joyce8/EMBER2024-capa huggingface dataset:
Function at 0x434ef4
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push eax
mov edx, dword [0x54d750]
push edx
call sub.KERNEL32.DLL_TlsGetValue
add eax, 0x10
push eax
call fcn.0043da04
add esp, 8
pop ebp
ret

Function at 0x434f18
Capabilities:
Get thread local storage value

Disassembly:
push 0
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
add eax, 0x10
push eax
call fcn.0043da04
add esp, 8
ret

Function at 0x434f34
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push eax
mov edx, dword [0x54d750]
push edx
call sub.KERNEL32.DLL_TlsGetValue
add eax, 0x10
push eax
call fcn.0043dc00
add esp, 8
pop ebp
ret

Function at 0x434f58
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push eax
mov edx, dword [0x54d750]
push edx
call sub.KERNEL32.DLL_TlsGetValue
add eax, 0x10
push eax
call fcn.0043db30
add esp, 8
pop ebp
ret

Function at 0x434f7c
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push eax
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [0x54d750]
push ecx
call sub.KERNEL32.DLL_TlsGetValue
add eax, 0x10
push eax
call fcn.0043daa0
add esp, 0xc
pop ebp
ret

Function at 0x434fa4
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push eax
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [0x54d750]
push ecx
call sub.KERNEL32.DLL_TlsGetValue
add eax, 0x10
push eax
call fcn.0043dc90
add esp, 0xc
pop ebp
ret

Function at 0x434ff4
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push eax
mov edx, dword [0x54d750]
push edx
call sub.KERNEL32.DLL_TlsGetValue
add eax, 0x10
push eax
call fcn.0043e17c
add esp, 8
pop ebp
ret

Function at 0x435018
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
push eax
mov edx, dword [ebp + 0xc]
push edx
mov ecx, dword [ebp + 8]
push ecx
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
add eax, 0x10
push eax
call fcn.0043e1c0
add esp, 0x10
pop ebp
ret

Function at 0x435040
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push eax
mov edx, dword [0x54d750]
push edx
call sub.KERNEL32.DLL_TlsGetValue
add eax, 0x10
push eax
call fcn.0043e210
add esp, 8
pop ebp
ret

Function at 0x435064
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [0x54d750]
push dword [ebp + 0xc]
push dword [ebp + 8]
push edx
call sub.KERNEL32.DLL_TlsGetValue
add eax, 0x10
push eax
call fcn.0043e294
add esp, 0xc
pop ebp
ret

Function at 0x435088
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push eax
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [0x54d750]
push ecx
call sub.KERNEL32.DLL_TlsGetValue
add eax, 0x10
push eax
call fcn.0043e2ec
add esp, 0xc
pop ebp
ret
Function at 0x4350b0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
je 0x4350c0
mov eax, 1
jmp 0x4350c2
xor eax, eax
push eax
mov edx, dword [0x54d750]
push edx
call sub.KERNEL32.DLL_TlsGetValue
add eax, 0x10
push eax
call fcn.0043e32c
add esp, 8
pop ebp
ret

Function at 0x4350e0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [0x54d750]
push dword [ebp + 0xc]
push dword [ebp + 8]
push edx
call sub.KERNEL32.DLL_TlsGetValue
add eax, 0x10
push eax
call fcn.0043e364
add esp, 0xc
pop ebp
ret

Function at 0x435104
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push eax
mov edx, dword [0x54d750]
push edx
call sub.KERNEL32.DLL_TlsGetValue
add eax, 0x10
push eax
call fcn.0043e3f4
add esp, 8
pop ebp
ret

Function at 0x435128
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push eax
mov edx, dword [0x54d750]
push edx
call sub.KERNEL32.DLL_TlsGetValue
add eax, 0x10
push eax
call fcn.0043e44c
add esp, 8
pop ebp
ret

Function at 0x43514c
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push eax
mov edx, dword [0x54d750]
push edx
call sub.KERNEL32.DLL_TlsGetValue
add eax, 0x10
push eax
call fcn.0043e4a4
add esp, 8
pop ebp
ret

Function at 0x435194
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [0x54d750]
push dword [ebp + 0xc]
push dword [ebp + 8]
push edx
call sub.KERNEL32.DLL_TlsGetValue
add eax, 0x10
push eax
call fcn.0043e568
add esp, 0xc
pop ebp
ret

Function at 0x4351b8
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [0x54d750]
mov edx, dword [ebp + 0x10]
push edx
push dword [ebp + 0xc]
push dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_TlsGetValue
add eax, 0x10
push eax
call fcn.0043e684
add esp, 0x14
pop ebp
ret

Function at 0x4351e4
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [0x54d750]
mov edx, dword [ebp + 0x10]
push edx
push dword [ebp + 0xc]
push dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_TlsGetValue
add eax, 0x10
push eax
call fcn.0043e734
add esp, 0x14
pop ebp
ret

Function at 0x435210
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push eax
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [0x54d750]
push ecx
call sub.KERNEL32.DLL_TlsGetValue
add eax, 0x10
push eax
call fcn.0043e8c8
add esp, 0xc
pop ebp
ret

Function at 0x435288
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [0x54d750]
mov eax, dword [ebp + 0x10]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push ecx
call sub.KERNEL32.DLL_TlsGetValue
add eax, 0x10
push eax
call fcn.0043e630
add esp, 0x10
pop ebp
ret
Function at 0x4352b0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push eax
mov edx, dword [0x54d750]
push edx
call sub.KERNEL32.DLL_TlsGetValue
add eax, 0x10
push eax
call fcn.0043eadc
add esp, 8
pop ebp
ret

Function at 0x4352d4
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push eax
mov edx, dword [0x54d750]
push edx
call sub.KERNEL32.DLL_TlsGetValue
add eax, 0x10
push eax
call fcn.0043eb1c
add esp, 8
pop ebp
ret

Function at 0x435374
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
cmp ebx, 0xffffffff
jne 0x4353a4
mov eax, dword [ebp + 8]
push eax
mov edx, dword [0x54d750]
push edx
call sub.KERNEL32.DLL_TlsGetValue
add eax, 0x10
push eax
call fcn.0043da04
add esp, 8
mov eax, 1
pop ebx
pop ebp
ret
test ebx, ebx
jl 0x4353f6
mov edx, dword [0x54d750]
push edx
call sub.KERNEL32.DLL_TlsGetValue
mov ecx, dword [eax + 0xc]
mov eax, dword [ecx]
movzx edx, word [eax + 0x10]
cmp ebx, edx
jg 0x4353f6
mov ecx, dword [0x54d750]
push ecx
call sub.KERNEL32.DLL_TlsGetValue
mov eax, dword [eax + 0xc]
mov ebx, dword [eax + ebx*4 + 4]
test byte [ebx + 1], 0x20
je 0x4353f6
mov edx, dword [ebp + 8]
push edx
push ebx
call fcn.0043f598
pop ecx
push eax
call fcn.0043da04
add esp, 8
mov eax, 1
pop ebx
pop ebp
ret
xor eax, eax
pop ebx
pop ebp
ret

Function at 0x4353fc
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0x10]
cmp ebx, 0xffffffff
jne 0x435430
mov eax, dword [ebp + 0xc]
push eax
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [0x54d750]
push ecx
call sub.KERNEL32.DLL_TlsGetValue
add eax, 0x10
push eax
call fcn.0043daa0
add esp, 0xc
mov eax, 1
pop ebx
pop ebp
ret
test ebx, ebx
jl 0x435486
mov edx, dword [0x54d750]
push edx
call sub.KERNEL32.DLL_TlsGetValue
mov ecx, dword [eax + 0xc]
mov eax, dword [ecx]
movzx edx, word [eax + 0x10]
cmp ebx, edx
jg 0x435486
mov ecx, dword [0x54d750]
push ecx
call sub.KERNEL32.DLL_TlsGetValue
mov eax, dword [eax + 0xc]
mov ebx, dword [eax + ebx*4 + 4]
test byte [ebx + 1], 0x20
je 0x435486
mov edx, dword [ebp + 0xc]
push edx
mov ecx, dword [ebp + 8]
push ecx
push ebx
call fcn.0043f598
pop ecx
push eax
call fcn.0043daa0
add esp, 0xc
mov eax, 1
pop ebx
pop ebp
ret
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x4355a4
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
cmp ebx, 0xffffffff
jne 0x4355d4
mov eax, dword [ebp + 8]
push eax
mov edx, dword [0x54d750]
push edx
call sub.KERNEL32.DLL_TlsGetValue
add eax, 0x10
push eax
call fcn.0043e210
add esp, 8
mov eax, 1
pop ebx
pop ebp
ret
test ebx, ebx
jl 0x435626
mov edx, dword [0x54d750]
push edx
call sub.KERNEL32.DLL_TlsGetValue
mov ecx, dword [eax + 0xc]
mov eax, dword [ecx]
movzx edx, word [eax + 0x10]
cmp ebx, edx
jg 0x435626
mov ecx, dword [0x54d750]
push ecx
call sub.KERNEL32.DLL_TlsGetValue
mov eax, dword [eax + 0xc]
mov ebx, dword [eax + ebx*4 + 4]
test byte [ebx + 1], 0x20
je 0x435626
mov edx, dword [ebp + 8]
push edx
push ebx
call fcn.0043f598
pop ecx
push eax
call fcn.0043e210
add esp, 8
mov eax, 1
pop ebx
pop ebp
ret
xor eax, eax
pop ebx
pop ebp
ret

Function at 0x4356b8
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0x10]
cmp ebx, 0xffffffff
jne 0x4356ec
mov eax, dword [ebp + 0xc]
push eax
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [0x54d750]
push ecx
call sub.KERNEL32.DLL_TlsGetValue
add eax, 0x10
push eax
call fcn.0043e2ec
add esp, 0xc
mov eax, 1
pop ebx
pop ebp
ret
test ebx, ebx
jl 0x435742
mov edx, dword [0x54d750]
push edx
call sub.KERNEL32.DLL_TlsGetValue
mov ecx, dword [eax + 0xc]
mov eax, dword [ecx]
movzx edx, word [eax + 0x10]
cmp ebx, edx
jg 0x435742
mov ecx, dword [0x54d750]
push ecx
call sub.KERNEL32.DLL_TlsGetValue
mov eax, dword [eax + 0xc]
mov ebx, dword [eax + ebx*4 + 4]
test byte [ebx + 1], 0x20
je 0x435742
mov edx, dword [ebp + 0xc]
push edx
mov ecx, dword [ebp + 8]
push ecx
push ebx
call fcn.0043f598
pop ecx
push eax
call fcn.0043e2ec
add esp, 0xc
mov eax, 1
pop ebx
pop ebp
ret
xor eax, eax
pop ebx
pop ebp
ret

Function at 0x435748
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
cmp ebx, 0xffffffff
jne 0x435784
cmp dword [ebp + 8], 0
je 0x435761
mov eax, 1
jmp 0x435763
xor eax, eax
push eax
mov edx, dword [0x54d750]
push edx
call sub.KERNEL32.DLL_TlsGetValue
add eax, 0x10
push eax
call fcn.0043e32c
add esp, 8
mov eax, 1
pop ebx
pop ebp
ret
test ebx, ebx
jl 0x4357e2
mov edx, dword [0x54d750]
push edx
call sub.KERNEL32.DLL_TlsGetValue
mov ecx, dword [eax + 0xc]
mov eax, dword [ecx]
movzx edx, word [eax + 0x10]
cmp ebx, edx
jg 0x4357e2
mov ecx, dword [0x54d750]
push ecx
call sub.KERNEL32.DLL_TlsGetValue
mov eax, dword [eax + 0xc]
mov ebx, dword [eax + ebx*4 + 4]
test byte [ebx + 1], 0x20
je 0x4357e2
cmp dword [ebp + 8], 0
je 0x4357c7
mov edx, 1
jmp 0x4357c9
xor edx, edx
push edx
push ebx
call fcn.0043f598
pop ecx
push eax
call fcn.0043e32c
add esp, 8
mov eax, 1
pop ebx
pop ebp
ret
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x4357e8
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
cmp ebx, 0xffffffff
jne 0x435818
mov eax, dword [ebp + 8]
push eax
mov edx, dword [0x54d750]
push edx
call sub.KERNEL32.DLL_TlsGetValue
add eax, 0x10
push eax
call fcn.0043e3f4
add esp, 8
mov eax, 1
pop ebx
pop ebp
ret
test ebx, ebx
jl 0x43586a
mov edx, dword [0x54d750]
push edx
call sub.KERNEL32.DLL_TlsGetValue
mov ecx, dword [eax + 0xc]
mov eax, dword [ecx]
movzx edx, word [eax + 0x10]
cmp ebx, edx
jg 0x43586a
mov ecx, dword [0x54d750]
push ecx
call sub.KERNEL32.DLL_TlsGetValue
mov eax, dword [eax + 0xc]
mov ebx, dword [eax + ebx*4 + 4]
test byte [ebx + 1], 0x20
je 0x43586a
mov edx, dword [ebp + 8]
push edx
push ebx
call fcn.0043f598
pop ecx
push eax
call fcn.0043e3f4
add esp, 8
mov eax, 1
pop ebx
pop ebp
ret
xor eax, eax
pop ebx
pop ebp
ret

Function at 0x435870
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
cmp ebx, 0xffffffff
jne 0x4358a0
mov eax, dword [ebp + 8]
push eax
mov edx, dword [0x54d750]
push edx
call sub.KERNEL32.DLL_TlsGetValue
add eax, 0x10
push eax
call fcn.0043e44c
add esp, 8
mov eax, 1
pop ebx
pop ebp
ret
test ebx, ebx
jl 0x4358f2
mov edx, dword [0x54d750]
push edx
call sub.KERNEL32.DLL_TlsGetValue
mov ecx, dword [eax + 0xc]
mov eax, dword [ecx]
movzx edx, word [eax + 0x10]
cmp ebx, edx
jg 0x4358f2
mov ecx, dword [0x54d750]
push ecx
call sub.KERNEL32.DLL_TlsGetValue
mov eax, dword [eax + 0xc]
mov ebx, dword [eax + ebx*4 + 4]
test byte [ebx + 1], 0x20
je 0x4358f2
mov edx, dword [ebp + 8]
push edx
push ebx
call fcn.0043f598
pop ecx
push eax
call fcn.0043e44c
add esp, 8
mov eax, 1
pop ebx
pop ebp
ret
xor eax, eax
pop ebx
pop ebp
ret

Function at 0x4358f8
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
cmp ebx, 0xffffffff
jne 0x435928
mov eax, dword [ebp + 8]
push eax
mov edx, dword [0x54d750]
push edx
call sub.KERNEL32.DLL_TlsGetValue
add eax, 0x10
push eax
call fcn.0043e4a4
add esp, 8
mov eax, 1
pop ebx
pop ebp
ret
test ebx, ebx
jl 0x43597a
mov edx, dword [0x54d750]
push edx
call sub.KERNEL32.DLL_TlsGetValue
mov ecx, dword [eax + 0xc]
mov eax, dword [ecx]
movzx edx, word [eax + 0x10]
cmp ebx, edx
jg 0x43597a
mov ecx, dword [0x54d750]
push ecx
call sub.KERNEL32.DLL_TlsGetValue
mov eax, dword [eax + 0xc]
mov ebx, dword [eax + ebx*4 + 4]
test byte [ebx + 1], 0x20
je 0x43597a
mov edx, dword [ebp + 8]
push edx
push ebx
call fcn.0043f598
pop ecx
push eax
call fcn.0043e4a4
add esp, 8
mov eax, 1
pop ebx
pop ebp
ret
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x435a98
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0x10]
cmp ebx, 0xffffffff
jne 0x435aca
push dword [ebp + 0xc]
push dword [ebp + 8]
mov edx, dword [0x54d750]
push edx
call sub.KERNEL32.DLL_TlsGetValue
add eax, 0x10
push eax
call fcn.0043e364
add esp, 0xc
mov eax, 1
pop ebx
pop ebp
ret
test ebx, ebx
jl 0x435b1e
mov edx, dword [0x54d750]
push edx
call sub.KERNEL32.DLL_TlsGetValue
mov ecx, dword [eax + 0xc]
mov eax, dword [ecx]
movzx edx, word [eax + 0x10]
cmp ebx, edx
jg 0x435b1e
mov ecx, dword [0x54d750]
push ecx
call sub.KERNEL32.DLL_TlsGetValue
mov eax, dword [eax + 0xc]
mov ebx, dword [eax + ebx*4 + 4]
test byte [ebx + 1], 0x20
je 0x435b1e
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call fcn.0043f598
pop ecx
push eax
call fcn.0043e364
add esp, 0xc
mov eax, 1
pop ebx
pop ebp
ret
xor eax, eax
pop ebx
pop ebp
ret

Function at 0x435c34
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
cmp dword [ebp + 0xc], 0xffffffff
mov edi, dword [ebp + 8]
jl 0x435cf1
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov edx, dword [eax + 0xc]
mov ecx, dword [edx]
movzx eax, word [ecx + 0x10]
cmp eax, dword [ebp + 0xc]
jl 0x435cf1
cmp dword [ebp + 0xc], 0xffffffff
jne 0x435c7d
mov edx, dword [0x54d750]
push edx
call sub.KERNEL32.DLL_TlsGetValue
mov ebx, eax
add ebx, 0x10
jmp 0x435c92
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov edx, dword [eax + 0xc]
mov ecx, dword [ebp + 0xc]
mov ebx, dword [edx + ecx*4 + 4]
test byte [ebx + 1], 0x20
setne al
and eax, 1
mov esi, eax
test esi, esi
je 0x435cab
push ebx
call fcn.0043f598
pop ecx
mov ebx, eax
test byte [ebx + 1], 0x80
je 0x435cd6
lea esi, [ebp + 0x10]
push edi
add esi, 4
mov eax, dword [esi - 4]
push eax
push ebx
call fcn.0042a71c
add esp, 0xc
test eax, eax
je 0x435cd0
mov eax, 1
jmp 0x435cf3
xor eax, eax
jmp 0x435cf3
test esi, esi
jne 0x435ce0
cmp dword [ebp + 0xc], 0xffffffff
jne 0x435cf1
push edi
push ebx
call fcn.0043da04
add esp, 8
mov eax, 1
jmp 0x435cf3
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4361b0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
cmp dword [ebp + 0xc], 0xffffffff
mov edi, dword [ebp + 8]
jl 0x436287
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov edx, dword [eax + 0xc]
mov ecx, dword [edx]
movzx eax, word [ecx + 0x10]
cmp eax, dword [ebp + 0xc]
jl 0x436287
cmp dword [ebp + 0xc], 0xffffffff
jne 0x4361f9
mov edx, dword [0x54d750]
push edx
call sub.KERNEL32.DLL_TlsGetValue
mov ebx, eax
add ebx, 0x10
jmp 0x43620e
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov edx, dword [eax + 0xc]
mov ecx, dword [ebp + 0xc]
mov ebx, dword [edx + ecx*4 + 4]
test byte [ebx + 1], 0x20
setne al
and eax, 1
mov esi, eax
test esi, esi
je 0x436227
push ebx
call fcn.0043f598
pop ecx
mov ebx, eax
test byte [ebx + 1], 0x80
je 0x43625f
lea esi, [ebp + 0x10]
test edi, edi
je 0x43623b
mov eax, 1
jmp 0x43623d
xor eax, eax
push eax
add esi, 4
mov eax, dword [esi - 4]
push eax
push ebx
call fcn.0042a534
add esp, 0xc
test eax, eax
je 0x436259
mov eax, 1
jmp 0x436289
xor eax, eax
jmp 0x436289
test esi, esi
jne 0x436269
cmp dword [ebp + 0xc], 0xffffffff
jne 0x436287
test edi, edi
je 0x436274
mov edx, 1
jmp 0x436276
xor edx, edx
push edx
push ebx
call fcn.0043e32c
add esp, 8
mov eax, 1
jmp 0x436289
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x436290
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
cmp dword [ebp + 0xc], 0xffffffff
mov edi, dword [ebp + 8]
jl 0x43634d
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov edx, dword [eax + 0xc]
mov ecx, dword [edx]
movzx eax, word [ecx + 0x10]
cmp eax, dword [ebp + 0xc]
jl 0x43634d
cmp dword [ebp + 0xc], 0xffffffff
jne 0x4362d9
mov edx, dword [0x54d750]
push edx
call sub.KERNEL32.DLL_TlsGetValue
mov ebx, eax
add ebx, 0x10
jmp 0x4362ee
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov edx, dword [eax + 0xc]
mov ecx, dword [ebp + 0xc]
mov ebx, dword [edx + ecx*4 + 4]
test byte [ebx + 1], 0x20
setne al
and eax, 1
mov esi, eax
test esi, esi
je 0x436307
push ebx
call fcn.0043f598
pop ecx
mov ebx, eax
test byte [ebx + 1], 0x80
je 0x436332
lea esi, [ebp + 0x10]
push edi
add esi, 4
mov eax, dword [esi - 4]
push eax
push ebx
call fcn.0042a578
add esp, 0xc
test eax, eax
je 0x43632c
mov eax, 1
jmp 0x43634f
xor eax, eax
jmp 0x43634f
test esi, esi
jne 0x43633c
cmp dword [ebp + 0xc], 0xffffffff
jne 0x43634d
push edi
push ebx
call fcn.0043e3f4
add esp, 8
mov eax, 1
jmp 0x43634f
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x436354
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
cmp dword [ebp + 0xc], 0xffffffff
mov edi, dword [ebp + 8]
jl 0x436411
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov edx, dword [eax + 0xc]
mov ecx, dword [edx]
movzx eax, word [ecx + 0x10]
cmp eax, dword [ebp + 0xc]
jl 0x436411
cmp dword [ebp + 0xc], 0xffffffff
jne 0x43639d
mov edx, dword [0x54d750]
push edx
call sub.KERNEL32.DLL_TlsGetValue
mov ebx, eax
add ebx, 0x10
jmp 0x4363b2
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov edx, dword [eax + 0xc]
mov ecx, dword [ebp + 0xc]
mov ebx, dword [edx + ecx*4 + 4]
test byte [ebx + 1], 0x20
setne al
and eax, 1
mov esi, eax
test esi, esi
je 0x4363cb
push ebx
call fcn.0043f598
pop ecx
mov ebx, eax
test byte [ebx + 1], 0x80
je 0x4363f6
lea esi, [ebp + 0x10]
push edi
add esi, 4
mov eax, dword [esi - 4]
push eax
push ebx
call fcn.0042a5bc
add esp, 0xc
test eax, eax
je 0x4363f0
mov eax, 1
jmp 0x436413
xor eax, eax
jmp 0x436413
test esi, esi
jne 0x436400
cmp dword [ebp + 0xc], 0xffffffff
jne 0x436411
push edi
push ebx
call fcn.0043e44c
add esp, 8
mov eax, 1
jmp 0x436413
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4368c8
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov edx, dword [eax + 0xc]
mov ecx, dword [edx]
movzx eax, word [ecx + 0x10]
ret

Function at 0x436938
Capabilities:
Get system information on windows

Disassembly:
push ebx
push esi
add esp, 0xffffffdc
push 0x5392f4
call fcn.0043b500
pop ecx
cmp dword [0x54d898], 0
jne 0x4369b1
push esp
call sub.KERNEL32.DLL_GetSystemInfo
mov ebx, dword [esp + 4]
mov esi, dword [esp + 0x1c]
mov eax, esi
dec eax
test eax, esi
jne 0x43696d
mov edx, ebx
dec edx
test edx, ebx
je 0x436972
call fcn.004b1ce8
mov dword [0x54d8a0], esi
mov dword [0x54d89c], ebx
mov dword [0x54d8a4], 0x40000
mov dword [0x54d8a8], 0x200000
mov dword [0x54d8ac], 7
call sub.KERNEL32.DLL_GetTickCount
xor eax, 0x55555555
or eax, 8
and eax, 0xfffffff8
mov dword [0x54d898], eax
dec dword [0x5392f8]
jne 0x4369c8
xor ecx, ecx
xor eax, eax
mov dword [0x5392fc], ecx
mov dword [0x5392f4], eax
mov eax, 1
add esp, 0x24
pop esi
pop ebx
ret

Function at 0x43affc
Capabilities:
Get thread local storage value

Disassembly:
push ebx
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov ebx, dword [eax + 0x1f8]
test ebx, ebx
je 0x43b042
xor edx, edx
mov dword [eax + 0x1f8], edx
push 0x539328
call fcn.004499f4
pop ecx
dec dword [ebx]
jne 0x43b037
push 0
mov eax, dword [ebx + 4]
push eax
call fcn.0043acd8
add esp, 8
push 0x539328
call fcn.00449a14
pop ecx
pop ebx
ret
Function at 0x43b36c
Capabilities:
Get memory capacity
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff40
mov eax, dword [ebp + 8]
cmp eax, 0x68
jg 0x43b3cc
je 0x43b4ad
cmp eax, 4
jg 0x43b3b0
je 0x43b474
sub eax, 1
jb 0x43b419
je 0x43b42d
dec eax
je 0x43b44c
dec eax
je 0x43b460
jmp 0x43b4f4
sub eax, 0x65
je 0x43b478
dec eax
je 0x43b48f
dec eax
je 0x43b496
jmp 0x43b4f4
cmp eax, 0x3eb
jg 0x43b3f9
je 0x43b4c1
sub eax, 0x69
je 0x43b4b1
sub eax, 0x380
je 0x43b4b5
dec eax
je 0x43b4bd
jmp 0x43b4f4
sub eax, 0x3ec
je 0x43b4c8
dec eax
je 0x43b4d5
sub eax, 2
je 0x43b4b9
jmp 0x43b4f4
lea edx, [ebp - 0x20]
push edx
call sub.KERNEL32.DLL_GlobalMemoryStatus
mov eax, dword [ebp - 0x14]
shr eax, 0xa
jmp 0x43b4f6
lea edx, [ebp - 0x40]
push edx
call sub.KERNEL32.DLL_GlobalMemoryStatus
cmp dword [ebp - 0x34], 0xffffffff
jae 0x43b441
mov eax, dword [ebp - 0x34]
jmp 0x43b444
or eax, 0xffffffff
shr eax, 0xa
jmp 0x43b4f6
lea edx, [ebp - 0x60]
push edx
call sub.KERNEL32.DLL_GlobalMemoryStatus
mov eax, dword [ebp - 0x54]
shr eax, 0xa
jmp 0x43b4f6
lea edx, [ebp - 0x80]
push edx
call sub.KERNEL32.DLL_GlobalMemoryStatus
mov eax, dword [ebp - 0x64]
shr eax, 0xa
jmp 0x43b4f6
xor eax, eax
jmp 0x43b4f6
lea edx, [ebp - 0xa0]
push edx
call sub.KERNEL32.DLL_GlobalMemoryStatus
mov eax, dword [ebp - 0x98]
shr eax, 0xa
jmp 0x43b4f6
mov eax, 1
jmp 0x43b4f6
lea edx, [ebp - 0xc0]
push edx
call sub.KERNEL32.DLL_GlobalMemoryStatus
mov eax, dword [ebp - 0xac]
shr eax, 0xa
jmp 0x43b4f6
xor eax, eax
jmp 0x43b4f6
xor eax, eax
jmp 0x43b4f6
xor eax, eax
jmp 0x43b4f6
xor eax, eax
jmp 0x43b4f6
xor eax, eax
jmp 0x43b4f6
call fcn.00432e74
jmp 0x43b4f6
call fcn.00432e74
shl eax, 3
lea eax, [eax + eax*2]
jmp 0x43b4f6
mov edx, dword [0x54d750]
push edx
call sub.KERNEL32.DLL_TlsGetValue
mov ecx, dword [eax]
sub ecx, dword [eax + 8]
test ecx, ecx
jns 0x43b4ed
add ecx, 3
sar ecx, 2
mov eax, ecx
jmp 0x43b4f6
xor eax, eax
mov esp, ebp
pop ebp
ret