joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4357ec
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
cmp ebx, 0xffffffff
jne 0x43581c
mov eax, dword [ebp + 8]
push eax
mov edx, dword [0x555894]
push edx
call sub.KERNEL32.DLL_TlsGetValue
add eax, 0x10
push eax
call fcn.0043e458
add esp, 8
mov eax, 1
pop ebx
pop ebp
ret
test ebx, ebx
jl 0x43586e
mov edx, dword [0x555894]
push edx
call sub.KERNEL32.DLL_TlsGetValue
mov ecx, dword [eax + 0xc]
mov eax, dword [ecx]
movzx edx, word [eax + 0x10]
cmp ebx, edx
jg 0x43586e
mov ecx, dword [0x555894]
push ecx
call sub.KERNEL32.DLL_TlsGetValue
mov eax, dword [eax + 0xc]
mov ebx, dword [eax + ebx*4 + 4]
test byte [ebx + 1], 0x20
je 0x43586e
mov edx, dword [ebp + 8]
push edx
push ebx
call fcn.0043f7e0
pop ecx
push eax
call fcn.0043e458
add esp, 8
mov eax, 1
pop ebx
pop ebp
ret
xor eax, eax
pop ebx
pop ebp
ret

Function at 0x435900
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0x10]
cmp ebx, 0xffffffff
jne 0x435934
mov eax, dword [ebp + 0xc]
push eax
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [0x555894]
push ecx
call sub.KERNEL32.DLL_TlsGetValue
add eax, 0x10
push eax
call fcn.0043e534
add esp, 0xc
mov eax, 1
pop ebx
pop ebp
ret
test ebx, ebx
jl 0x43598a
mov edx, dword [0x555894]
push edx
call sub.KERNEL32.DLL_TlsGetValue
mov ecx, dword [eax + 0xc]
mov eax, dword [ecx]
movzx edx, word [eax + 0x10]
cmp ebx, edx
jg 0x43598a
mov ecx, dword [0x555894]
push ecx
call sub.KERNEL32.DLL_TlsGetValue
mov eax, dword [eax + 0xc]
mov ebx, dword [eax + ebx*4 + 4]
test byte [ebx + 1], 0x20
je 0x43598a
mov edx, dword [ebp + 0xc]
push edx
mov ecx, dword [ebp + 8]
push ecx
push ebx
call fcn.0043f7e0
pop ecx
push eax
call fcn.0043e534
add esp, 0xc
mov eax, 1
pop ebx
pop ebp
ret
xor eax, eax
pop ebx
pop ebp
ret

Function at 0x435990
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
cmp ebx, 0xffffffff
jne 0x4359cc
cmp dword [ebp + 8], 0
je 0x4359a9
mov eax, 1
jmp 0x4359ab
xor eax, eax
push eax
mov edx, dword [0x555894]
push edx
call sub.KERNEL32.DLL_TlsGetValue
add eax, 0x10
push eax
call fcn.0043e574
add esp, 8
mov eax, 1
pop ebx
pop ebp
ret
test ebx, ebx
jl 0x435a2a
mov edx, dword [0x555894]
push edx
call sub.KERNEL32.DLL_TlsGetValue
mov ecx, dword [eax + 0xc]
mov eax, dword [ecx]
movzx edx, word [eax + 0x10]
cmp ebx, edx
jg 0x435a2a
mov ecx, dword [0x555894]
push ecx
call sub.KERNEL32.DLL_TlsGetValue
mov eax, dword [eax + 0xc]
mov ebx, dword [eax + ebx*4 + 4]
test byte [ebx + 1], 0x20
je 0x435a2a
cmp dword [ebp + 8], 0
je 0x435a0f
mov edx, 1
jmp 0x435a11
xor edx, edx
push edx
push ebx
call fcn.0043f7e0
pop ecx
push eax
call fcn.0043e574
add esp, 8
mov eax, 1
pop ebx
pop ebp
ret
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x435a30
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
cmp ebx, 0xffffffff
jne 0x435a60
mov eax, dword [ebp + 8]
push eax
mov edx, dword [0x555894]
push edx
call sub.KERNEL32.DLL_TlsGetValue
add eax, 0x10
push eax
call fcn.0043e63c
add esp, 8
mov eax, 1
pop ebx
pop ebp
ret
test ebx, ebx
jl 0x435ab2
mov edx, dword [0x555894]
push edx
call sub.KERNEL32.DLL_TlsGetValue
mov ecx, dword [eax + 0xc]
mov eax, dword [ecx]
movzx edx, word [eax + 0x10]
cmp ebx, edx
jg 0x435ab2
mov ecx, dword [0x555894]
push ecx
call sub.KERNEL32.DLL_TlsGetValue
mov eax, dword [eax + 0xc]
mov ebx, dword [eax + ebx*4 + 4]
test byte [ebx + 1], 0x20
je 0x435ab2
mov edx, dword [ebp + 8]
push edx
push ebx
call fcn.0043f7e0
pop ecx
push eax
call fcn.0043e63c
add esp, 8
mov eax, 1
pop ebx
pop ebp
ret
xor eax, eax
pop ebx
pop ebp
ret

Function at 0x435ab8
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
cmp ebx, 0xffffffff
jne 0x435ae8
mov eax, dword [ebp + 8]
push eax
mov edx, dword [0x555894]
push edx
call sub.KERNEL32.DLL_TlsGetValue
add eax, 0x10
push eax
call fcn.0043e694
add esp, 8
mov eax, 1
pop ebx
pop ebp
ret
test ebx, ebx
jl 0x435b3a
mov edx, dword [0x555894]
push edx
call sub.KERNEL32.DLL_TlsGetValue
mov ecx, dword [eax + 0xc]
mov eax, dword [ecx]
movzx edx, word [eax + 0x10]
cmp ebx, edx
jg 0x435b3a
mov ecx, dword [0x555894]
push ecx
call sub.KERNEL32.DLL_TlsGetValue
mov eax, dword [eax + 0xc]
mov ebx, dword [eax + ebx*4 + 4]
test byte [ebx + 1], 0x20
je 0x435b3a
mov edx, dword [ebp + 8]
push edx
push ebx
call fcn.0043f7e0
pop ecx
push eax
call fcn.0043e694
add esp, 8
mov eax, 1
pop ebx
pop ebp
ret
xor eax, eax
pop ebx
pop ebp
ret

Function at 0x435b40
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
cmp ebx, 0xffffffff
jne 0x435b70
mov eax, dword [ebp + 8]
push eax
mov edx, dword [0x555894]
push edx
call sub.KERNEL32.DLL_TlsGetValue
add eax, 0x10
push eax
call fcn.0043e6ec
add esp, 8
mov eax, 1
pop ebx
pop ebp
ret
test ebx, ebx
jl 0x435bc2
mov edx, dword [0x555894]
push edx
call sub.KERNEL32.DLL_TlsGetValue
mov ecx, dword [eax + 0xc]
mov eax, dword [ecx]
movzx edx, word [eax + 0x10]
cmp ebx, edx
jg 0x435bc2
mov ecx, dword [0x555894]
push ecx
call sub.KERNEL32.DLL_TlsGetValue
mov eax, dword [eax + 0xc]
mov ebx, dword [eax + ebx*4 + 4]
test byte [ebx + 1], 0x20
je 0x435bc2
mov edx, dword [ebp + 8]
push edx
push ebx
call fcn.0043f7e0
pop ecx
push eax
call fcn.0043e6ec
add esp, 8
mov eax, 1
pop ebx
pop ebp
ret
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x435ce0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0x10]
cmp ebx, 0xffffffff
jne 0x435d12
push dword [ebp + 0xc]
push dword [ebp + 8]
mov edx, dword [0x555894]
push edx
call sub.KERNEL32.DLL_TlsGetValue
add eax, 0x10
push eax
call fcn.0043e5ac
add esp, 0xc
mov eax, 1
pop ebx
pop ebp
ret
test ebx, ebx
jl 0x435d66
mov edx, dword [0x555894]
push edx
call sub.KERNEL32.DLL_TlsGetValue
mov ecx, dword [eax + 0xc]
mov eax, dword [ecx]
movzx edx, word [eax + 0x10]
cmp ebx, edx
jg 0x435d66
mov ecx, dword [0x555894]
push ecx
call sub.KERNEL32.DLL_TlsGetValue
mov eax, dword [eax + 0xc]
mov ebx, dword [eax + ebx*4 + 4]
test byte [ebx + 1], 0x20
je 0x435d66
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call fcn.0043f7e0
pop ecx
push eax
call fcn.0043e5ac
add esp, 0xc
mov eax, 1
pop ebx
pop ebp
ret
xor eax, eax
pop ebx
pop ebp
ret

Function at 0x435e7c
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
cmp dword [ebp + 0xc], 0xffffffff
mov edi, dword [ebp + 8]
jl 0x435f39
mov eax, dword [0x555894]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov edx, dword [eax + 0xc]
mov ecx, dword [edx]
movzx eax, word [ecx + 0x10]
cmp eax, dword [ebp + 0xc]
jl 0x435f39
cmp dword [ebp + 0xc], 0xffffffff
jne 0x435ec5
mov edx, dword [0x555894]
push edx
call sub.KERNEL32.DLL_TlsGetValue
mov ebx, eax
add ebx, 0x10
jmp 0x435eda
mov eax, dword [0x555894]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov edx, dword [eax + 0xc]
mov ecx, dword [ebp + 0xc]
mov ebx, dword [edx + ecx*4 + 4]
test byte [ebx + 1], 0x20
setne al
and eax, 1
mov esi, eax
test esi, esi
je 0x435ef3
push ebx
call fcn.0043f7e0
pop ecx
mov ebx, eax
test byte [ebx + 1], 0x80
je 0x435f1e
lea esi, [ebp + 0x10]
push edi
add esi, 4
mov eax, dword [esi - 4]
push eax
push ebx
call fcn.0042a964
add esp, 0xc
test eax, eax
je 0x435f18
mov eax, 1
jmp 0x435f3b
xor eax, eax
jmp 0x435f3b
test esi, esi
jne 0x435f28
cmp dword [ebp + 0xc], 0xffffffff
jne 0x435f39
push edi
push ebx
call fcn.0043dc4c
add esp, 8
mov eax, 1
jmp 0x435f3b
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4363f8
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
cmp dword [ebp + 0xc], 0xffffffff
mov edi, dword [ebp + 8]
jl 0x4364cf
mov eax, dword [0x555894]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov edx, dword [eax + 0xc]
mov ecx, dword [edx]
movzx eax, word [ecx + 0x10]
cmp eax, dword [ebp + 0xc]
jl 0x4364cf
cmp dword [ebp + 0xc], 0xffffffff
jne 0x436441
mov edx, dword [0x555894]
push edx
call sub.KERNEL32.DLL_TlsGetValue
mov ebx, eax
add ebx, 0x10
jmp 0x436456
mov eax, dword [0x555894]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov edx, dword [eax + 0xc]
mov ecx, dword [ebp + 0xc]
mov ebx, dword [edx + ecx*4 + 4]
test byte [ebx + 1], 0x20
setne al
and eax, 1
mov esi, eax
test esi, esi
je 0x43646f
push ebx
call fcn.0043f7e0
pop ecx
mov ebx, eax
test byte [ebx + 1], 0x80
je 0x4364a7
lea esi, [ebp + 0x10]
test edi, edi
je 0x436483
mov eax, 1
jmp 0x436485
xor eax, eax
push eax
add esi, 4
mov eax, dword [esi - 4]
push eax
push ebx
call fcn.0042a77c
add esp, 0xc
test eax, eax
je 0x4364a1
mov eax, 1
jmp 0x4364d1
xor eax, eax
jmp 0x4364d1
test esi, esi
jne 0x4364b1
cmp dword [ebp + 0xc], 0xffffffff
jne 0x4364cf
test edi, edi
je 0x4364bc
mov edx, 1
jmp 0x4364be
xor edx, edx
push edx
push ebx
call fcn.0043e574
add esp, 8
mov eax, 1
jmp 0x4364d1
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4364d8
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
cmp dword [ebp + 0xc], 0xffffffff
mov edi, dword [ebp + 8]
jl 0x436595
mov eax, dword [0x555894]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov edx, dword [eax + 0xc]
mov ecx, dword [edx]
movzx eax, word [ecx + 0x10]
cmp eax, dword [ebp + 0xc]
jl 0x436595
cmp dword [ebp + 0xc], 0xffffffff
jne 0x436521
mov edx, dword [0x555894]
push edx
call sub.KERNEL32.DLL_TlsGetValue
mov ebx, eax
add ebx, 0x10
jmp 0x436536
mov eax, dword [0x555894]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov edx, dword [eax + 0xc]
mov ecx, dword [ebp + 0xc]
mov ebx, dword [edx + ecx*4 + 4]
test byte [ebx + 1], 0x20
setne al
and eax, 1
mov esi, eax
test esi, esi
je 0x43654f
push ebx
call fcn.0043f7e0
pop ecx
mov ebx, eax
test byte [ebx + 1], 0x80
je 0x43657a
lea esi, [ebp + 0x10]
push edi
add esi, 4
mov eax, dword [esi - 4]
push eax
push ebx
call fcn.0042a7c0
add esp, 0xc
test eax, eax
je 0x436574
mov eax, 1
jmp 0x436597
xor eax, eax
jmp 0x436597
test esi, esi
jne 0x436584
cmp dword [ebp + 0xc], 0xffffffff
jne 0x436595
push edi
push ebx
call fcn.0043e63c
add esp, 8
mov eax, 1
jmp 0x436597
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x43659c
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
cmp dword [ebp + 0xc], 0xffffffff
mov edi, dword [ebp + 8]
jl 0x436659
mov eax, dword [0x555894]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov edx, dword [eax + 0xc]
mov ecx, dword [edx]
movzx eax, word [ecx + 0x10]
cmp eax, dword [ebp + 0xc]
jl 0x436659
cmp dword [ebp + 0xc], 0xffffffff
jne 0x4365e5
mov edx, dword [0x555894]
push edx
call sub.KERNEL32.DLL_TlsGetValue
mov ebx, eax
add ebx, 0x10
jmp 0x4365fa
mov eax, dword [0x555894]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov edx, dword [eax + 0xc]
mov ecx, dword [ebp + 0xc]
mov ebx, dword [edx + ecx*4 + 4]
test byte [ebx + 1], 0x20
setne al
and eax, 1
mov esi, eax
test esi, esi
je 0x436613
push ebx
call fcn.0043f7e0
pop ecx
mov ebx, eax
test byte [ebx + 1], 0x80
je 0x43663e
lea esi, [ebp + 0x10]
push edi
add esi, 4
mov eax, dword [esi - 4]
push eax
push ebx
call fcn.0042a804
add esp, 0xc
test eax, eax
je 0x436638
mov eax, 1
jmp 0x43665b
xor eax, eax
jmp 0x43665b
test esi, esi
jne 0x436648
cmp dword [ebp + 0xc], 0xffffffff
jne 0x436659
push edi
push ebx
call fcn.0043e694
add esp, 8
mov eax, 1
jmp 0x43665b
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x436b10
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x555894]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov edx, dword [eax + 0xc]
mov ecx, dword [edx]
movzx eax, word [ecx + 0x10]
ret

Function at 0x436b80
Capabilities:
Get system information on windows

Disassembly:
push ebx
push esi
add esp, 0xffffffdc
push 0x541438
call fcn.0043b748
pop ecx
cmp dword [0x5559dc], 0
jne 0x436bf9
push esp
call sub.KERNEL32.DLL_GetSystemInfo
mov ebx, dword [esp + 4]
mov esi, dword [esp + 0x1c]
mov eax, esi
dec eax
test eax, esi
jne 0x436bb5
mov edx, ebx
dec edx
test edx, ebx
je 0x436bba
call fcn.004b1f30
mov dword [0x5559e4], esi
mov dword [0x5559e0], ebx
mov dword [0x5559e8], 0x40000
mov dword [0x5559ec], 0x200000
mov dword [0x5559f0], 7
call sub.KERNEL32.DLL_GetTickCount
xor eax, 0x55555555
or eax, 8
and eax, 0xfffffff8
mov dword [0x5559dc], eax
dec dword [0x54143c]
jne 0x436c10
xor ecx, ecx
xor eax, eax
mov dword [0x541440], ecx
mov dword [0x541438], eax
mov eax, 1
add esp, 0x24
pop esi
pop ebx
ret

Function at 0x43b244
Capabilities:
Get thread local storage value

Disassembly:
push ebx
mov eax, dword [0x555894]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov ebx, dword [eax + 0x1f8]
test ebx, ebx
je 0x43b28a
xor edx, edx
mov dword [eax + 0x1f8], edx
push 0x54146c
call fcn.00449c3c
pop ecx
dec dword [ebx]
jne 0x43b27f
push 0
mov eax, dword [ebx + 4]
push eax
call fcn.0043af20
add esp, 8
push 0x54146c
call fcn.00449c5c
pop ecx
pop ebx
ret
Function at 0x43b5b4
Capabilities:
Get memory capacity
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff40
mov eax, dword [ebp + 8]
cmp eax, 0x68
jg 0x43b614
je 0x43b6f5
cmp eax, 4
jg 0x43b5f8
je 0x43b6bc
sub eax, 1
jb 0x43b661
je 0x43b675
dec eax
je 0x43b694
dec eax
je 0x43b6a8
jmp 0x43b73c
sub eax, 0x65
je 0x43b6c0
dec eax
je 0x43b6d7
dec eax
je 0x43b6de
jmp 0x43b73c
cmp eax, 0x3eb
jg 0x43b641
je 0x43b709
sub eax, 0x69
je 0x43b6f9
sub eax, 0x380
je 0x43b6fd
dec eax
je 0x43b705
jmp 0x43b73c
sub eax, 0x3ec
je 0x43b710
dec eax
je 0x43b71d
sub eax, 2
je 0x43b701
jmp 0x43b73c
lea edx, [ebp - 0x20]
push edx
call sub.KERNEL32.DLL_GlobalMemoryStatus
mov eax, dword [ebp - 0x14]
shr eax, 0xa
jmp 0x43b73e
lea edx, [ebp - 0x40]
push edx
call sub.KERNEL32.DLL_GlobalMemoryStatus
cmp dword [ebp - 0x34], 0xffffffff
jae 0x43b689
mov eax, dword [ebp - 0x34]
jmp 0x43b68c
or eax, 0xffffffff
shr eax, 0xa
jmp 0x43b73e
lea edx, [ebp - 0x60]
push edx
call sub.KERNEL32.DLL_GlobalMemoryStatus
mov eax, dword [ebp - 0x54]
shr eax, 0xa
jmp 0x43b73e
lea edx, [ebp - 0x80]
push edx
call sub.KERNEL32.DLL_GlobalMemoryStatus
mov eax, dword [ebp - 0x64]
shr eax, 0xa
jmp 0x43b73e
xor eax, eax
jmp 0x43b73e
lea edx, [ebp - 0xa0]
push edx
call sub.KERNEL32.DLL_GlobalMemoryStatus
mov eax, dword [ebp - 0x98]
shr eax, 0xa
jmp 0x43b73e
mov eax, 1
jmp 0x43b73e
lea edx, [ebp - 0xc0]
push edx
call sub.KERNEL32.DLL_GlobalMemoryStatus
mov eax, dword [ebp - 0xac]
shr eax, 0xa
jmp 0x43b73e
xor eax, eax
jmp 0x43b73e
xor eax, eax
jmp 0x43b73e
xor eax, eax
jmp 0x43b73e
xor eax, eax
jmp 0x43b73e
xor eax, eax
jmp 0x43b73e
call fcn.004330bc
jmp 0x43b73e
call fcn.004330bc
shl eax, 3
lea eax, [eax + eax*2]
jmp 0x43b73e
mov edx, dword [0x555894]
push edx
call sub.KERNEL32.DLL_TlsGetValue
mov ecx, dword [eax]
sub ecx, dword [eax + 8]
test ecx, ecx
jns 0x43b735
add ecx, 3
sar ecx, 2
mov eax, ecx
jmp 0x43b73e
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x43cf70
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
test byte [ebx], 4
je 0x43d16a
test dword [esi], 0x47b
je 0x43cfc2
lea eax, [ebp - 4]
push eax
push esi
mov edx, dword [ebx + 8]
push edx
call fcn.0043c6a0
add esp, 0xc
test eax, eax
je 0x43d16a
cmp dword [ebp + 0x10], 0
je 0x43cfb8
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 4]
inc ecx
mov dword [eax], ecx
mov eax, 1
jmp 0x43d179
test byte [esi], 4
je 0x43d16a
mov edx, dword [esi + 8]
cmp dword [edx + 0x10], 1
jne 0x43d16a
lea ecx, [ebp - 4]
push ecx
mov eax, dword [esi + 8]
mov edx, dword [eax]
push edx
mov ecx, dword [ebx + 8]
push ecx
call fcn.0043c6a0
add esp, 0xc
test eax, eax
je 0x43d16a
mov ecx, dword [ebp - 4]
mov eax, dword [ebx + 8]
shl ecx, 4
xor edi, edi
mov edx, dword [eax]
mov eax, dword [esi + 8]
lea ecx, [ecx + ecx*2]
add edx, ecx
add edx, 0x18
mov ebx, edx
mov edx, dword [eax]
add edx, 0x18
test byte [ebx + 1], 4
mov esi, edx
je 0x43d03e
test byte [esi + 1], 4
je 0x43d03e
push 1
push esi
push ebx
call fcn.0043fa58
add esp, 0xc
test eax, eax
sete al
and eax, 1
mov edi, eax
jmp 0x43d150
mov ecx, dword [ebx]
test cl, 0xa
je 0x43d087
test byte [esi], 0xa
je 0x43d087
test cl, 2
je 0x43d055
mov eax, dword [ebx + 8]
cdq
jmp 0x43d05b
mov eax, dword [ebx + 8]
mov edx, dword [ebx + 0xc]
push edx
push eax
test byte [esi], 2
je 0x43d068
mov eax, dword [esi + 8]
cdq
jmp 0x43d06e
mov eax, dword [esi + 8]
mov edx, dword [esi + 0xc]
cmp edx, dword [esp + 4]
jne 0x43d077
cmp eax, dword [esp]
sete cl
and ecx, 1
add esp, 8
mov edi, ecx
jmp 0x43d150
test byte [ebx], 0x1a
je 0x43d0b5
test byte [esi], 0x1a
je 0x43d0b5
push ebx
call fcn.0043e188
pop ecx
fstp qword [ebp - 0xc]
push esi
call fcn.0043e188
fcomp qword [ebp - 0xc]
pop ecx
fnstsw ax
sahf
sete dl
and edx, 1
mov edi, edx
jmp 0x43d150
test dword [ebx], 0xfffbffff
jne 0x43d0cf
test dword [esi], 0xfffbffff
jne 0x43d0cf
mov edi, 1
jmp 0x43d150
push ebx
call fcn.0043eee8
pop ecx
push eax
push esi
call fcn.0043eee8
pop ecx
pop edx
and edx, eax
je 0x43d150
push ebx
call fcn.00422db8
pop ecx
push esi
call fcn.00422db8
pop ecx
call fcn.00426c5c
test eax, eax
jne 0x43d150
mov eax, dword [0x555894]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov ecx, dword [eax]
mov eax, dword [ecx - 4]
push eax
call fcn.0043e12c
pop ecx
mov edi, eax
mov eax, dword [0x555894]
push eax
call sub.KERNEL32.DLL_TlsGetValue
sub dword [eax], 4
mov edx, dword [0x555894]
push edx
call sub.KERNEL32.DLL_TlsGetValue
mov ecx, dword [eax]
mov eax, dword [ecx]
test dword [eax], 0xb405
je 0x43d150
mov edx, dword [0x555894]
push edx
call sub.KERNEL32.DLL_TlsGetValue
mov ecx, dword [eax]
mov eax, dword [ecx]
push eax
call fcn.0043f008
pop ecx
test edi, edi
je 0x43d16a
cmp dword [ebp + 0x10], 0
je 0x43d163
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp - 4]
inc edx
mov dword [ecx], edx
mov eax, 1
jmp 0x43d179
cmp dword [ebp + 0x10], 0
je 0x43d177
mov edx, dword [ebp + 0x10]
xor ecx, ecx
mov dword [edx], ecx
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43da68
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push 0x2000
movzx eax, bx
push eax
call fcn.004336c4
add esp, 8
test eax, eax
je 0x43daca
mov edx, dword [0x555894]
push edx
call sub.KERNEL32.DLL_TlsGetValue
mov ecx, dword [eax + 0xc]
test esi, esi
movzx eax, bx
mov eax, dword [ecx + eax*4 + 4]
je 0x43daae
push esi
push eax
call fcn.0043f1f4
add esp, 8
jmp 0x43dac3
test dword [eax], 0xb405
je 0x43dabf
push eax
call fcn.0043f008
pop ecx
jmp 0x43dac3
xor edx, edx
mov dword [eax], edx
mov eax, 1
jmp 0x43dacc
xor eax, eax
pop esi
pop ebx
pop ebp
ret

Function at 0x43dad0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push 0x2000
movzx eax, bx
push eax
call fcn.004336c4
add esp, 8
test eax, eax
je 0x43db32
mov edx, dword [0x555894]
push edx
call sub.KERNEL32.DLL_TlsGetValue
mov ecx, dword [eax + 0xc]
test esi, esi
movzx eax, bx
mov eax, dword [ecx + eax*4 + 4]
je 0x43db16
push esi
push eax
call fcn.0043f344
add esp, 8
jmp 0x43db2b
test dword [eax], 0xb405
je 0x43db27
push eax
call fcn.0043f008
pop ecx
jmp 0x43db2b
xor edx, edx
mov dword [eax], edx
mov eax, 1
jmp 0x43db34
xor eax, eax
pop esi
pop ebx
pop ebp
ret

Function at 0x43e344
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x43e367
push ebx
mov eax, dword [0x555894]
push eax
call sub.KERNEL32.DLL_TlsGetValue
add eax, 0x10
push eax
call fcn.0043f0d4
add esp, 8
mov eax, ebx
pop ebx
pop ebp
ret

Function at 0x43e36c
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x43e38f
push ebx
mov eax, dword [0x555894]
push eax
call sub.KERNEL32.DLL_TlsGetValue
add eax, 0x10
push eax
call fcn.0043f284
add esp, 8
mov eax, ebx
pop ebx
pop ebp
ret

Function at 0x43e394
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x43e3be
push ebx
mov eax, dword [0x555894]
push eax
call sub.KERNEL32.DLL_TlsGetValue
add eax, 0x10
push eax
call fcn.0043f284
add esp, 8
push ebx
call fcn.0043dbc0
pop ecx
pop ebx
pop ebp
ret

Function at 0x43e5ac
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x43e5c8
test dword [ebx], 0xb405
je 0x43e5d2
push ebx
call fcn.0043f008
pop ecx
jmp 0x43e5d2
push 0
call fcn.0043da24
pop ecx
mov ebx, eax
mov dword [ebx], 0x10
fld qword [ebp + 0xc]
fcomp qword [0x43e62c]
fnstsw ax
sahf
ja 0x43e5f4
fld qword [ebp + 0xc]
fcomp qword [0x43e634]
fnstsw ax
sahf
jae 0x43e5fa
mov dx, 0x14
jmp 0x43e5fe
mov dx, 0xa
mov word [ebx + 0x10], dx
mov eax, dword [0x555894]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov cx, word [eax + 0xf4]
mov word [ebx + 0x12], cx
mov eax, dword [ebp + 0xc]
mov dword [ebx + 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebx + 0xc], eax
mov eax, ebx
pop ebx
pop ebp
ret
Function at 0x43e8cc
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov ebx, dword [ebp + 0x18]
mov esi, dword [ebp + 0x14]
mov edi, dword [ebp + 8]
test ebx, ebx
jge 0x43e8f3
mov eax, dword [0x555894]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov ebx, dword [eax + 0xf4]
test ebx, ebx
jne 0x43e953
fld qword [ebp + 0xc]
call fcn.004afcf0
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
fild qword [ebp - 8]
fcomp qword [ebp + 0xc]
fnstsw ax
sahf
jne 0x43e953
test esi, esi
jle 0x43e919
cmp esi, 0x63
jle 0x43e941
fld qword [ebp + 0xc]
fcomp qword [0x43e96c]
fnstsw ax
sahf
ja 0x43e935
fld qword [ebp + 0xc]
fcomp qword [0x43e974]
fnstsw ax
sahf
jae 0x43e93c
mov esi, 0x14
jmp 0x43e941
mov esi, 0xa
push esi
push dword [ebp - 4]
push dword [ebp - 8]
push edi
call fcn.0043e878
add esp, 0x10
jmp 0x43e964
push ebx
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call fcn.0043e97c
add esp, 0x14
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x43e97c
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0x18]
mov esi, dword [ebp + 0x14]
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x43e9a0
test dword [ebx], 0xb405
je 0x43e9aa
push ebx
call fcn.0043f008
pop ecx
jmp 0x43e9aa
push 0
call fcn.0043da24
pop ecx
mov ebx, eax
test esi, esi
jle 0x43e9b3
cmp esi, 0x63
jle 0x43e9db
fld qword [ebp + 0xc]
fcomp qword [0x43ea14]
fnstsw ax
sahf
ja 0x43e9cf
fld qword [ebp + 0xc]
fcomp qword [0x43ea1c]
fnstsw ax
sahf
jae 0x43e9d6
mov esi, 0x14
jmp 0x43e9db
mov esi, 0xa
test edi, edi
jge 0x43e9f0
mov eax, dword [0x555894]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov edi, dword [eax + 0xf4]
mov dword [ebx], 0x10
mov word [ebx + 0x10], si
mov word [ebx + 0x12], di
mov eax, dword [ebp + 0xc]
mov dword [ebx + 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebx + 0xc], eax
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x43ea24
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0x14]
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x43ea44
test dword [ebx], 0xb405
je 0x43ea4e
push ebx
call fcn.0043f008
pop ecx
jmp 0x43ea4e
push 0
call fcn.0043da24
pop ecx
mov ebx, eax
mov dword [ebx], 0x10
fld qword [ebp + 0xc]
fcomp qword [0x43eab4]
fnstsw ax
sahf
ja 0x43ea70
fld qword [ebp + 0xc]
fcomp qword [0x43eabc]
fnstsw ax
sahf
jae 0x43ea76
mov dx, 0x14
jmp 0x43ea7a
mov dx, 0xa
mov word [ebx + 0x10], dx
cmp esi, 0xff
jne 0x43ea9e
mov eax, dword [0x555894]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov cx, word [eax + 0xf4]
mov word [ebx + 0x12], cx
jmp 0x43eaa2
mov word [ebx + 0x12], si
mov eax, dword [ebp + 0xc]
mov dword [ebx + 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebx + 0xc], eax
mov eax, ebx
pop esi
pop ebx
pop ebp
ret