joyce8/EMBER2024-capa huggingface dataset:
Function at 0x462870
Capabilities:
Get thread local storage value

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 4]
mov ecx, dword [esp + 8]
cmp eax, ecx
jge 0x462940
add eax, eax
cmp eax, ecx
jl 0x46288c
mov dword [esp + 8], eax
mov eax, dword [0x4c6060]
push ebx
push ebp
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [esp + 0x14]
shl ecx, 7
push 0x17
push ecx
mov ecx, eax
call fcn.00402380
mov edx, dword [esi]
test edx, edx
mov ebp, eax
je 0x462910
mov ecx, dword [esi + 0x10]
test ecx, ecx
je 0x462903
mov edi, dword [esi + 0xc]
mov eax, dword [esi + 8]
cmp edi, eax
jg 0x4628f0
mov ecx, dword [esi + 4]
sub ecx, eax
shl ecx, 7
mov ebx, ecx
shl eax, 7
push ebx
add eax, edx
push eax
push ebp
call fcn.00406220
mov edx, dword [esi]
shl edi, 7
push edi
push edx
add ebx, ebp
push ebx
call fcn.00406220
add esp, 0x18
jmp 0x462903
shl ecx, 7
shl eax, 7
push ecx
add eax, edx
push eax
push ebp
call fcn.00406220
add esp, 0xc
mov eax, dword [esi + 0x10]
mov dword [esi + 8], 0
mov dword [esi + 0xc], eax
mov edi, dword [esi + 4]
test edi, edi
je 0x462934
mov ecx, dword [0x4c6060]
mov ebx, dword [esi]
push ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push 0x17
shl edi, 7
push edi
push ebx
mov ecx, eax
call fcn.004023e0
mov edx, dword [esp + 0x14]
pop edi
mov dword [esi], ebp
pop ebp
mov dword [esi + 4], edx
pop ebx
pop esi
ret 4
Function at 0x463200
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov edx, dword [0x4c6060]
push ebx
push esi
lea ebx, [eax + ecx]
push edi
mov edi, dword [esp + 0x10]
lea ebx, [ebx*4 + 0x14]
lea esi, [ebx + 0x20]
imul esi, edi
add esi, 0x3f
push edx
and esi, 0xfffffff0
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push 4
push esi
mov ecx, eax
call fcn.00402380
mov cl, byte [esp + 0x14]
mov dl, byte [esp + 0x18]
mov byte [eax + 8], cl
mov cx, word [esp + 0x1c]
mov word [eax + 6], di
mov word [eax + 0xc], cx
mov word [eax + 2], si
mov byte [eax + 0xa], bl
xor ecx, ecx
mov byte [eax + 9], dl
mov word [eax + 0x10], cx
mov word [eax + 0x12], 3
pop edi
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x1c], ecx
mov dword [eax + 0x20], ecx
mov dword [eax + 0x24], ecx
mov dword [eax + 0x28], ecx
mov dword [eax + 0x2c], ecx
pop esi
mov word [eax], 0x16
mov word [eax + 4], cx
pop ebx
ret

Function at 0x4633a0
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
movzx eax, word [esi + 6]
push edi
movzx edi, word [esi + 4]
cmp edi, eax
mov ebx, esi
mov ecx, esi
jl 0x463409
cmp edi, 2
mov eax, edi
jg 0x4633c3
mov eax, 2
movzx ecx, word [esi + 0xc]
add eax, eax
cmp eax, ecx
jl 0x4633cf
mov eax, ecx
movzx edx, byte [esi + 8]
push ecx
movzx ecx, byte [esi + 9]
push ecx
push edx
push eax
call fcn.00463200
mov ebx, eax
push esi
push ebx
call fcn.00463290
mov eax, dword [0x4c6060]
add esp, 0x18
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
movzx ecx, word [esi + 2]
push 4
push ecx
push esi
mov ecx, eax
call fcn.004023e0
mov ecx, ebx
movzx eax, byte [ecx + 0xa]
lea edx, [edi + 1]
mov word [ecx + 4], dx
movsx edx, ax
movsx esi, di
imul edx, esi
movzx esi, word [ecx + 6]
shl esi, 5
add edx, ecx
sar eax, 2
sub eax, 1
lea edi, [esi + edx + 0x30]
js 0x463439
lea ecx, [eax + 1]
xor eax, eax
rep stosd dword es:[edi], eax
pop edi
pop esi
mov eax, ebx
pop ebx
ret

Function at 0x463440
Capabilities:
Get thread local storage value

Disassembly:
push esi
mov esi, dword [esp + 8]
movzx ecx, word [esi + 4]
add ecx, dword [esp + 0xc]
movzx eax, word [esi + 6]
add ecx, ecx
cmp ecx, eax
jg 0x46349b
movzx edx, word [esi + 0xc]
movzx ecx, byte [esi + 9]
push edi
push edx
movzx edx, byte [esi + 8]
push ecx
shr eax, 1
push edx
push eax
call fcn.00463200
mov edi, eax
push esi
push edi
call fcn.00463290
mov eax, dword [0x4c6060]
add esp, 0x18
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
movzx ecx, word [esi + 2]
push 4
push ecx
push esi
mov ecx, eax
call fcn.004023e0
mov eax, edi
pop edi
pop esi
ret
mov eax, esi
pop esi
ret

Function at 0x464030
Capabilities:
Get thread local storage value

Disassembly:
push esi
mov esi, ecx
mov dword [esi], vtable.hkpAabbPhantom.0
mov eax, dword [esi + 0xc8]
test eax, eax
js 0x464070
and eax, 0x3fffffff
push edi
mov edi, eax
mov eax, dword [0x4c6060]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edx, dword [esi + 0xc0]
push 0x17
lea ecx, [edi*4]
push ecx
push edx
mov ecx, eax
call fcn.004023e0
pop edi
mov ecx, esi
pop esi
jmp fcn.00454700
Function at 0x4646d0
Capabilities:
Get thread local storage value

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, dword [esi]
mov edx, dword [eax + 0x10]
push edi
mov ecx, esi
call edx
sub eax, 2
je 0x4647b1
sub eax, 4
je 0x46475a
sub eax, 1
je 0x4646f7
pop edi
xor eax, eax
pop esi
ret
mov eax, dword [0x4c6060]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push 0x2c
push 0x140
mov ecx, eax
call fcn.00402380
mov ecx, eax
mov word [eax + 4], 0x140
call fcn.00467da0
lea ecx, [esi + 0x10]
mov edi, eax
push ecx
lea ecx, [edi + 0x10]
call fcn.004645a0
mov edx, dword [esi + 8]
mov dword [edi + 8], edx
xor esi, esi
mov ecx, dword [edi + esi*4 + 0xe0]
test ecx, ecx
je 0x46474d
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
call edx
mov dword [edi + esi*4 + 0xe0], eax
add esi, 1
cmp esi, 3
jl 0x464734
mov eax, edi
pop edi
pop esi
ret
mov eax, dword [0x4c6060]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push 0x2c
push 0xd0
mov ecx, eax
call fcn.00402380
mov ecx, eax
mov word [eax + 4], 0xd0
call fcn.004669a0
lea ecx, [esi + 0x10]
mov edi, eax
push ecx
lea ecx, [edi + 0x10]
call fcn.004644e0
mov edx, dword [esi + 8]
mov dword [edi + 8], edx
mov ecx, dword [edi + 0xac]
test ecx, ecx
je 0x464803
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
call edx
mov dword [edi + 0xac], eax
mov eax, edi
pop edi
pop esi
ret
mov eax, dword [0x4c6060]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push 0x2c
push 0xe0
mov ecx, eax
call fcn.00402380
mov ecx, eax
mov word [eax + 4], 0xe0
call fcn.00466330
lea ecx, [esi + 0x10]
mov edi, eax
push ecx
lea ecx, [edi + 0x10]
call fcn.00464400
mov edx, dword [esi + 8]
mov dword [edi + 8], edx
mov ecx, dword [edi + 0xb0]
test ecx, ecx
je 0x464803
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
call edx
mov dword [edi + 0xb0], eax
mov eax, edi
pop edi
pop esi
ret
Function at 0x469e60
Capabilities:
Enumerate pe sections
Get thread local storage value

Disassembly:
mov eax, dword [0x4c6060]
push ebx
push ebp
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
imul ecx, ebx
push 0x17
push ecx
mov ecx, eax
call fcn.00402380
mov esi, dword [esp + 0x10]
movzx edx, word [esi + 4]
imul edx, ebx
mov ebp, eax
mov eax, dword [esi]
push edx
push eax
push ebp
call fcn.0042cb00
movzx eax, word [esi + 6]
add esp, 0xc
test eax, 0x8000
jne 0x469ecf
mov ecx, dword [0x4c6060]
push edi
and eax, 0x3fff
push ecx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
imul edi, ebx
mov edx, dword [esi]
push 0x17
push edi
push edx
mov ecx, eax
call fcn.004023e0
pop edi
mov ax, word [esi + 6]
and ax, 0x4000
or ax, word [esp + 0x14]
mov dword [esi], ebp
mov word [esi + 6], ax
pop esi
pop ebp
pop ebx
ret

Function at 0x469ef0
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
movzx eax, word [esi + 4]
test ax, ax
push edi
je 0x469f0c
movzx edi, ax
add edi, edi
mov dword [esp + 0x14], edi
jmp 0x469f18
mov dword [esp + 0x14], 1
mov edi, dword [esp + 0x14]
mov eax, dword [0x4c6060]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, dword [esp + 0x18]
mov ecx, edi
imul ecx, ebx
push 0x17
push ecx
mov ecx, eax
call fcn.00402380
movzx edx, word [esi + 4]
imul edx, ebx
mov ebp, eax
mov eax, dword [esi]
push edx
push eax
push ebp
call fcn.0042cb00
movzx eax, word [esi + 6]
add esp, 0xc
test eax, 0x8000
jne 0x469f80
mov ecx, dword [0x4c6060]
and eax, 0x3fff
push ecx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
imul edi, ebx
mov edx, dword [esi]
push 0x17
push edi
push edx
mov ecx, eax
call fcn.004023e0
mov edi, dword [esp + 0x14]
mov ax, word [esi + 6]
and ax, 0x4000
or ax, di
pop edi
mov dword [esi], ebp
mov word [esi + 6], ax
pop esi
pop ebp
pop ebx
ret
Function at 0x46a730
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [esp + 4]
push ebx
push ebp
push esi
xor ebx, ebx
push edi
mov edi, dword [eax + 4]
mov ebp, ecx
mov ecx, dword [eax]
mov edx, dword [ecx]
lea eax, [ebx + 1]
cmp edi, eax
jle 0x46a768
lea esi, [ecx + 4]
lea ecx, [ecx]
mov ecx, dword [esi]
cmp ecx, edx
jle 0x46a75a
mov edx, ecx
mov ebx, eax
add eax, 1
add esi, 4
cmp eax, edi
jl 0x46a750
test ebx, ebx
jne 0x46a771
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 4
mov eax, dword [0x4c6060]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, dword [eax + 0x20]
lea ecx, [edi*4 + 0x10]
and ecx, 0xfffffff0
lea edx, [esi + ecx]
cmp edx, dword [eax + 0x2c]
ja 0x46a797
mov dword [eax + 0x20], edx
jmp 0x46a7a3
mov edx, dword [eax]
push ecx
mov ecx, eax
mov eax, dword [edx + 0x14]
call eax
mov esi, eax
xor eax, eax
test edi, edi
jle 0x46a7ba
lea esp, [esp]
mov dword [esi + eax*4], eax
add eax, 1
cmp eax, edi
jl 0x46a7b0
mov edx, dword [esp + 0x14]
mov dword [esi], ebx
mov dword [esi + ebx*4], 0
mov eax, dword [edx]
mov edi, dword [eax]
mov ecx, dword [eax + ebx*4]
mov dword [eax + ebx*4], edi
mov edx, dword [edx]
xor eax, eax
mov dword [edx], ecx
cmp dword [ebp + 4], eax
jle 0x46a7f7
lea esp, [esp]
mov ecx, dword [ebp]
mov edx, dword [ecx]
lea ecx, [edx + eax*4]
mov edx, dword [ecx]
mov edx, dword [esi + edx*4]
add eax, 1
mov dword [ecx], edx
cmp eax, dword [ebp + 4]
jl 0x46a7e0
mov eax, dword [0x4c6060]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp esi, dword [eax + 0x28]
mov dword [eax + 0x20], esi
jne 0x46a815
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x18]
push esi
call eax
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
ret 4
Function at 0x46a820
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push ebp
xor eax, eax
cmp dword [ecx + 4], eax
push esi
push edi
jle 0x46a84d
jmp 0x46a830
mov edx, dword [ecx]
mov edx, dword [edx]
mov edi, dword [esp + 0x14]
mov esi, dword [edx + eax*4]
mov edi, dword [edi]
mov esi, dword [edi + esi*4]
lea edx, [edx + eax*4]
add eax, 1
mov dword [edx], esi
cmp eax, dword [ecx + 4]
jl 0x46a830
mov eax, dword [0x4c6060]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebp, dword [esp + 0x18]
mov ebx, dword [eax + 0x20]
lea ecx, [ebp*4 + 0x10]
and ecx, 0xfffffff0
lea edx, [ebx + ecx]
cmp edx, dword [eax + 0x2c]
ja 0x46a877
mov dword [eax + 0x20], edx
jmp 0x46a883
mov edx, dword [eax]
push ecx
mov ecx, eax
mov eax, dword [edx + 0x14]
call eax
mov ebx, eax
test ebp, ebp
jle 0x46a88f
mov ecx, ebp
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
mov esi, dword [esp + 0x1c]
xor eax, eax
cmp dword [esi + 4], eax
jle 0x46a8bc
lea ebx, [ebx]
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx]
mov ecx, dword [edx + eax*4]
mov edx, dword [esi]
mov edx, dword [edx + eax*4]
add dword [ebx + ecx*4], edx
lea ecx, [ebx + ecx*4]
add eax, 1
cmp eax, dword [esi + 4]
jl 0x46a8a0
mov eax, dword [esi + 8]
and eax, 0x3fffffff
cmp eax, ebp
jge 0x46a8dc
add eax, eax
cmp ebp, eax
jl 0x46a8d0
mov eax, ebp
push 4
push eax
push esi
call fcn.004026b0
add esp, 0xc
xor eax, eax
test ebp, ebp
mov dword [esi + 4], ebp
jle 0x46a8f4
mov edx, dword [ebx + eax*4]
mov ecx, dword [esi]
mov dword [ecx + eax*4], edx
add eax, 1
cmp eax, ebp
jl 0x46a8e5
mov eax, dword [0x4c6060]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp ebx, dword [eax + 0x28]
mov dword [eax + 0x20], ebx
jne 0x46a912
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x18]
push ebx
call eax
pop edi
pop esi
pop ebp
pop ebx
ret 0xc
Function at 0x46ab70
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push esi
mov esi, ecx
xor ebp, ebp
mov ecx, 0x4c6080
mov dword [esi + 0x20], ebp
mov dword [esi + 0x24], ebp
mov dword [esi + 0x28], ebp
call fcn.00404790
mov eax, dword [0x4c60a8]
cmp eax, ebp
mov dword [esi + 0x28], eax
je 0x46ab98
mov dword [eax + 0x24], esi
push ebx
push edi
mov dword [esi + 0x24], 0x4c6080
or edi, 0xffffffff
push 0x4c6080
mov dword [0x4c60a8], esi
mov dword [0x4c6098], edi
mov dword [0x4c609c], edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov ecx, dword [0x4c6060]
push ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [eax + 0x68]
cmp ecx, ebp
je 0x46abef
add dword [eax + 0x6c], edi
mov edx, dword [ecx]
mov dword [eax + 0x68], edx
mov ebx, ecx
jmp 0x46abfa
push 6
mov ecx, eax
call fcn.00402220
mov ebx, eax
cmp ebx, ebp
je 0x46ac1e
lea edi, [ebx + 0x14]
mov ebp, 2
mov ecx, edi
call fcn.0046b890
add edi, 0x14
sub ebp, 1
jns 0x46ac06
xor ebp, ebp
mov eax, ebx
or edi, 0xffffffff
jmp 0x46ac20
xor eax, eax
mov dword [esi + 0x30], eax
mov eax, dword [0x4c6060]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [eax + 0x40]
cmp ecx, ebp
je 0x46ac40
add dword [eax + 0x44], edi
mov edx, dword [ecx]
mov dword [eax + 0x40], edx
jmp 0x46ac4b
push 1
mov ecx, eax
call fcn.00402220
mov ecx, eax
cmp ecx, ebp
pop edi
pop ebx
je 0x46ac5e
push 0x3e8
push ebp
call fcn.0046b9a0
jmp 0x46ac60
xor eax, eax
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov dword [esi + 0x4c], eax
mov eax, dword [esp + 0xc]
mov dword [esi + 0x50], eax
mov eax, dword [esi + 0x30]
mov dword [esi + 0x54], ecx
mov dword [esi + 0x58], edx
mov byte [eax + 0x10], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx + 4], ebp
mov edx, dword [esi + 0x30]
mov dword [edx + 8], ebp
mov eax, dword [esi + 0x30]
mov dword [eax + 0xc], ebp
mov ecx, dword [esi + 0x30]
mov dword [ecx], ebp
push 0x80
mov ecx, esi
call fcn.0046ab20
push ebp
mov ecx, esi
call fcn.0046aa90
mov eax, esi
pop esi
pop ebp
ret 0xc
Function at 0x46b7d0
Capabilities:
Get thread local storage value

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x30]
test ecx, ecx
je 0x46b7e1
push 1
call fcn.0046b930
push edi
mov edi, dword [esi + 0x4c]
test edi, edi
je 0x46b81c
mov ecx, edi
call fcn.0046b9c0
mov eax, dword [0x4c6060]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [eax + 0x44]
cmp ecx, dword [eax + 0x34]
jl 0x46b810
push edi
push 1
mov ecx, eax
call fcn.004022b0
jmp 0x46b81c
mov edx, dword [eax + 0x40]
add dword [eax + 0x44], 1
mov dword [edi], edx
mov dword [eax + 0x40], edi
push esi
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
cmp dword [esi + 0x24], 0
pop edi
je 0x46b862
mov ecx, 0x4c6080
call fcn.00404790
mov eax, dword [esi + 0x24]
mov ecx, dword [esi + 0x28]
mov dword [eax + 0x28], ecx
mov eax, dword [esi + 0x28]
test eax, eax
je 0x46b84a
mov edx, dword [esi + 0x24]
mov dword [eax + 0x24], edx
or eax, 0xffffffff
push 0x4c6080
mov dword [0x4c6098], eax
mov dword [0x4c609c], eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
ret

Function at 0x46b930
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push esi
push edi
mov edi, ecx
lea esi, [edi + 0x50]
mov ebp, 2
lea ecx, [ecx]
sub esi, 0x14
mov ecx, esi
call fcn.0046b8b0
sub ebp, 1
jns 0x46b940
test byte [esp + 0x10], 1
je 0x46b98c
test edi, edi
je 0x46b98c
mov eax, dword [0x4c6060]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [eax + 0x6c]
cmp ecx, dword [eax + 0x34]
jl 0x46b980
push edi
push 6
mov ecx, eax
call fcn.004022b0
mov eax, edi
pop edi
pop esi
pop ebp
ret 4
mov edx, dword [eax + 0x68]
add dword [eax + 0x6c], 1
mov dword [edi], edx
mov dword [eax + 0x68], edi
mov eax, edi
pop edi
pop esi
pop ebp
ret 4
Function at 0x46ebe0
Capabilities:
Get thread local storage value

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
push edi
push ebx
mov esi, ecx
call fcn.0044d6a0
mov dword [esi], vtable.hkpContinuousSimulation.0
lea edi, [esi + 0x30]
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], bind
mov byte [esi + 0x10], 1
mov eax, dword [0x4c6060]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push 0x15
push 0xc
mov ecx, eax
call fcn.00402380
mov ecx, eax
mov word [eax + 4], 0xc
call fcn.0047fe60
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], 0
mov eax, dword [edi + 8]
mov ecx, dword [ebx + 0x2f4]
and eax, 0x3fffffff
cmp eax, ecx
jge 0x46ec64
add eax, eax
cmp ecx, eax
jl 0x46ec58
mov eax, ecx
push 0x70
push eax
push edi
call fcn.004026b0
add esp, 0xc
pop edi
mov eax, esi
pop esi
pop ebx
ret 4
Function at 0x46f0f0
Capabilities:
Execute anti-debugging instructions
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
mov eax, 0x3094
call fcn.0042ddc0
mov eax, dword [0x4c6074]
push ebx
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
mov ecx, dword [esi + 4]
cmp ecx, dword [esi + 0xc]
jae 0x46f132
mov dword [ecx], str.TtNarrowPhaseTOI
rdtsc
mov dword [esp + 0xc], eax
mov edx, dword [esp + 0xc]
mov dword [ecx + 4], edx
add ecx, 0xc
mov dword [esi + 4], ecx
mov eax, dword [ebp + 8]
xor ebx, ebx
cmp dword [eax + 4], ebx
jle 0x46f1e2
mov edi, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
fldz
mov edx, dword [ecx]
mov esi, dword [edx + ebx*4]
fst dword [esp + 0x3060]
mov eax, dword [ebp + 0x10]
fstp dword [esp + 0x3064]
fld dword [0x4b33d8]
mov dword [esp + 0x14], eax
mov eax, dword [edi]
fstp dword [esp + 0x3040]
lea edx, [eax + 0x1da0]
lea ecx, [esp + 0x20]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x3090], 0
mov dword [edi + 0x60], edx
movsx ecx, byte [esi + 0xc]
shl ecx, 6
mov edx, dword [ecx + eax + 0x1c30]
mov dword [edi + 0x10], edx
mov eax, dword [esi + 8]
push eax
lea ecx, [esp + 0x14]
push ecx
push edi
push esi
call fcn.0047a3d0
lea edx, [esp + 0x30]
add esp, 0x10
cmp dword [esp + 0x10], edx
je 0x46f1d3
mov ecx, dword [esi + 8]
mov eax, dword [ecx]
mov eax, dword [eax + 0x18]
lea edx, [esp + 0x10]
push edx
mov edx, dword [esi + 0x14]
push edi
push edx
mov edx, dword [esi + 0x10]
push edx
call eax
mov ecx, dword [ebp + 8]
add ebx, 1
cmp ebx, dword [ecx + 4]
jl 0x46f143
mov edx, dword [0x4c6074]
push edx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
mov ecx, dword [esi + 4]
cmp ecx, dword [esi + 0xc]
jae 0x46f212
mov dword [ecx], 0x4b2454
rdtsc
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
mov dword [ecx + 4], eax
add ecx, 0xc
mov dword [esi + 4], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x46f7a0
Capabilities:
Execute anti-debugging instructions
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
mov eax, 0x30c4
call fcn.0042ddc0
mov eax, dword [ebp + 8]
mov edx, dword [0x4c6060]
push ebx
push esi
mov dword [esp + 0x28], ecx
mov ecx, dword [eax]
mov ebx, dword [ecx + 0xb8]
mov esi, dword [ebx + 0x4c]
push edi
push edx
mov dword [esp + 0x2c], ebx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [eax + 0x20]
lea edx, [esi + 0x10]
and edx, 0xfffffff0
lea edi, [ecx + edx]
cmp edi, dword [eax + 0x2c]
ja 0x46f7f2
mov dword [eax + 0x20], edi
mov edi, ecx
mov dword [esp + 0x1c], edi
jmp 0x46f802
mov edi, dword [eax]
mov ecx, eax
mov eax, dword [edi + 0x14]
push edx
call eax
mov dword [esp + 0x1c], eax
mov edi, eax
push esi
mov eax, esi
or eax, 0x80000000
push 0
push edi
mov dword [esp + 0x44], eax
call fcn.00406240
fld dword [0x4b33d8]
mov ecx, dword [0x4c6074]
fstp dword [esp + 0x307c]
fldz
add esp, 0xc
mov dword [esp + 0x44], ebx
fst dword [esp + 0x3090]
mov ebx, dword [sym.imp.KERNEL32.dll_TlsGetValue]
fstp dword [esp + 0x3094]
push ecx
call ebx
mov ecx, eax
mov esi, dword [ecx + 4]
cmp esi, dword [ecx + 0xc]
jae 0x46f86c
mov dword [esi], str.TtNarrowPhaseTOI
rdtsc
mov dword [esp + 0x14], eax
mov edx, dword [esp + 0x14]
mov dword [esi + 4], edx
add esi, 0xc
mov dword [ecx + 4], esi
xor eax, eax
cmp dword [ebp + 0xc], eax
mov dword [esp + 0x18], eax
jle 0x46f9ca
mov ebx, dword [ebp + 0x10]
Function at 0x471b50
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x34
mov ecx, dword [ebp + 0x10]
mov ax, word [ecx + 8]
mov dx, word [ecx]
push ebx
mov bx, word [ecx + 4]
push esi
mov si, word [ecx + 2]
push edi
mov di, word [ecx + 0xa]
mov cx, word [ecx + 6]
sub cx, 2
sub bx, 2
mov word [esp + 0x14], cx
mov ecx, dword [ebp + 0xc]
mov word [esp + 0x10], bx
mov ebx, dword [ebp + 8]
shl ecx, 4
add ecx, ebx
sub ax, 1
sub dx, 1
sub si, 1
sub di, 2
cmp ebx, ecx
jae 0x471ce9
movzx ebx, di
mov dword [esp + 0x1c], ebx
movzx ebx, ax
movzx eax, ax
mov dword [esp + 0x18], ebx
movzx ebx, word [esp + 0x10]
mov dword [esp + 0x28], eax
movzx eax, word [esp + 0x10]
mov dword [esp + 0x24], ebx
movzx ebx, dx
movzx edx, dx
mov dword [esp + 0x30], eax
mov ax, word [esp + 0x14]
mov dword [esp + 0x10], edx
movzx edx, ax
mov dword [esp + 0x34], edx
movzx edx, si
mov dword [esp + 0x14], edx
movzx edx, si
mov dword [esp + 0x38], edx
mov edx, dword [ebp + 8]
sub ecx, edx
movzx eax, ax
sub ecx, 1
movzx edi, di
shr ecx, 4
mov dword [esp + 0x3c], eax
mov dword [esp + 0x20], ebx
mov dword [esp + 0x2c], edi
lea eax, [edx + 0xa]
add ecx, 1
movzx edx, word [eax - 2]
mov edi, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
movzx esi, dx
sub edi, esi
sub ebx, esi
shr edi, 0x1f
add edi, edx
movzx edx, word [eax - 0xa]
shr ebx, 0x1f
add ebx, edi
mov edi, dword [esp + 0x20]
mov word [eax - 2], bx
mov ebx, dword [esp + 0x24]
movzx esi, dx
sub edi, esi
sub ebx, esi
shr edi, 0x1f
add edi, edx
movzx edx, word [eax]
shr ebx, 0x1f
add ebx, edi
mov edi, dword [esp + 0x28]
mov word [eax - 0xa], bx
mov ebx, dword [esp + 0x2c]
movzx esi, dx
sub edi, esi
shr edi, 0x1f
add edi, edx
movzx edx, word [eax - 6]
sub ebx, esi
shr ebx, 0x1f
add ebx, edi
mov edi, dword [esp + 0x10]
mov word [eax], bx
mov ebx, dword [esp + 0x30]
movzx esi, dx
sub edi, esi
shr edi, 0x1f
add edi, edx
movzx edx, word [eax - 8]
sub ebx, esi
shr ebx, 0x1f
add ebx, edi
mov edi, dword [esp + 0x14]
movzx esi, dx
sub edi, esi
mov word [eax - 6], bx
mov ebx, dword [esp + 0x34]
shr edi, 0x1f
add edi, edx
movzx edx, word [eax - 4]
sub ebx, esi
shr ebx, 0x1f
add ebx, edi
mov edi, dword [esp + 0x38]
mov word [eax - 8], bx
mov ebx, dword [esp + 0x3c]
movzx esi, dx
sub edi, esi
sub ebx, esi
shr edi, 0x1f
shr ebx, 0x1f
add edi, edx
add ebx, edi
mov word [eax - 4], bx
add eax, 0x10
sub ecx, 1
jne 0x471c19
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc