joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5ce5d3
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 8
push esi
mov esi, ecx
cmp dword [esi + 0x78], 0
je 0x5ce816
cmp byte [esi + 0xa2], 0
je 0x5ce816
cmp byte [esi + 0xa4], 0
push edi
jne 0x5ce732
cmp byte [esi + 0xa3], 0
jne 0x5ce732
push ebx
mov ebx, dword [esp + 0x1c]
push ebx
push dword [esp + 0x1c]
call fcn.005cf5d0
movss xmm0, dword [esi + 8]
comiss xmm0, dword [esi + 0x9c]
jbe 0x5ce715
mov ecx, esi
call fcn.005cf9f0
cmp dword [esi + 0x84], 0
je 0x5ce715
movss xmm0, dword [esi + 0x9c]
divss xmm0, dword [esi + 8]
mov eax, dword [ebx]
push ebp
cmp dword [eax + 4], 2
movss dword [esp + 0x20], xmm0
jle 0x5ce65f
movsx ebp, word [eax + 0x32]
jmp 0x5ce661
xor ebp, ebp
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
lea ecx, [ebp*2]
add ecx, ebp
shl ecx, 4
mov edi, dword [eax + 0xc]
mov dword [esp + 0x1c], ecx
add ecx, 0x7f
and ecx, 0xffffff80
mov dword [esp + 0x14], ecx
lea edx, [edi + ecx]
cmp ecx, dword [eax + 8]
jg 0x5ce69c
cmp edx, dword [eax + 0x10]
ja 0x5ce69c
mov dword [eax + 0xc], edx
jmp 0x5ce6a6
push ecx
mov ecx, eax
call fcn.0046a3c0
mov edi, eax
mov edx, dword [ebx]
movss xmm0, dword [esp + 0x20]
push edi
push ecx
movsx ecx, word [edx + 0x34]
movss dword [esp], xmm0
add ecx, edx
push ecx
push dword [esi + 0x84]
push ebp
call fcn.0057eab0
mov ecx, dword [ebx]
push dword [esp + 0x30]
push edi
movsx eax, word [ecx + 0x34]
add eax, ecx
push eax
call fcn.0045d810
add esp, 0x20
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [esp + 0x14]
pop ebp
lea edx, [ecx + 0xf]
and edx, 0xfffffff0
cmp ecx, dword [eax + 8]
jg 0x5ce70c
lea ecx, [edx + edi]
cmp ecx, dword [eax + 0xc]
jne 0x5ce70c
cmp dword [eax + 0x14], edi
je 0x5ce70c
mov dword [eax + 0xc], edi
jmp 0x5ce715
push edx
push edi
mov ecx, eax
call fcn.0046a590
pop ebx
pop edi
mov dword [esi + 0x94], 0
mov dword [esi + 0x90], 0
pop esi
add esp, 8
ret 8
mov edi, dword [esi + 0x84]
test edi, edi
je 0x5ce75e
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push dword [eax + 0x2c]
call fcn.00460680
add esp, 8
mov dword [esi + 0x84], 0
mov ecx, esi
call fcn.005cf780
mov edi, dword [esp + 0x18]
xorps xmm0, xmm0
movaps xmm1, xmm0
movss dword [esp + 0xc], xmm0
movss dword [esp + 8], xmm1
mov ecx, dword [edi]
mov edx, dword [ecx + 4]
cmp edx, 4
jle 0x5ce79d
movss xmm2, dword [ecx + 0x58]
comiss xmm2, xmm0
seta al
test al, al
je 0x5ce79d
movaps xmm1, xmm2
movss dword [esp + 8], xmm1
cmp edx, 6
jle 0x5ce7ba
movss xmm2, dword [ecx + 0x78]
comiss xmm2, xmm0
seta al
test al, al
je 0x5ce7ba
movaps xmm0, xmm2
movss dword [esp + 0xc], xmm0
cmp byte [esi + 0xa6], 0
jne 0x5ce7f9
cmp byte [esi + 0xa7], 0
jne 0x5ce7f9
cmp byte [esi + 0x56], 2
mov ecx, esi
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
sete al
movzx eax, al
push eax
push 1
sub esp, 8
movss dword [esp + 4], xmm0
movss dword [esp], xmm1
push edi
push dword [esp + 0x34]
call fcn.005cfb00
movss xmm0, dword [esp + 8]
movss dword [esi + 0x90], xmm0
movss xmm0, dword [esp + 0xc]
movss dword [esi + 0x94], xmm0
pop edi
pop esi
add esp, 8
ret 8
Function at 0x5ce820
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
push dword [edi + 0x78]
call fcn.005cc920
mov ebx, dword [edi + 0x88]
test ebx, ebx
je 0x5ce86d
push dword [0x884adc]
mov esi, dword [edi + 0x8c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [eax + 0x2c]
lea eax, [esi + esi*2]
shl eax, 4
push eax
push ebx
mov edx, dword [ecx]
call dword [edx + 8]
mov dword [edi + 0x88], 0
mov dword [edi + 0x8c], 0
mov ecx, edi
call fcn.005cf9f0
mov esi, dword [edi + 0x84]
test esi, esi
je 0x5ce8a0
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
push dword [eax + 0x2c]
call fcn.00460680
add esp, 8
mov dword [edi + 0x84], 0
mov eax, dword [edi + 8]
mov dword [edi + 0x9c], eax
mov dword [edi + 0x98], 0
movaps xmm0, xmmword [0x884c20]
movaps xmmword [edi + 0x20], xmm0
movaps xmm0, xmmword [0x884c30]
movaps xmmword [edi + 0x30], xmm0
movaps xmm0, xmmword [0x884c40]
movaps xmmword [edi + 0x40], xmm0
mov dword [edi + 0x90], 0
mov dword [edi + 0x94], 0
mov word [edi + 0xa0], 1
mov dword [edi + 0xa3], 0
pop edi
pop esi
pop ebx
ret
Function at 0x5cecc0
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 0x14
mov eax, dword [ecx + 0x74]
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov eax, dword [eax + 0x2c]
push esi
push edi
push dword [0x884adc]
mov eax, dword [eax + 0x1c]
mov dword [esp + 0x24], eax
mov ecx, dword [eax + 0x10]
mov eax, dword [eax + 0x14]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov ebx, dword [ecx + 0x1c]
mov esi, dword [eax + 0x1c]
mov dword [esp + 0x18], esi
mov dword [esp + 0x20], ebx
call ebp
lea ebx, [ebx + ebx*2]
shl ebx, 4
add ebx, 0x7f
mov edi, dword [eax + 0xc]
and ebx, 0xffffff80
lea ecx, [edi + ebx]
cmp ebx, dword [eax + 8]
jg 0x5ced1f
cmp ecx, dword [eax + 0x10]
ja 0x5ced1f
mov dword [eax + 0xc], ecx
jmp 0x5ced29
push ebx
mov ecx, eax
call fcn.0046a3c0
mov edi, eax
push dword [0x884adc]
call ebp
lea ebp, [esi + esi*2]
shl ebp, 4
add ebp, 0x7f
mov esi, dword [eax + 0xc]
and ebp, 0xffffff80
lea ecx, [esi + ebp]
cmp ebp, dword [eax + 8]
jg 0x5ced52
cmp ecx, dword [eax + 0x10]
ja 0x5ced52
mov dword [eax + 0xc], ecx
jmp 0x5ced5c
push ebp
mov ecx, eax
call fcn.0046a3c0
mov esi, eax
mov eax, dword [esp + 0x18]
push edi
push dword [esp + 0x2c]
push dword [eax + 0xc]
push dword [esp + 0x28]
call fcn.0057e2a0
mov eax, dword [esp + 0x20]
push esi
push dword [eax + 0x24]
push dword [eax + 0xc]
push dword [esp + 0x30]
call fcn.0057e2a0
mov eax, dword [esp + 0x30]
push 2
push esi
push dword [eax + 0x24]
push edi
push dword [esp + 0x50]
call fcn.00569220
push dword [esp + 0x60]
mov eax, dword [esp + 0x48]
push esi
push dword [eax + 0xc]
push dword [esp + 0x54]
call fcn.0057e3c0
add esp, 0x44
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
lea edx, [ebp + 0xf]
and edx, 0xfffffff0
cmp ebp, dword [eax + 8]
jg 0x5cedda
lea ecx, [edx + esi]
cmp ecx, dword [eax + 0xc]
jne 0x5cedda
cmp dword [eax + 0x14], esi
je 0x5cedda
mov dword [eax + 0xc], esi
jmp 0x5cede3
push edx
push esi
mov ecx, eax
call fcn.0046a590
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
lea edx, [ebx + 0xf]
and edx, 0xfffffff0
cmp ebx, dword [eax + 8]
jg 0x5cee14
lea ecx, [edx + edi]
cmp ecx, dword [eax + 0xc]
jne 0x5cee14
cmp dword [eax + 0x14], edi
je 0x5cee14
mov dword [eax + 0xc], edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 8
push edx
push edi
mov ecx, eax
call fcn.0046a590
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 8
Function at 0x5cee30
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 0x14
mov eax, dword [ecx + 0x74]
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov eax, dword [eax + 0x2c]
push esi
push edi
push dword [0x884adc]
mov eax, dword [eax + 0x1c]
mov dword [esp + 0x24], eax
mov ecx, dword [eax + 0x10]
mov eax, dword [eax + 0x14]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov ebx, dword [ecx + 0x1c]
mov esi, dword [eax + 0x1c]
mov dword [esp + 0x18], esi
mov dword [esp + 0x20], ebx
call ebp
lea ebx, [ebx + ebx*2]
shl ebx, 4
add ebx, 0x7f
mov edi, dword [eax + 0xc]
and ebx, 0xffffff80
lea ecx, [edi + ebx]
cmp ebx, dword [eax + 8]
jg 0x5cee8f
cmp ecx, dword [eax + 0x10]
ja 0x5cee8f
mov dword [eax + 0xc], ecx
jmp 0x5cee99
push ebx
mov ecx, eax
call fcn.0046a3c0
mov edi, eax
push dword [0x884adc]
call ebp
lea ebp, [esi + esi*2]
shl ebp, 4
add ebp, 0x7f
mov esi, dword [eax + 0xc]
and ebp, 0xffffff80
lea ecx, [esi + ebp]
cmp ebp, dword [eax + 8]
jg 0x5ceec2
cmp ecx, dword [eax + 0x10]
ja 0x5ceec2
mov dword [eax + 0xc], ecx
jmp 0x5ceecc
push ebp
mov ecx, eax
call fcn.0046a3c0
mov esi, eax
mov eax, dword [esp + 0x18]
push edi
push dword [esp + 0x2c]
push dword [eax + 0xc]
push dword [esp + 0x28]
call fcn.0057e2a0
mov eax, dword [esp + 0x20]
push esi
push dword [eax + 0x24]
push dword [eax + 0xc]
push dword [esp + 0x30]
call fcn.0057e2a0
mov eax, dword [esp + 0x30]
push 2
push esi
push dword [eax + 0x24]
push edi
push dword [esp + 0x50]
call fcn.00569220
push dword [esp + 0x64]
push esi
push dword [esp + 0x68]
push dword [esp + 0x54]
call fcn.0057e3e0
add esp, 0x44
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
lea edx, [ebp + 0xf]
and edx, 0xfffffff0
cmp ebp, dword [eax + 8]
jg 0x5cef47
lea ecx, [edx + esi]
cmp ecx, dword [eax + 0xc]
jne 0x5cef47
cmp dword [eax + 0x14], esi
je 0x5cef47
mov dword [eax + 0xc], esi
jmp 0x5cef50
push edx
push esi
mov ecx, eax
call fcn.0046a590
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
lea edx, [ebx + 0xf]
and edx, 0xfffffff0
cmp ebx, dword [eax + 8]
jg 0x5cef81
lea ecx, [edx + edi]
cmp ecx, dword [eax + 0xc]
jne 0x5cef81
cmp dword [eax + 0x14], edi
je 0x5cef81
mov dword [eax + 0xc], edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 0xc
push edx
push edi
mov ecx, eax
call fcn.0046a590
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 0xc
Function at 0x5cf5d0
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 8
push ebx
mov ebx, ecx
cmp dword [ebx + 0x84], 0
jne 0x5cf779
cmp dword [ebx + 0x7c], 0
je 0x5cf779
mov eax, dword [esp + 0x10]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
mov eax, dword [eax]
push edi
push dword [0x884adc]
mov eax, dword [eax + 0x2c]
mov eax, dword [eax + 0x14]
mov esi, dword [eax + 0x1c]
call ebp
mov ecx, dword [eax + 0x2c]
lea eax, [esi + esi*2]
shl eax, 4
push eax
push ecx
call fcn.00460640
mov dword [ebx + 0x84], eax
add esp, 8
mov eax, dword [ebx + 0x78]
push dword [0x884adc]
mov eax, dword [eax + 0x2c]
mov esi, dword [eax + 0x1c]
call ebp
mov ecx, eax
lea eax, [esi + esi*2]
shl eax, 4
add eax, 0x7f
and eax, 0xffffff80
mov edi, dword [ecx + 0xc]
mov dword [esp + 0x14], eax
lea edx, [edi + eax]
cmp eax, dword [ecx + 8]
jg 0x5cf65e
cmp edx, dword [ecx + 0x10]
ja 0x5cf65e
mov dword [ecx + 0xc], edx
jmp 0x5cf666
push eax
call fcn.0046a3c0
mov edi, eax
mov edx, dword [esp + 0x20]
push edi
push dword [ebx + 0x7c]
mov edx, dword [edx]
movsx ecx, word [edx + 0x14]
add ecx, edx
push ecx
push esi
call fcn.0057e4b0
mov eax, dword [ebx + 0x74]
add esp, 0x10
mov eax, dword [eax + 0x2c]
push dword [0x884adc]
mov eax, dword [eax + 0x14]
mov dword [esp + 0x14], eax
mov esi, dword [eax + 0x1c]
call ebp
lea ebp, [esi + esi*2]
shl ebp, 4
add ebp, 0x7f
mov esi, dword [eax + 0xc]
and ebp, 0xffffff80
lea ecx, [esi + ebp]
cmp ebp, dword [eax + 8]
jg 0x5cf6b9
cmp ecx, dword [eax + 0x10]
ja 0x5cf6b9
mov dword [eax + 0xc], ecx
jmp 0x5cf6c3
push ebp
mov ecx, eax
call fcn.0046a3c0
mov esi, eax
mov eax, dword [esp + 0x1c]
push esi
mov ecx, dword [eax]
mov ecx, dword [ecx + 0x2c]
push dword [ecx + 0x18]
push dword [esp + 0x28]
push edi
call fcn.005df3b0
mov eax, dword [esp + 0x30]
add esp, 0x10
mov eax, dword [eax]
cmp dword [eax + 4], 2
jle 0x5cf6ef
movsx eax, word [eax + 0x32]
jmp 0x5cf6f1
xor eax, eax
push dword [ebx + 0x84]
mov ecx, dword [esp + 0x14]
push esi
push dword [ecx + 0xc]
push eax
call fcn.0057e3c0
mov ebx, dword [sym.imp.KERNEL32.dll_TlsGetValue]
add esp, 0x10
push dword [0x884adc]
call ebx
lea edx, [ebp + 0xf]
and edx, 0xfffffff0
cmp ebp, dword [eax + 8]
jg 0x5cf733
lea ecx, [edx + esi]
cmp ecx, dword [eax + 0xc]
jne 0x5cf733
cmp dword [eax + 0x14], esi
je 0x5cf733
mov dword [eax + 0xc], esi
jmp 0x5cf73c
push edx
push esi
mov ecx, eax
call fcn.0046a590
push dword [0x884adc]
call ebx
mov ecx, dword [esp + 0x14]
lea edx, [ecx + 0xf]
and edx, 0xfffffff0
cmp ecx, dword [eax + 8]
jg 0x5cf76d
lea ecx, [edx + edi]
cmp ecx, dword [eax + 0xc]
jne 0x5cf76d
cmp dword [eax + 0x14], edi
je 0x5cf76d
mov dword [eax + 0xc], edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 8
push edx
push edi
mov ecx, eax
call fcn.0046a590
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 8
Function at 0x5cf9f0
Capabilities:
Get thread local storage value

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, dword [esi + 0x7c]
test edi, edi
je 0x5cfa1a
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push dword [eax + 0x2c]
call fcn.00460680
add esp, 8
mov dword [esi + 0x7c], 0
pop edi
pop esi
ret
Function at 0x5d0270
Capabilities:
Get thread local storage value

Disassembly:
push esi
mov esi, ecx
call fcn.005cc800
mov eax, dword [esp + 8]
test al, 1
je 0x5d02c5
test al, 4
jne 0x5d02b7
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0xb0
cmp ax, cx
je 0x5d029a
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0xb0
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4

Function at 0x5d0330
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x13c
mov eax, dword [ebp + 0x10]
xorps xmm0, xmm0
movaps xmmword [esp + 0xdc], xmm0
movaps xmmword [esp + 0xec], xmm0
movaps xmmword [esp + 0xfc], xmm0
movaps xmm0, xmmword [eax]
push esi
movaps xmmword [esp + 0x110], xmm0
movss xmm0, dword [ebp + 0x14]
push ecx
lea ecx, [esp + 0x124]
mov dword [esp + 0xe4], 0x3f800000
mov dword [esp + 0xf8], 0x3f800000
mov dword [esp + 0x10c], 0x3f800000
movss dword [esp], xmm0
call fcn.004e2a80
lea eax, [esp + 0x120]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x10], eax
lea ecx, [esp + 0x30]
lea eax, [esp + 0xe0]
mov dword [esp + 0x14], 0xffffffff
mov dword [esp + 0x18], eax
mov byte [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov word [esp + 0x28], 0x7f00
mov dword [esp + 0x2c], 0
mov byte [esp + 0x2a], 0xff
call fcn.004f48f0
mov esi, dword [ebp + 8]
lea ecx, [esp + 0x24]
mov dword [esp + 0x5c], 0xbf800000
lea eax, [esp + 0x10]
sub al, cl
mov byte [esp + 0x21], 8
mov byte [esp + 0x29], al
xor eax, eax
mov ecx, dword [esi + 0x78]
mov word [esp + 0x22], ax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x2c], eax
mov eax, dword [ecx]
mov dword [esp + 0x60], eax
mov eax, dword [ecx + 4]
mov dword [esp + 0x64], eax
mov eax, dword [ecx + 8]
mov dword [esp + 0x68], eax
mov eax, dword [ecx + 0xc]
mov dword [esp + 0x6c], eax
mov eax, dword [ecx + 0x10]
mov dword [esp + 0x70], eax
mov eax, dword [ecx + 0x14]
mov dword [esp + 0x74], eax
mov eax, dword [ecx + 0x18]
mov dword [esp + 0x78], eax
movaps xmm0, xmmword [ecx + 0x20]
movaps xmmword [esp + 0x80], xmm0
movaps xmm0, xmmword [ecx + 0x30]
movaps xmmword [esp + 0x90], xmm0
movaps xmm0, xmmword [ecx + 0x40]
push ecx
lea ecx, [esp + 0x64]
movaps xmmword [esp + 0xa4], xmm0
mov dword [esp + 0xc8], 0
call fcn.004fd5b0
mov eax, dword [esi + 0x7c]
mov ecx, esi
push dword [ebp + 0x1c]
movss xmm0, dword [ebp + 0x18]
mov dword [esp + 0x74], eax
lea eax, [esp + 0x64]
push eax
lea eax, [esp + 0x18]
movss dword [esp + 0x74], xmm0
push eax
call fcn.0050e920
cmp dword [esp + 0xc4], 0
je 0x5d04d6
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push 0x200
push dword [esp + 0xc8]
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x5d0ab0
Capabilities:
Get thread local storage value

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, dword [esi + 0x18]
sub edi, 1
mov dword [esi], vtable.hkbWorld.0
js 0x5d0ad6
mov eax, dword [esi + 0x14]
mov ecx, esi
push 1
push dword [eax + edi*4]
call fcn.005d0d20
sub edi, 1
jns 0x5d0ac2
mov edi, dword [esi + 0x24]
sub edi, 1
js 0x5d0af1
nop
mov eax, dword [esi + 0x20]
push esi
mov ecx, dword [eax + edi*4]
mov eax, dword [ecx]
call dword [eax + 0x20]
sub edi, 1
jns 0x5d0ae0
mov edi, dword [esi + 0xd0]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_TlsGetValue]
test edi, edi
je 0x5d0b1c
mov ecx, edi
call fcn.005dd170
push dword [0x884adc]
call ebx
push 0xc
push edi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
mov ecx, dword [esi + 0xdc]
test ecx, ecx
je 0x5d0b2c
mov eax, dword [ecx]
push 1
call dword [eax]
mov edi, dword [esi + 0xe0]
test edi, edi
je 0x5d0b86
lea eax, [edi + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov eax, dword [edi + 8]
mov dword [edi + 4], 0
test eax, eax
js 0x5d0b66
and eax, 0x3fffffff
mov ecx, 0x7d8954
shl eax, 4
push eax
mov eax, dword [0x7d8954]
push dword [edi]
call dword [eax + 0x10]
mov dword [edi], 0
mov dword [edi + 8], connect
push dword [0x884adc]
call ebx
push 0x24
push edi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
lea ecx, [esi + 0x98]
call fcn.005d2660
lea ecx, [esi + 0x74]
call fcn.005d2660
lea ecx, [esi + 0x50]
call fcn.005d2660
lea ecx, [esi + 0x2c]
call fcn.005d2660
mov eax, dword [esi + 0x28]
mov dword [esi + 0x24], 0
test eax, eax
js 0x5d0bd0
and eax, 0x3fffffff
mov ecx, 0x7d8954
shl eax, 2
push eax
mov eax, dword [0x7d8954]
push dword [esi + 0x20]
call dword [eax + 0x10]
mov dword [esi + 0x20], 0
mov dword [esi + 0x28], connect
mov eax, dword [esi + 0x1c]
mov dword [esi + 0x18], 0
test eax, eax
js 0x5d0c05
and eax, 0x3fffffff
mov ecx, 0x7d8954
shl eax, 2
push eax
mov eax, dword [0x7d8954]
push dword [esi + 0x14]
call dword [eax + 0x10]
mov dword [esi + 0x14], 0
mov dword [esi + 0x1c], connect
mov edi, dword [esi + 0xc]
sub edi, 1
mov ebx, dword [esi + 8]
js 0x5d0c38
nop
mov ecx, dword [ebx + edi*4]
test ecx, ecx
je 0x5d0c2c
call fcn.0045c160
mov dword [ebx + edi*4], 0
sub edi, 1
jns 0x5d0c20
mov eax, dword [esi + 0x10]
mov dword [esi + 0xc], 0
pop ebx
test eax, eax
js 0x5d0c60
and eax, 0x3fffffff
mov ecx, 0x7d8954
shl eax, 2
push eax
mov eax, dword [0x7d8954]
push dword [esi + 8]
call dword [eax + 0x10]
mov dword [esi + 8], 0
mov dword [esi + 0x10], connect
pop edi
mov dword [esi], vtable.hkBaseObject.0
pop esi
ret
Function at 0x5d0f50
Capabilities:
Execute anti-debugging instructions
Get thread local storage value

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
mov esi, ecx
push edi
mov al, byte [esi + 0xe7]
cmp al, 1
je 0x5d10a1
cmp al, 3
je 0x5d10a1
push dword [0x884c50]
call ebp
mov ebx, eax
mov edi, dword [ebx + 4]
cmp edi, dword [ebx + 0xc]
jae 0x5d0f9e
mov dword [edi], str.TtstepSt
rdtsc
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x10]
lea eax, [edi + 0xc]
mov dword [edi + 4], ecx
mov dword [ebx + 4], eax
movss xmm0, dword [esp + 0x18]
push ecx
mov ecx, esi
movss dword [esp], xmm0
call fcn.005d1900
movss xmm0, dword [esp + 0x18]
push ecx
mov ecx, esi
movss dword [esp], xmm0
call fcn.005d2010
mov eax, dword [esi + 0xd8]
xor edi, edi
cmp dword [eax + 0x10], edi
jle 0x5d1017
xor ebx, ebx
xor ebp, ebp
mov ecx, dword [esi + 0xd8]
push 0
push ecx
mov dword [esp], 0
mov eax, dword [ecx + 4]
push 0
lea eax, [eax + edi*8]
push eax
mov eax, dword [ecx]
mov ecx, dword [ecx + 8]
add eax, ebp
push eax
mov ecx, dword [ecx + ebx + 0x28]
call fcn.00598090
mov eax, dword [esi + 0xd8]
lea ebx, [ebx + 0x50]
inc edi
add ebp, 0x28
cmp edi, dword [eax + 0x10]
jl 0x5d0fd5
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov eax, dword [esi + 0xd8]
push dword [eax + 0x10]
movss xmm0, dword [eax + 0x14]
push ecx
movss dword [esp], xmm0
mov ecx, esi
push dword [eax + 4]
push dword [eax]
call fcn.005d2150
mov eax, dword [esi + 0xd8]
movss xmm0, dword [esp + 0x18]
push dword [eax + 0x10]
push ecx
movss dword [esp], xmm0
mov ecx, esi
push dword [eax + 4]
push dword [eax]
call fcn.005d2320
mov ecx, esi
call fcn.005d2530
mov ecx, esi
call fcn.005d1ec0
cmp byte [esi + 0xe7], 2
jne 0x5d1076
mov byte [esi + 0xe7], 1
push dword [0x884c50]
call ebp
mov ebx, eax
mov edi, dword [ebx + 4]
cmp edi, dword [ebx + 0xc]
jae 0x5d10a1
mov dword [edi], 0x77f5ec
rdtsc
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x10]
lea eax, [edi + 0xc]
mov dword [edi + 4], ecx
mov dword [ebx + 4], eax
push dword [0x884c50]
call ebp
mov ebx, eax
mov edi, dword [ebx + 4]
cmp edi, dword [ebx + 0xc]
jae 0x5d10cc
mov dword [edi], str.TtpostGenCb
rdtsc
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x10]
lea eax, [edi + 0xc]
mov dword [edi + 4], ecx
mov dword [ebx + 4], eax
xor ebx, ebx
cmp dword [esi + 0x24], ebx
jle 0x5d1109
xor edi, edi
cmp dword [esi + 0x18], edi
jle 0x5d1103
nop word [eax + eax]
mov eax, dword [esi + 0x20]
movss xmm0, dword [esp + 0x18]
mov ecx, dword [eax + ebx*4]
mov eax, dword [esi + 0x14]
push ecx
movss dword [esp], xmm0
mov edx, dword [ecx]
push dword [eax + edi*4]
call dword [edx + 0x18]
inc edi
cmp edi, dword [esi + 0x18]
jl 0x5d10e0
inc ebx
cmp ebx, dword [esi + 0x24]
jl 0x5d10d3
push dword [0x884c50]
call ebp
mov edi, eax
mov esi, dword [edi + 4]
cmp esi, dword [edi + 0xc]
jae 0x5d1134
mov dword [esi], 0x77f5ec
rdtsc
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 0x18]
lea eax, [esi + 0xc]
mov dword [esi + 4], ecx
mov dword [edi + 4], eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 4
Function at 0x5d1140
Capabilities:
Execute anti-debugging instructions
Get thread local storage value

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, ecx
push edi
push dword [0x884c50]
mov dword [esp + 0x14], ebx
call esi
mov ecx, eax
mov edi, dword [ecx + 4]
cmp edi, dword [ecx + 0xc]
jae 0x5d1185
mov dword [edi], str.LthkbWorld::stepMultithreaded
mov dword [edi + 0xc], str.Stbegin
rdtsc
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
mov dword [edi + 4], eax
lea eax, [edi + 0x10]
mov dword [ecx + 4], eax
movss xmm0, dword [esp + 0x1c]
push ecx
mov ecx, ebx
movss dword [esp], xmm0
call fcn.005d12b0
push dword [0x884c50]
call esi
mov ebx, eax
mov edi, dword [ebx + 4]
cmp edi, dword [ebx + 0xc]
jae 0x5d11c3
mov dword [edi], str.Ststage1
rdtsc
mov dword [esp + 0x1c], eax
mov ecx, dword [esp + 0x1c]
lea eax, [edi + 0xc]
mov dword [edi + 4], ecx
mov dword [ebx + 4], eax
mov ebp, dword [esp + 0x20]
xor ebx, ebx
mov ecx, dword [esp + 0x10]
push ebp
call fcn.005d1300
test al, al
je 0x5d126e
mov edi, dword [esp + 0x24]
nop
mov eax, dword [edi]
mov ecx, edi
push 0x15
push ebp
call dword [eax + 0xc]
mov ecx, ebp
call fcn.0064eb00
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x10]
inc ebx
cmp ebx, 1
jne 0x5d1222
push dword [0x884c50]
call esi
mov edi, eax
mov esi, dword [edi + 4]
cmp esi, dword [edi + 0xc]
jae 0x5d1252
mov dword [esi], str.Ststage2
rdtsc
mov dword [esp + 0x1c], eax
mov ecx, dword [esp + 0x1c]
jmp 0x5d1249
cmp ebx, 2
jne 0x5d125c
push dword [0x884c50]
call esi
mov edi, eax
mov esi, dword [edi + 4]
cmp esi, dword [edi + 0xc]
jae 0x5d1252
mov dword [esi], str.Ststage3
rdtsc
mov dword [esp + 0x20], eax
mov ecx, dword [esp + 0x20]
lea eax, [esi + 0xc]
mov dword [esi + 4], ecx
mov dword [edi + 4], eax
mov edi, dword [esp + 0x24]
mov esi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [esp + 0x10]
push ebp
call fcn.005d1300
test al, al
jne 0x5d11e0
push dword [0x884c50]
call esi
mov edi, eax
mov esi, dword [edi + 4]
cmp esi, dword [edi + 0xc]
jae 0x5d1299
mov dword [esi], 0x77f784
rdtsc
mov dword [esp + 0x24], eax
mov ecx, dword [esp + 0x24]
lea eax, [esi + 0xc]
mov dword [esi + 4], ecx
mov dword [edi + 4], eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc