joyce8/EMBER2024-capa huggingface dataset:
Function at 0x416300
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push dword [0x5b3084]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
lea edi, [ebp - 1]
mov esi, edi
mov edx, dword [eax + 0x38]
mov ecx, edx
sub ecx, esi
sub esi, edx
cmp edi, edx
cmovbe esi, ecx
cmp esi, dword [eax + 0x34]
jbe 0x41633b
mov dword [eax + 0x34], esi
mov dword [eax + 0x3c], 0x56d488
mov dword [eax + 0x40], 0x45e
call fcn.00418190
push 0x5b84a8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x416450
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push dword [0x5b3084]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
lea edi, [ebp - 1]
mov esi, edi
mov edx, dword [eax + 0x38]
mov ecx, edx
sub ecx, esi
sub esi, edx
cmp edi, edx
cmovbe esi, ecx
cmp esi, dword [eax + 0x34]
jbe 0x41648b
mov dword [eax + 0x34], esi
mov dword [eax + 0x3c], 0x56d488
mov dword [eax + 0x40], 0x49d
mov esi, dword [ebp + 8]
test esi, esi
jne 0x41649d
pop edi
mov eax, 0x11174
pop esi
mov esp, ebp
pop ebp
ret
call fcn.00418190
push esi
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4164d0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push dword [0x5b3084]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
lea edi, [ebp - 1]
mov esi, edi
mov edx, dword [eax + 0x38]
mov ecx, edx
sub ecx, esi
sub esi, edx
cmp edi, edx
cmovbe esi, ecx
cmp esi, dword [eax + 0x34]
jbe 0x41650b
mov dword [eax + 0x34], esi
mov dword [eax + 0x3c], 0x56d488
mov dword [eax + 0x40], 0x439
mov esi, dword [ebp + 8]
test esi, esi
jne 0x41651d
pop edi
mov eax, 0x11174
pop esi
mov esp, ebp
pop ebp
ret
call fcn.00418190
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call fcn.00418190
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x416540
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push dword [0x5b3084]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
lea edi, [ebp - 1]
mov esi, edi
mov edx, dword [eax + 0x38]
mov ecx, edx
sub ecx, esi
sub esi, edx
cmp edi, edx
cmovbe esi, ecx
cmp esi, dword [eax + 0x34]
jbe 0x41657b
mov dword [eax + 0x34], esi
mov dword [eax + 0x3c], 0x56d488
mov dword [eax + 0x40], 0x47c
mov esi, dword [ebp + 8]
test esi, esi
jne 0x41658d
pop edi
mov eax, 0x11174
pop esi
mov esp, ebp
pop ebp
ret
call fcn.00418190
push esi
call dword [sym.imp.KERNEL32.dll_TryEnterCriticalSection]
mov esi, eax
call fcn.00418190
xor ecx, ecx
mov eax, 0x11171
test esi, esi
pop edi
cmovne eax, ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4165c0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push dword [0x5b3084]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
lea edi, [ebp - 1]
mov esi, edi
mov edx, dword [eax + 0x38]
mov ecx, edx
sub ecx, esi
sub esi, edx
cmp edi, edx
cmovbe esi, ecx
cmp esi, dword [eax + 0x34]
jbe 0x4165fb
mov dword [eax + 0x34], esi
mov dword [eax + 0x3c], 0x56d488
mov dword [eax + 0x40], 0x45e
mov esi, dword [ebp + 8]
test esi, esi
jne 0x41660d
pop edi
mov eax, 0x11174
pop esi
mov esp, ebp
pop ebp
ret
call fcn.00418190
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x416650
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x4167df
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x4167df
push ebx
push edi
push 0xc
push esi
mov dword [eax], 0
call fcn.0041c550
mov edi, eax
add esp, 8
test edi, edi
je 0x4167d3
push 0x38
push esi
call fcn.0041c550
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x4166a5
mov eax, 0x11177
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
push dword [ebp + 0xc]
push ebx
call fcn.004158a0
add esp, 8
test eax, eax
jne 0x41669e
mov dword [edi], ebx
push dword [0x5b3084]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
lea ecx, [ebp - 1]
mov dword [ebp + 8], ecx
lea ebx, [ebp - 1]
mov edx, dword [eax + 0x38]
mov ecx, edx
sub ecx, ebx
sub ebx, edx
cmp dword [ebp + 8], edx
cmovbe ebx, ecx
cmp ebx, dword [eax + 0x34]
jbe 0x4166f1
mov dword [eax + 0x34], ebx
mov dword [eax + 0x3c], 0x56d488
mov dword [eax + 0x40], 0x4df
lea eax, [edi + 4]
test eax, eax
je 0x4167bb
push 0x24
push esi
call fcn.0041c550
add esp, 8
mov ebx, eax
push 0
push 1
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
mov dword [ebx], eax
test eax, eax
jne 0x416764
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
je 0x41674e
call esi
test eax, eax
je 0x4167a6
call esi
mov esi, eax
add esi, 0x1d4c0
je 0x4167a6
push dword [edi]
call fcn.00416450
add esp, 4
mov eax, esi
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
push dword [edi]
or esi, 0xffffffff
call fcn.00416450
add esp, 4
mov eax, esi
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0xc]
mov esi, str.sem_p
test eax, eax
push 0x25
cmovne esi, eax
push esi
call fcn.00503370
add esp, 8
test eax, eax
lea eax, [ebx + 4]
je 0x416792
push ebx
push esi
push 0x20
push eax
call fcn.00403590
add esp, 0x10
jmp 0x41679e
push 0x20
push esi
push eax
call fcn.0041cb60
add esp, 0xc
call fcn.00418190
mov dword [edi + 4], ebx
mov eax, dword [ebp + 0x10]
mov dword [edi + 8], 0
mov dword [eax], edi
xor eax, eax
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
push dword [edi]
mov esi, 0x11174
call fcn.00416450
add esp, 4
mov eax, esi
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
pop edi
pop ebx
mov eax, 0x11174
pop esi
mov esp, ebp
pop ebp
ret
mov eax, 0x11174
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4167f0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
test esi, esi
jne 0x416806
mov eax, 0x11174
pop esi
mov esp, ebp
pop ebp
ret
push ebx
mov ebx, dword [esi]
push edi
push dword [0x5b3084]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
lea ecx, [ebp - 1]
mov dword [ebp + 8], ecx
lea edi, [ebp - 1]
mov edx, dword [eax + 0x38]
mov ecx, edx
sub ecx, edi
sub edi, edx
cmp dword [ebp + 8], edx
cmovbe edi, ecx
cmp edi, dword [eax + 0x34]
jbe 0x416844
mov dword [eax + 0x34], edi
mov dword [eax + 0x3c], 0x56d488
mov dword [eax + 0x40], 0x49d
test ebx, ebx
je 0x416854
call fcn.00418190
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push dword [0x5b3084]
mov edi, dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
lea ebx, [ebp - 2]
mov esi, ebx
mov edx, dword [eax + 0x38]
mov ecx, edx
sub ecx, esi
sub esi, edx
cmp ebx, edx
cmovbe esi, ecx
cmp esi, dword [eax + 0x34]
jbe 0x41688c
mov dword [eax + 0x34], esi
mov dword [eax + 0x3c], 0x56d488
mov dword [eax + 0x40], 0x54b
test edi, edi
je 0x4168b5
call fcn.00418190
push dword [edi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x4168b5
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
je 0x4168b5
call esi
test eax, eax
je 0x4168b5
call esi
pop edi
pop ebx
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4168c0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
test esi, esi
jne 0x4168d6
mov eax, 0x11174
pop esi
mov esp, ebp
pop ebp
ret
push ebx
mov ebx, dword [esi]
push edi
push dword [0x5b3084]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
lea ecx, [ebp - 1]
mov dword [ebp + 8], ecx
lea edi, [ebp - 1]
mov edx, dword [eax + 0x38]
mov ecx, edx
sub ecx, edi
sub edi, edx
cmp dword [ebp + 8], edx
cmovbe edi, ecx
cmp edi, dword [eax + 0x34]
jbe 0x416914
mov dword [eax + 0x34], edi
mov dword [eax + 0x3c], 0x56d488
mov dword [eax + 0x40], 0x439
test ebx, ebx
jne 0x416924
pop edi
pop ebx
mov eax, 0x11174
pop esi
mov esp, ebp
pop ebp
ret
call fcn.00418190
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call fcn.00418190
inc dword [esi + 8]
cmp dword [esi + 8], 1
jne 0x416949
push dword [esi + 4]
call fcn.00416dc0
add esp, 4
push dword [0x5b3084]
mov edi, dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
lea ebx, [ebp - 2]
mov esi, ebx
mov edx, dword [eax + 0x38]
mov ecx, edx
sub ecx, esi
sub esi, edx
cmp ebx, edx
cmovbe esi, ecx
cmp esi, dword [eax + 0x34]
jbe 0x416980
mov dword [eax + 0x34], esi
mov dword [eax + 0x3c], 0x56d488
mov dword [eax + 0x40], 0x45e
test edi, edi
je 0x416918
call fcn.00418190
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop ebx
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4169a0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
test eax, eax
jne 0x4169b4
mov eax, 0x11174
mov esp, ebp
pop ebp
ret
push ebx
push esi
push edi
push dword [0x5b3084]
mov edi, dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
lea ebx, [ebp - 1]
mov esi, ebx
mov edx, dword [eax + 0x38]
mov ecx, edx
sub ecx, esi
sub esi, edx
cmp ebx, edx
cmovbe esi, ecx
cmp esi, dword [eax + 0x34]
jbe 0x4169ef
mov dword [eax + 0x34], esi
mov dword [eax + 0x3c], 0x56d488
mov dword [eax + 0x40], 0x524
test edi, edi
jne 0x4169ff
pop edi
pop esi
mov eax, 0x11174
pop ebx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
push edi
call fcn.00416e20
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x416a20
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
test esi, esi
jne 0x416a36
mov eax, 0x11174
pop esi
mov esp, ebp
pop ebp
ret
push ebx
mov ebx, dword [esi]
push edi
push dword [0x5b3084]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
lea ecx, [ebp - 1]
mov dword [ebp + 8], ecx
lea edi, [ebp - 1]
mov edx, dword [eax + 0x38]
mov ecx, edx
sub ecx, edi
sub edi, edx
cmp dword [ebp + 8], edx
cmovbe edi, ecx
cmp edi, dword [eax + 0x34]
jbe 0x416a74
mov dword [eax + 0x34], edi
mov dword [eax + 0x3c], 0x56d488
mov dword [eax + 0x40], 0x439
test ebx, ebx
jne 0x416a84
pop edi
pop ebx
mov eax, 0x11174
pop esi
mov esp, ebp
pop ebp
ret
call fcn.00418190
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call fcn.00418190
add dword [esi + 8], 0xffffffff
jne 0x416aa6
push dword [esi + 4]
call fcn.00416cc0
add esp, 4
push dword [0x5b3084]
mov edi, dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
lea ebx, [ebp - 2]
mov esi, ebx
mov edx, dword [eax + 0x38]
mov ecx, edx
sub ecx, esi
sub esi, edx
cmp ebx, edx
cmovbe esi, ecx
cmp esi, dword [eax + 0x34]
jbe 0x416add
mov dword [eax + 0x34], esi
mov dword [eax + 0x3c], 0x56d488
mov dword [eax + 0x40], 0x45e
test edi, edi
je 0x416a78
call fcn.00418190
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop ebx
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x416b20
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push dword [0x5b3084]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
lea edi, [ebp - 1]
mov esi, edi
mov edx, dword [eax + 0x38]
mov ecx, edx
sub ecx, esi
sub esi, edx
cmp edi, edx
cmovbe esi, ecx
cmp esi, dword [eax + 0x34]
jbe 0x416b5c
mov dword [eax + 0x34], esi
mov dword [eax + 0x3c], 0x56d488
mov dword [eax + 0x40], 0x4df
mov eax, dword [ebp + 8]
test eax, eax
je 0x416c17
mov ebx, dword [ebp + 0x18]
test ebx, ebx
je 0x416c17
push 0x24
push eax
call fcn.0041c550
add esp, 8
mov edi, eax
push 0
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
mov dword [edi], eax
test eax, eax
jne 0x416bbf
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
je 0x416bb5
call esi
test eax, eax
je 0x416c0e
call esi
pop edi
pop esi
add eax, 0x1d4c0
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0xc]
mov esi, str.sem_p
test eax, eax
push 0x25
cmovne esi, eax
push esi
call fcn.00503370
add esp, 8
test eax, eax
lea eax, [edi + 4]
je 0x416bfb
push edi
push esi
push 0x20
push eax
call fcn.00403590
add esp, 0x10
call fcn.00418190
mov dword [ebx], edi
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x20
push esi
push eax
call fcn.0041cb60
add esp, 0xc
call fcn.00418190
mov dword [ebx], edi
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 0x11174
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x416c30
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push dword [0x5b3084]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
lea edi, [ebp - 1]
mov esi, edi
mov edx, dword [eax + 0x38]
mov ecx, edx
sub ecx, esi
sub esi, edx
cmp edi, edx
cmovbe esi, ecx
cmp esi, dword [eax + 0x34]
jbe 0x416c6b
mov dword [eax + 0x34], esi
mov dword [eax + 0x3c], 0x56d488
mov dword [eax + 0x40], 0x54b
mov esi, dword [ebp + 8]
test esi, esi
jne 0x416c7d
pop edi
mov eax, 0x11174
pop esi
mov esp, ebp
pop ebp
ret
call fcn.00418190
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x416c96
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
je 0x416cb5
call esi
test eax, eax
je 0x416c8e
call esi
pop edi
add eax, 0x1d4c0
pop esi
mov esp, ebp
pop ebp
ret
pop edi
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x416cc0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push dword [0x5b3084]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
lea edi, [ebp - 1]
mov esi, edi
mov edx, dword [eax + 0x38]
mov ecx, edx
sub ecx, esi
sub esi, edx
cmp edi, edx
cmovbe esi, ecx
cmp esi, dword [eax + 0x34]
jbe 0x416cfb
mov dword [eax + 0x34], esi
mov dword [eax + 0x3c], 0x56d488
mov dword [eax + 0x40], 0x53a
mov esi, dword [ebp + 8]
test esi, esi
jne 0x416d0d
pop edi
mov eax, 0x11174
pop esi
mov esp, ebp
pop ebp
ret
call fcn.00418190
push 0
push 1
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
test eax, eax
je 0x416d2a
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
je 0x416d49
call esi
test eax, eax
je 0x416d22
call esi
pop edi
add eax, 0x1d4c0
pop esi
mov esp, ebp
pop ebp
ret
pop edi
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x416dc0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push dword [0x5b3084]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
lea edi, [ebp - 1]
mov esi, edi
mov edx, dword [eax + 0x38]
mov ecx, edx
sub ecx, esi
sub esi, edx
cmp edi, edx
cmovbe esi, ecx
cmp esi, dword [eax + 0x34]
jbe 0x416dfb
mov dword [eax + 0x34], esi
mov dword [eax + 0x3c], 0x56d488
mov dword [eax + 0x40], 0x524
mov eax, dword [ebp + 8]
pop edi
pop esi
test eax, eax
jne 0x416e0d
mov eax, 0x11174
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
push eax
call fcn.00416e20
add esp, 8
mov esp, ebp
pop ebp
ret

Function at 0x416e20
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push dword [0x5b3084]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
lea edi, [ebp - 1]
mov esi, edi
mov edx, dword [eax + 0x38]
mov ecx, edx
sub ecx, esi
sub esi, edx
cmp edi, edx
cmovbe esi, ecx
cmp esi, dword [eax + 0x34]
jbe 0x416e5b
mov dword [eax + 0x34], esi
mov dword [eax + 0x3c], 0x56d488
mov dword [eax + 0x40], 0x503
mov esi, dword [ebp + 8]
test esi, esi
jne 0x416e6d
pop edi
mov eax, 0x11174
pop esi
mov esp, ebp
pop ebp
ret
call fcn.00418190
push dword [ebp + 0xc]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov esi, eax
call fcn.00418190
test esi, esi
jne 0x416e90
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
cmp esi, 0x102
jne 0x416ea3
pop edi
mov eax, 0x11179
pop esi
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
je 0x416ec2
call esi
test eax, eax
je 0x416e88
call esi
pop edi
add eax, 0x1d4c0
pop esi
mov esp, ebp
pop ebp
ret
pop edi
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x416ee0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
sub dword [0x5b83a0], 1
jne 0x417016
call fcn.00418190
cmp eax, 5
jl 0x416f1f
push dword [0x5b83e8]
push dword [0x5b83e4]
push dword [0x5b83dc]
push str.Main_thread_stack_max_usage_u_by__s:_d
push 0x5b83a8
call fcn.004180a0
add esp, 0x14
push ebx
push esi
mov esi, dword [0x5b83a4]
sub esi, 1
push edi
js 0x416f3e
nop dword [eax]
mov eax, dword [esi*4 + 0x5b84e0]
call eax
sub esi, 1
jns 0x416f30
mov eax, dword [0x5c5bd8]
mov dword [0x5b83a4], 0
cmp eax, 0xffffffff
je 0x416f65
push eax
call fcn.0041ea70
add esp, 4
mov dword [0x5c5bd8], 0xffffffff
push dword [0x5b3084]
mov edi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
call edi
lea ebx, [ebp - 1]
mov esi, ebx
mov edx, dword [eax + 0x38]
mov ecx, edx
sub ecx, esi
sub esi, edx
cmp ebx, edx
cmovbe esi, ecx
cmp esi, dword [eax + 0x34]
jbe 0x416f9c
mov dword [eax + 0x34], esi
mov dword [eax + 0x3c], 0x56d488
mov dword [eax + 0x40], 0x49d
call fcn.00418190
push 0x5b84a8
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov esi, dword [0x5b3084]
cmp esi, 0xffffffff
je 0x416ff4
push esi
call edi
lea ebx, [ebp - 2]
mov edi, ebx
mov edx, dword [eax + 0x38]
mov ecx, edx
sub ecx, edi
sub edi, edx
cmp ebx, edx
cmovbe edi, ecx
cmp edi, dword [eax + 0x34]
jbe 0x416fe3
mov dword [eax + 0x34], edi
mov dword [eax + 0x3c], 0x56d488
mov dword [eax + 0x40], 0x3b3
push esi
call dword [sym.imp.KERNEL32.dll_TlsFree]
mov dword [0x5b3084], 0xffffffff
call fcn.004154d0
push pe_nt_image_headers32
push 0
push 0x5b83a8
call fcn.00502bf0
add esp, 0xc
call dword [sym.imp.WS2_32.dll_WSACleanup]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4170c0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push dword [0x5b3084]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
lea edi, [ebp - 1]
mov esi, edi
mov edx, dword [eax + 0x38]
mov ecx, edx
sub ecx, esi
sub esi, edx
cmp edi, edx
cmovbe esi, ecx
cmp esi, dword [eax + 0x34]
jbe 0x4170fb
mov dword [eax + 0x34], esi
mov dword [eax + 0x3c], 0x56d488
mov dword [eax + 0x40], 0x636
mov esi, dword [ebp + 8]
mov eax, esi
and eax, 2
add eax, eax
movzx edx, ax
push ebx
mov eax, edx
mov ebx, esi
or eax, 2
test bl, 4
movzx ecx, ax
mov eax, edx
cmove ecx, eax
movzx edx, cx
mov eax, edx
or eax, 1
test bl, 1
movzx ecx, ax
mov eax, edx
cmove ecx, eax
and bl, 8
movzx edx, cx
mov eax, edx
or eax, 8
test bl, bl
movzx ecx, ax
mov eax, edx
cmove ecx, eax
movzx eax, cx
push eax
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
pop ebx
test eax, eax
je 0x417163
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
je 0x417182
call esi
test eax, eax
je 0x41715b
call esi
pop edi
add eax, 0x1d4c0
pop esi
mov esp, ebp
pop ebp
ret
pop edi
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x417190
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push dword [0x5b3084]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
lea edi, [ebp - 1]
mov eax, edi
mov edx, dword [esi + 0x38]
mov ecx, edx
sub ecx, eax
sub eax, edx
cmp edi, edx
cmovbe eax, ecx
cmp eax, dword [esi + 0x34]
jbe 0x4171cb
mov dword [esi + 0x34], eax
mov eax, dword [ebp + 8]
mov dword [esi + 0x3c], eax
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x40], eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4171e0
Capabilities:
Create thread
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push dword [0x5b3084]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
lea edi, [ebp - 1]
mov esi, edi
mov edx, dword [eax + 0x38]
mov ecx, edx
sub ecx, esi
sub esi, edx
cmp edi, edx
cmovbe esi, ecx
cmp esi, dword [eax + 0x34]
jbe 0x41721b
mov dword [eax + 0x34], esi
mov dword [eax + 0x3c], 0x56d488
mov dword [eax + 0x40], 0x235
mov eax, dword [ebp + 8]
test eax, eax
je 0x417313
cmp dword [ebp + 0x10], 0
je 0x417313
cmp dword [ebp + 0x20], 0
je 0x417313
push ebx
mov ebx, dword [ebp + 0x1c]
push 0x44
push 1
and ebx, 1
push eax
shl ebx, 2
call fcn.0041c720
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x417263
pop ebx
pop edi
mov eax, 0x11177
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0xc]
mov edi, str.thr_p
test eax, eax
push 0x25
cmovne edi, eax
push edi
call fcn.00503370
add esp, 8
test eax, eax
je 0x41728e
push esi
push edi
push 0x20
push esi
call fcn.00403590
add esp, 0x10
jmp 0x41729a
push 0x20
push edi
push esi
call fcn.0041cb60
add esp, 0xc
call fcn.00418190
mov ecx, dword [ebp + 0x18]
or eax, 0xffffffff
test ecx, ecx
mov dword [esi + 0x34], 0
cmovne eax, ecx
mov dword [esi + 0x30], eax
mov eax, dword [ebp + 0x10]
mov dword [esi + 0x28], eax
mov eax, dword [ebp + 0x14]
mov dword [esi + 0x2c], eax
lea eax, [esi + 0x24]
push eax
push ebx
push esi
push 0x417a80
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x20], eax
test eax, eax
jne 0x417305
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
je 0x4172fb
call esi
test eax, eax
je 0x41730a
call esi
pop ebx
pop edi
add eax, 0x1d4c0
pop esi
mov esp, ebp
pop ebp
ret
pop ebx
pop edi
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x20]
mov dword [eax], esi
pop ebx
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
pop edi
mov eax, 0x11174
pop esi
mov esp, ebp
pop ebp
ret