joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5352d0
Capabilities:
Execute anti-debugging instructions
Get thread local storage value

Disassembly:
push ecx
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
push ebp
push esi
lea ebp, [eax + 0x200]
mov dword [ecx + 0xc], eax
movzx esi, word [ebp + 4]
sub esi, 1
js 0x535370
push ebx
push edi
mov eax, dword [ebp]
cmp dword [eax + esi*4], 0
je 0x535369
push dword [0x884c50]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov edi, dword [ebx + 4]
cmp edi, dword [ebx + 0xc]
jae 0x53532b
mov dword [edi], str.TtcpAddCb
rdtsc
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 0x18]
lea eax, [edi + 0xc]
mov dword [edi + 4], ecx
mov dword [ebx + 4], eax
mov eax, dword [ebp]
push dword [esp + 0x1c]
mov ecx, dword [eax + esi*4]
mov eax, dword [ecx]
call dword [eax + 0x10]
push dword [0x884c50]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov edi, dword [ebx + 4]
cmp edi, dword [ebx + 0xc]
jae 0x535369
mov dword [edi], 0x77f5ec
rdtsc
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x10]
lea eax, [edi + 0xc]
mov dword [edi + 4], ecx
mov dword [ebx + 4], eax
sub esi, 1
jns 0x5352f3
pop edi
pop ebx
push ebp
call fcn.005354e0
add esp, 4
pop esi
pop ebp
pop ecx
ret

Function at 0x535814
Capabilities:
Get thread local storage value

Disassembly:
sub ecx, 8
jmp method.hkpEntityEntityBroadPhaseListener.virtual_0
mov eax, dword [esp + 4]
push esi
mov esi, ecx
mov dword [esi + 8], vtable.hkpBroadPhaseListener.0
mov dword [esi], vtable.hkBaseObject.0
test al, 1
je 0x53586a
test al, 4
jne 0x53585f
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0x10
cmp ax, cx
je 0x535842
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0x10
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4

Function at 0x535b30
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 0x10
push ebx
push esi
push edi
push dword [0x884adc]
mov edi, ecx
mov ebx, dword [edi + 0x50]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
lea edx, [ebx*4 + 0x7f]
and edx, 0xffffff80
mov esi, dword [eax + 0xc]
lea ecx, [esi + edx]
cmp edx, dword [eax + 8]
jg 0x535b66
cmp ecx, dword [eax + 0x10]
ja 0x535b66
mov dword [eax + 0xc], ecx
jmp 0x535b70
push edx
mov ecx, eax
call fcn.0046a3c0
mov esi, eax
push dword [edi + 0x50]
lea eax, [esp + 0x10]
mov dword [esp + 0x10], esi
push eax
lea ecx, [esp + 0x1c]
mov dword [esp + 0x18], ebx
call fcn.006513e0
lea eax, [esp + 0x14]
mov ecx, edi
push eax
call fcn.00535f70
mov ecx, dword [esp + 0x10]
mov bl, al
push dword [0x884adc]
mov edi, dword [esp + 0x10]
lea esi, [ecx*4 + 0x7f]
and esi, 0xffffff80
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
lea edx, [esi + 0xf]
and edx, 0xfffffff0
cmp esi, dword [eax + 8]
jg 0x535bd9
lea ecx, [edx + edi]
cmp ecx, dword [eax + 0xc]
jne 0x535bd9
cmp dword [eax + 0x14], edi
je 0x535bd9
mov dword [eax + 0xc], edi
mov al, bl
pop edi
pop esi
pop ebx
add esp, 0x10
ret
push edx
push edi
mov ecx, eax
call fcn.0046a590
pop edi
pop esi
mov al, bl
pop ebx
add esp, 0x10
ret
Function at 0x536210
Capabilities:
Get thread local storage value

Disassembly:
push esi
mov esi, ecx
call fcn.00535ce0
mov eax, dword [esp + 8]
test al, 1
je 0x536265
test al, 4
jne 0x536257
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0x84
cmp ax, cx
je 0x53623a
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0x84
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4
Function at 0x536a50
Capabilities:
Get thread local storage value

Disassembly:
sub ecx, 8
jmp method.hkpBroadPhaseBorder.virtual_0
push esi
mov esi, ecx
call fcn.005366b0
mov eax, dword [esp + 8]
test al, 1
je 0x536aa2
test al, 4
jne 0x536a97
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0x44
cmp ax, cx
je 0x536a7a
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0x44
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4

Function at 0x536ab4
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, ecx
mov dword [esi], vtable.hkpPhantomOverlapListener.0
test al, 1
je 0x536aed
test al, 4
jne 0x536ae2
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push 4
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
mov eax, esi
pop esi
ret 4
push 4
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4

Function at 0x536c80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x18]
mov edx, ecx
push esi
push edi
mov edi, dword [esp + 0x1c]
push ebp
lea ebx, [edx + 0x44]
mov dword [esp + 0x14], edx
lea esi, [edx + 0x14]
mov dword [edx + 4], 0x1ffff
push edi
push ebx
mov ecx, esi
mov dword [edx + 8], 0
mov dword [edx], vtable.hkpSimpleConstraintContactMgr.0
call fcn.0053bf60
push 1
mov ecx, ebx
call fcn.00506450
mov eax, dword [esp + 0x10]
xor ecx, ecx
mov dword [eax + 0x50], esi
mov esi, dword [esp + 0x18]
mov dword [eax + 0x58], edi
mov dword [eax + 0x5c], ebp
mov dword [eax + 0x10], ecx
mov word [eax + 0x18], cx
mov word [eax + 0x48], cx
mov ecx, ebx
mov dword [eax + 0x78], 0xffffffff
mov dword [eax + 0xc], esi
movsx eax, byte [edi + 0x2a]
mov esi, dword [esi + 0x80]
lea edx, [eax + eax*4]
movsx eax, byte [ebp + 0x2a]
add eax, esi
movsx eax, byte [eax + edx*2 + 0x1c50]
shl eax, 6
movzx eax, word [eax + esi + 0x1cfc]
push eax
call fcn.00506b80
movsx eax, word [edi + 0x8e]
shl eax, 0x10
mov dword [esp + 0x20], eax
movsx eax, word [ebp + 0x8e]
movss xmm0, dword [esp + 0x20]
shl eax, 0x10
pop edi
mov dword [esp + 0x18], eax
movss xmm1, dword [esp + 0x18]
comiss xmm0, xmm1
pop esi
pop ebp
pop ebx
ja 0x536d4a
movaps xmm0, xmm1
mov edx, dword [esp]
movss dword [esp + 0x10], xmm0
mov ecx, dword [esp + 0x10]
sar ecx, 0x10
mov eax, dword [edx + 0x3c]
mov word [eax + 0x18], cx
mov eax, edx
pop ecx
ret 0xc
Function at 0x537820
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push edi
mov edi, ecx
mov ebx, dword [edi + 0x28]
mov dword [edi], vtable.hkpSimpleContactConstraintData.0
test ebx, ebx
je 0x537858
movzx eax, word [ebx + 2]
push esi
push eax
call fcn.0053c9d0
add esp, 4
mov esi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
push ebx
mov ecx, dword [eax + 0x2c]
mov edx, dword [ecx]
call dword [edx + 8]
pop esi
mov eax, dword [edi + 0x14]
mov dword [edi + 0x10], 0
test eax, eax
js 0x53787c
and eax, 0x3fffffff
mov ecx, 0x7d8954
push eax
mov eax, dword [0x7d8954]
push dword [edi + 0xc]
call dword [eax + 0x10]
mov dword [edi + 0xc], 0
mov dword [edi + 0x14], connect
mov dword [edi], vtable.hkBaseObject.0
pop edi
pop ebx
ret

Function at 0x5378a4
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, ecx
mov dword [esi], vtable.hkBaseObject.0
test al, 1
je 0x5378f3
test al, 4
jne 0x5378e8
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0xc
cmp ax, cx
je 0x5378cb
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0xc
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4

Function at 0x537960
Capabilities:
Get thread local storage value

Disassembly:
push esi
mov esi, ecx
call fcn.00536d70
mov eax, dword [esp + 8]
test al, 1
je 0x5379b5
test al, 4
jne 0x5379a7
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0x80
cmp ax, cx
je 0x53798a
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0x80
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4

Function at 0x5379c0
Capabilities:
Get thread local storage value

Disassembly:
push esi
mov esi, ecx
call fcn.00537820
mov eax, dword [esp + 8]
test al, 1
je 0x537a12
test al, 4
jne 0x537a07
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0x30
cmp ax, cx
je 0x5379ea
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0x30
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4

Function at 0x538344
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, ecx
mov dword [esi], vtable.hkBaseObject.0
test al, 1
je 0x538393
test al, 4
jne 0x538388
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0xc
cmp ax, cx
je 0x53836b
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0xc
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4
Function at 0x5397e4
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, ecx
mov dword [esi], vtable.hkBaseObject.0
test al, 1
je 0x539833
test al, 4
jne 0x539828
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0x10
cmp ax, cx
je 0x53980b
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0x10
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4

Function at 0x5399f4
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, ecx
mov dword [esi], vtable.hkBaseObject.0
test al, 1
je 0x539a43
test al, 4
jne 0x539a38
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0x14
cmp ax, cx
je 0x539a1b
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0x14
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4

Function at 0x53a360
Capabilities:
Get thread local storage value

Disassembly:
sub ecx, 8
jmp method.hkpEndOfStepCallbackUtil.virtual_0
push esi
mov esi, ecx
call fcn.00510ad0
mov eax, dword [esp + 8]
test al, 1
je 0x53a3b2
test al, 4
jne 0x53a3a7
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0x38
cmp ax, cx
je 0x53a38a
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0x38
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4
Function at 0x53c6f0
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov ebp, edi
movzx ebx, word [edi + 4]
movzx eax, word [edi + 6]
cmp ebx, eax
jl 0x53c763
movzx ecx, word [edi + 0xc]
mov edx, 2
movzx eax, byte [edi + 9]
cmp ebx, edx
push ecx
cmovg edx, ebx
add edx, edx
push eax
movzx eax, byte [edi + 8]
cmp edx, ecx
push eax
cmovl ecx, edx
push ecx
call fcn.0053c820
mov ebp, eax
push edi
push ebp
call fcn.0053c900
movzx ecx, word [edi + 2]
push ecx
call fcn.0053c9d0
add esp, 0x1c
mov esi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
push edi
mov ecx, dword [eax + 0x2c]
mov edx, dword [ecx]
call dword [edx + 8]
mov eax, dword [esp + 0x18]
mov edi, ebp
mov byte [eax], 1
movzx edx, byte [edi + 0xa]
lea eax, [ebx + 1]
mov word [edi + 4], ax
movsx ecx, dx
movsx eax, bx
imul ecx, eax
movzx eax, word [edi + 6]
add edi, 0x30
shl eax, 5
sar edx, 2
add edi, ecx
add edi, eax
sub edx, 1
js 0x53c794
lea ecx, [edx + 1]
xor eax, eax
rep stosd dword es:[edi], eax
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
ret

Function at 0x53c7a0
Capabilities:
Get thread local storage value

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
push edi
movzx eax, word [ebx + 4]
add eax, dword [esp + 0x14]
movzx ecx, word [ebx + 6]
add eax, eax
cmp eax, ecx
jg 0x53c80b
movzx eax, word [ebx + 0xc]
push eax
movzx eax, byte [ebx + 9]
push eax
movzx eax, byte [ebx + 8]
shr ecx, 1
push eax
push ecx
call fcn.0053c820
mov edi, eax
push ebx
push edi
call fcn.0053c900
movzx eax, word [ebx + 2]
push eax
call fcn.0053c9d0
add esp, 0x1c
mov esi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
push ebx
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
mov eax, dword [esp + 0x18]
mov byte [eax], 1
mov eax, edi
pop edi
pop esi
pop ebx
ret
pop edi
pop esi
mov eax, ebx
pop ebx
ret
Function at 0x53c820
Capabilities:
Get thread local storage value

Disassembly:
push ecx
mov eax, dword [esp + 0xc]
add eax, dword [esp + 0x10]
push ebx
mov ebx, dword [esp + 0xc]
push ebp
lea eax, [eax*4 + 0x14]
lea ebp, [eax + 0x20]
mov dword [esp + 8], eax
imul ebp, ebx
push esi
push edi
push dword [0x884adc]
add ebp, 0x3f
and ebp, 0xfffffff0
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push ebp
mov esi, dword [eax + 0x2c]
mov edi, dword [esi]
call fcn.0053c9d0
add esp, 4
mov ecx, esi
push eax
call dword [edi + 4]
mov cx, word [esp + 0x24]
mov edx, eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x1c], 0
pop edi
mov byte [edx + 8], al
mov eax, dword [esp + 0x1c]
mov byte [edx + 9], al
mov eax, dword [esp + 0x18]
mov word [edx + 0xc], cx
mov ecx, dword [esp + 0xc]
mov word [edx + 2], bp
mov word [edx + 6], bx
mov byte [edx + 0xa], cl
mov dword [edx + 0x10], 0x30000
mov dword [edx + 0x14], 0
sar eax, 0x10
mov word [edx + 0x1a], ax
mov dword [esp + 0x18], 0
mov eax, dword [esp + 0x18]
sar eax, 0x10
mov word [edx + 0x18], ax
mov eax, 0x19
mov dword [edx + 0x1c], 0
mov dword [edx + 0x20], 0
mov dword [edx + 0x24], 0
mov dword [edx + 0x28], 0
mov dword [edx + 0x2c], 0
mov word [edx], ax
xor eax, eax
pop esi
pop ebp
mov word [edx + 4], ax
mov eax, edx
pop ebx
pop ecx
ret

Function at 0x53cce0
Capabilities:
Get thread local storage value

Disassembly:
push esi
mov esi, ecx
call fcn.0053cbe0
mov eax, dword [esp + 8]
test al, 1
je 0x53cd32
test al, 4
jne 0x53cd27
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0x2c
cmp ax, cx
je 0x53cd0a
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0x2c
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4

Function at 0x53cd40
Capabilities:
Get thread local storage value

Disassembly:
push esi
mov esi, ecx
mov dword [esi], vtable.hkpMoppCode.0
mov eax, dword [esi + 0x28]
mov dword [esi + 0x24], 0
test eax, eax
js 0x53cd6d
and eax, 0x3fffffff
mov ecx, 0x7d8954
push eax
mov eax, dword [0x7d8954]
push dword [esi + 0x20]
call dword [eax + 0x10]
mov eax, dword [esp + 8]
mov dword [esi + 0x20], 0
mov dword [esi + 0x28], connect
mov dword [esi], vtable.hkBaseObject.0
test al, 1
je 0x53cdcb
test al, 4
jne 0x53cdc0
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0x30
cmp ax, cx
je 0x53cda3
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0x30
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4
Function at 0x53cf50
Capabilities:
Get thread local storage value

Disassembly:
push ebx
mov ebx, ecx
push esi
push edi
mov ecx, dword [ebx + 0x110]
mov dword [ebx], vtable.hkpHybridBroadPhase.0
call fcn.0045c160
lea esi, [ebx + 0x28]
mov edi, 5
nop
mov eax, dword [esi]
mov dword [esi - 4], 0
test eax, eax
js 0x53cf96
and eax, 0x3fffffff
mov ecx, 0x7d8954
shl eax, 5
push eax
mov eax, dword [0x7d8954]
push dword [esi - 8]
call dword [eax + 0x10]
mov dword [esi - 8], 0
mov dword [esi], connect
add esi, 0x20
sub edi, 1
jne 0x53cf70
mov edi, 2
lea esi, [ebx + 0xd8]
mov eax, dword [esi - 4]
lea esi, [esi - 0xc]
dec edi
mov dword [esi + 4], 0
test eax, eax
js 0x53cfe0
and eax, 0x3fffffff
mov ecx, 0x7d8954
shl eax, 3
push eax
mov eax, dword [0x7d8954]
push dword [esi]
call dword [eax + 0x10]
mov dword [esi], 0
mov dword [esi + 8], connect
test edi, edi
jne 0x53cfb6
pop edi
pop esi
mov ecx, ebx
pop ebx
jmp fcn.006af440
Function at 0x540560
Capabilities:
Get thread local storage value

Disassembly:
push esi
mov esi, ecx
call fcn.0053cf50
mov eax, dword [esp + 8]
test al, 1
je 0x5405b5
test al, 4
jne 0x5405a7
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0x120
cmp ax, cx
je 0x54058a
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0x120
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4

Function at 0x548720
Capabilities:
Execute anti-debugging instructions
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x98
push esi
push edi
push dword [0x884c50]
mov dword [esp + 0x20], ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
mov esi, dword [edi + 4]
cmp esi, dword [edi + 0xc]
jae 0x548761
mov dword [esi], 0x7874b0
rdtsc
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 0x18]
lea eax, [esi + 0xc]
mov dword [esi + 4], ecx
mov dword [edi + 4], eax
mov edi, dword [ebp + 0x14]
lea eax, [esp + 0x50]
xorps xmm0, xmm0
mov ecx, dword [esp + 0x1c]
movaps xmmword [esp + 0x20], xmm0
movaps xmmword [esp + 0x30], xmm0
movaps xmmword [esp + 0x40], xmm0
movups xmm0, xmmword [edi]
push eax
push dword [ebp + 0x10]
movups xmmword [esp + 0x58], xmm0
lea eax, [esp + 0x28]
mov dword [esp + 0x28], 0x3f800000
movups xmm0, xmmword [edi + 0x10]
push eax
push 0
push dword [ebp + 0xc]
movups xmmword [esp + 0x74], xmm0
lea eax, [esp + 0x2b]
mov dword [esp + 0x48], 0x3f800000
movups xmm0, xmmword [edi + 0x20]
push eax
mov dword [esp + 0x60], 0x3f800000
movups xmmword [esp + 0x88], xmm0
movups xmm0, xmmword [edi + 0x30]
movups xmmword [esp + 0x98], xmm0
movups xmm0, xmmword [edi + 0x40]
movups xmmword [esp + 0xa8], xmm0
call fcn.00548860
push dword [0x884c50]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [esp + 0x18], eax
mov esi, dword [eax + 4]
cmp esi, dword [eax + 0xc]
jae 0x548818
mov dword [esi], 0x77f5ec
rdtsc
mov dword [esp + 0x1c], eax
mov ecx, dword [esp + 0x1c]
lea eax, [esi + 0xc]
mov dword [esi + 4], ecx
mov ecx, dword [esp + 0x18]
mov dword [ecx + 4], eax
cmp byte [esp + 0x17], 0
je 0x54884c
movss xmm0, dword [esp + 0x60]
ucomiss xmm0, dword [0x718814]
lahf
test ah, 0x44
jnp 0x54884c
lea eax, [esp + 0x50]
mov ecx, edi
push eax
call fcn.0054a7a0
mov eax, dword [ebp + 8]
mov byte [eax], 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [ebp + 8]
pop edi
pop esi
mov byte [eax], 0
mov esp, ebp
pop ebp
ret 0x10

Function at 0x54ad00
Capabilities:
Get thread local storage value

Disassembly:
push esi
mov esi, ecx
call fcn.0054abb0
mov eax, dword [esp + 8]
test al, 1
je 0x54ad52
test al, 4
jne 0x54ad47
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0x10
cmp ax, cx
je 0x54ad2a
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0x10
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4
Function at 0x54df50
Capabilities:
Execute anti-debugging instructions
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x78
push esi
push edi
push dword [0x884c50]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
mov esi, dword [edi + 4]
cmp esi, dword [edi + 0xc]
jae 0x54df8a
mov dword [esi], 0x787560
rdtsc
mov dword [esp + 8], eax
mov ecx, dword [esp + 8]
lea eax, [esi + 0xc]
mov dword [esi + 4], ecx
mov dword [edi + 4], eax
mov esi, dword [ebp + 0x10]
lea ecx, [esp + 0x10]
mov eax, dword [ebp + 0xc]
movss xmm1, dword [ebp + 0x14]
push dword [ebp + 0x28]
movaps xmm0, xmmword [esi]
mov edi, dword [ebp + 8]
movaps xmmword [esp + 0x14], xmm0
movaps xmm0, xmmword [esi + 0x10]
movaps xmmword [esp + 0x24], xmm0
movaps xmm0, xmmword [esi + 0x20]
movaps xmmword [esp + 0x34], xmm0
movaps xmm0, xmmword [esi + 0x30]
mov dword [esp + 0x6c], eax
mov eax, dword [ebp + 0x18]
movaps xmmword [esp + 0x44], xmm0
movaps xmm0, xmm1
mov dword [esp + 0x74], eax
mov eax, dword [ebp + 0x1c]
mulss xmm1, xmm1
mov dword [esp + 0x78], eax
mov eax, dword [ebp + 0x20]
shufps xmm0, xmm0, 0
mov dword [esp + 0x7c], eax
mov eax, dword [ebp + 0x24]
mov dword [esp + 0x68], edi
movaps xmmword [esp + 0x54], xmm0
movss dword [esp + 0x64], xmm1
mov dword [esp + 0x70], 0
mov dword [esp + 0x80], eax
call fcn.0054e4c0
mov dword [esp + 8], eax
cmp eax, 3
jne 0x54e033
push dword [ebp + 0x28]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push esi
push dword [ebp + 0xc]
push edi
call fcn.0054f580
add esp, 0x18
mov dword [esp + 8], 1
push dword [0x884c50]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
mov esi, dword [edi + 4]
cmp esi, dword [edi + 0xc]
jae 0x54e062
mov dword [esi], 0x77f5ec
rdtsc
mov dword [esp + 0xc], eax
mov ecx, dword [esp + 0xc]
lea eax, [esi + 0xc]
mov dword [esi + 4], ecx
mov dword [edi + 4], eax
mov eax, dword [esp + 8]
pop edi
pop esi
mov esp, ebp
pop ebp
ret