joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5fb900
Capabilities:
Get thread local storage value

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
push edi
push ebx
mov edi, ecx
call fcn.005951a0
mov dword [edi], vtable.hkbModifier.0
lea esi, [edi + 0x64]
mov al, byte [ebx + 0x28]
mov byte [edi + 0x28], al
or eax, 0xffffffff
mov dword [edi], vtable.hkbCatchFallModifier.0
mov dword [edi + 0x60], 0
mov word [esi], ax
mov word [esi + 2], ax
mov word [esi + 4], ax
mov word [edi + 0x6a], ax
mov word [edi + 0x6c], ax
mov word [edi + 0x6e], ax
mov dword [edi + 0x70], eax
lea eax, [ebx + 0x30]
push 0x30
push eax
lea eax, [edi + 0x30]
mov dword [edi + 0x74], 0
push eax
call fcn.0045d810
push 0x47
lea eax, [ebx + 0x64]
push eax
push esi
call fcn.0045d810
mov eax, dword [ebx + 0x60]
add esp, 0x18
test eax, eax
je 0x5fb9dd
cmp dword [eax + 8], 0
jne 0x5fb99f
mov ecx, eax
test ecx, ecx
je 0x5fb985
call fcn.0045c0c0
mov ecx, dword [edi + 0x60]
test ecx, ecx
je 0x5fb991
call fcn.0045c160
mov eax, dword [ebx + 0x60]
mov dword [edi + 0x60], eax
mov eax, edi
pop edi
pop esi
pop ebx
ret 4
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push 0x28
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, 0x28
mov word [eax + 4], cx
mov ecx, eax
push dword [ebx + 0x60]
call fcn.005b1ea0
mov ecx, dword [edi + 0x60]
mov esi, eax
test ecx, ecx
je 0x5fb9da
cmp ecx, esi
je 0x5fb9da
call fcn.0045c160
mov dword [edi + 0x60], esi
mov eax, edi
pop edi
pop esi
pop ebx
ret 4
Function at 0x601550
Capabilities:
Get thread local storage value

Disassembly:
push esi
push edi
push dword [0x884adc]
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, dword [esp + 0xc]
mov ecx, dword [eax + 0x2c]
lea eax, [esi + esi*2]
shl eax, 2
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov dword [edi], eax
mov eax, edi
mov dword [edi + 4], esi
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
pop edi
pop esi
ret 4

Function at 0x6015a0
Capabilities:
Get thread local storage value

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x98]
test ecx, ecx
je 0x6015b2
call fcn.0045c160
mov dword [esi + 0x98], 0
mov ecx, dword [esi + 0x94]
test ecx, ecx
je 0x6015cb
call fcn.0045c160
mov dword [esi + 0x94], 0
mov ecx, dword [esi + 0x2c]
test ecx, ecx
je 0x6015e1
call fcn.0045c160
mov ecx, esi
mov dword [esi + 0x2c], 0
call fcn.0058ee20
mov eax, dword [esp + 8]
test al, 1
je 0x60163c
test al, 4
jne 0x60162e
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0x190
cmp ax, cx
je 0x601611
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0x190
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4
Function at 0x603e50
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, ecx
mov dword [esi + 4], 0x1ffff
lea ecx, [esi + 0x58]
mov dword [esi], vtable.hkbClientCharacterState.0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], connect
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], connect
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], connect
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], connect
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], connect
mov dword [esi + 0x44], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], connect
mov dword [esi + 0x50], eax
mov eax, dword [esp + 0xc]
mov dword [esi + 0x54], eax
call fcn.0045d8c0
lea ecx, [esi + 0x5c]
call fcn.0045d8c0
lea ecx, [esi + 0x60]
call fcn.0045d8c0
mov dword [esi + 0x64], 0
mov dword [esi + 0x68], 0
mov dword [esi + 0x6c], 0
mov byte [esi + 0x70], 0
mov dword [esi + 0x74], 0
mov dword [esi + 0x78], 0
mov dword [esi + 0xb0], 0
mov dword [esi + 0xb4], 0
mov dword [esi + 0xb8], connect
mov dword [esi + 0xbc], 0
mov dword [esi + 0xc0], 0
mov dword [esi + 0xc4], connect
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push 0xc
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
mov eax, dword [eax + 4]
call eax
test eax, eax
je 0x603f99
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0xffffffff
jmp 0x603f9b
xor eax, eax
mov dword [esi + 0x6c], eax
xorps xmm0, xmm0
movaps xmmword [esi + 0x80], xmm0
mov eax, esi
movaps xmm0, xmmword [0x7195b0]
movaps xmmword [esi + 0x90], xmm0
movaps xmm0, xmmword [0x719da0]
movaps xmmword [esi + 0xa0], xmm0
pop esi
ret 8
Function at 0x606394
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, ecx
mov dword [esi], vtable.hkRemoteObjectClientSideListener.0
test al, 1
je 0x6063cd
test al, 4
jne 0x6063c2
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push 8
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
mov eax, esi
pop esi
ret 4
push 8
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4

Function at 0x6063e0
Capabilities:
Get thread local storage value

Disassembly:
sub ecx, 8
jmp method.hkbBehaviorClient.virtual_0
push esi
mov esi, ecx
call fcn.00604310
mov eax, dword [esp + 8]
test al, 1
je 0x606432
test al, 4
jne 0x606427
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0x50
cmp ax, cx
je 0x60640a
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0x50
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4

Function at 0x606440
Capabilities:
Get thread local storage value

Disassembly:
push esi
mov esi, ecx
call fcn.00604010
mov eax, dword [esp + 8]
test al, 1
je 0x606495
test al, 4
jne 0x606487
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0xd0
cmp ax, cx
je 0x60646a
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0xd0
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4
Function at 0x606bb0
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 0x14
mov eax, dword [esp + 0x1c]
push esi
push edi
push dword [0x884adc]
mov eax, dword [eax + 0x2c]
mov dword [esp + 0x1c], 0
mov esi, dword [eax + 0x1c]
mov dword [esp + 0x14], esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
lea ecx, [esi + 0x7f]
and ecx, 0xffffff80
mov dword [esp + 8], ecx
mov edx, dword [eax + 0xc]
mov dword [esp + 0x14], edx
lea edi, [edx + ecx]
cmp ecx, dword [eax + 8]
jg 0x606bfa
cmp edi, dword [eax + 0x10]
ja 0x606bfa
mov dword [eax + 0xc], edi
jmp 0x606c08
push ecx
mov ecx, eax
call fcn.0046a3c0
mov edx, eax
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x30]
xorps xmm0, xmm0
movaps xmmword [ecx], xmm0
test esi, esi
jle 0x606c2e
mov ecx, esi
mov edi, edx
mov edx, ecx
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x24]
mov edi, dword [esp + 0x14]
mov eax, dword [edx + 0x2c]
mov eax, dword [eax + 0xc]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x20]
mov esi, eax
cmp eax, dword [esp + 0x10]
jge 0x606cbb
nop dword [eax]
cmp esi, eax
je 0x606c62
mov eax, dword [esp + 0xc]
movsx eax, word [eax + esi*2]
cmp byte [eax + edi], 0
je 0x606c82
lea eax, [esp + 0x18]
push eax
push ecx
push dword [esp + 0x34]
push dword [esp + 0x34]
push edx
push esi
call fcn.00606d10
mov edx, dword [esp + 0x3c]
add esp, 0x18
mov byte [edi + esi], 1
mov ecx, dword [esp + 0x30]
inc esi
mov eax, dword [esp + 0x20]
cmp esi, dword [esp + 0x10]
jl 0x606c50
movss xmm1, dword [esp + 0x18]
xorps xmm0, xmm0
ucomiss xmm1, xmm0
lahf
test ah, 0x44
jnp 0x606cbb
movss xmm0, dword [0x718824]
mov eax, ecx
divss xmm0, xmm1
shufps xmm0, xmm0, 0
mulps xmm0, xmmword [eax]
movaps xmmword [eax], xmm0
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [esp + 8]
lea edx, [ecx + 0xf]
and edx, 0xfffffff0
cmp ecx, dword [eax + 8]
jg 0x606cf0
lea ecx, [edx + edi]
cmp ecx, dword [eax + 0xc]
jne 0x606cf0
cmp dword [eax + 0x14], edi
je 0x606cf0
fld dword [esp + 0x18]
mov dword [eax + 0xc], edi
pop edi
pop esi
add esp, 0x14
ret
push edx
push edi
mov ecx, eax
call fcn.0046a590
fld dword [esp + 0x18]
pop edi
pop esi
add esp, 0x14
ret
Function at 0x606f50
Capabilities:
Get thread local storage value

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
push edi
push dword [0x884adc]
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x14]
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], ecx
mov esi, dword [eax + 0x1c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
lea ebx, [esi + esi*2]
shl ebx, 4
add ebx, 0x7f
mov edi, dword [eax + 0xc]
and ebx, 0xffffff80
lea ecx, [edi + ebx]
cmp ebx, dword [eax + 8]
jg 0x606f97
cmp ecx, dword [eax + 0x10]
ja 0x606f97
mov dword [eax + 0xc], ecx
jmp 0x606fa1
push ebx
mov ecx, eax
call fcn.0046a3c0
mov edi, eax
mov eax, dword [esp + 0x10]
push edi
push dword [esp + 0x1c]
push dword [eax + 0xc]
push dword [eax + 0x1c]
call fcn.0057e2a0
mov eax, dword [esp + 0x2c]
mov esi, dword [esp + 0x30]
push esi
push dword [eax + 0x24]
push dword [eax + 0xc]
push dword [eax + 0x1c]
call fcn.0057e2a0
mov ecx, dword [esp + 0x3c]
push 2
push esi
push dword [ecx + 0x24]
push edi
push ebp
call fcn.00569220
add esp, 0x34
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
lea edx, [ebx + 0xf]
and edx, 0xfffffff0
cmp ebx, dword [eax + 8]
jg 0x60700d
lea ecx, [edx + edi]
cmp ecx, dword [eax + 0xc]
jne 0x60700d
cmp dword [eax + 0x14], edi
je 0x60700d
mov dword [eax + 0xc], edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push edx
push edi
mov ecx, eax
call fcn.0046a590
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x638f75
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00638b7a

Function at 0x63b26e
Capabilities:
Create thread
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0063aff5

Function at 0x63d45a
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0063cc34

Function at 0x63d465
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0063ce6f

Function at 0x64aa54
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, ecx
mov dword [esi], vtable.hkBaseObject.0
test al, 1
je 0x64aaa3
test al, 4
jne 0x64aa98
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0x10
cmp ax, cx
je 0x64aa7b
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0x10
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4

Function at 0x64cac0
Capabilities:
Get thread local storage value

Disassembly:
push esi
mov esi, ecx
call fcn.0064c950
mov eax, dword [esp + 8]
test al, 1
je 0x64cb12
test al, 4
jne 0x64cb07
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0x10
cmp ax, cx
je 0x64caea
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0x10
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4

Function at 0x64d0a0
Capabilities:
Get thread local storage value

Disassembly:
push esi
mov esi, ecx
call fcn.0064cfc0
mov eax, dword [esp + 8]
test al, 1
je 0x64d0f2
test al, 4
jne 0x64d0e7
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0x14
cmp ax, cx
je 0x64d0ca
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0x14
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4
Function at 0x64e910
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x278
push esi
push edi
lea eax, [esp + 0x30]
mov edi, ecx
push eax
mov dword [esp + 0x20], edi
call fcn.0064f5d0
mov edx, dword [edi + 0x30]
add edx, dword [ebp + 8]
push dword [ebp + 0xc]
mov dword [esp + 0x18], eax
lea ecx, [edx + 4]
lea ecx, [edx + ecx*4]
lea ecx, [eax + ecx*4]
call fcn.0064fdb0
xor ecx, ecx
mov dword [esp + 0x24], ecx
cmp dword [edi + 0x48], ecx
jle 0x64eaa0
mov edx, dword [ebp + 0xc]
lea eax, [edi + 0x3d]
mov dword [esp + 0x28], eax
movzx eax, byte [eax]
lea esi, [eax + eax*4]
mov eax, dword [esp + 0x14]
mov eax, dword [eax + esi*4 + 0x44]
cmp eax, edx
jge 0x64ea87
push dword [0x884adc]
add eax, eax
mov edi, edx
cmp eax, edx
cmovge edi, eax
mov dword [esp + 0x30], edi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [eax + 0x2c]
mov eax, edi
shl eax, 7
push eax
mov edx, dword [ecx]
mov eax, dword [edx + 4]
call eax
mov edx, dword [esp + 0x14]
mov edi, eax
mov dword [esp + 0x18], edi
cmp dword [edx + esi*4 + 0x40], 0
je 0x64ea3b
mov ecx, dword [edx + esi*4 + 0x50]
test ecx, ecx
je 0x64ea2b
mov eax, dword [esp + 0x14]
mov edx, dword [edx + esi*4 + 0x4c]
mov dword [esp + 0x20], edx
mov eax, dword [eax + esi*4 + 0x48]
cmp edx, eax
mov edx, dword [esp + 0x14]
jg 0x64ea12
mov edi, dword [edx + esi*4 + 0x44]
sub edi, eax
shl eax, 7
add eax, dword [edx + esi*4 + 0x40]
shl edi, 7
push edi
push eax
push dword [esp + 0x20]
call fcn.0045d810
mov eax, dword [esp + 0x2c]
shl eax, 7
push eax
mov eax, dword [esp + 0x24]
push dword [eax + esi*4 + 0x40]
mov eax, dword [esp + 0x2c]
add eax, edi
push eax
call fcn.0045d810
add esp, 0x18
jmp 0x64ea27
shl ecx, 7
shl eax, 7
add eax, dword [edx + esi*4 + 0x40]
push ecx
push eax
push edi
call fcn.0045d810
add esp, 0xc
mov edx, dword [esp + 0x14]
mov eax, dword [edx + esi*4 + 0x50]
mov dword [edx + esi*4 + 0x48], 0
mov dword [edx + esi*4 + 0x4c], eax
mov eax, dword [edx + esi*4 + 0x44]
mov dword [esp + 0x20], eax
test eax, eax
je 0x64ea6c
push dword [0x884adc]
mov edi, dword [edx + esi*4 + 0x40]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edx, dword [esp + 0x20]
shl edx, 7
push edx
mov ecx, dword [eax + 0x2c]
push edi
mov eax, dword [ecx]
call dword [eax + 8]
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov edi, dword [esp + 0x1c]
mov ecx, dword [esp + 0x24]
mov dword [edx + esi*4 + 0x40], eax
mov eax, dword [esp + 0x2c]
mov dword [edx + esi*4 + 0x44], eax
mov edx, dword [ebp + 0xc]
mov eax, dword [esp + 0x28]
inc ecx
add eax, 8
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], eax
cmp ecx, dword [edi + 0x48]
jl 0x64e962
mov esi, dword [edi + 0x28]
cmp esi, dword [edi + 0x2c]
jge 0x64eace
mov edx, dword [esp + 0x14]
lea edi, [esi + 4]
lea edi, [esi + edi*4]
lea edi, [edx + edi*4]
push dword [ebp + 0xc]
mov ecx, edi
call fcn.0064fdb0
mov eax, dword [esp + 0x1c]
inc esi
add edi, 0x14
cmp esi, dword [eax + 0x2c]
jl 0x64eab5
mov edi, eax
push dword [esp + 0x14]
mov ecx, edi
call fcn.0064f5f0
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x64efc0
Capabilities:
Execute anti-debugging instructions
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x2e8
push esi
push edi
push dword [0x884c50]
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [esp + 8], eax
mov esi, dword [eax + 4]
cmp esi, dword [eax + 0xc]
jae 0x64f005
mov dword [esi], str.TtfinishJob
rdtsc
mov dword [esp + 0xc], eax
mov ecx, dword [esp + 0xc]
lea eax, [esi + 0xc]
mov dword [esi + 4], ecx
mov ecx, dword [esp + 8]
mov dword [ecx + 4], eax
lea eax, [esp + 0xa0]
mov ecx, edi
push eax
call fcn.0064f5d0
mov ecx, dword [edi + 0x20]
mov esi, eax
lea eax, [esp + 0x10]
push eax
push dword [ebp + 8]
push esi
push edi
call ecx
add esp, 0x10
test eax, eax
jne 0x64f069
lea eax, [esp + 0x20]
mov ecx, edi
push eax
call fcn.0064f580
cmp dword [esp + 0x10], 0
lea ecx, [esp + 0x20]
push ecx
mov dword [esp + 0xc], eax
lea ecx, [eax + 4]
lea ecx, [eax + ecx*4]
lea ecx, [esi + ecx*4]
jne 0x64f058
call fcn.0064fa40
jmp 0x64f05d
call fcn.0064f9f0
push esi
push dword [esp + 0xc]
mov ecx, edi
call fcn.0064f4d0
cmp dword [ebp + 0xc], 0
jne 0x64f07a
mov eax, dword [ebp + 8]
movzx eax, byte [eax + 1]
dec word [esi + eax*2]
push esi
mov ecx, edi
call fcn.0064f5f0
push dword [0x884c50]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
mov esi, dword [edi + 4]
cmp esi, dword [edi + 0xc]
jae 0x64f0b1
mov dword [esi], 0x77f5ec
rdtsc
mov dword [esp + 8], eax
mov ecx, dword [esp + 8]
lea eax, [esi + 0xc]
mov dword [esi + 4], ecx
mov dword [edi + 4], eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x64f0c0
Capabilities:
Execute anti-debugging instructions
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x2f8
push esi
push edi
push dword [0x884c50]
mov edi, ecx
mov dword [esp + 0x20], edi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [esp + 0x10], eax
mov esi, dword [eax + 4]
cmp esi, dword [eax + 0xc]
jae 0x64f110
mov dword [esi], str.TtGetNextJob
rdtsc
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x14]
lea eax, [esi + 0xc]
mov dword [esi + 4], ecx
mov ecx, dword [esp + 0x10]
mov dword [ecx + 4], eax
nop dword [eax]
lea eax, [esp + 0xb0]
mov ecx, edi
push eax
call fcn.0064f5d0
mov esi, eax
mov dword [esp + 0x14], 0xffffffff
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], esi
test eax, eax
je 0x64f214
lea ecx, [esp + 0x20]
push ecx
push eax
mov eax, dword [edi + 0x20]
push esi
push edi
call eax
add esp, 0x10
test eax, eax
jne 0x64f202
lea eax, [esp + 0x30]
mov ecx, edi
push eax
call fcn.0064f580
cmp dword [esp + 0x20], 0
mov dword [esp + 0x14], eax
lea eax, [eax + eax*4]
lea eax, [eax + 0x10]
mov ecx, dword [esi + eax*4 + 4]
lea eax, [esi + eax*4]
mov dword [esp + 0x18], eax
jne 0x64f1b7
cmp dword [eax + 0x10], ecx
jl 0x64f193
test ecx, ecx
jne 0x64f185
push 8
jmp 0x64f188
add ecx, ecx
push ecx
mov ecx, eax
call fcn.0064fdb0
mov eax, dword [esp + 0x18]
cmp dword [eax + 8], 0
jne 0x64f19f
mov ecx, dword [eax + 4]
mov dword [eax + 8], ecx
dec dword [eax + 8]
lea esi, [esp + 0x30]
mov edi, dword [eax + 8]
mov ecx, 0x20
shl edi, 7
add edi, dword [eax]
rep movsd dword es:[edi], dword [esi]
jmp 0x64f1f7
cmp dword [eax + 0x10], ecx
jl 0x64f1d2
test ecx, ecx
jne 0x64f1c4
push 8
jmp 0x64f1c7
add ecx, ecx
push ecx
mov ecx, eax
call fcn.0064fdb0
mov eax, dword [esp + 0x18]
mov ecx, dword [eax + 0xc]
cmp ecx, dword [eax + 4]
jne 0x64f1e1
mov dword [eax + 0xc], 0
mov edi, dword [eax + 0xc]
lea esi, [esp + 0x30]
shl edi, 7
mov ecx, 0x20
add edi, dword [eax]
rep movsd dword es:[edi], dword [esi]
inc dword [eax + 0xc]
mov esi, dword [esp + 0x10]
mov edi, dword [esp + 0x1c]
inc dword [eax + 0x10]
mov eax, dword [ebp + 8]
mov dword [ebp + 8], 0
movzx eax, byte [eax + 1]
dec word [esi + eax*2]
push dword [ebp + 0xc]
mov ecx, edi
push dword [ebp + 0x10]
push esi
push dword [esp + 0x20]
call fcn.0064fa90
mov esi, eax
cmp esi, 0xffffffff
je 0x64f110
push dword [0x884c50]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [esp + 0x10], eax
mov edi, dword [eax + 4]
cmp edi, dword [eax + 0xc]
jae 0x64f266
mov dword [edi], 0x77f5ec
rdtsc
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x14]
lea eax, [edi + 0xc]
mov dword [edi + 4], ecx
mov ecx, dword [esp + 0x10]
mov dword [ecx + 4], eax
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x64f270
Capabilities:
Execute anti-debugging instructions
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x268
push esi
push edi
push dword [0x884c50]
mov dword [esp + 0x18], ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
mov esi, dword [edi + 4]
cmp esi, dword [edi + 0xc]
jae 0x64f2b1
mov dword [esi], str.TtGetNextJob
rdtsc
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x10]
lea eax, [esi + 0xc]
mov dword [esi + 4], ecx
mov dword [edi + 4], eax
mov byte [esp + 0xf], 1
nop word [eax + eax]
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x20]
mov esi, dword [ebp + 0x10]
push eax
call fcn.0064f5d0
mov edi, eax
or edx, 0xffffffff
cmp byte [esp + 0xf], 0
mov dword [esp + 0x1c], edi
je 0x64f39e
mov eax, dword [ebp + 8]
mov ecx, dword [esp + 0x14]
push esi
dec word [edi + eax*2]
call fcn.0064f580
cmp dword [ebp + 0xc], 0
mov edx, eax
mov dword [esp + 0x10], edx
lea eax, [edx + 4]
lea eax, [edx + eax*4]
mov ecx, dword [edi + eax*4 + 4]
lea eax, [edi + eax*4]
mov dword [esp + 0x18], eax
jne 0x64f352
cmp dword [eax + 0x10], ecx
jl 0x64f332
test ecx, ecx
jne 0x64f320
push 8
jmp 0x64f323
add ecx, ecx
push ecx
mov ecx, eax
call fcn.0064fdb0
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
cmp dword [eax + 8], 0
jne 0x64f33e
mov ecx, dword [eax + 4]
mov dword [eax + 8], ecx
dec dword [eax + 8]
mov ecx, 0x20
mov edi, dword [eax + 8]
shl edi, 7
add edi, dword [eax]
rep movsd dword es:[edi], dword [esi]
jmp 0x64f392
cmp dword [eax + 0x10], ecx
jl 0x64f371
test ecx, ecx
jne 0x64f35f
push 8
jmp 0x64f362
add ecx, ecx
push ecx
mov ecx, eax
call fcn.0064fdb0
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
mov ecx, dword [eax + 0xc]
cmp ecx, dword [eax + 4]
jne 0x64f380
mov dword [eax + 0xc], 0
mov edi, dword [eax + 0xc]
mov ecx, 0x20
shl edi, 7
add edi, dword [eax]
rep movsd dword es:[edi], dword [esi]
inc dword [eax + 0xc]
inc dword [eax + 0x10]
mov edi, dword [esp + 0x1c]
mov byte [esp + 0xf], 0
push dword [ebp + 0x10]
mov ecx, dword [esp + 0x18]
push dword [ebp + 0x14]
push edi
push edx
call fcn.0064fa90
mov esi, eax
cmp esi, 0xffffffff
je 0x64f2c0
push dword [0x884c50]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [esp + 0x14], eax
mov edi, dword [eax + 4]
cmp edi, dword [eax + 0xc]
jae 0x64f3ef
mov dword [edi], 0x77f5ec
rdtsc
mov dword [esp + 0x1c], eax
mov ecx, dword [esp + 0x1c]
lea eax, [edi + 0xc]
mov dword [edi + 4], ecx
mov ecx, dword [esp + 0x14]
mov dword [ecx + 4], eax
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 0x10