joyce8/EMBER2024-capa huggingface dataset:
Function at 0x422aa0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov esi, eax
push 0x28
call fcn.0043b120
mov ebx, eax
xor eax, eax
pop ecx
xor edx, edx
mov dword [ebx], eax
mov dword [ebx + 0x18], edx
mov dword [ebx + 0x1c], 0x18
xor ecx, ecx
add esi, 0x10
mov dword [ebx + 0x20], ecx
mov dword [ebx + 0x24], 0x422a88
test dword [esi], 0xb405
je 0x422aee
push esi
call fcn.0043edc0
pop ecx
mov dword [esi], 0x22000
mov dword [esi + 8], ebx
mov dword [esi + 0xc], 0x5385d0
push edi
push ebx
call fcn.0043f03c
add esp, 8
push esi
push edi
call fcn.0043f03c
add esp, 8
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x422b18
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov eax, dword [0x54d750]
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov esi, eax
jmp 0x422b5d
mov ax, word [ebx]
mov edx, dword [esi + 0x8c]
mov ecx, dword [edx + 8]
mov edx, dword [ecx]
movzx eax, ax
mov ecx, eax
shl ecx, 3
lea ecx, [ecx + ecx*2]
add edx, ecx
add edx, 0xffffffe8
mov eax, edx
push eax
call fcn.00422aa0
pop ecx
add ebx, 2
mov eax, edi
add di, 0xffff
test ax, ax
jne 0x422b33
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x422b70
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov ebx, eax
mov eax, dword [ebp + 8]
push eax
add dword [ebx], 4
mov edx, dword [ebx]
cmp edx, dword [ebx + 4]
jne 0x422b94
call fcn.00432adc
mov ecx, dword [ebx]
mov eax, dword [ecx - 4]
push eax
call fcn.0043ee8c
add esp, 8
pop ebx
pop ebp
ret

Function at 0x422ba8
Capabilities:
Get thread local storage value

Disassembly:
push ebx
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov ebx, eax
add dword [ebx], 4
mov eax, dword [ebx]
cmp eax, dword [ebx + 4]
jne 0x422bc5
call fcn.00432adc
mov edx, dword [ebx]
mov ecx, dword [edx - 4]
xor eax, eax
mov dword [ecx], eax
pop ebx
ret

Function at 0x422bd0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov ebx, eax
add dword [ebx], 4
mov eax, dword [ebx]
cmp eax, dword [ebx + 4]
jne 0x422bf0
call fcn.00432adc
mov edx, dword [ebx]
mov eax, dword [edx - 4]
mov dword [eax], 0x80
mov edx, dword [ebp + 8]
mov dword [eax + 8], edx
pop ebx
pop ebp
ret

Function at 0x422d18
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov ebx, eax
add dword [ebx], 4
mov eax, dword [ebx]
cmp eax, dword [ebx + 4]
jne 0x422d3c
call fcn.00432adc
mov edx, dword [ebx]
mov eax, dword [edx - 4]
mov dword [eax], 2
mov dword [eax + 8], esi
cmp esi, 0xc4653601
jl 0x422d5a
cmp esi, 0x3b9ac9ff
jle 0x422d60
mov dx, 0x14
jmp 0x422d64
mov dx, 0xa
mov word [eax + 0xc], dx
pop esi
pop ebx
pop ebp
ret
Function at 0x422d6c
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov ebx, eax
add dword [ebx], 4
mov eax, dword [ebx]
cmp eax, dword [ebx + 4]
jne 0x422d90
call fcn.00432adc
mov edx, dword [ebx]
mov eax, esi
mov ecx, dword [edx - 4]
cdq
mov ebx, ecx
mov dword [ebx], 2
mov dword [ebx + 8], esi
push edx
push eax
call fcn.00422cc4
add esp, 8
mov word [ebx + 0xc], ax
pop esi
pop ebx
pop ebp
ret

Function at 0x422db8
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov ebx, eax
add dword [ebx], 4
mov eax, dword [ebx]
cmp eax, dword [ebx + 4]
jne 0x422ddc
call fcn.00432adc
mov edx, dword [ebx]
mov eax, dword [edx - 4]
mov dword [eax], 2
mov dword [eax + 8], esi
cmp esi, 0xc4653601
jl 0x422dfa
cmp esi, 0x3b9ac9ff
jle 0x422e00
mov dx, 0x14
jmp 0x422e04
mov dx, 0xa
mov word [eax + 0xc], dx
pop esi
pop ebx
pop ebp
ret

Function at 0x422e1c
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov ebx, eax
add dword [ebx], 4
mov eax, dword [ebx]
cmp eax, dword [ebx + 4]
jne 0x422e3c
call fcn.00432adc
mov edx, dword [ebx]
mov ecx, dword [edx - 4]
mov dword [ecx], 8
mov eax, dword [ebp + 8]
mov dword [ecx + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ecx + 0xc], eax
cmp dword [ebp + 0xc], 0xffffffff
jne 0x422e64
cmp dword [ebp + 8], 0xc4653601
jb 0x422e79
jmp 0x422e66
jl 0x422e79
cmp dword [ebp + 0xc], 2
jne 0x422e77
cmp dword [ebp + 8], 0x540be3ff
jbe 0x422e7f
jmp 0x422e79
jle 0x422e7f
mov dx, 0x14
jmp 0x422e83
mov dx, 0xa
mov word [ecx + 0x10], dx
pop ebx
pop ebp
ret

Function at 0x422e8c
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov ebx, eax
add dword [ebx], 4
mov eax, dword [ebx]
cmp eax, dword [ebx + 4]
jne 0x422eac
call fcn.00432adc
mov edx, dword [ebx]
mov ecx, dword [edx - 4]
mov ebx, ecx
mov dword [ebx], 8
mov eax, dword [ebp + 8]
mov dword [ebx + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebx + 0xc], eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00422cc4
add esp, 8
mov word [ebx + 0x10], ax
pop ebx
pop ebp
ret
Function at 0x422f24
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0x10]
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov ebx, eax
add dword [ebx], 4
mov eax, dword [ebx]
cmp eax, dword [ebx + 4]
jne 0x422f48
call fcn.00432adc
mov edx, dword [ebx]
mov edx, dword [edx - 4]
mov dword [edx], 0x10
mov eax, dword [ebp + 8]
mov dword [edx + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [edx + 0xc], eax
fld qword [ebp + 8]
fcomp qword [0x422fa8]
fnstsw ax
sahf
ja 0x422f7b
fld qword [ebp + 8]
fcomp qword [0x422fb0]
fnstsw ax
sahf
jae 0x422f81
mov cx, 0x14
jmp 0x422f85
mov cx, 0xa
mov word [edx + 0x10], cx
cmp esi, 0xff
jne 0x422f9e
mov ax, word [ebx + 0xf4]
mov word [edx + 0x12], ax
jmp 0x422fa2
mov word [edx + 0x12], si
pop esi
pop ebx
pop ebp
ret

Function at 0x422fb8
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov eax, dword [0x54d750]
mov edi, dword [ebp + 0x14]
mov esi, dword [ebp + 0x10]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov ebx, eax
add dword [ebx], 4
mov eax, dword [ebx]
cmp eax, dword [ebx + 4]
jne 0x422fe0
call fcn.00432adc
mov edx, dword [ebx]
cmp edi, 0xff
mov edx, dword [edx - 4]
mov dword [edx], 0x10
mov eax, dword [ebp + 8]
mov dword [edx + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [edx + 0xc], eax
jne 0x42300c
mov cx, word [ebx + 0xf4]
mov word [edx + 0x12], cx
jmp 0x423010
mov word [edx + 0x12], di
cmp esi, 0xff
jne 0x423044
fld qword [ebp + 8]
fcomp qword [0x423050]
fnstsw ax
sahf
ja 0x423034
fld qword [ebp + 8]
fcomp qword [0x423058]
fnstsw ax
sahf
jae 0x42303a
mov cx, 0x14
jmp 0x42303e
mov cx, 0xa
mov word [edx + 0x10], cx
jmp 0x423048
mov word [edx + 0x10], si
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4230d8
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov ebx, eax
add dword [ebx], 4
mov eax, dword [ebx]
cmp eax, dword [ebx + 4]
jne 0x4230f8
call fcn.00432adc
mov edx, dword [ebx]
xor ecx, ecx
mov eax, dword [edx - 4]
mov dword [eax], 1
mov edx, dword [ebp + 8]
mov dword [eax + 8], edx
mov dword [eax + 0x10], ecx
mov dword [eax + 0xc], ecx
pop ebx
pop ebp
ret

Function at 0x423160
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov ebx, eax
mov eax, dword [ebp + 0xc]
push eax
mov edx, dword [ebp + 8]
push edx
add dword [ebx], 4
mov ecx, dword [ebx]
cmp ecx, dword [ebx + 4]
jne 0x423188
call fcn.00432adc
mov eax, dword [ebx]
mov edx, dword [eax - 4]
push edx
call fcn.0043daa0
add esp, 0xc
pop ebx
pop ebp
ret
Function at 0x42319c
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov ebx, eax
add dword [ebx], 4
mov eax, dword [ebx]
cmp eax, dword [ebx + 4]
jne 0x4231bc
call fcn.00432adc
mov edx, dword [ebx]
xor ecx, ecx
mov eax, dword [edx - 4]
mov dword [eax], 0x400
mov edx, dword [ebp + 0xc]
mov dword [eax + 8], edx
mov dword [eax + 0xc], ecx
mov edx, dword [ebp + 8]
mov dword [eax + 0x10], edx
pop ebx
pop ebp
ret

Function at 0x4231dc
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov ebx, eax
add dword [ebx], 4
mov eax, dword [ebx]
cmp eax, dword [ebx + 4]
jne 0x4231fc
call fcn.00432adc
mov edx, dword [ebx]
xor ecx, ecx
mov eax, dword [edx - 4]
mov dword [eax], 0x100
mov edx, dword [ebp + 8]
mov dword [eax + 8], edx
mov dword [eax + 0xc], ecx
pop ebx
pop ebp
ret

Function at 0x423218
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov ebx, eax
add dword [ebx], 4
mov eax, dword [ebx]
cmp eax, dword [ebx + 4]
jne 0x423238
call fcn.00432adc
mov edx, dword [ebx]
mov eax, dword [edx - 4]
mov dword [eax], 0x100
mov edx, dword [ebp + 8]
mov ecx, dword [edx]
xor edx, edx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
pop ebx
pop ebp
ret

Function at 0x423254
Capabilities:
Get thread local storage value

Disassembly:
push ebx
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov ebx, eax
add dword [ebx], 4
mov eax, dword [ebx]
cmp eax, dword [ebx + 4]
jne 0x423271
call fcn.00432adc
mov edx, dword [ebx]
mov eax, dword [edx - 4]
xor edx, edx
mov dword [eax], 0x100
mov dword [eax + 8], 0x53852c
mov dword [eax + 0xc], edx
pop ebx
ret

Function at 0x42328c
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov ebx, eax
add dword [ebx], 4
mov eax, dword [ebx]
cmp eax, dword [ebx + 4]
jne 0x4232b2
call fcn.00432adc
mov edx, dword [ebx]
mov ax, word [edi + 2]
mov esi, dword [edx - 4]
mov word [ebp - 2], ax
cmp dword [ebp + 0x10], 0
je 0x4232ce
movzx edx, word [ebp - 2]
add edx, edx
sub dword [ebp + 0x10], edx
mov ecx, dword [ebp + 0x10]
lea edx, [edi + 4]
push ecx
mov eax, dword [ebp + 0xc]
push eax
push edx
mov cx, word [ebp - 2]
push ecx
movzx eax, word [ebp - 2]
add eax, eax
add eax, edi
add eax, 4
push eax
call fcn.00432064
mov dword [esi + 8], eax
mov dword [esi], 0x1000
mov dx, word [edi]
add esp, 0x14
mov word [esi + 0xc], dx
mov ecx, dword [ebx + 0xc]
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
mov cx, word [edx + 0x10]
mov word [esi + 0xe], cx
mov eax, dword [ebx + 0xc]
mov edx, dword [eax]
mov ecx, dword [edx + 0xc]
mov ax, word [ecx + 0xc]
mov word [esi + 0x10], ax
mov edx, dword [ebx + 0xc]
mov ecx, dword [edx]
mov eax, dword [ecx + 0xc]
mov dx, word [eax + 0xe]
mov word [esi + 0x12], dx
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x42333c
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov ebx, eax
add dword [ebx], 4
mov eax, dword [ebx]
cmp eax, dword [ebx + 4]
jne 0x42335d
call fcn.00432adc
mov edx, dword [ebx]
mov eax, dword [ebp + 0x10]
mov esi, dword [edx - 4]
push eax
mov edx, dword [ebp + 0xc]
push edx
push 0
push 0
mov ecx, dword [ebp + 8]
push ecx
call fcn.00432064
mov dword [esi + 8], eax
mov dword [esi], 0x1000
mov word [esi + 0xc], 0
mov eax, dword [ebx + 0xc]
add esp, 0x14
mov edx, dword [eax]
mov ecx, dword [edx + 0xc]
mov ax, word [ecx + 0x10]
mov word [esi + 0xe], ax
mov edx, dword [ebx + 0xc]
mov ecx, dword [edx]
mov eax, dword [ecx + 0xc]
mov dx, word [eax + 0xc]
mov word [esi + 0x10], dx
mov ecx, dword [ebx + 0xc]
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
mov cx, word [edx + 0xe]
mov word [esi + 0x12], cx
pop esi
pop ebx
pop ebp
ret

Function at 0x4233c0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov ebx, eax
add dword [ebx], 4
mov eax, dword [ebx]
cmp eax, dword [ebx + 4]
jne 0x4233e1
call fcn.00432adc
mov edx, dword [ebx]
mov eax, dword [ebp + 0xc]
mov esi, dword [edx - 4]
push eax
mov edx, dword [ebp + 8]
push edx
call fcn.00432238
mov dword [esi + 8], eax
mov dword [esi], 0x1000
mov cx, word [ebp + 0x10]
add esp, 8
mov word [esi + 0xc], cx
mov eax, dword [ebx + 0xc]
mov edx, dword [eax]
mov ecx, dword [edx + 0xc]
mov ax, word [ecx + 0x10]
mov word [esi + 0xe], ax
mov edx, dword [ebx + 0xc]
mov ecx, dword [edx]
mov eax, dword [ecx + 0xc]
mov dx, word [eax + 0xc]
mov word [esi + 0x10], dx
mov ecx, dword [ebx + 0xc]
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
mov cx, word [edx + 0xe]
mov word [esi + 0x12], cx
pop esi
pop ebx
pop ebp
ret

Function at 0x42343c
Capabilities:
Get thread local storage value

Disassembly:
push ebx
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov ebx, eax
add dword [ebx], 4
mov eax, dword [ebx]
cmp eax, dword [ebx + 4]
jne 0x423459
call fcn.00432adc
mov edx, dword [ebx]
mov ecx, dword [edx - 4]
mov ebx, ecx
mov dword [ebx], 2
call fcn.00482d40
mov dword [ebx + 8], eax
mov word [ebx + 0xc], 0xa
pop ebx
ret

Function at 0x423478
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov ebx, eax
call fcn.00482d40
mov esi, eax
mov eax, dword [ebx]
mov ebx, dword [eax - 4]
push edi
push ebx
call fcn.00421e08
add esp, 8
test eax, eax
jne 0x4234b2
push edi
push ebx
call fcn.004838b8
add esp, 8
push esi
call fcn.00482d4c
pop ecx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4234c0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov edx, dword [eax]
mov ebx, dword [edx - 4]
test byte [ebx + 1], 4
je 0x423558
mov esi, dword [ebx + 0x10]
mov al, byte [esi]
cmp al, 0x4d
je 0x4234ec
cmp al, 0x6d
jne 0x42351a
cmp dword [ebx + 8], 1
je 0x42350e
cmp dword [ebx + 8], 4
jb 0x423558
mov edx, dword [ebx + 8]
push edx
push 0x5386c9
push esi
call fcn.004a86ec
add esp, 0xc
test eax, eax
jne 0x423558
push edi
push ebx
call fcn.00443b10
add esp, 8
jmp 0x42355f
cmp dword [ebx + 8], 4
jb 0x423558
mov ecx, dword [ebx + 8]
push ecx
push 0x5386d0
push esi
call fcn.004a86ec
add esp, 0xc
test eax, eax
je 0x42354c
mov eax, dword [ebx + 8]
push eax
push 0x5386d6
push esi
call fcn.004a86ec
add esp, 0xc
test eax, eax
jne 0x423558
push edi
push ebx
call fcn.004838b8
add esp, 8
jmp 0x42355f
push edi
call fcn.00423478
pop ecx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x423564
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov ebx, eax
test esi, esi
jl 0x4235b6
mov eax, dword [ebx + 0xc]
mov eax, dword [eax]
mov dx, word [eax + 0x12]
cmp dx, word [eax + 0x10]
jae 0x4235a9
movzx ecx, dx
cmp esi, ecx
jle 0x4235a9
mov eax, dword [ebx + 0xc]
mov edx, dword [eax]
mov eax, dword [ebx + 0xc]
movzx ecx, word [edx + 0x10]
mov edx, dword [eax]
movzx eax, word [edx + 0x12]
sub ecx, eax
jmp 0x4235ab
xor ecx, ecx
add esi, ecx
mov edx, dword [ebx + 0xc]
mov esi, dword [edx + esi*4 + 4]
jmp 0x4235cb
push esi
mov eax, dword [ebx + 0xc]
mov edx, dword [eax + 4]
mov ecx, dword [edx + 8]
push ecx
call fcn.004322e8
add esp, 8
mov esi, eax
test byte [esi + 1], 0x20
je 0x4235da
push esi
call fcn.0043f598
pop ecx
jmp 0x4235dc
mov eax, esi
push eax
add dword [ebx], 4
mov edx, dword [ebx]
cmp edx, dword [ebx + 4]
jne 0x4235ec
call fcn.00432adc
mov ecx, dword [ebx]
mov eax, dword [ecx - 4]
push eax
call fcn.0043ee8c
add esp, 8
pop esi
pop ebx
pop ebp
ret
Function at 0x423600
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov ebx, eax
add dword [ebx], 4
mov eax, dword [ebx]
cmp eax, dword [ebx + 4]
jne 0x423624
call fcn.00432adc
mov edx, dword [ebx]
test esi, esi
mov eax, dword [edx - 4]
jl 0x423692
mov edx, dword [ebx + 0xc]
mov edx, dword [edx]
mov cx, word [edx + 0x12]
cmp cx, word [edx + 0x10]
jae 0x423668
mov edx, dword [ebx + 0xc]
mov ecx, dword [edx]
movzx edx, word [ecx + 0x12]
cmp esi, edx
jle 0x423668
mov ecx, dword [ebx + 0xc]
mov edx, dword [ecx]
movzx ecx, word [edx + 0x10]
mov edx, dword [ebx + 0xc]
mov edx, dword [edx]
movzx edx, word [edx + 0x12]
sub ecx, edx
add esi, ecx
mov ecx, dword [ebx + 0xc]
mov edx, dword [ecx + esi*4 + 4]
jmp 0x42366f
mov ecx, dword [ebx + 0xc]
mov edx, dword [ecx + esi*4 + 4]
mov ecx, dword [edx]
test ch, 0x20
je 0x42368a
test ecx, 0x10000
jne 0x42368a
push edx
push eax
call fcn.0043ee8c
add esp, 8
jmp 0x4236bb
lea edx, [ebx + 8]
mov dword [eax + 8], edx
jmp 0x42369e
mov ecx, dword [ebx + 0xc]
mov edx, dword [ecx + 4]
mov ecx, dword [edx + 8]
mov dword [eax + 8], ecx
mov dword [eax], 0x2000
mov dword [eax + 0x10], esi
mov edx, dword [ebx + 0xc]
sub edx, dword [ebx + 8]
test edx, edx
jns 0x4236b4
add edx, 3
sar edx, 2
inc edx
mov dword [eax + 0xc], edx
pop esi
pop ebx
pop ebp
ret

Function at 0x4236c0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov ebx, eax
mov eax, dword [ebx + 0x8c]
mov edx, dword [eax + 8]
movzx eax, word [ebp + 8]
mov esi, dword [edx]
mov edx, eax
shl edx, 3
lea edx, [edx + edx*2]
add esi, edx
add esi, 0xffffffe8
test byte [esi + 1], 0x20
je 0x4236fd
push esi
call fcn.0043f598
pop ecx
jmp 0x4236ff
mov eax, esi
push eax
add dword [ebx], 4
mov edx, dword [ebx]
cmp edx, dword [ebx + 4]
jne 0x42370f
call fcn.00432adc
mov ecx, dword [ebx]
mov eax, dword [ecx - 4]
push eax
call fcn.0043ee8c
add esp, 8
pop esi
pop ebx
pop ebp
ret
Function at 0x423724
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov ebx, eax
add dword [ebx], 4
mov eax, dword [ebx]
cmp eax, dword [ebx + 4]
jne 0x423749
call fcn.00432adc
mov edx, dword [ebx]
movzx ecx, si
mov eax, dword [edx - 4]
mov edx, dword [ebx + 0x8c]
lea ebx, [ecx + ecx*2]
mov edi, dword [edx + 8]
mov edi, dword [edi]
test byte [edi + ebx*8 - 0x17], 0x20
je 0x423794
movzx ebx, si
lea ebx, [ebx + ebx*2]
mov edi, dword [edx + 8]
mov edi, dword [edi]
test byte [edi + ebx*8 - 0x16], 1
jne 0x423794
shl ecx, 3
mov edx, dword [edx + 8]
mov edx, dword [edx]
lea ecx, [ecx + ecx*2]
add edx, ecx
add edx, 0xffffffe8
push edx
push eax
call fcn.0043ee8c
add esp, 8
jmp 0x4237b3
mov dword [eax], 0x2000
dec ecx
mov dword [eax + 0x10], ecx
xor ecx, ecx
mov dword [eax + 0xc], ecx
mov ecx, dword [edx + 8]
mov dword [eax + 8], ecx
mov eax, dword [edx + 8]
push eax
call fcn.0043b7d0
pop ecx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4237b8
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov esi, eax
add dword [esi], 4
mov eax, dword [esi]
cmp eax, dword [esi + 4]
jne 0x4237dd
call fcn.00432adc
mov edx, dword [esi]
mov ecx, dword [edx - 4]
mov esi, ecx
push ebx
push esi
call fcn.00483828
add esp, 8
test eax, eax
je 0x423850
push ebx
push esi
call fcn.00443aa8
add esp, 8
test eax, eax
je 0x423850
push 1
push 0
mov eax, dword [ebx]
push eax
push 0
push 0x3eb
push 0xe
push 0
push 2
call fcn.00456c34
add esp, 0x20
mov edi, eax
jmp 0x42383c
push ebx
push esi
call fcn.00483828
add esp, 8
test eax, eax
je 0x423849
push ebx
push esi
call fcn.00443aa8
add esp, 8
test eax, eax
je 0x423849
push edi
call fcn.004566f4
pop ecx
cmp ax, 1
je 0x423820
push edi
call fcn.00456970
pop ecx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x423858
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov ebx, eax
mov eax, dword [ebx]
mov esi, dword [eax - 4]
push esi
add dword [ebx], 4
mov eax, dword [ebx]
cmp eax, dword [ebx + 4]
jne 0x42387c
call fcn.00432adc
mov edx, dword [ebx]
mov ecx, dword [edx - 4]
push ecx
call fcn.0043ee8c
add esp, 8
pop esi
pop ebx
ret

Function at 0x423890
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov ebx, eax
mov eax, dword [ebx]
mov esi, dword [eax - 4]
push esi
add dword [ebx], 4
mov eax, dword [ebx]
cmp eax, dword [ebx + 4]
jne 0x4238b4
call fcn.00432adc
mov edx, dword [ebx]
mov ecx, dword [edx - 4]
push ecx
call fcn.0043ee8c
add esp, 8
test byte [esi + 1], 0x20
je 0x4238d9
push esi
call fcn.0043f598
pop ecx
push eax
push esi
call fcn.0043ee8c
add esp, 8
pop esi
pop ebx
ret
Function at 0x4238dc
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov ebx, eax
mov eax, dword [ebx]
mov esi, dword [eax - 4]
test byte [esi + 1], 0x20
je 0x4238ff
push esi
call fcn.0043f598
pop ecx
jmp 0x423901
mov eax, esi
push eax
add dword [ebx], 4
mov edx, dword [ebx]
cmp edx, dword [ebx + 4]
jne 0x423911
call fcn.00432adc
mov ecx, dword [ebx]
mov eax, dword [ecx - 4]
push eax
call fcn.0043ee8c
add esp, 8
pop esi
pop ebx
ret

Function at 0x423924
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov esi, eax
or ebx, 0xffffffff
mov eax, dword [esi]
mov edx, dword [eax + ebx*4 - 4]
push edx
mov ecx, dword [esi]
mov eax, dword [ecx + ebx*4]
push eax
call fcn.0043f20c
add esp, 8
dec ebx
mov edx, dword [ebp + 8]
add dword [ebp + 8], 0xffffffff
test edx, edx
jne 0x423939
pop esi
pop ebx
pop ebp
ret

Function at 0x423960
Capabilities:
Get thread local storage value

Disassembly:
push ebx
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov ebx, eax
mov eax, dword [ebx]
mov eax, dword [eax - 4]
test byte [eax], 0x80
je 0x423982
mov eax, dword [eax + 8]
sub dword [ebx], 4
pop ebx
ret
mov edx, dword [ebx]
mov ecx, dword [edx - 4]
push ecx
push 1
push 0x32
call fcn.0046bdb8
pop ecx
push eax
push 0
push 0x42a
push 1
call fcn.00456f18
add esp, 0x18
xor eax, eax
pop ebx
ret

Function at 0x4239a8
Capabilities:
Get thread local storage value

Disassembly:
push ebx
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov ebx, eax
push 0
mov eax, dword [ebx]
mov edx, dword [eax - 4]
push edx
call fcn.00421e08
add esp, 8
sub dword [ebx], 4
pop ebx
ret

Function at 0x4239cc
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov ebx, eax
call fcn.00482d40
mov esi, eax
push edi
mov eax, dword [ebx]
mov edx, dword [eax - 4]
push edx
call fcn.00421e08
add esp, 8
test eax, eax
jne 0x423a0b
push edi
mov ecx, dword [ebx]
mov eax, dword [ecx - 8]
push eax
call fcn.00483938
add esp, 8
push esi
call fcn.00482d4c
pop ecx
sub dword [ebx], 4
sub dword [ebx], 4
mov edx, dword [ebx]
mov eax, dword [edx]
test dword [eax], 0xb405
je 0x423a2b
push eax
call fcn.0043edc0
pop ecx
pop edi
pop esi
pop ebx
pop ebp
ret