Function at 0x49b9c0
Capabilities:
Get thread local storage value
Read file on windows

Disassembly:
mov eax, dword [0x526ad4]
sub esp, 0xc
push ebx
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebp, eax
xor ebx, ebx
cmp ebp, ebx
jne 0x49b9e1
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
mov eax, dword [esp + 0x18]
push esi
push edi
cmp eax, ebx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
push ebx
je 0x49bbf9
mov ecx, dword [ebp + 0xc30]
mov edx, dword [ebp + 0x97e]
push ebx
push ecx
push edx
call fcn.004a2ed0
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x49ba1e
mov dword [esp + 0x14], 1
push ebp
call fcn.0049b850
add esp, 4
test eax, eax
je 0x49bc81
push ebp
call fcn.0049b8f0
add esp, 4
test eax, eax
je 0x49bc81
mov ecx, 9
xor eax, eax
lea edi, [ebp + 0x8f28]
mov dword [ebp + 0xc36], ebx
mov byte [ebp + 0x8e00], 0
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x14]
mov dword [ebp + 0x976], ebx
cmp eax, ebx
mov dword [ebp + 0x97a], ebx
jne 0x49bc81
cmp dword [ebp + 0xc68], ebx
je 0x49bc81
cmp dword [ebp + 0xc70], ebx
je 0x49bc81
mov ecx, dword [ebp + 0x97a]
xor eax, eax
mov ax, word [ebp + 0xc2a]
cdq
cmp ecx, edx
jg 0x49bc81
jl 0x49bab4
mov edx, dword [ebp + 0x976]
cmp edx, eax
jae 0x49bc81
mov ecx, dword [ebp + 0x97e]
lea eax, [esp + 0x18]
push ebx
lea esi, [ebp + 0xc3a]
push eax
push 0x2e
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, 1
jne 0x49bc81
cmp dword [esp + 0x18], 0x2e
jne 0x49bc81
cmp dword [esi], 0x2014b50
jne 0x49bc63
xor ebx, ebx
xor edx, edx
mov bx, word [ebp + 0xc5a]
mov dx, word [ebp + 0xc58]
mov edi, dword [ebp + 0xc78]
xor eax, eax
mov ax, word [ebp + 0xc56]
add ebx, edx
add ebx, eax
mov edx, dword [ebp + 0xc68]
push 2
lea ecx, [ebx + 0x2e]
add edi, ecx
mov eax, edi
mov dword [ebp + 0xc78], edi
push eax
push edx
call dword [sym.imp.KERNEL32.dll_GlobalReAlloc]
test eax, eax
je 0x49bc4f
push eax
mov dword [ebp + 0xc68], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
mov dword [ebp + 0xc6c], eax
je 0x49bc4f
mov eax, dword [ebp + 0x976]
mov ecx, dword [ebp + 0xc70]
push eax
push ecx
call fcn.0049ae30
mov edi, dword [ebp + 0xc6c]
mov ecx, 0xb
add edi, eax
add esp, 8
mov dword [ebp + 0xc6c], edi
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov edx, dword [ebp + 0xc6c]
xor esi, esi
add edx, 0x2e
push esi
mov dword [ebp + 0xc6c], edx
mov eax, edx
lea edx, [esp + 0x1c]
push edx
push ebx
push eax
mov eax, dword [ebp + 0x97e]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x49bc1d
cmp dword [esp + 0x18], ebx
jne 0x49bc1d
mov edx, dword [esp + 0x10]
mov ecx, dword [ebp + 0x976]
inc edx
add ecx, 1
mov dword [ebp + 0x976], ecx
mov eax, dword [ebp + 0x97a]
mov ecx, dword [ebp + 0xc78]
mov dword [esp + 0x10], edx
adc eax, esi
push ecx
mov dword [ebp + 0x97a], eax
mov edx, dword [ebp + 0x976]
mov eax, dword [ebp + 0xc70]
push edx
push eax
call fcn.0049ae60
add esp, 0xc
jmp 0x49bc2d
mov eax, dword [ebp + 0x97e]
push ebx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x49ba74
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
mov dword [esp + 0x10], 0xffffffff
mov dword [esp + 0x14], 1
mov ecx, dword [ebp + 0xc68]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [esp + 0x14]
mov dword [ebp + 0xc6c], esi
cmp eax, esi
jne 0x49bc81
xor ebx, ebx
jmp 0x49ba8c
pop edi
mov dword [esp + 0xc], 0xffffffff
mov eax, dword [esp + 0xc]
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
cmp dword [ebp + 0xc3a], 0x4034b50
jne 0x49bc81
cmp word [ebp + 0xc2a], 0x7fff
jne 0x49bc81
mov word [ebp + 0xc2a], bx
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret