joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49e310
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edx, dword [ebp + 0x24]
push edx
fld qword [ebp + 0x1c]
sub esp, 8
fstp qword [esp]
mov edx, dword [ebp + 0x18]
push edx
mov edx, dword [ebp + 0x14]
push edx
mov edx, dword [ebp + 0x10]
push edx
mov edx, dword [ebp + 0xc]
push edx
mov edx, dword [ebp + 8]
push edx
lea eax, [eax + 0x10]
push eax
call fcn.004a01d0
add esp, 0x24
pop ebp
ret

Function at 0x49e350
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edx, dword [ebp + 8]
push edx
lea eax, [eax + 0x10]
push eax
call fcn.004a0220
add esp, 8
pop ebp
ret

Function at 0x49e380
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
fld qword [ebp + 8]
sub esp, 8
fstp qword [esp]
lea eax, [eax + 0x10]
push eax
call fcn.004a02c0
add esp, 0xc
pop ebp
ret

Function at 0x49e3b0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edx, dword [ebp + 0xc]
push edx
mov edx, dword [ebp + 8]
push edx
lea eax, [eax + 0x10]
push eax
call fcn.004a0240
add esp, 0xc
pop ebp
ret

Function at 0x49e3e0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp dword [ebp + 8], 0
je 0x49e3fd
mov ebx, 1
jmp 0x49e3ff
xor ebx, ebx
push ebx
lea eax, [eax + 0x10]
push eax
call fcn.004a0300
add esp, 8
pop ebx
pop ebp
ret

Function at 0x49e410
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
fld qword [ebp + 8]
sub esp, 8
fstp qword [esp]
lea eax, [eax + 0x10]
push eax
call fcn.004a0350
add esp, 0xc
pop ebp
ret

Function at 0x49e440
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edx, dword [ebp + 8]
push edx
lea eax, [eax + 0x10]
push eax
call fcn.004a0410
add esp, 8
pop ebp
ret

Function at 0x49e470
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edx, dword [ebp + 8]
push edx
lea eax, [eax + 0x10]
push eax
call fcn.004a0470
add esp, 8
pop ebp
ret

Function at 0x49e4a0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edx, dword [ebp + 0x14]
push edx
mov edx, dword [ebp + 0x10]
push edx
fld qword [ebp + 8]
sub esp, 8
fstp qword [esp]
lea eax, [eax + 0x10]
push eax
call fcn.004a04d0
add esp, 0x14
pop ebp
ret
Function at 0x49e4d0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edx, dword [ebp + 0x14]
push edx
mov edx, dword [ebp + 0x10]
push edx
fld qword [ebp + 8]
sub esp, 8
fstp qword [esp]
lea eax, [eax + 0x10]
push eax
call fcn.004a05e0
add esp, 0x14
pop ebp
ret

Function at 0x49e500
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edx, dword [ebp + 0xc]
push edx
mov edx, dword [ebp + 8]
push edx
lea eax, [eax + 0x10]
push eax
call fcn.004a0690
add esp, 0xc
pop ebp
ret

Function at 0x49e530
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edx, dword [ebp + 0xc]
push edx
mov edx, dword [ebp + 8]
push edx
lea eax, [eax + 0x10]
push eax
call fcn.004a0700
add esp, 0xc
pop ebp
ret

Function at 0x49e560
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edx, dword [ebp + 8]
push edx
lea eax, [eax + 0x10]
push eax
call fcn.004a4ef0
add esp, 8
pop ebp
ret

Function at 0x49e5c0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push dword [ebp + 0xc]
push dword [ebp + 8]
lea eax, [eax + 0x10]
push eax
call fcn.004a19b0
add esp, 0xc
pop ebp
ret

Function at 0x49e5f0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edx, dword [ebp + 0x10]
push edx
push dword [ebp + 0xc]
push dword [ebp + 8]
lea eax, [eax + 0x10]
push eax
call fcn.004a1a10
add esp, 0x10
pop ebp
ret
Function at 0x49e620
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
test eax, eax
jl 0x49e63f
call fcn.0049e190
mov edx, dword [ebp - 4]
cmp edx, eax
jle 0x49e649
cmp dword [ebp + 0xc], 0xffffffff
jne 0x49e6f0
cmp dword [ebp + 0xc], 0xffffffff
jne 0x49e660
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
lea esi, [eax + 0x10]
jmp 0x49e676
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edx, dword [ebp + 0xc]
mov eax, dword [eax + 0x30]
mov esi, dword [eax + edx*4 + 4]
mov ebx, esi
mov eax, dword [ebx]
and eax, 0x2000
je 0x49e688
mov edi, 1
jmp 0x49e68a
xor edi, edi
mov dword [ebp - 8], edi
cmp dword [ebp - 8], 0
je 0x49e69c
push ebx
call fcn.004a0990
pop ecx
mov ebx, eax
mov eax, dword [ebx]
and eax, 0x8000
je 0x49e6d7
lea eax, [ebp + 0x10]
mov dword [ebp - 0x10], eax
lea eax, [eax + 4]
mov dword [ebp - 0x10], eax
mov eax, dword [eax - 4]
push eax
push ebx
call fcn.004a30e0
add esp, 8
mov dword [ebp - 0xc], eax
test eax, eax
je 0x49e6f0
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
call fcn.004a4aa0
add esp, 8
jmp 0x49e6f0
cmp dword [ebp - 8], 0
jne 0x49e6e3
cmp dword [ebp + 0xc], 0xffffffff
jne 0x49e6f0
mov eax, dword [ebp + 8]
push eax
push ebx
call fcn.004a4aa0
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x49e700
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [ebp + 0x10]
mov dword [ebp - 4], eax
test eax, eax
jl 0x49e71f
call fcn.0049e190
mov edx, dword [ebp - 4]
cmp edx, eax
jle 0x49e729
cmp dword [ebp + 0x10], 0xffffffff
jne 0x49e7d8
cmp dword [ebp + 0x10], 0xffffffff
jne 0x49e740
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
lea esi, [eax + 0x10]
jmp 0x49e756
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edx, dword [ebp + 0x10]
mov eax, dword [eax + 0x30]
mov esi, dword [eax + edx*4 + 4]
mov ebx, esi
mov eax, dword [ebx]
and eax, 0x2000
je 0x49e768
mov edi, 1
jmp 0x49e76a
xor edi, edi
mov dword [ebp - 8], edi
cmp dword [ebp - 8], 0
je 0x49e77c
push ebx
call fcn.004a0990
pop ecx
mov ebx, eax
mov eax, dword [ebx]
and eax, 0x8000
je 0x49e7bb
lea eax, [ebp + 0x14]
mov dword [ebp - 0x10], eax
lea eax, [eax + 4]
mov dword [ebp - 0x10], eax
mov eax, dword [eax - 4]
push eax
push ebx
call fcn.004a30e0
add esp, 8
mov dword [ebp - 0xc], eax
test eax, eax
je 0x49e7d8
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
call fcn.004a4ad0
add esp, 0xc
jmp 0x49e7d8
cmp dword [ebp - 8], 0
jne 0x49e7c7
cmp dword [ebp + 0x10], 0xffffffff
jne 0x49e7d8
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
push ebx
call fcn.004a4ad0
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x49ef40
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
test eax, eax
jl 0x49ef5f
call fcn.0049e190
mov edx, dword [ebp - 4]
cmp edx, eax
jle 0x49ef69
cmp dword [ebp + 0xc], 0xffffffff
jne 0x49f03c
cmp dword [ebp + 0xc], 0xffffffff
jne 0x49ef80
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
lea esi, [eax + 0x10]
jmp 0x49ef96
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edx, dword [ebp + 0xc]
mov eax, dword [eax + 0x30]
mov esi, dword [eax + edx*4 + 4]
mov ebx, esi
mov eax, dword [ebx]
and eax, 0x2000
je 0x49efa8
mov edi, 1
jmp 0x49efaa
xor edi, edi
mov dword [ebp - 8], edi
cmp dword [ebp - 8], 0
je 0x49efbc
push ebx
call fcn.004a0990
pop ecx
mov ebx, eax
mov eax, dword [ebx]
and eax, 0x8000
je 0x49f00d
lea eax, [ebp + 0x10]
mov dword [ebp - 0x10], eax
lea eax, [eax + 4]
mov dword [ebp - 0x10], eax
mov eax, dword [eax - 4]
push eax
push ebx
call fcn.004a30e0
add esp, 8
mov dword [ebp - 0xc], eax
test eax, eax
je 0x49f03c
cmp dword [ebp + 8], 0
je 0x49eff4
mov dword [ebp - 0x14], 1
jmp 0x49effb
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0xc]
push eax
call fcn.004a0300
add esp, 8
jmp 0x49f03c
cmp dword [ebp - 8], 0
jne 0x49f019
cmp dword [ebp + 0xc], 0xffffffff
jne 0x49f03c
cmp dword [ebp + 8], 0
je 0x49f028
mov dword [ebp - 0xc], 1
jmp 0x49f02f
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
push eax
push ebx
call fcn.004a0300
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x49f050
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
test eax, eax
jl 0x49f06f
call fcn.0049e190
mov edx, dword [ebp - 4]
cmp edx, eax
jle 0x49f079
cmp dword [ebp + 0xc], 0xffffffff
jne 0x49f120
cmp dword [ebp + 0xc], 0xffffffff
jne 0x49f090
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
lea esi, [eax + 0x10]
jmp 0x49f0a6
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edx, dword [ebp + 0xc]
mov eax, dword [eax + 0x30]
mov esi, dword [eax + edx*4 + 4]
mov ebx, esi
mov eax, dword [ebx]
and eax, 0x2000
je 0x49f0b8
mov edi, 1
jmp 0x49f0ba
xor edi, edi
mov dword [ebp - 8], edi
cmp dword [ebp - 8], 0
je 0x49f0cc
push ebx
call fcn.004a0990
pop ecx
mov ebx, eax
mov eax, dword [ebx]
and eax, 0x8000
je 0x49f107
lea eax, [ebp + 0x10]
mov dword [ebp - 0x10], eax
lea eax, [eax + 4]
mov dword [ebp - 0x10], eax
mov eax, dword [eax - 4]
push eax
push ebx
call fcn.004a30e0
add esp, 8
mov dword [ebp - 0xc], eax
test eax, eax
je 0x49f120
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
call fcn.004a0410
add esp, 8
jmp 0x49f120
cmp dword [ebp - 8], 0
jne 0x49f113
cmp dword [ebp + 0xc], 0xffffffff
jne 0x49f120
mov eax, dword [ebp + 8]
push eax
push ebx
call fcn.004a0410
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x49f130
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
test eax, eax
jl 0x49f14f
call fcn.0049e190
mov edx, dword [ebp - 4]
cmp edx, eax
jle 0x49f159
cmp dword [ebp + 0xc], 0xffffffff
jne 0x49f200
cmp dword [ebp + 0xc], 0xffffffff
jne 0x49f170
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
lea esi, [eax + 0x10]
jmp 0x49f186
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edx, dword [ebp + 0xc]
mov eax, dword [eax + 0x30]
mov esi, dword [eax + edx*4 + 4]
mov ebx, esi
mov eax, dword [ebx]
and eax, 0x2000
je 0x49f198
mov edi, 1
jmp 0x49f19a
xor edi, edi
mov dword [ebp - 8], edi
cmp dword [ebp - 8], 0
je 0x49f1ac
push ebx
call fcn.004a0990
pop ecx
mov ebx, eax
mov eax, dword [ebx]
and eax, 0x8000
je 0x49f1e7
lea eax, [ebp + 0x10]
mov dword [ebp - 0x10], eax
lea eax, [eax + 4]
mov dword [ebp - 0x10], eax
mov eax, dword [eax - 4]
push eax
push ebx
call fcn.004a30e0
add esp, 8
mov dword [ebp - 0xc], eax
test eax, eax
je 0x49f200
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
call fcn.004a0470
add esp, 8
jmp 0x49f200
cmp dword [ebp - 8], 0
jne 0x49f1f3
cmp dword [ebp + 0xc], 0xffffffff
jne 0x49f200
mov eax, dword [ebp + 8]
push eax
push ebx
call fcn.004a0470
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x49f400
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
test eax, eax
jl 0x49f41f
call fcn.0049e190
mov edx, dword [ebp - 4]
cmp edx, eax
jle 0x49f429
cmp dword [ebp + 0xc], 0xffffffff
jne 0x49f4d0
cmp dword [ebp + 0xc], 0xffffffff
jne 0x49f440
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
lea esi, [eax + 0x10]
jmp 0x49f456
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edx, dword [ebp + 0xc]
mov eax, dword [eax + 0x30]
mov esi, dword [eax + edx*4 + 4]
mov ebx, esi
mov eax, dword [ebx]
and eax, 0x2000
je 0x49f468
mov edi, 1
jmp 0x49f46a
xor edi, edi
mov dword [ebp - 8], edi
cmp dword [ebp - 8], 0
je 0x49f47c
push ebx
call fcn.004a0990
pop ecx
mov ebx, eax
mov eax, dword [ebx]
and eax, 0x8000
je 0x49f4b7
lea eax, [ebp + 0x10]
mov dword [ebp - 0x10], eax
lea eax, [eax + 4]
mov dword [ebp - 0x10], eax
mov eax, dword [eax - 4]
push eax
push ebx
call fcn.004a30e0
add esp, 8
mov dword [ebp - 0xc], eax
test eax, eax
je 0x49f4d0
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
call fcn.004a4ef0
add esp, 8
jmp 0x49f4d0
cmp dword [ebp - 8], 0
jne 0x49f4c3
cmp dword [ebp + 0xc], 0xffffffff
jne 0x49f4d0
mov eax, dword [ebp + 8]
push eax
push ebx
call fcn.004a4ef0
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4a1d30
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
push 0x7d8aa0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push eax
call fcn.004a2080
pop ecx
mov ebx, eax
test eax, eax
je 0x4a1daf
mov eax, dword [ebp + 8]
movsx eax, word [eax + 4]
and eax, 0x200
je 0x4a1d7d
mov eax, dword [ebp + 8]
mov dword [ebx + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebx + 0x18], eax
jmp 0x4a1d97
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
test eax, eax
je 0x4a1d97
mov eax, dword [ebx + 8]
mov eax, dword [eax + 8]
test eax, eax
jne 0x4a1d97
mov eax, dword [ebp + 8]
mov dword [ebx + 8], eax
mov eax, dword [ebp + 8]
mov dword [eax + 0xc], ebx
push 0x7d8aa0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, ebx
jmp 0x4a1e9a
mov eax, dword [0x7bf1e8]
test eax, eax
jne 0x4a1dc4
mov eax, dword [0x7bf1e4]
mov ebx, dword [eax]
jmp 0x4a1e3d
mov eax, dword [0x7bf1e8]
inc eax
shl eax, 2
push eax
mov eax, dword [0x7bf1e4]
push eax
call fcn.0049b5d0
add esp, 8
mov dword [0x7bf1e4], eax
mov eax, dword [0x7bf1e8]
cmp dword [esi + 0x1600], eax
ja 0x4a1e24
xor edi, edi
jmp 0x4a1e15
push 4
mov eax, dword [0x7bf1e8]
sub eax, edi
mov edx, dword [0x7bf1e4]
lea ecx, [eax - 1]
lea ecx, [edx + ecx*4]
push ecx
lea eax, [edx + eax*4]
push eax
call fcn.00531d20
add esp, 0xc
inc edi
mov eax, dword [0x7bf1e8]
sub eax, dword [esi + 0x1600]
cmp edi, eax
jb 0x4a1df2
push 0x1c
call fcn.0049b580
pop ecx
mov ebx, eax
mov eax, dword [esi + 0x1600]
mov edx, dword [0x7bf1e4]
mov dword [edx + eax*4], ebx
add dword [0x7bf1e8], 1
mov dword [ebx + 4], 0
mov dword [ebx], 0
mov dword [ebx + 0xc], 0
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x14], 0
mov dword [ebx + 0x18], 0
mov eax, dword [ebp + 8]
movsx eax, word [eax + 4]
and eax, 0x200
je 0x4a1e81
mov eax, dword [ebp + 0xc]
mov dword [ebx + 0x18], eax
mov eax, dword [ebp + 8]
mov dword [ebx + 8], eax
mov eax, dword [ebp + 8]
mov dword [eax + 0xc], ebx
push 0x7d8aa0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4a1ea0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 0x48], eax
mov ebx, 0x3f
lea esi, [ebp - 0x44]
mov eax, dword [ebp + 8]
lea edx, [eax + 1]
mov dword [ebp + 8], edx
mov al, byte [eax]
mov byte [ebp - 0x49], al
movsx eax, byte [ebp - 0x49]
test eax, eax
je 0x4a1edf
cmp eax, 0x20
je 0x4a1edf
cmp eax, 9
jne 0x4a1ee1
jmp 0x4a1f0e
movsx eax, byte [ebp - 0x49]
cmp eax, 0x61
jl 0x4a1efd
cmp eax, 0x7a
jg 0x4a1efd
mov eax, esi
inc esi
movsx edx, byte [ebp - 0x49]
lea edx, [edx - 0x20]
mov byte [eax], dl
jmp 0x4a1f05
mov eax, esi
inc esi
mov dl, byte [ebp - 0x49]
mov byte [eax], dl
lea eax, [ebx - 1]
mov ebx, eax
test eax, eax
jne 0x4a1ebf
mov byte [esi], 0
push 0x7d8aa0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [ebp - 0x44]
push eax
call fcn.004a2080
pop ecx
mov dword [ebp - 4], eax
test eax, eax
jne 0x4a1f5e
lea eax, [ebp - 0x44]
push eax
call fcn.004a1cc0
pop ecx
mov edx, dword [ebp - 0x48]
mov edx, dword [edx + 0x30]
mov edx, dword [edx]
mov edx, dword [edx + 0x14]
mov edx, dword [edx + 0xc]
mov edx, dword [edx + 0x18]
push edx
push eax
call fcn.004a1d30
add esp, 8
mov dword [ebp - 4], eax
mov eax, dword [eax + 8]
mov word [eax + 4], 1
push 0x7d8aa0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4a1f80
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
push 0x7d8aa0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp + 8]
push eax
call fcn.004a2080
pop ecx
mov ebx, eax
test eax, eax
jne 0x4a1fe1
mov eax, dword [ebp + 8]
push eax
call fcn.004a1cc0
pop ecx
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x30]
mov edx, dword [edx]
mov edx, dword [edx + 0x14]
mov edx, dword [edx + 0xc]
mov edx, dword [edx + 0x18]
push edx
push eax
call fcn.004a1d30
add esp, 8
mov ebx, eax
mov eax, dword [ebx + 8]
mov word [eax + 4], 1
push 0x7d8aa0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4a2080
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
push 0x7d8aa0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x7bf1e4]
test eax, eax
jne 0x4a20ef
push 4
call fcn.0049b580
pop ecx
mov dword [0x7bf1e4], eax
push 0x1c
call fcn.0049b580
pop ecx
mov edx, dword [0x7bf1e4]
mov dword [edx], eax
push 0x1c
push 0
mov eax, dword [0x7bf1e4]
mov eax, dword [eax]
push eax
call fcn.00531d50
add esp, 0xc
push 0x7d8aa0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
jmp 0x4a2187
xor esi, esi
mov edi, dword [0x7bf1e8]
mov ebx, edi
shr ebx, 1
mov eax, dword [ebp - 4]
mov dword [eax + 0x1600], ebx
jmp 0x4a2172
mov eax, dword [ebp + 8]
push eax
mov eax, dword [0x7bf1e4]
mov eax, dword [eax + ebx*4]
mov eax, dword [eax + 8]
mov eax, dword [eax]
push eax
call fcn.00534750
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4a214a
mov eax, dword [ebp - 4]
mov dword [eax + 0x1600], ebx
push 0x7d8aa0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [0x7bf1e4]
mov eax, dword [eax + ebx*4]
jmp 0x4a2187
cmp dword [ebp - 8], 0
jge 0x4a215d
mov edi, ebx
mov eax, dword [ebp - 4]
mov dword [eax + 0x1600], ebx
jmp 0x4a2169
lea esi, [ebx + 1]
mov eax, dword [ebp - 4]
mov dword [eax + 0x1600], esi
mov eax, edi
sub eax, esi
shr eax, 1
lea ebx, [eax + esi]
cmp esi, edi
jb 0x4a2109
push 0x7d8aa0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4a4140
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push 0
call fcn.0049f730
pop ecx
mov esi, eax
movzx eax, word [ebp + 8]
push eax
push esi
call fcn.004a2750
add esp, 8
mov bx, 1
jmp 0x4a4193
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
movzx edx, bx
movzx ecx, word [ebp + 8]
sub edx, ecx
mov eax, dword [eax + 4]
mov eax, dword [eax + edx*4 - 4]
push eax
movzx eax, bx
push eax
push esi
call fcn.004a2c30
add esp, 0xc
movzx eax, bx
inc eax
mov ebx, eax
movzx eax, bx
movzx edx, word [ebp + 8]
cmp eax, edx
jle 0x4a4163
mov eax, esi
pop esi
pop ebx
pop ebp
ret

Function at 0x4a4260
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
push esi
push edi
push 0
call fcn.0049f730
pop ecx
mov edi, eax
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov eax, dword [eax + 0x30]
mov eax, dword [eax]
mov si, word [eax + 0xe]
movzx eax, si
push eax
push edi
call fcn.004a2750
add esp, 8
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov eax, dword [eax + 0x30]
mov eax, dword [eax]
mov ax, word [eax + 0x10]
mov word [ebp - 2], ax
mov bx, 1
jmp 0x4a42e4
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
movzx edx, bx
movzx ecx, word [ebp - 2]
add edx, ecx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + edx*4 + 4]
push eax
movzx eax, bx
push eax
push edi
call fcn.004a2c30
add esp, 0xc
movzx eax, bx
inc eax
mov ebx, eax
movzx eax, bx
movzx edx, si
cmp eax, edx
jle 0x4a42b4
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4a4300
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0
call fcn.0049f730
pop ecx
mov edi, eax
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov eax, dword [eax + 0x30]
mov eax, dword [eax]
mov si, word [eax + 0xe]
movzx eax, si
inc eax
push eax
push edi
call fcn.004a2750
add esp, 8
xor bx, bx
jmp 0x4a4363
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
movzx edx, bx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + edx*4 + 4]
push eax
movzx eax, bx
inc eax
push eax
push edi
call fcn.004a2c30
add esp, 0xc
movzx eax, bx
inc eax
mov ebx, eax
movzx eax, bx
movzx edx, si
cmp eax, edx
jle 0x4a4338
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret