joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e45c0
Capabilities:
Execute anti-debugging instructions
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x218
push esi
push edi
push dword [0x884c50]
mov dword [esp + 0xc], ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
mov esi, dword [edi + 4]
cmp esi, dword [edi + 0xc]
jae 0x4e4601
mov dword [esi], str.TtrcShpCollect
rdtsc
mov dword [esp + 0xc], eax
mov ecx, dword [esp + 0xc]
lea eax, [esi + 0xc]
mov dword [esi + 4], ecx
mov dword [edi + 4], eax
mov esi, dword [esp + 8]
add esi, 0x14
mov ecx, esi
mov eax, dword [esi]
mov eax, dword [eax + 8]
call eax
mov edi, eax
cmp edi, 0xffffffff
je 0x4e4660
mov eax, dword [esi]
lea ecx, [esp + 0x20]
push ecx
push edi
mov ecx, esi
mov eax, dword [eax + 0x14]
call eax
mov ecx, dword [ebp + 0xc]
push dword [ebp + 0x10]
mov dword [esp + 0x20], ecx
mov dword [esp + 0x14], eax
mov ecx, dword [ecx + 8]
mov dword [esp + 0x1c], ecx
lea ecx, [esp + 0x14]
mov dword [esp + 0x18], edi
mov edx, dword [eax]
push ecx
push dword [ebp + 8]
mov ecx, eax
call dword [edx + 0x24]
mov eax, dword [esi]
mov ecx, esi
push edi
mov eax, dword [eax + 0xc]
call eax
mov edi, eax
cmp edi, 0xffffffff
jne 0x4e4618
push dword [0x884c50]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
mov esi, dword [edi + 4]
cmp esi, dword [edi + 0xc]
jae 0x4e468f
mov dword [esi], 0x77f5ec
rdtsc
mov dword [esp + 8], eax
mov ecx, dword [esp + 8]
lea eax, [esi + 0xc]
mov dword [esi + 4], ecx
mov dword [edi + 4], eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4e4b40
Capabilities:
Execute anti-debugging instructions
Get thread local storage value

Disassembly:
push ecx
push esi
push edi
push dword [0x884c50]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
mov esi, dword [edi + 4]
cmp esi, dword [edi + 0xc]
jae 0x4e4b72
mov dword [esi], str.TtrcMultiSpher
rdtsc
mov dword [esp + 8], eax
mov ecx, dword [esp + 8]
lea eax, [esi + 0xc]
mov dword [esi + 4], ecx
mov dword [edi + 4], eax
mov edi, dword [esp + 0x18]
xor esi, esi
xor eax, eax
test edi, edi
jle 0x4e4c7d
mov ecx, dword [esp + 0x20]
xorps xmm5, xmm5
mov edx, dword [esp + 0x14]
sub dword [esp + 0x1c], ecx
movss xmm6, dword [0x719730]
movss xmm7, dword [0x719760]
mov edi, dword [esp + 0x10]
movups xmm1, xmmword [edi]
movups xmm3, xmmword [edi + 0x10]
mov edi, dword [esp + 0x18]
subps xmm1, xmmword [edx]
subps xmm3, xmmword [edx]
movaps xmm4, xmm1
mulps xmm4, xmm1
subps xmm3, xmm1
movaps xmm0, xmm4
movaps xmm2, xmm3
shufps xmm0, xmm4, 0x55
mulps xmm2, xmm1
addss xmm0, xmm4
shufps xmm4, xmm4, 0xaa
addss xmm4, xmm0
movaps xmm0, xmm2
shufps xmm0, xmm2, 0x55
addss xmm0, xmm2
shufps xmm2, xmm2, 0xaa
addss xmm2, xmm0
shufps xmm2, xmm2, 0
mulss xmm2, dword [0x719724]
comiss xmm2, xmm5
jae 0x4e4c71
mulps xmm3, xmm3
movaps xmm1, xmm2
mulss xmm1, xmm2
movaps xmm0, xmm3
shufps xmm0, xmm3, 0x55
addss xmm0, xmm3
shufps xmm3, xmm3, 0xaa
addss xmm3, xmm0
movss xmm0, dword [edx + 0xc]
mulss xmm0, xmm0
subss xmm4, xmm0
movaps xmm0, xmm3
mulss xmm0, dword [0x77fa40]
mulss xmm4, xmm0
subss xmm1, xmm4
comiss xmm5, xmm1
jae 0x4e4c71
xorps xmm0, xmm0
xorps xmm2, xmm6
sqrtss xmm0, xmm1
subss xmm2, xmm0
mulss xmm2, xmm7
comiss xmm2, xmm3
jae 0x4e4c71
comiss xmm5, xmm2
ja 0x4e4c71
mov edi, dword [esp + 0x1c]
inc esi
divss xmm2, xmm3
movss dword [edi + ecx], xmm2
mov edi, dword [esp + 0x18]
mov dword [ecx], eax
add ecx, 4
inc eax
add edx, 0x10
cmp eax, edi
jl 0x4e4ba1
push dword [0x884c50]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [esp + 8], eax
mov edi, dword [eax + 4]
cmp edi, dword [eax + 0xc]
jae 0x4e4cb2
mov dword [edi], 0x77f5ec
rdtsc
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 8]
mov dword [edi + 4], ecx
lea ecx, [edi + 0xc]
mov dword [eax + 4], ecx
pop edi
mov eax, esi
pop esi
pop ecx
ret
Function at 0x4e5410
Capabilities:
Execute anti-debugging instructions
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x48
push esi
push edi
push dword [0x884c50]
mov dword [esp + 0xc], ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
mov esi, dword [edi + 4]
cmp esi, dword [edi + 0xc]
jae 0x4e544e
mov dword [esi], str.TtrcTransform
rdtsc
mov dword [esp + 0xc], eax
mov ecx, dword [esp + 0xc]
lea eax, [esi + 0xc]
mov dword [esi + 4], ecx
mov dword [edi + 4], eax
mov edx, dword [esp + 8]
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
movaps xmm5, xmmword [edx + 0x30]
movups xmm0, xmmword [eax]
push esi
movaps xmm4, xmmword [edx + 0x50]
movaps xmm1, xmm5
unpcklps xmm1, xmmword [edx + 0x40]
movaps xmm6, xmmword [eax]
movaps xmm2, xmm1
subps xmm6, xmmword [edx + 0x60]
unpckhps xmm5, xmmword [edx + 0x40]
movups xmmword [esp + 0x24], xmm0
movups xmm0, xmmword [eax + 0x10]
movlhps xmm2, xmm4
movups xmmword [esp + 0x34], xmm0
movups xmm0, xmmword [eax + 0x20]
movaps xmm3, xmm2
shufps xmm5, xmm4, 0xe4
movups xmmword [esp + 0x44], xmm0
movhlps xmm3, xmm1
movaps xmm0, xmm6
shufps xmm0, xmm6, 0x55
shufps xmm3, xmm4, 0xd4
movaps xmm4, xmmword [edx + 0x50]
mulps xmm3, xmm0
movaps xmm0, xmm6
shufps xmm0, xmm6, 0
mulps xmm0, xmm2
shufps xmm6, xmm6, 0xaa
mulps xmm6, xmm5
movaps xmm5, xmmword [edx + 0x30]
addps xmm3, xmm0
movaps xmm1, xmm5
unpckhps xmm5, xmmword [edx + 0x40]
unpcklps xmm1, xmmword [edx + 0x40]
movaps xmm2, xmm1
shufps xmm5, xmm4, 0xe4
movlhps xmm2, xmm4
addps xmm3, xmm6
movaps xmm6, xmmword [eax + 0x10]
subps xmm6, xmmword [edx + 0x60]
inc dword [esi + 0x40]
mov ecx, dword [edx + 0x14]
lea edx, [esp + 0x24]
push edx
movaps xmmword [esp + 0x28], xmm3
movaps xmm3, xmm2
movhlps xmm3, xmm1
movaps xmm0, xmm6
shufps xmm0, xmm6, 0x55
shufps xmm3, xmm4, 0xd4
mulps xmm3, xmm0
movaps xmm0, xmm6
push edi
shufps xmm0, xmm6, 0
mulps xmm0, xmm2
shufps xmm6, xmm6, 0xaa
mulps xmm6, xmm5
addps xmm3, xmm0
addps xmm3, xmm6
movaps xmmword [esp + 0x3c], xmm3
mov eax, dword [ecx]
call dword [eax + 0x20]
dec dword [esi + 0x40]
cmp byte [edi], 0
je 0x4e555f
movups xmm0, xmmword [esi]
lea eax, [esp + 0x10]
mov ecx, esi
push eax
mov eax, dword [esp + 0xc]
add eax, 0x30
push eax
movups xmmword [esp + 0x18], xmm0
call fcn.0046e9b0
mov eax, dword [esi + 0x40]
mov dword [esi + eax*4 + 0x20], 0
push dword [0x884c50]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
mov esi, dword [edi + 4]
cmp esi, dword [edi + 0xc]
jae 0x4e558e
mov dword [esi], 0x77f5ec
rdtsc
mov dword [esp + 0xc], eax
mov ecx, dword [esp + 0xc]
mov dword [esi + 4], ecx
lea ecx, [esi + 0xc]
mov dword [edi + 4], ecx
mov eax, dword [ebp + 8]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4e55a0
Capabilities:
Execute anti-debugging instructions
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x88
push esi
push edi
push dword [0x884c50]
mov dword [esp + 0xc], ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
mov esi, dword [edi + 4]
cmp esi, dword [edi + 0xc]
jae 0x4e55e1
mov dword [esi], str.TtrcTransform
rdtsc
mov dword [esp + 0xc], eax
mov ecx, dword [esp + 0xc]
lea eax, [esi + 0xc]
mov dword [esi + 4], ecx
mov dword [edi + 4], eax
mov eax, dword [ebp + 8]
mov edi, dword [esp + 8]
movaps xmm5, xmmword [edi + 0x30]
lea ecx, [edi + 0x30]
movaps xmm4, xmmword [ecx + 0x20]
movaps xmm1, xmm5
movups xmm0, xmmword [eax]
mov esi, dword [ebp + 0xc]
unpcklps xmm1, xmmword [ecx + 0x10]
movaps xmm6, xmmword [eax]
movaps xmm2, xmm1
subps xmm6, xmmword [ecx + 0x30]
unpckhps xmm5, xmmword [ecx + 0x10]
movups xmmword [esp + 0x20], xmm0
push ecx
movups xmm0, xmmword [eax + 0x10]
movlhps xmm2, xmm4
movups xmmword [esp + 0x34], xmm0
movups xmm0, xmmword [eax + 0x20]
movaps xmm3, xmm2
shufps xmm5, xmm4, 0xe4
movhlps xmm3, xmm1
movups xmmword [esp + 0x44], xmm0
shufps xmm3, xmm4, 0xd4
movaps xmm0, xmm6
shufps xmm0, xmm6, 0x55
mulps xmm3, xmm0
movaps xmm0, xmm6
movaps xmm4, xmmword [ecx + 0x20]
shufps xmm0, xmm6, 0
mulps xmm0, xmm2
shufps xmm6, xmm6, 0xaa
mulps xmm6, xmm5
movaps xmm5, xmmword [ecx]
addps xmm3, xmm0
movaps xmm1, xmm5
unpckhps xmm5, xmmword [ecx + 0x10]
unpcklps xmm1, xmmword [ecx + 0x10]
movaps xmm2, xmm1
shufps xmm5, xmm4, 0xe4
push dword [esi + 8]
addps xmm3, xmm6
movlhps xmm2, xmm4
movaps xmm6, xmmword [eax + 0x10]
subps xmm6, xmmword [ecx + 0x30]
lea ecx, [esp + 0x58]
movaps xmmword [esp + 0x28], xmm3
movaps xmm3, xmm2
movhlps xmm3, xmm1
movaps xmm0, xmm6
shufps xmm3, xmm4, 0xd4
shufps xmm0, xmm6, 0x55
mulps xmm3, xmm0
movaps xmm0, xmm6
shufps xmm0, xmm6, 0
mulps xmm0, xmm2
shufps xmm6, xmm6, 0xaa
mulps xmm6, xmm5
addps xmm3, xmm0
addps xmm3, xmm6
movaps xmmword [esp + 0x38], xmm3
call fcn.0046ef00
mov ecx, dword [edi + 0x14]
lea eax, [esp + 0x50]
push dword [ebp + 0x10]
lea edx, [esp + 0x14]
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], eax
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], 0
mov eax, dword [ecx]
push edx
lea edx, [esp + 0x28]
push edx
call dword [eax + 0x24]
push dword [0x884c50]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
mov esi, dword [edi + 4]
cmp esi, dword [edi + 0xc]
jae 0x4e5719
mov dword [esi], 0x77f5ec
rdtsc
mov dword [esp + 8], eax
mov ecx, dword [esp + 8]
lea eax, [esi + 0xc]
mov dword [esi + 4], ecx
mov dword [edi + 4], eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4e70e0
Capabilities:
Get thread local storage value

Disassembly:
sub ecx, 0x10
jmp method.hkpCompressedMeshShape.virtual_0
push esi
mov esi, ecx
call fcn.004e6e40
mov eax, dword [esp + 8]
test al, 1
je 0x4e7135
test al, 4
jne 0x4e7127
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0xf0
cmp ax, cx
je 0x4e710a
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0xf0
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4
Function at 0x4e83f0
Capabilities:
Get thread local storage value

Disassembly:
push esi
mov esi, ecx
call fcn.004e73c0
mov eax, dword [esp + 8]
test al, 1
je 0x4e8442
test al, 4
jne 0x4e8437
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0x70
cmp ax, cx
je 0x4e841a
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0x70
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4

Function at 0x4e84a0
Capabilities:
Execute anti-debugging instructions
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x228
push esi
push edi
push dword [0x884c50]
mov dword [esp + 0x10], ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
mov esi, dword [edi + 4]
cmp esi, dword [edi + 0xc]
jae 0x4e84e1
mov dword [esi], str.TthkpShapeCollection::getAabb
rdtsc
mov dword [esp + 8], eax
mov ecx, dword [esp + 8]
lea eax, [esi + 0xc]
mov dword [esi + 4], ecx
mov dword [edi + 4], eax
mov esi, dword [ebp + 0x10]
movaps xmm0, xmmword [0x77fb00]
mov edi, dword [esp + 0xc]
add edi, 0x10
movaps xmmword [esi], xmm0
mov ecx, edi
movaps xmm0, xmmword [0x77fb10]
movaps xmmword [esi + 0x10], xmm0
mov eax, dword [edi]
mov eax, dword [eax + 8]
call eax
mov ecx, eax
mov dword [esp + 8], ecx
cmp ecx, 0xffffffff
je 0x4e856d
mov eax, dword [edi]
lea edx, [esp + 0x30]
push edx
push ecx
mov ecx, edi
mov eax, dword [eax + 0x14]
call eax
movss xmm0, dword [ebp + 0xc]
lea ecx, [esp + 0x10]
push ecx
push ecx
mov edx, dword [eax]
mov ecx, eax
movss dword [esp], xmm0
push dword [ebp + 8]
call dword [edx + 0x1c]
movaps xmm0, xmmword [esi]
mov ecx, edi
minps xmm0, xmmword [esp + 0x10]
push dword [esp + 8]
movaps xmmword [esi], xmm0
movaps xmm0, xmmword [esi + 0x10]
maxps xmm0, xmmword [esp + 0x24]
movaps xmmword [esi + 0x10], xmm0
mov eax, dword [edi]
mov eax, dword [eax + 0xc]
call eax
mov ecx, eax
mov dword [esp + 8], eax
cmp ecx, 0xffffffff
jne 0x4e8514
push dword [0x884c50]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
mov esi, dword [edi + 4]
cmp esi, dword [edi + 0xc]
jae 0x4e859c
mov dword [esi], 0x77f5ec
rdtsc
mov dword [esp + 0xc], eax
mov ecx, dword [esp + 0xc]
lea eax, [esi + 0xc]
mov dword [esi + 4], ecx
mov dword [edi + 4], eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4e85b0
Capabilities:
Execute anti-debugging instructions
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x218
push esi
push edi
push dword [0x884c50]
mov dword [esp + 0x1c], ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
mov esi, dword [edi + 4]
cmp esi, dword [edi + 0xc]
jae 0x4e85f1
mov dword [esi], str.TtrcShpCollect
rdtsc
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x14]
lea eax, [esi + 0xc]
mov dword [esi + 4], ecx
mov dword [edi + 4], eax
mov edi, dword [ebp + 0x10]
or esi, 0xffffffff
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x14], esi
inc dword [edi + 0x40]
cmp dword [eax + 0x24], 0
jne 0x4e8676
mov ecx, dword [esp + 0x18]
add ecx, 0x10
mov eax, dword [ecx]
mov eax, dword [eax + 8]
call eax
mov edx, eax
mov dword [esp + 0x14], edx
cmp edx, 0xffffffff
je 0x4e86fb
mov ecx, dword [esp + 0x18]
lea edi, [esp + 0x20]
add ecx, 0x10
push edi
push edx
mov eax, dword [ecx]
mov eax, dword [eax + 0x14]
call eax
mov edi, dword [ebp + 0x10]
lea ecx, [esp + 0x13]
push edi
push dword [ebp + 0xc]
mov edx, dword [eax]
push ecx
mov ecx, eax
call dword [edx + 0x20]
cmp byte [esp + 0x13], 0
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
cmovne esi, edx
add ecx, 0x10
push edx
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
mov edx, eax
mov dword [esp + 0x14], eax
cmp edx, 0xffffffff
jne 0x4e8624
jmp 0x4e86fb
mov edi, dword [esp + 0x18]
add edi, 0x10
mov ecx, edi
mov eax, dword [edi]
mov eax, dword [eax + 8]
call eax
mov esi, eax
cmp esi, 0xffffffff
je 0x4e86f5
nop dword [eax]
mov edx, dword [ebp + 0xc]
push esi
push edi
push dword [esp + 0x20]
mov ecx, dword [edx + 0x24]
push edx
lea edx, [esp + 0x2f]
push edx
mov eax, dword [ecx]
mov eax, dword [eax]
call eax
cmp byte [eax], 0
je 0x4e86de
mov eax, dword [edi]
lea ecx, [esp + 0x20]
push ecx
push esi
mov ecx, edi
mov eax, dword [eax + 0x14]
call eax
push dword [ebp + 0x10]
lea ecx, [esp + 0x17]
push dword [ebp + 0xc]
mov edx, dword [eax]
push ecx
mov ecx, eax
call dword [edx + 0x20]
mov eax, dword [esp + 0x14]
cmp byte [esp + 0x13], 0
cmovne eax, esi
mov dword [esp + 0x14], eax
mov eax, dword [edi]
mov ecx, edi
push esi
mov eax, dword [eax + 0xc]
call eax
mov esi, eax
cmp esi, 0xffffffff
jne 0x4e8690
mov esi, dword [esp + 0x14]
jmp 0x4e86f8
or esi, 0xffffffff
mov edi, dword [ebp + 0x10]
dec dword [edi + 0x40]
mov eax, dword [edi + 0x40]
cmp esi, 0xffffffff
je 0x4e870a
mov dword [edi + eax*4 + 0x20], esi
push dword [0x884c50]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [esp + 0x18], eax
mov edi, dword [eax + 4]
cmp edi, dword [eax + 0xc]
jae 0x4e873f
mov dword [edi], 0x77f5ec
rdtsc
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x14]
lea eax, [edi + 0xc]
mov dword [edi + 4], ecx
mov ecx, dword [esp + 0x18]
mov dword [ecx + 4], eax
mov eax, dword [ebp + 8]
cmp esi, 0xffffffff
pop edi
setne cl
pop esi
mov byte [eax], cl
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4e8760
Capabilities:
Execute anti-debugging instructions
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x228
push esi
push edi
push dword [0x884c50]
mov edi, ecx
mov dword [esp + 0x1c], edi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [esp + 0x2c], eax
mov esi, dword [eax + 4]
cmp esi, dword [eax + 0xc]
jae 0x4e87a9
mov dword [esi], str.TtrcShpCollect
rdtsc
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x10]
lea eax, [esi + 0xc]
mov dword [esi + 4], ecx
mov ecx, dword [esp + 0x2c]
mov dword [ecx + 4], eax
mov esi, dword [ebp + 8]
add edi, 0x10
mov ecx, edi
cmp dword [esi + 0x24], 0
mov eax, dword [edi]
mov eax, dword [eax + 8]
jne 0x4e8823
call eax
mov ecx, eax
mov dword [esp + 0x10], ecx
cmp ecx, 0xffffffff
je 0x4e8895
nop dword [eax]
mov eax, dword [edi]
lea edx, [esp + 0x30]
push edx
push ecx
mov ecx, edi
mov eax, dword [eax + 0x14]
call eax
mov ecx, dword [ebp + 0xc]
push dword [ebp + 0x10]
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x20], eax
mov ecx, dword [ecx + 8]
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x24], ecx
lea ecx, [esp + 0x20]
mov edx, dword [eax]
push ecx
push esi
mov ecx, eax
call dword [edx + 0x24]
mov eax, dword [edi]
mov ecx, edi
push dword [esp + 0x10]
mov eax, dword [eax + 0xc]
call eax
mov ecx, eax
mov dword [esp + 0x10], eax
cmp ecx, 0xffffffff
jne 0x4e87d0
jmp 0x4e8895
call eax
mov esi, eax
cmp esi, 0xffffffff
je 0x4e8895
nop dword [eax]
mov edx, dword [ebp + 8]
push esi
push edi
push dword [esp + 0x20]
mov ecx, dword [edx + 0x24]
push edx
lea edx, [esp + 0x27]
push edx
mov eax, dword [ecx]
mov eax, dword [eax]
call eax
cmp byte [eax], 0
je 0x4e8884
mov eax, dword [edi]
lea ecx, [esp + 0x30]
push ecx
push esi
mov ecx, edi
mov eax, dword [eax + 0x14]
call eax
mov ecx, dword [ebp + 0xc]
push dword [ebp + 0x10]
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x20], eax
mov ecx, dword [ecx + 8]
mov dword [esp + 0x28], ecx
lea ecx, [esp + 0x20]
mov dword [esp + 0x24], esi
mov edx, dword [eax]
push ecx
push dword [ebp + 8]
mov ecx, eax
call dword [edx + 0x24]
mov eax, dword [edi]
mov ecx, edi
push esi
mov eax, dword [eax + 0xc]
call eax
mov esi, eax
cmp esi, 0xffffffff
jne 0x4e8830
push dword [0x884c50]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
mov esi, dword [edi + 4]
cmp esi, dword [edi + 0xc]
jae 0x4e88c4
mov dword [esi], 0x77f5ec
rdtsc
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 0x18]
lea eax, [esi + 0xc]
mov dword [esi + 4], ecx
mov dword [edi + 4], eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4e88d0
Capabilities:
Execute anti-debugging instructions
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x208
push esi
push edi
push dword [0x884c50]
mov dword [esp + 0x10], ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
mov esi, dword [edi + 4]
cmp esi, dword [edi + 0xc]
jae 0x4e8911
mov dword [esi], str.TthkpShapeCollection::getMaximumProjection
rdtsc
mov dword [esp + 8], eax
mov ecx, dword [esp + 8]
lea eax, [esi + 0xc]
mov dword [esi + 4], ecx
mov dword [edi + 4], eax
mov edi, dword [esp + 0xc]
movss xmm0, dword [0x77fafc]
add edi, 0x10
mov ecx, edi
movss dword [esp + 8], xmm0
mov eax, dword [edi]
mov eax, dword [eax + 8]
call eax
mov esi, eax
cmp esi, 0xffffffff
je 0x4e8980
mov eax, dword [edi]
lea ecx, [esp + 0x10]
push ecx
push esi
mov ecx, edi
mov eax, dword [eax + 0x14]
call eax
push dword [ebp + 8]
mov ecx, eax
mov edx, dword [eax]
mov eax, dword [edx + 0xc]
call eax
movss xmm0, dword [esp + 8]
fstp dword [esp + 0xc]
movss xmm1, dword [esp + 0xc]
comiss xmm0, xmm1
ja 0x4e896f
movaps xmm0, xmm1
movss dword [esp + 8], xmm0
mov eax, dword [edi]
mov ecx, edi
push esi
mov eax, dword [eax + 0xc]
call eax
mov esi, eax
cmp esi, 0xffffffff
jne 0x4e8936
push dword [0x884c50]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
mov esi, dword [edi + 4]
cmp esi, dword [edi + 0xc]
jae 0x4e89af
mov dword [esi], 0x77f5ec
rdtsc
mov dword [esp + 0xc], eax
mov ecx, dword [esp + 0xc]
lea eax, [esi + 0xc]
mov dword [esi + 4], ecx
mov dword [edi + 4], eax
fld dword [esp + 8]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x4eac80
Capabilities:
Get thread local storage value

Disassembly:
sub ecx, 0x10
jmp method.hkpExtendedMeshShape.virtual_0
push esi
mov esi, ecx
call fcn.004e9760
mov eax, dword [esp + 8]
test al, 1
je 0x4eacd5
test al, 4
jne 0x4eacc7
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0xf0
cmp ax, cx
je 0x4eacaa
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0xf0
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4
Function at 0x4ec2b0
Capabilities:
Get thread local storage value

Disassembly:
push esi
mov esi, ecx
call fcn.004ec010
mov eax, dword [esp + 8]
test al, 1
je 0x4ec302
test al, 4
jne 0x4ec2f7
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0x68
cmp ax, cx
je 0x4ec2da
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0x68
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4

Function at 0x4ec310
Capabilities:
Get thread local storage value

Disassembly:
push esi
mov esi, ecx
call fcn.004ec1f0
mov eax, dword [esp + 8]
test al, 1
je 0x4ec362
test al, 4
jne 0x4ec357
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0x2c
cmp ax, cx
je 0x4ec33a
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0x2c
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4

Function at 0x4ec370
Capabilities:
Get thread local storage value

Disassembly:
sub ecx, 0x10
jmp method.hkpStorageExtendedMeshShape.virtual_0
push esi
mov esi, ecx
call fcn.004eaed0
mov eax, dword [esp + 8]
test al, 1
je 0x4ec3c5
test al, 4
jne 0x4ec3b7
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0x110
cmp ax, cx
je 0x4ec39a
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0x110
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4
Function at 0x4f07b0
Capabilities:
Get thread local storage value

Disassembly:
sub ecx, 0x10
jmp method.hkpMeshShape.1.virtual_0
push esi
mov esi, ecx
call fcn.004dc0a0
mov eax, dword [esp + 8]
test al, 1
je 0x4f0802
test al, 4
jne 0x4f07f7
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0x60
cmp ax, cx
je 0x4f07da
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0x60
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4

Function at 0x4f1420
Capabilities:
Get thread local storage value

Disassembly:
push esi
mov esi, ecx
call fcn.004f12c0
mov eax, dword [esp + 8]
test al, 1
je 0x4f1472
test al, 4
jne 0x4f1467
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0x50
cmp ax, cx
je 0x4f144a
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0x50
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4

Function at 0x4f1480
Capabilities:
Get thread local storage value

Disassembly:
sub ecx, 0x10
jmp method.hkpStorageMeshShape.virtual_0
push esi
mov esi, ecx
call fcn.004f0b50
mov eax, dword [esp + 8]
test al, 1
je 0x4f14d2
test al, 4
jne 0x4f14c7
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0x70
cmp ax, cx
je 0x4f14aa
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0x70
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4