joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6ae7a0
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
mov eax, dword [edi + 4]
lea ebx, [edi + 4]
mov ecx, dword [ebx + 4]
mov dword [esp + 0x14], ebx
movzx ebp, byte [edi + 2]
shl ebp, 6
mov edx, dword [eax + ecx*4 - 4]
movzx eax, word [edi]
sub edx, ebp
add edx, eax
mov eax, dword [esp + 0x20]
cmp eax, edx
je 0x6ae830
shr ebp, 4
lea ebx, [edx + 0xc]
sub edx, eax
lea edi, [eax + 8]
mov dword [esp + 0x10], edx
mov edx, dword [edx + edi]
lea ebx, [ebx + 0x10]
mov ecx, dword [ebx - 0x18]
lea edi, [edi + 0x10]
mov esi, dword [ebx - 0x10]
dec ebp
mov eax, dword [ebx - 0x1c]
mov dword [edi - 0x10], edx
mov edx, dword [esp + 0x10]
mov dword [edi - 0x18], eax
mov dword [edi - 0x14], ecx
mov dword [edi - 0xc], esi
test ebp, ebp
jg 0x6ae7e1
mov ebx, dword [esp + 0x20]
mov edi, dword [esp + 0x1c]
mov eax, dword [ebx + 0x10]
movzx ecx, word [ebx + 4]
movzx edx, word [ebx + 6]
mov eax, dword [eax + 0x50]
mov dword [eax + ecx*8], ebx
mov ecx, edx
mov eax, dword [ebx + 0x14]
mov eax, dword [eax + 0x50]
mov dword [eax + ecx*8], ebx
mov ebx, dword [esp + 0x14]
movzx ecx, byte [edi + 2]
mov eax, 0xffc0
imul ecx, eax
add word [edi], cx
jne 0x6ae86f
mov ecx, dword [ebx + 4]
mov eax, dword [ebx]
mov esi, dword [eax + ecx*4 - 4]
dec dword [ebx + 4]
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push 0x200
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
mov eax, 0x200
mov word [edi], ax
mov edx, dword [ebx + 8]
test edx, edx
js 0x6ae8c9
mov ecx, dword [ebx + 4]
add ecx, 3
mov eax, ecx
shr eax, 0x10
or ecx, eax
mov eax, ecx
shr eax, 8
or ecx, eax
mov eax, ecx
shr eax, 4
or ecx, eax
mov eax, ecx
shr eax, 2
or ecx, eax
mov eax, ecx
shr eax, 1
or eax, ecx
inc eax
cmp eax, 1
jge 0x6ae8ac
push 1
lea eax, [ebx + 0xc]
push eax
jmp 0x6ae8b9
and edx, 0x3fffffff
cmp eax, edx
jge 0x6ae8c9
push eax
push 0
push 4
push ebx
push 0x7d8954
call fcn.00467c80
add esp, 0x14
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret

Function at 0x6aee10
Capabilities:
Get thread local storage value

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, 0x200
push edi
movzx edi, word [esi]
cmp di, ax
jae 0x6aee40
mov ecx, dword [esi + 4]
mov eax, edi
mov edx, dword [esi + 8]
add eax, dword [ecx + edx*4 - 4]
movzx ecx, byte [esi + 2]
shl cx, 6
add cx, di
pop edi
mov word [esi], cx
pop esi
ret
push ebx
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push 0x200
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 4]
lea edi, [esi + 4]
mov ebx, eax
mov eax, dword [edi + 8]
and eax, 0x3fffffff
cmp dword [edi + 4], eax
jne 0x6aee7c
push 4
push edi
push 0x7d8954
call fcn.00467c00
add esp, 0xc
mov edx, dword [edi + 4]
mov eax, ebx
mov ecx, dword [edi]
mov dword [ecx + edx*4], ebx
inc dword [edi + 4]
movzx ecx, byte [esi + 2]
pop ebx
shl cx, 6
pop edi
mov word [esi], cx
pop esi
ret
Function at 0x6af394
Capabilities:
Get thread local storage value

Disassembly:
sub ecx, 8
jmp method.hkpNullBroadPhaseListener.virtual_0
mov eax, dword [esp + 4]
push esi
mov esi, ecx
mov dword [esi + 8], vtable.hkpBroadPhaseListener.0
mov dword [esi], vtable.hkBaseObject.0
test al, 1
je 0x6af3ea
test al, 4
jne 0x6af3df
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0xc
cmp ax, cx
je 0x6af3c2
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0xc
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4

Function at 0x6af4f0
Capabilities:
Get thread local storage value

Disassembly:
push esi
mov esi, ecx
call fcn.006af440
mov eax, dword [esp + 8]
test al, 1
je 0x6af542
test al, 4
jne 0x6af537
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0x20
cmp ax, cx
je 0x6af51a
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0x20
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4

Function at 0x6af7e0
Capabilities:
Execute anti-debugging instructions
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x28
push esi
push edi
push dword [0x884c50]
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [esp + 0xc], eax
mov edi, dword [eax + 4]
cmp edi, dword [eax + 0xc]
jae 0x6af822
mov dword [edi], str.TtRayCstCchSim
rdtsc
mov dword [esp + 8], eax
mov ecx, dword [esp + 8]
lea eax, [edi + 0xc]
mov dword [edi + 4], ecx
mov ecx, dword [esp + 0xc]
mov dword [ecx + 4], eax
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 0xc]
mov dword [esi + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [esi + 4], ecx
test eax, eax
je 0x6af83a
lea edx, [eax + 0x14]
jmp 0x6af83c
xor edx, edx
mov dword [esi + 8], edx
cmp byte [ecx + 0x20], 0
je 0x6af858
test eax, eax
je 0x6af851
add eax, 0x10
mov dword [esi + 0x34], eax
jmp 0x6af85f
xor eax, eax
mov dword [esi + 0x34], eax
jmp 0x6af85f
mov dword [esi + 0x34], 0
movaps xmm0, xmmword [ecx]
lea eax, [ecx + 0x10]
mov ecx, dword [ebp + 8]
lea edx, [esp + 0x10]
mov dword [esp + 0x24], eax
mov eax, dword [ebp + 0x14]
push 0
mov dword [esp + 0x30], eax
mov eax, dword [ecx]
push esi
push edx
mov dword [esp + 0x2c], 1
mov dword [esp + 0x34], 0x10
movaps xmmword [esp + 0x1c], xmm0
call dword [eax + 0x64]
push dword [0x884c50]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
mov esi, dword [edi + 4]
cmp esi, dword [edi + 0xc]
jae 0x6af8c4
mov dword [esi], 0x77f5ec
rdtsc
mov dword [esp + 0xc], eax
mov ecx, dword [esp + 0xc]
lea eax, [esi + 0xc]
mov dword [esi + 4], ecx
mov dword [edi + 4], eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x14
Function at 0x6afb30
Capabilities:
Execute anti-debugging instructions
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x28
push esi
push edi
push dword [0x884c50]
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [esp + 0xc], eax
mov edi, dword [eax + 4]
cmp edi, dword [eax + 0xc]
jae 0x6afb72
mov dword [edi], str.TtRayCstCached
rdtsc
mov dword [esp + 8], eax
mov ecx, dword [esp + 8]
lea eax, [edi + 0xc]
mov dword [edi + 4], ecx
mov ecx, dword [esp + 0xc]
mov dword [ecx + 4], eax
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 0xc]
mov dword [esi + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [esi + 4], ecx
mov dword [esi + 0x10], 0
test eax, eax
je 0x6afb91
lea edx, [eax + 0x14]
jmp 0x6afb93
xor edx, edx
mov dword [esi + 8], edx
cmp byte [ecx + 0x20], 0
je 0x6afbaf
test eax, eax
je 0x6afba8
add eax, 0x10
mov dword [esi + 0x44], eax
jmp 0x6afbb6
xor eax, eax
mov dword [esi + 0x44], eax
jmp 0x6afbb6
mov dword [esi + 0x44], 0
movaps xmm0, xmmword [ecx]
lea eax, [ecx + 0x10]
mov ecx, dword [ebp + 8]
lea edx, [esp + 0x10]
mov dword [esp + 0x24], eax
mov eax, dword [ebp + 0x14]
push 0
mov dword [esp + 0x30], eax
mov eax, dword [ecx]
push esi
push edx
mov dword [esp + 0x2c], 1
mov dword [esp + 0x34], 0x10
movaps xmmword [esp + 0x1c], xmm0
call dword [eax + 0x64]
push dword [0x884c50]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
mov esi, dword [edi + 4]
cmp esi, dword [edi + 0xc]
jae 0x6afc1b
mov dword [esi], 0x77f5ec
rdtsc
mov dword [esp + 0xc], eax
mov ecx, dword [esp + 0xc]
lea eax, [esi + 0xc]
mov dword [esi + 4], ecx
mov dword [edi + 4], eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x14
Function at 0x6b08b0
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
mov dword [edi], vtable.hkp3AxisSweep.0
cmp dword [edi + 0xd0], ebx
jle 0x6b0919
push ebp
xor ebp, ebp
nop dword [eax + eax]
mov esi, dword [edi + 0xd8]
add esi, ebp
mov dword [esi + 8], 0
mov eax, dword [esi + 0xc]
test eax, eax
js 0x6b08fe
and eax, 0x3fffffff
mov ecx, 0x7d8954
add eax, eax
push eax
mov eax, dword [0x7d8954]
push dword [esi + 4]
call dword [eax + 0x10]
inc ebx
mov dword [esi + 4], 0
mov dword [esi + 0xc], connect
add ebp, 0x10
cmp ebx, dword [edi + 0xd0]
jl 0x6b08d0
pop ebp
push dword [0x884adc]
mov esi, dword [edi + 0xd8]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
push dword [eax + 0x2c]
call fcn.00460680
add esp, 8
lea esi, [edi + 0xd0]
mov ebx, 3
mov eax, dword [esi - 4]
lea esi, [esi - 0xc]
dec ebx
mov dword [esi + 4], 0
test eax, eax
js 0x6b096c
and eax, 0x3fffffff
mov ecx, 0x7d8954
shl eax, 2
push eax
mov eax, dword [0x7d8954]
push dword [esi]
call dword [eax + 0x10]
mov dword [esi], 0
mov dword [esi + 8], connect
test ebx, ebx
jne 0x6b0942
mov eax, dword [edi + 0xa8]
mov dword [edi + 0xa4], ebx
test eax, eax
js 0x6b09a9
and eax, 0x3fffffff
mov ecx, 0x7d8954
shl eax, 4
push eax
mov eax, dword [0x7d8954]
push dword [edi + 0xa0]
call dword [eax + 0x10]
mov dword [edi + 0xa0], 0
mov ecx, edi
mov dword [edi + 0xa8], connect
pop edi
pop esi
pop ebx
jmp fcn.006af440
Function at 0x6ba5a0
Capabilities:
Get thread local storage value

Disassembly:
push esi
mov esi, ecx
call fcn.006b08b0
mov eax, dword [esp + 8]
test al, 1
je 0x6ba5f5
test al, 4
jne 0x6ba5e7
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0xe0
cmp ax, cx
je 0x6ba5ca
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0xe0
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4
Function at 0x6bd150
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0xf8
push esi
push edi
mov ecx, dword [ebp + 8]
movups xmm0, xmmword [ecx + 0x50]
movups xmm3, xmmword [ecx + 0x20]
mov eax, dword [ecx]
lea esi, [esp + 0xe0]
movups xmm2, xmmword [ecx + 0x30]
mov dword [esp + 0x60], eax
mov eax, dword [ecx + 4]
movups xmm1, xmmword [ecx + 0x40]
mov dword [esp + 0x64], eax
mov eax, dword [ecx + 8]
mov dword [esp + 0x68], eax
mov eax, dword [ecx + 0xc]
mov dword [esp + 0x6c], eax
mov eax, dword [ecx + 0x10]
mov dword [esp + 0x70], eax
lea eax, [ecx + 0x20]
mov dword [esp + 0x30], eax
mov eax, dword [ecx + 0x60]
mov dword [esp + 0xc0], eax
lea eax, [esp + 0x60]
mov dword [esp + 0x34], eax
lea eax, [esp + 0x64]
mov dword [esp + 0x38], eax
mov eax, dword [ebp + 0x10]
movaps xmmword [esp + 0xb0], xmm0
movups xmm0, xmmword [ecx + 0x70]
movzx ecx, byte [eax + 0xb]
mov eax, ecx
movaps xmmword [esp + 0x80], xmm3
and eax, 1
movaps xmmword [esp + 0x90], xmm2
and ecx, 2
mov dword [esp + 0x3c], eax
xor eax, eax
movaps xmmword [esp + 0xa0], xmm1
movups xmmword [esp + 0xd0], xmm0
mov dword [esp + 0x40], ecx
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x1c], esi
mov dword [esp + 0x14], eax
nop dword [eax + eax]
cmp dword [esp + eax + 0x3c], 0
je 0x6bd2c9
mov eax, dword [esp + eax + 0x34]
push dword [0x884adc]
mov dword [esp + 0x1c], eax
mov eax, dword [eax]
mov edi, dword [eax]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push 0x40
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
mov eax, dword [eax + 4]
call eax
mov esi, eax
mov ecx, edi
mov eax, 0x40
mov word [esi + 4], ax
movss xmm0, dword [edi + 0x10]
movss dword [esp + 0x2c], xmm0
call fcn.004e1a90
fstp dword [esp + 0x28]
movss xmm0, dword [esp + 0x28]
lea eax, [edi + 0x30]
addss xmm0, dword [esp + 0x2c]
push ecx
mov ecx, esi
addss xmm0, dword [0x7c264c]
movss dword [esp], xmm0
push eax
lea eax, [edi + 0x20]
push eax
call fcn.004e02b0
mov esi, dword [esp + 0x1c]
mov edi, dword [esp + 0x18]
test esi, esi
je 0x6bd2b0
mov ecx, dword [edi]
mov edx, dword [ecx + 8]
mov dword [esi + 0xc], ecx
mov dword [esi + 8], edx
mov ecx, dword [esp + 0x14]
mov dword [esi], eax
mov dword [esi + 4], 0xffffffff
mov eax, dword [edi]
mov dword [esp + ecx + 0x20], eax
mov eax, ecx
mov dword [edi], esi
jmp 0x6bd2d1
mov dword [esp + eax + 0x20], 0
add eax, 4
add esi, 0x10
mov dword [esp + 0x1c], esi
mov dword [esp + 0x14], eax
cmp eax, 8
jl 0x6bd220
mov eax, dword [esp + 0x64]
lea ecx, [esp + 0x44]
push dword [esp + 0x30]
push dword [eax]
mov eax, dword [esp + 0x68]
push dword [eax]
call fcn.006f43f0
lea eax, [esp + 0x50]
push eax
lea eax, [esp + 0x48]
push eax
push dword [ebp + 0xc]
lea eax, [esp + 0x6c]
push eax
call fcn.006bc490
add esp, 0x10
xor edi, edi
nop dword [eax]
mov eax, dword [esp + edi + 0x20]
test eax, eax
je 0x6bd33b
mov esi, dword [esp + edi + 0x34]
mov ecx, dword [esi]
mov ecx, dword [ecx]
call fcn.0045c160
mov eax, dword [esp + edi + 0x20]
mov dword [esi], eax
add edi, 4
cmp edi, 8
jl 0x6bd320
fld dword [esp + 0x5c]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x6be284
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, ecx
mov dword [esi], vtable.hkBaseObject.0
test al, 1
je 0x6be2d3
test al, 4
jne 0x6be2c8
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0x14
cmp ax, cx
je 0x6be2ab
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0x14
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4
Function at 0x6bf4f0
Capabilities:
Execute anti-debugging instructions
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0xa8
push esi
push edi
push dword [0x884c50]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
mov esi, dword [edi + 4]
cmp esi, dword [edi + 0xc]
jae 0x6bf52d
mov dword [esi], str.TtProcessCollCollNar
rdtsc
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x14]
lea eax, [esi + 0xc]
mov dword [esi + 4], ecx
mov dword [edi + 4], eax
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov edi, dword [eax]
lea ecx, [eax + 4]
mov eax, dword [esi]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], edi
mov ecx, dword [eax]
mov eax, dword [ecx]
mov eax, dword [eax + 0x10]
call eax
mov ecx, dword [esi + 4]
mov dword [esp + 0x2c], eax
mov ecx, dword [ecx]
mov edx, dword [ecx]
mov edx, dword [edx + 0x10]
call edx
mov ecx, dword [ebp + 0x10]
push edi
mov dword [esp + 0x20], eax
call fcn.006dc000
push dword [0x884c50]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, eax
mov dword [esp + 0x28], ecx
mov eax, dword [ecx + 4]
mov dword [esp + 0x24], eax
cmp eax, dword [ecx + 0xc]
jae 0x6bf5a9
mov dword [eax], str.StNarrow
rdtsc
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
mov dword [eax + 4], ecx
add eax, 0xc
mov ecx, dword [esp + 0x28]
mov dword [ecx + 4], eax
push dword [ebp + 0x14]
mov ecx, dword [esi + 8]
push edi
push dword [esp + 0x24]
test ecx, ecx
jne 0x6bf5cb
push dword [esp + 0x38]
push esi
push dword [esp + 0x28]
call fcn.006da710
add esp, 0x18
jmp 0x6bf63d
mov eax, dword [esi + 4]
movups xmm0, xmmword [esi + 0x50]
mov dword [esp + 0x40], eax
mov eax, dword [esi + 0xc]
movups xmm3, xmmword [esi + 0x20]
mov dword [esp + 0x48], eax
mov eax, dword [esi + 0x10]
movups xmm2, xmmword [esi + 0x30]
mov dword [esp + 0x4c], eax
mov eax, dword [esi + 0x60]
movups xmm1, xmmword [esi + 0x40]
mov dword [esp + 0x9c], eax
lea eax, [esp + 0x3c]
movaps xmmword [esp + 0x8c], xmm0
movups xmm0, xmmword [esi + 0x70]
push eax
push dword [esp + 0x24]
movaps xmmword [esp + 0x64], xmm3
movaps xmmword [esp + 0x74], xmm2
movaps xmmword [esp + 0x84], xmm1
movups xmmword [esp + 0xb4], xmm0
mov dword [esp + 0x44], ecx
mov dword [esp + 0x4c], 0
call fcn.006d9470
add esp, 0x14
mov esi, dword [esp + 0x18]
push dword [0x884adc]
lea esi, [esi*4 + 0x87]
and esi, 0xffffff80
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
lea edx, [esi + 0xf]
and edx, 0xfffffff0
cmp esi, dword [eax + 8]
jg 0x6bf674
lea ecx, [edx + edi]
cmp ecx, dword [eax + 0xc]
jne 0x6bf674
cmp dword [eax + 0x14], edi
je 0x6bf674
mov dword [eax + 0xc], edi
jmp 0x6bf67d
push edx
push edi
mov ecx, eax
call fcn.0046a590
push dword [0x884c50]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
mov esi, dword [edi + 4]
cmp esi, dword [edi + 0xc]
jae 0x6bf6ac
mov dword [esi], 0x77f5ec
rdtsc
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 0x18]
lea eax, [esi + 0xc]
mov dword [esi + 4], ecx
mov dword [edi + 4], eax
mov eax, dword [ebp + 0xc]
pop edi
add eax, 0x10
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x6c1ea4
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, ecx
mov dword [esi], vtable.hkBaseObject.0
test al, 1
je 0x6c1ef6
test al, 4
jne 0x6c1ee8
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0x80
cmp ax, cx
je 0x6c1ecb
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0x80
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4

Function at 0x6c1f60
Capabilities:
Execute anti-debugging instructions
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x198
push esi
push edi
push dword [0x884c50]
mov dword [esp + 0xc], ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
mov esi, dword [edi + 4]
cmp esi, dword [edi + 0xc]
jae 0x6c1fa1
mov dword [esi], str.TtBoxBox
rdtsc
mov dword [esp + 0xc], eax
mov ecx, dword [esp + 0xc]
lea eax, [esi + 0xc]
mov dword [esi + 4], ecx
mov dword [edi + 4], eax
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov eax, dword [esi]
mov ecx, dword [edi]
push dword [edi + 8]
movss xmm0, dword [eax + 0x10]
push dword [esi + 8]
shufps xmm0, xmm0, 0
addps xmm0, xmmword [eax + 0x20]
movaps xmmword [esp + 0x18], xmm0
movss xmm0, dword [ecx + 0x10]
shufps xmm0, xmm0, 0
addps xmm0, xmmword [ecx + 0x20]
lea ecx, [esp + 0x38]
movaps xmmword [esp + 0x28], xmm0
call fcn.0046efa0
movaps xmm0, xmmword [esp + 0x30]
mov eax, dword [ebp + 0x10]
mov ecx, dword [esp + 8]
movaps xmm3, xmmword [esp + 0x10]
movaps xmm2, xmmword [esp + 0x20]
movss xmm1, dword [eax + 0xc]
movaps xmmword [esp + 0x90], xmm0
movaps xmm0, xmmword [esp + 0x40]
movaps xmmword [esp + 0xa0], xmm0
movaps xmm0, xmmword [esp + 0x50]
mov dword [esp + 0x78], eax
mov eax, dword [ecx + 8]
movaps xmmword [esp + 0xb0], xmm0
movaps xmm0, xmmword [esp + 0x60]
mov dword [esp + 0x7c], eax
mov eax, dword [ebp + 0x14]
movss dword [esp + 0x120], xmm1
shufps xmm1, xmm1, 0
mov dword [esp + 0x80], eax
mov eax, dword [esi + 8]
movaps xmmword [esp + 0xc0], xmm0
movaps xmm0, xmm1
mov dword [esp + 0x84], eax
addps xmm0, xmm3
mov eax, dword [edi + 8]
movaps xmmword [esp + 0xf0], xmm1
addps xmm1, xmm2
mov dword [esp + 0x88], eax
lea eax, [ecx + 0x10]
push eax
lea ecx, [esp + 0x74]
mov dword [esp + 0x74], esi
mov dword [esp + 0x78], edi
movaps xmmword [esp + 0xd4], xmm3
movaps xmmword [esp + 0xe4], xmm2
mov dword [esp + 0x128], 0x3c23d70a
movaps xmmword [esp + 0x104], xmm0
movaps xmmword [esp + 0x114], xmm1
call fcn.006d3df0
push dword [0x884c50]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
mov esi, dword [edi + 4]
cmp esi, dword [edi + 0xc]
jae 0x6c20de
mov dword [esi], 0x77f5ec
rdtsc
mov dword [esp + 8], eax
mov ecx, dword [esp + 8]
lea eax, [esi + 0xc]
mov dword [esi + 4], ecx
mov dword [edi + 4], eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x6c2110
Capabilities:
Execute anti-debugging instructions
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x1f8
push esi
push edi
push dword [0x884c50]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
mov esi, dword [edi + 4]
cmp esi, dword [edi + 0xc]
jae 0x6c214d
mov dword [esi], str.TtBoxBox
rdtsc
mov dword [esp + 0xc], eax
mov ecx, dword [esp + 0xc]
lea eax, [esi + 0xc]
mov dword [esi + 4], ecx
mov dword [edi + 4], eax
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov eax, dword [esi]
mov ecx, dword [edi]
push dword [edi + 8]
movss xmm0, dword [eax + 0x10]
push dword [esi + 8]
shufps xmm0, xmm0, 0
addps xmm0, xmmword [eax + 0x20]
movaps xmmword [esp + 0x18], xmm0
movss xmm0, dword [ecx + 0x10]
shufps xmm0, xmm0, 0
addps xmm0, xmmword [ecx + 0x20]
lea ecx, [esp + 0x98]
movaps xmmword [esp + 0x28], xmm0
call fcn.0046efa0
movaps xmm0, xmmword [esp + 0x90]
lea ecx, [esp + 0xd0]
mov eax, dword [ebp + 0x10]
movaps xmm3, xmmword [esp + 0x10]
movaps xmm2, xmmword [esp + 0x20]
movaps xmmword [esp + 0xf0], xmm0
movss xmm1, dword [eax + 0xc]
movaps xmm0, xmmword [esp + 0xa0]
mov eax, dword [esi + 8]
movaps xmmword [esp + 0x100], xmm0
movaps xmm0, xmmword [esp + 0xb0]
movaps xmmword [esp + 0x110], xmm0
movaps xmm0, xmmword [esp + 0xc0]
movss dword [esp + 0x180], xmm1
shufps xmm1, xmm1, 0
mov dword [esp + 0xe4], eax
mov eax, dword [edi + 8]
movaps xmmword [esp + 0x120], xmm0
movaps xmm0, xmm1
mov dword [esp + 0xe8], eax
addps xmm0, xmm3
movaps xmmword [esp + 0x150], xmm1
lea eax, [esp + 0x30]
addps xmm1, xmm2
mov dword [esp + 0xd0], esi
push eax
lea eax, [esp + 0xf]
mov dword [esp + 0xd8], edi
push eax
mov dword [esp + 0xe0], 0
mov dword [esp + 0xe4], 0
mov dword [esp + 0xe8], 0
movaps xmmword [esp + 0x138], xmm3
movaps xmmword [esp + 0x148], xmm2
mov dword [esp + 0x18c], 0x3c23d70a
movaps xmmword [esp + 0x168], xmm0
movaps xmmword [esp + 0x178], xmm1
call fcn.006d5bd0
cmp byte [esp + 0xb], 0
je 0x6c22bc
mov ecx, dword [ebp + 0x14]
lea edx, [esp + 0x50]
movaps xmm0, xmmword [esp + 0x30]
movaps xmmword [esp + 0x50], xmm0
movaps xmm0, xmmword [esp + 0x40]
mov eax, dword [ecx]
push edx
movaps xmmword [esp + 0x64], xmm0
mov dword [esp + 0x84], esi
mov dword [esp + 0x88], edi
movaps xmmword [esp + 0x74], xmm0
call dword [eax + 4]
push dword [0x884c50]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
mov esi, dword [edi + 4]
cmp esi, dword [edi + 0xc]
jae 0x6c22eb
mov dword [esi], 0x77f5ec
rdtsc
mov dword [esp + 0xc], eax
mov ecx, dword [esp + 0xc]
lea eax, [esi + 0xc]
mov dword [esi + 4], ecx
mov dword [edi + 4], eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret