joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a5ee0
Capabilities:
Get thread local storage value

Disassembly:
push esi
mov esi, ecx
call fcn.004a8ce0
mov eax, dword [esp + 8]
test al, 1
je 0x4a5f35
test al, 4
jne 0x4a5f27
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0xb0
cmp ax, cx
je 0x4a5f0a
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0xb0
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4

Function at 0x4a5f40
Capabilities:
Get thread local storage value

Disassembly:
push esi
mov esi, ecx
call fcn.004a54f0
mov eax, dword [esp + 8]
test al, 1
je 0x4a5f92
test al, 4
jne 0x4a5f87
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0x70
cmp ax, cx
je 0x4a5f6a
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0x70
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4

Function at 0x4a5fa0
Capabilities:
Get thread local storage value

Disassembly:
push esi
mov esi, ecx
call fcn.004a55a0
mov eax, dword [esp + 8]
test al, 1
je 0x4a5ff2
test al, 4
jne 0x4a5fe7
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0x20
cmp ax, cx
je 0x4a5fca
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0x20
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4

Function at 0x4a6000
Capabilities:
Get thread local storage value

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x4a600f
call fcn.0045c160
mov ecx, esi
mov dword [esi + 0x20], 0
call fcn.004a5620
mov eax, dword [esp + 8]
test al, 1
je 0x4a6067
test al, 4
jne 0x4a605c
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0x24
cmp ax, cx
je 0x4a603f
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0x24
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4

Function at 0x4a6070
Capabilities:
Get thread local storage value

Disassembly:
push esi
mov esi, ecx
call fcn.004a5620
mov eax, dword [esp + 8]
test al, 1
je 0x4a60c2
test al, 4
jne 0x4a60b7
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0x20
cmp ax, cx
je 0x4a609a
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0x20
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4
Function at 0x4a60d0
Capabilities:
Get thread local storage value

Disassembly:
push esi
mov esi, ecx
call fcn.004a56a0
mov eax, dword [esp + 8]
test al, 1
je 0x4a6122
test al, 4
jne 0x4a6117
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0x20
cmp ax, cx
je 0x4a60fa
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0x20
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4

Function at 0x4a6130
Capabilities:
Get thread local storage value

Disassembly:
push esi
mov esi, ecx
lea ecx, [esi + 0x10]
call fcn.0045d990
lea ecx, [esi + 0xc]
call fcn.0045d990
lea ecx, [esi + 8]
call fcn.0045d990
mov eax, dword [esp + 8]
mov dword [esi], vtable.hkBaseObject.0
test al, 1
je 0x4a619b
test al, 4
jne 0x4a6190
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0x14
cmp ax, cx
je 0x4a6173
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0x14
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4

Function at 0x4a61b0
Capabilities:
Get thread local storage value

Disassembly:
push esi
mov esi, ecx
lea ecx, [esi + 0x1c]
call fcn.0045d990
lea ecx, [esi + 0x18]
call fcn.0045d990
mov eax, dword [esi + 0x14]
mov dword [esi + 0x10], 0
test eax, eax
js 0x4a61e7
and eax, 0x3fffffff
mov ecx, 0x7d8954
push eax
mov eax, dword [0x7d8954]
push dword [esi + 0xc]
call dword [eax + 0x10]
mov eax, dword [esp + 8]
mov dword [esi + 0xc], 0
mov dword [esi + 0x14], connect
mov dword [esi], vtable.hkBaseObject.0
test al, 1
je 0x4a6245
test al, 4
jne 0x4a623a
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0x20
cmp ax, cx
je 0x4a621d
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0x20
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4

Function at 0x4a6250
Capabilities:
Get thread local storage value

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x10]
mov dword [esi + 0xc], 0
test eax, eax
js 0x4a627a
and eax, 0x3fffffff
mov ecx, 0x7d8954
shl eax, 2
push eax
mov eax, dword [0x7d8954]
push dword [esi + 8]
call dword [eax + 0x10]
mov eax, dword [esp + 8]
mov dword [esi + 8], 0
mov dword [esi + 0x10], connect
mov dword [esi], vtable.hkBaseObject.0
test al, 1
je 0x4a62d8
test al, 4
jne 0x4a62cd
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0x14
cmp ax, cx
je 0x4a62b0
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0x14
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4
Function at 0x4a62e0
Capabilities:
Get thread local storage value

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x10]
mov dword [esi + 0xc], 0
test eax, eax
js 0x4a630a
and eax, 0x3fffffff
mov ecx, 0x7d8954
shl eax, 2
push eax
mov eax, dword [0x7d8954]
push dword [esi + 8]
call dword [eax + 0x10]
mov eax, dword [esp + 8]
mov dword [esi + 8], 0
mov dword [esi + 0x10], connect
mov dword [esi], vtable.hkBaseObject.0
test al, 1
je 0x4a6368
test al, 4
jne 0x4a635d
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0x18
cmp ax, cx
je 0x4a6340
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0x18
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4

Function at 0x4a6370
Capabilities:
Get thread local storage value

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x10]
mov dword [esi + 0xc], 0
test eax, eax
js 0x4a639a
and eax, 0x3fffffff
mov ecx, 0x7d8954
shl eax, 2
push eax
mov eax, dword [0x7d8954]
push dword [esi + 8]
call dword [eax + 0x10]
mov eax, dword [esp + 8]
mov dword [esi + 8], 0
mov dword [esi + 0x10], connect
mov dword [esi], vtable.hkBaseObject.0
test al, 1
je 0x4a63f8
test al, 4
jne 0x4a63ed
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0x14
cmp ax, cx
je 0x4a63d0
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0x14
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4

Function at 0x4a6400
Capabilities:
Get thread local storage value

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x10]
mov dword [esi + 0xc], 0
test eax, eax
js 0x4a642a
and eax, 0x3fffffff
mov ecx, 0x7d8954
shl eax, 2
push eax
mov eax, dword [0x7d8954]
push dword [esi + 8]
call dword [eax + 0x10]
mov eax, dword [esp + 8]
mov dword [esi + 8], 0
mov dword [esi + 0x10], connect
mov dword [esi], vtable.hkBaseObject.0
test al, 1
je 0x4a6488
test al, 4
jne 0x4a647d
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0x14
cmp ax, cx
je 0x4a6460
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0x14
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4
Function at 0x4a6490
Capabilities:
Get thread local storage value

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x10]
mov dword [esi + 0xc], 0
test eax, eax
js 0x4a64ba
and eax, 0x3fffffff
mov ecx, 0x7d8954
shl eax, 4
push eax
mov eax, dword [0x7d8954]
push dword [esi + 8]
call dword [eax + 0x10]
mov eax, dword [esp + 8]
mov dword [esi + 8], 0
mov dword [esi + 0x10], connect
mov dword [esi], vtable.hkBaseObject.0
test al, 1
je 0x4a6518
test al, 4
jne 0x4a650d
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0x14
cmp ax, cx
je 0x4a64f0
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0x14
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4

Function at 0x4a6960
Capabilities:
Get thread local storage value

Disassembly:
push esi
mov esi, ecx
lea ecx, [esi + 0x14]
call fcn.0045d990
mov eax, dword [esp + 8]
mov dword [esi], vtable.hkBaseObject.0
test al, 1
je 0x4a69bb
test al, 4
jne 0x4a69b0
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0x18
cmp ax, cx
je 0x4a6993
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0x18
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4

Function at 0x4a7370
Capabilities:
Get thread local storage value

Disassembly:
push esi
mov esi, ecx
call fcn.004a7300
mov eax, dword [esp + 8]
test al, 1
je 0x4a73c2
test al, 4
jne 0x4a73b7
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0x14
cmp ax, cx
je 0x4a739a
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0x14
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4

Function at 0x4a7cd0
Capabilities:
Get thread local storage value

Disassembly:
push esi
mov esi, ecx
call fcn.004a7c60
mov eax, dword [esp + 8]
test al, 1
je 0x4a7d22
test al, 4
jne 0x4a7d17
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0x14
cmp ax, cx
je 0x4a7cfa
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0x14
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4
Function at 0x4a8600
Capabilities:
Get thread local storage value

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x64]
mov dword [esi + 0x60], 0
test eax, eax
js 0x4a862a
and eax, 0x3fffffff
mov ecx, 0x7d8954
shl eax, 4
push eax
mov eax, dword [0x7d8954]
push dword [esi + 0x5c]
call dword [eax + 0x10]
lea ecx, [esi + 8]
mov dword [esi + 0x5c], 0
mov dword [esi + 0x64], connect
call fcn.004a50b0
mov eax, dword [esp + 8]
mov dword [esi], vtable.hkBaseObject.0
test al, 1
je 0x4a8690
test al, 4
jne 0x4a8685
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0x68
cmp ax, cx
je 0x4a8668
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0x68
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4

Function at 0x4a8a00
Capabilities:
Get thread local storage value

Disassembly:
push esi
mov esi, ecx
call fcn.004a86b0
mov eax, dword [esp + 8]
test al, 1
je 0x4a8a52
test al, 4
jne 0x4a8a47
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0x20
cmp ax, cx
je 0x4a8a2a
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0x20
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4

Function at 0x4aa7d0
Capabilities:
Get thread local storage value

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x14]
mov dword [esi + 0x10], 0
test eax, eax
js 0x4aa7f7
and eax, 0x3fffffff
mov ecx, 0x7d8954
push eax
mov eax, dword [0x7d8954]
push dword [esi + 0xc]
call dword [eax + 0x10]
lea ecx, [esi + 8]
mov dword [esi + 0xc], 0
mov dword [esi + 0x14], connect
call fcn.0045d990
mov eax, dword [esp + 8]
mov dword [esi], vtable.hkBaseObject.0
test al, 1
je 0x4aa85d
test al, 4
jne 0x4aa852
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0x20
cmp ax, cx
je 0x4aa835
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0x20
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4

Function at 0x4ac540
Capabilities:
Get thread local storage value

Disassembly:
push esi
mov esi, ecx
call fcn.004ac320
mov eax, dword [esp + 8]
test al, 1
je 0x4ac592
test al, 4
jne 0x4ac587
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0x48
cmp ax, cx
je 0x4ac56a
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0x48
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4
Function at 0x4acc30
Capabilities:
Get thread local storage value

Disassembly:
push esi
mov esi, ecx
call fcn.004acb80
mov eax, dword [esp + 8]
test al, 1
je 0x4acc82
test al, 4
jne 0x4acc77
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0x70
cmp ax, cx
je 0x4acc5a
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0x70
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4

Function at 0x4ad0f0
Capabilities:
Get thread local storage value

Disassembly:
push esi
mov esi, ecx
call fcn.004ad080
mov eax, dword [esp + 8]
test al, 1
je 0x4ad142
test al, 4
jne 0x4ad137
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0x18
cmp ax, cx
je 0x4ad11a
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0x18
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4

Function at 0x4ad790
Capabilities:
Get thread local storage value

Disassembly:
push esi
mov esi, ecx
call fcn.004ad500
mov eax, dword [esp + 8]
test al, 1
je 0x4ad7e2
test al, 4
jne 0x4ad7d7
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0x30
cmp ax, cx
je 0x4ad7ba
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0x30
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4

Function at 0x4ae1f0
Capabilities:
Get thread local storage value

Disassembly:
push esi
mov esi, ecx
call fcn.004ada80
mov eax, dword [esp + 8]
test al, 1
je 0x4ae245
test al, 4
jne 0x4ae237
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0x1a8
cmp ax, cx
je 0x4ae21a
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0x1a8
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4

Function at 0x4aeb50
Capabilities:
Get thread local storage value

Disassembly:
push ecx
mov eax, ecx
push ebx
mov dword [esp + 4], eax
mov ebx, dword [eax + 0x12c]
test ebx, ebx
jle 0x4aebc3
push ebp
push esi
push edi
xor edi, edi
nop word [eax + eax]
mov esi, dword [eax + 0x128]
add esi, edi
cmp byte [esi + 8], 0
je 0x4aeb8c
mov ecx, dword [esi]
push dword [esi + 4]
mov eax, dword [ecx]
call dword [eax + 0x34]
mov byte [esi + 8], 0
mov ebp, dword [esi + 4]
test ebp, ebp
je 0x4aebb4
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push 0x20c
push ebp
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
mov dword [esi + 4], 0
mov eax, dword [esp + 0x10]
add edi, 0xc
sub ebx, 1
jne 0x4aeb70
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x4af2d0
Capabilities:
Get thread local storage value

Disassembly:
push esi
mov esi, ecx
call fcn.004af190
mov eax, dword [esp + 8]
test al, 1
je 0x4af325
test al, 4
jne 0x4af317
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0x144
cmp ax, cx
je 0x4af2fa
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0x144
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4
Function at 0x4b1c10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [esp + 8]
sub esp, 0x10
mov edx, dword [esp + 0x1c]
mov ah, byte [ecx + 8]
cmp ah, byte [edx + 8]
jne 0x4b1de1
mov al, byte [ecx + 9]
cmp al, byte [edx + 9]
jne 0x4b1de1
push esi
push edi
movzx edi, al
movzx eax, ah
dec eax
cmp eax, 9
ja case.0x4b1c45.9
jmp dword [eax*4 + 0x4b1dec]
mov esi, dword [ecx]
xor ecx, ecx
mov eax, dword [edx]
test edi, edi
jle 0x4b1dc7
movss xmm1, dword [esp + 0x28]
sub esi, eax
movss xmm2, dword [0x719120]
nop word [eax + eax]
movss xmm0, dword [esi + eax]
subss xmm0, dword [eax]
andps xmm0, xmm2
comiss xmm0, xmm1
jae case.0x4b1c45.9
inc ecx
add eax, 4
cmp ecx, edi
jl 0x4b1c70
mov eax, dword [esp + 0x1c]
pop edi
pop esi
mov byte [eax], 1
add esp, 0x10
ret
mov eax, dword [ecx]
xor esi, esi
mov dword [esp + 0x20], eax
mov eax, dword [edx]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], esi
test edi, edi
jle 0x4b1dc7
movss xmm1, dword [esp + 0x28]
movaps xmm0, xmm1
mulss xmm0, dword [0x727dcc]
cvttss2si ecx, xmm0
xorps xmm0, xmm0
mov dword [esp + 8], ecx
mov ecx, dword [esp + 0x20]
sub ecx, eax
mov dword [esp + 0x20], ecx
nop word [eax + eax]
mov ecx, dword [ecx + eax]
mov edx, dword [eax]
mov dword [esp + 0x24], ecx
mov dword [esp + 0x14], edx
cmp ecx, edx
je 0x4b1d40
ucomiss xmm1, xmm0
lahf
test ah, 0x44
jnp case.0x4b1c45.9
xor esi, esi
movzx eax, dl
movzx edx, cl
sub edx, eax
mov ecx, edx
sar ecx, 0x1f
lea eax, [ecx + edx]
xor eax, ecx
cmp eax, dword [esp + 8]
jg case.0x4b1c45.9
mov ecx, dword [esp + 0x24]
inc esi
mov edx, dword [esp + 0x14]
shr ecx, 8
shr edx, 8
mov dword [esp + 0x24], ecx
mov dword [esp + 0x14], edx
cmp esi, 4
jl 0x4b1d00
mov eax, dword [esp + 0xc]
mov esi, dword [esp + 0x10]
inc esi
add eax, 4
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], eax
cmp esi, edi
jge 0x4b1dc7
mov ecx, dword [esp + 0x20]
jmp 0x4b1ce0
mov esi, dword [edx]
xor edx, edx
mov ecx, dword [ecx]
test edi, edi
jle 0x4b1dc7
sub esi, ecx
mov eax, dword [ecx]
cmp eax, dword [esi + ecx]
jne case.0x4b1c45.9
inc edx
add ecx, 4
cmp edx, edi
jl 0x4b1d62
mov eax, dword [esp + 0x1c]
pop edi
pop esi
mov byte [eax], 1
add esp, 0x10
ret
mov esi, dword [edx]
xor edx, edx
mov ecx, dword [ecx]
test edi, edi
jle 0x4b1dc7
sub esi, ecx
nop word [eax + eax]
mov al, byte [ecx]
cmp al, byte [esi + ecx]
jne case.0x4b1c45.9
inc edx
inc ecx
cmp edx, edi
jl 0x4b1d90
mov eax, dword [esp + 0x1c]
pop edi
pop esi
mov byte [eax], 1
add esp, 0x10
ret
mov esi, dword [edx]
xor edx, edx
mov ecx, dword [ecx]
test edi, edi
jle 0x4b1dc7
sub esi, ecx
mov ax, word [ecx]
cmp ax, word [esi + ecx]
jne case.0x4b1c45.9
inc edx
add ecx, 2
cmp edx, edi
jl 0x4b1db6
mov eax, dword [esp + 0x1c]
pop edi
pop esi
mov byte [eax], 1
add esp, 0x10
ret
mov eax, dword [esp + 0x1c]
pop edi
pop esi
mov byte [eax], 0
add esp, 0x10
ret
mov eax, dword [esp + 0x14]
mov byte [eax], 0
add esp, 0x10
ret
Function at 0x4b6934
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, ecx
mov dword [esi], vtable.hkXmlObjectWriter::NameFromAddress.0
test al, 1
je 0x4b696d
test al, 4
jne 0x4b6962
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push 4
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
mov eax, esi
pop esi
ret 4
push 4
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4

Function at 0x4b69e0
Capabilities:
Get thread local storage value

Disassembly:
push esi
mov esi, ecx
call fcn.004825d0
mov eax, dword [esp + 8]
test al, 1
je 0x4b6a35
test al, 4
jne 0x4b6a27
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0xe4
cmp ax, cx
je 0x4b6a0a
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0xe4
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4

Function at 0x4b6f24
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, ecx
mov dword [esi], vtable.hkBaseObject.0
test al, 1
je 0x4b6f73
test al, 4
jne 0x4b6f68
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 8
cmp ax, cx
je 0x4b6f4b
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 8
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4
Function at 0x4ce1a0
Capabilities:
Get thread local storage value

Disassembly:
push esi
mov esi, ecx
lea ecx, [esi + 0xc]
call fcn.0046a7e0
mov eax, dword [esp + 8]
mov dword [esi], vtable.hkBaseObject.0
test al, 1
je 0x4ce1fb
test al, 4
jne 0x4ce1f0
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0x1c
cmp ax, cx
je 0x4ce1d3
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0x1c
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4

Function at 0x4ce210
Capabilities:
Get thread local storage value

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x18]
mov dword [esi], vtable.hkRenamedClassNameRegistry.0
test ecx, ecx
je 0x4ce225
call fcn.0045c160
lea ecx, [esi + 8]
call fcn.0046a7e0
mov eax, dword [esp + 8]
mov dword [esi], vtable.hkBaseObject.0
test al, 1
je 0x4ce27d
test al, 4
jne 0x4ce272
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0x1c
cmp ax, cx
je 0x4ce255
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0x1c
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4

Function at 0x4ce290
Capabilities:
Get thread local storage value

Disassembly:
push esi
mov esi, ecx
call fcn.004cd490
mov eax, dword [esp + 8]
test al, 1
je 0x4ce2e2
test al, 4
jne 0x4ce2d7
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0x24
cmp ax, cx
je 0x4ce2ba
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0x24
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4