax
call fcn.004a44a0
add esp, 8
mov eax, dword [ebx + 8]
dec eax
mov dword [ebp - 8], eax
mov edx, dword [ebx + 4]
mov ecx, dword [ebx]
sub edx, ecx
mov dword [ebp - 4], edx
mov eax, edx
cdq
and edx, 3
add eax, edx
sar eax, 2
mov ecx, dword [ebp - 8]
cmp ecx, eax
jg 0x46d44f
call fcn.004a8c60
movzx eax, word [ebx + 0x44]
push eax
call fcn.0046ac40
pop ecx
mov word [ebx + 0x44], 0
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46d470
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov eax, dword [ebx + 4]
mov eax, dword [eax - 4]
movzx eax, word [eax + 0xc]
movzx edx, word [ebx + 0x44]
or eax, edx
mov esi, eax
movzx eax, si
and eax, 1
je 0x46d4a5
mov word [ebx + 0x44], 1
jmp 0x46d4cb
movzx eax, si
and eax, 2
je 0x46d4b5
mov word [ebx + 0x44], 2
jmp 0x46d4cb
movzx eax, si
and eax, 4
je 0x46d4c5
mov word [ebx + 0x44], 4
jmp 0x46d4cb
mov word [ebx + 0x44], 0
lea eax, [ebx + 4]
mov edx, dword [eax]
lea edx, [edx - 4]
mov dword [eax], edx
mov eax, edx
mov edx, dword [ebx]
cmp eax, edx
jae 0x46d4f0
push 0
push 0
push 0
push 0x233b
call fcn.00492ef0
add esp, 0x10
mov eax, dword [ebx + 0x10]
and eax, 0xf405
je 0x46d504
lea eax, [ebx + 0x10]
push eax
call fcn.004a45e0
pop ecx
lea eax, [ebx + 4]
mov edx, dword [eax]
lea edx, [edx - 4]
mov dword [eax], edx
mov eax, edx
mov edx, dword [ebx]
cmp eax, edx
jae 0x46d529
push 0
push 0
push 0
push 0x233b
call fcn.00492ef0
add esp, 0x10
mov eax, dword [ebx + 4]
mov eax, dword [eax]
push eax
lea eax, [ebx + 0x10]
push eax
call fcn.004a44a0
add esp, 8
pop esi
pop ebx
pop ebp
ret

Function at 0x46d590
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 0xc], eax
mov eax, dword [eax + 4]
mov esi, dword [eax]
mov eax, dword [0x7cd4ac]
movzx eax, word [eax + 4]
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0
movsx eax, word [ebp + 0xc]
mov edx, dword [ebp - 8]
lea edi, [edx + eax]
push edi
push 0x7cd4a4
call fcn.004a2950
add esp, 8
mov dword [esi], 0x2000
mov eax, dword [ebp - 8]
lea ebx, [eax + 1]
jmp 0x46d60a
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
mov dword [esi + 0x10], eax
or dword [esi + 0xc], 0xffffffff
mov eax, dword [ebp + 8]
mov dword [esi + 8], eax
push esi
push ebx
push 0x7cd4a4
call fcn.004a2c30
add esp, 0xc
inc ebx
cmp ebx, edi
jbe 0x46d5e6
mov dword [esi], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46e010
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
push 0x20
call fcn.0049b580
pop ecx
mov esi, eax
mov eax, dword [ebx + 4]
mov eax, dword [eax]
mov dword [eax], 0
mov eax, dword [ebx + 8]
dec eax
mov dword [ebp - 8], eax
mov edx, dword [ebx + 4]
mov ecx, dword [ebx]
sub edx, ecx
mov dword [ebp - 4], edx
mov eax, edx
cdq
and edx, 3
add eax, edx
sar eax, 2
mov ecx, dword [ebp - 8]
cmp ecx, eax
jg 0x46e063
call fcn.004a8c60
lea eax, [ebx + 4]
mov edx, dword [eax]
lea edx, [edx + 4]
mov dword [eax], edx
mov eax, dword [edx]
mov dword [eax], 0
mov dword [esi + 8], 0
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
sub eax, edx
cdq
and edx, 3
add eax, edx
sar eax, 2
mov dword [esi + 4], eax
mov word [esi], 0
mov dword [esi + 0xc], 0
mov eax, dword [ebx + 0x12e0]
mov dword [esi + 0x10], eax
mov eax, dword [ebx + 0x8d8]
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], 0
mov eax, dword [ebx + 0x15f4]
mov dword [esi + 0x1c], eax
mov dword [ebx + 0x15f4], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x46e0d0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov esi, dword [ebx + 0x15f4]
mov eax, dword [ebx + 0x15f4]
mov eax, dword [eax + 4]
push eax
call fcn.004a8d40
pop ecx
mov eax, dword [ebx + 4]
mov eax, dword [eax - 4]
mov eax, dword [eax]
and eax, 0xf405
je 0x46e117
mov eax, dword [ebx + 4]
mov eax, dword [eax - 4]
push eax
call fcn.004a45e0
pop ecx
jmp 0x46e123
mov eax, dword [ebx + 4]
mov eax, dword [eax - 4]
mov dword [eax], 0
lea eax, [ebx + 4]
mov edx, dword [eax]
lea edx, [edx - 4]
mov dword [eax], edx
mov eax, edx
mov edx, dword [ebx]
cmp eax, edx
jae 0x46e148
push 0
push 0
push 0
push 0x233b
call fcn.00492ef0
add esp, 0x10
lea eax, [ebx + 0x15f4]
mov edx, dword [eax]
mov edx, dword [edx + 0x1c]
mov dword [eax], edx
push esi
call fcn.0049b640
pop ecx
movzx eax, word [ebx + 0x44]
and eax, 4
je 0x46e16c
mov eax, 1
jmp 0x46e194
movzx eax, word [ebx + 0x44]
and eax, 2
je 0x46e17d
mov word [ebx + 0x44], 0
jmp 0x46e192
movzx eax, word [ebx + 0x44]
and eax, 1
je 0x46e192
call fcn.0045b7d0
push eax
call fcn.00533dc0
pop ecx
xor eax, eax
pop esi
pop ebx
pop ebp
ret
Function at 0x46e1a0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov esi, dword [ebx + 0x15f4]
mov eax, dword [ebx + 0x15f4]
mov eax, dword [eax + 4]
push eax
call fcn.004a8d40
pop ecx
lea eax, [ebx + 0x15f4]
mov edx, dword [eax]
mov edx, dword [edx + 0x1c]
mov dword [eax], edx
push esi
call fcn.0049b640
pop ecx
movzx eax, word [ebx + 0x44]
and eax, 4
je 0x46e1ed
mov eax, 1
jmp 0x46e215
movzx eax, word [ebx + 0x44]
and eax, 2
je 0x46e1fe
mov word [ebx + 0x44], 0
jmp 0x46e213
movzx eax, word [ebx + 0x44]
and eax, 1
je 0x46e213
call fcn.0045b7d0
push eax
call fcn.00533dc0
pop ecx
xor eax, eax
pop esi
pop ebx
pop ebp
ret
Function at 0x471d10
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
push 0x7cd4cc
call fcn.004a28f0
pop ecx
push eax
lea eax, [ebx + 0x10]
push eax
call fcn.004a0470
add esp, 8
pop ebx
pop ebp
ret

Function at 0x4734e0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
push esi
push edi
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov eax, dword [ebx + 0x1620]
test eax, eax
je 0x473520
mov edi, dword [ebx + 0x1620]
mov eax, 0xc
mul edi
mov ecx, dword [ebx + 0x1628]
mov eax, dword [ecx + eax + 8]
mov dword [ebx + 0x1620], eax
jmp 0x473580
mov eax, dword [ebx + 0x161c]
cmp dword [ebx + 0x1624], eax
jae 0x47353f
lea eax, [ebx + 0x1624]
mov edx, dword [eax]
lea ecx, [edx + 1]
mov dword [eax], ecx
mov edi, edx
jmp 0x473580
mov edi, dword [ebx + 0x161c]
mov eax, dword [ebx + 0x161c]
inc eax
mov dword [ebx + 0x1624], eax
lea eax, [ebx + 0x161c]
add dword [eax], 0x32
mov eax, 0xc
mul dword [ebx + 0x161c]
push eax
lea eax, [ebx + 0x1628]
mov dword [ebp - 4], eax
mov edx, dword [eax]
push edx
call fcn.0049b5d0
add esp, 8
mov edx, dword [ebp - 4]
mov dword [edx], eax
mov eax, 0xc
mul edi
mov ecx, dword [ebx + 0x1628]
lea esi, [ecx + eax]
push 0x20
call fcn.0049b580
pop ecx
mov dword [esi], eax
mov dword [esi + 4], 1
mov eax, dword [esi]
mov dword [eax], 0
cmp dword [ebp + 0xc], 0
je 0x4735cb
mov dword [esi + 8], 0
mov eax, dword [ebp + 8]
test eax, eax
je 0x4735e0
push eax
mov eax, dword [esi]
push eax
call fcn.004a4960
add esp, 8
jmp 0x4735e0
or dword [esi + 8], 0xffffffff
push 0x20
mov eax, dword [ebp + 8]
push eax
mov eax, dword [esi]
push eax
call fcn.00531d20
add esp, 0xc
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4735f0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
and eax, 0x4000
jne 0x47364d
push 0
mov eax, dword [ebp + 8]
push eax
call fcn.004734e0
add esp, 8
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [eax], 0x6000
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 4]
lea edx, [edx + 0x1628]
mov dword [eax + 8], edx
mov eax, dword [ebp + 8]
mov dword [eax + 0xc], 0
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 8]
mov dword [eax + 0x10], edx
mov eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret