joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43fa58
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
xor ecx, ecx
push ebx
push esi
push edi
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], ecx
mov ecx, dword [edx + 0x10]
mov edi, dword [eax + 0x10]
mov dword [ebp - 4], ecx
cmp dword [ebp + 0x10], 0
mov ebx, dword [eax + 8]
mov esi, dword [edx + 8]
jne 0x43fabe
mov eax, dword [0x555894]
push eax
call sub.KERNEL32.DLL_TlsGetValue
cmp dword [eax + 0x11c], 0
je 0x43fabe
jmp 0x43fa98
dec ebx
cmp esi, ebx
jae 0x43faa3
cmp byte [edi + ebx - 1], 0x20
je 0x43fa97
mov edx, dword [ebp - 4]
lea eax, [edx + esi - 1]
jmp 0x43faae
dec esi
dec eax
cmp ebx, esi
jae 0x43fab7
cmp byte [eax], 0x20
je 0x43faac
mov dword [ebp + 0x10], 1
cmp esi, ebx
jbe 0x43fac6
mov edx, ebx
jmp 0x43fac8
mov edx, esi
mov dword [ebp - 8], edx
cmp dword [ebp - 8], 0
je 0x43fb4d
call fcn.004257e8
test eax, eax
je 0x43fafc
test byte [eax + 0x24], 8
jne 0x43fafc
mov ecx, dword [ebp + 0x10]
push ecx
push eax
push esi
mov eax, dword [ebp - 4]
push eax
push ebx
push edi
call fcn.0044fba8
add esp, 0x18
mov dword [ebp - 0xc], eax
jmp 0x43fb7f
mov edx, dword [ebp - 4]
mov cl, byte [edx]
mov al, byte [edi]
cmp cl, al
je 0x43fb1d
mov edx, dword [ebp - 4]
cmp al, byte [edx]
jae 0x43fb13
or eax, 0xffffffff
jmp 0x43fb18
mov eax, 1
mov dword [ebp - 0xc], eax
jmp 0x43fb26
inc edi
inc dword [ebp - 4]
dec dword [ebp - 8]
jne 0x43fafc
cmp dword [ebp - 0xc], 0
jne 0x43fb7f
cmp esi, ebx
je 0x43fb7f
cmp dword [ebp + 0x10], 0
jne 0x43fb3a
cmp ebx, esi
jae 0x43fb7f
cmp esi, ebx
jbe 0x43fb43
or edx, 0xffffffff
jmp 0x43fb48
mov edx, 1
mov dword [ebp - 0xc], edx
jmp 0x43fb7f
cmp esi, ebx
je 0x43fb7a
cmp dword [ebp + 0x10], 0
je 0x43fb6a
cmp esi, ebx
jbe 0x43fb60
or eax, 0xffffffff
jmp 0x43fb65
mov eax, 1
mov dword [ebp - 0xc], eax
jmp 0x43fb7f
test esi, esi
jne 0x43fb72
xor edx, edx
jmp 0x43fb75
or edx, 0xffffffff
mov dword [ebp - 0xc], edx
jmp 0x43fb7f
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43fb8c
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
xor ecx, ecx
push ebx
push esi
push edi
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], ecx
mov ecx, dword [edx + 0x10]
mov edi, dword [eax + 0x10]
mov dword [ebp - 4], ecx
cmp dword [ebp + 0x10], 0
mov ebx, dword [eax + 8]
mov esi, dword [edx + 8]
jne 0x43fbf2
mov eax, dword [0x555894]
push eax
call sub.KERNEL32.DLL_TlsGetValue
cmp dword [eax + 0x11c], 0
je 0x43fbf2
jmp 0x43fbcc
dec ebx
cmp esi, ebx
jae 0x43fbd7
cmp byte [edi + ebx - 1], 0x20
je 0x43fbcb
mov edx, dword [ebp - 4]
lea eax, [edx + esi - 1]
jmp 0x43fbe2
dec esi
dec eax
cmp ebx, esi
jae 0x43fbeb
cmp byte [eax], 0x20
je 0x43fbe0
mov dword [ebp + 0x10], 1
cmp esi, ebx
jbe 0x43fbfa
mov edx, ebx
jmp 0x43fbfc
mov edx, esi
mov dword [ebp - 8], edx
cmp dword [ebp - 8], 0
je 0x43fcb6
call fcn.004257e8
test eax, eax
je 0x43fc34
test byte [eax + 0x24], 8
jne 0x43fc34
mov ecx, dword [ebp + 0x10]
push ecx
push eax
push esi
mov eax, dword [ebp - 4]
push eax
push ebx
push edi
call fcn.0044fbcc
add esp, 0x18
mov dword [ebp - 0xc], eax
jmp 0x43fce8
mov al, byte [edi]
cmp al, 0x61
jb 0x43fc47
cmp al, 0x7a
ja 0x43fc47
xor edx, edx
mov dl, byte [edi]
add edx, 0xffffffe0
jmp 0x43fc4b
xor edx, edx
mov dl, byte [edi]
mov eax, edx
mov ecx, dword [ebp - 4]
mov dl, byte [ecx]
cmp dl, 0x61
jb 0x43fc68
cmp dl, 0x7a
ja 0x43fc68
mov ecx, dword [ebp - 4]
xor edx, edx
mov dl, byte [ecx]
add edx, 0xffffffe0
jmp 0x43fc6f
mov ecx, dword [ebp - 4]
xor edx, edx
mov dl, byte [ecx]
cmp edx, eax
je 0x43fc86
cmp edx, eax
jle 0x43fc7c
or eax, 0xffffffff
jmp 0x43fc81
mov eax, 1
mov dword [ebp - 0xc], eax
jmp 0x43fc8f
inc edi
inc dword [ebp - 4]
dec dword [ebp - 8]
jne 0x43fc34
cmp dword [ebp - 0xc], 0
jne 0x43fce8
cmp esi, ebx
je 0x43fce8
cmp dword [ebp + 0x10], 0
jne 0x43fca3
cmp ebx, esi
jae 0x43fce8
cmp esi, ebx
jbe 0x43fcac
or edx, 0xffffffff
jmp 0x43fcb1
mov edx, 1
mov dword [ebp - 0xc], edx
jmp 0x43fce8
cmp esi, ebx
je 0x43fce3
cmp dword [ebp + 0x10], 0
je 0x43fcd3
cmp esi, ebx
jbe 0x43fcc9
or eax, 0xffffffff
jmp 0x43fcce
mov eax, 1
mov dword [ebp - 0xc], eax
jmp 0x43fce8
test esi, esi
jne 0x43fcdb
xor edx, edx
jmp 0x43fcde
or edx, 0xffffffff
mov dword [ebp - 0xc], edx
jmp 0x43fce8
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44160c
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push ebx
call fcn.004406a8
pop ecx
push eax
push ebx
mov eax, dword [ebp + 8]
push eax
mov edx, dword [0x555894]
push edx
call sub.KERNEL32.DLL_TlsGetValue
add eax, 0x10
push eax
call fcn.00440da0
add esp, 0x10
pop ebx
pop ebp
ret

Function at 0x441b28
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov eax, dword [ebp + 8]
mov ebx, 1
test byte [eax + 1], 4
jne 0x441ba7
push eax
push 1
push 0x5415cc
push 0
push 0x429
push 1
call fcn.00457300
add esp, 0x18
mov esi, eax
xor ebx, ebx
test esi, esi
je 0x441ba7
mov eax, dword [0x555894]
push eax
call sub.KERNEL32.DLL_TlsGetValue
sub dword [eax], 4
mov edx, dword [0x555894]
push edx
call sub.KERNEL32.DLL_TlsGetValue
mov ecx, dword [eax]
mov eax, dword [ecx]
test dword [eax], 0xb405
je 0x441b99
mov edx, dword [0x555894]
push edx
call sub.KERNEL32.DLL_TlsGetValue
mov ecx, dword [eax]
mov eax, dword [ecx]
push eax
call fcn.0043f008
pop ecx
push esi
call fcn.00422db8
pop ecx
push esi
call fcn.0043dbc0
pop ecx
mov eax, ebx
pop esi
pop ebx
pop ebp
ret

Function at 0x441bf8
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x441c62
cmp dword [ebx + 0x1c], 0
je 0x441c62
mov eax, dword [0x555894]
push eax
call sub.KERNEL32.DLL_TlsGetValue
sub dword [eax], 4
mov edx, dword [0x555894]
push edx
call sub.KERNEL32.DLL_TlsGetValue
mov ecx, dword [eax]
mov eax, dword [ecx]
test dword [eax], 0xb405
je 0x441c46
mov edx, dword [0x555894]
push edx
call sub.KERNEL32.DLL_TlsGetValue
mov ecx, dword [eax]
mov eax, dword [ecx]
push eax
call fcn.0043f008
pop ecx
mov edx, dword [ebx + 0x1c]
push edx
call fcn.0045693c
pop ecx
mov ecx, dword [ebx + 0x1c]
push ecx
call fcn.00456bb8
pop ecx
xor eax, eax
mov dword [ebx + 0x1c], eax
pop ebx
pop ebp
ret
mov edx, dword [0x555894]
push edx
call sub.KERNEL32.DLL_TlsGetValue
mov ecx, dword [eax]
mov eax, dword [ecx - 4]
push eax
push 1
push 0x5415cc
push 0
push 0x5a9
push 7
call fcn.00457300
add esp, 0x18
mov ebx, eax
test ebx, ebx
je 0x441cdd
mov eax, dword [0x555894]
push eax
call sub.KERNEL32.DLL_TlsGetValue
sub dword [eax], 4
mov edx, dword [0x555894]
push edx
call sub.KERNEL32.DLL_TlsGetValue
mov ecx, dword [eax]
mov eax, dword [ecx]
test dword [eax], 0xb405
je 0x441ccf
mov edx, dword [0x555894]
push edx
call sub.KERNEL32.DLL_TlsGetValue
mov ecx, dword [eax]
mov eax, dword [ecx]
push eax
call fcn.0043f008
pop ecx
push ebx
call fcn.00422db8
pop ecx
push ebx
call fcn.0043dbc0
pop ecx
pop ebx
pop ebp
ret
Function at 0x441ea0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
push ebx
push esi
push edi
mov ebx, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
push esi
call fcn.00441b28
pop ecx
test eax, eax
je 0x441fc8
mov dword [ebp - 0x50], 2
test bl, 0x40
je 0x441ed4
call fcn.00441a70
jmp 0x441ed6
mov eax, ebx
push eax
call fcn.004257e8
test byte [eax + 0x24], 4
je 0x441ee9
mov edx, 0x800
jmp 0x441eeb
xor edx, edx
pop eax
or eax, edx
mov dword [ebp - 0x4c], eax
lea eax, [ebp - 0x40]
mov dword [ebp - 0x3c], 1
mov word [ebp - 0x1a], 0x3f
mov dword [ebp - 0x38], 1
mov ecx, dword [esi + 8]
mov dword [ebp - 0x40], ecx
push eax
mov edx, dword [esi + 0x10]
push edx
call fcn.00441ce0
add esp, 8
mov ebx, eax
mov dword [ebp - 0x44], ebx
cmp ebx, dword [esi + 0x10]
jne 0x441f27
xor ebx, ebx
test edi, edi
je 0x441f38
or dword [ebp - 0x3c], 0x20
cmp edi, 0x2c
jne 0x441f38
or dword [ebp - 0x3c], 0x10
lea eax, [ebp - 0x50]
push eax
call fcn.00441a98
pop ecx
test eax, eax
jne 0x441fa7
test byte [ebp - 0x38], 1
je 0x441fa7
mov edx, dword [0x555894]
push edx
call sub.KERNEL32.DLL_TlsGetValue
sub dword [eax], 4
mov ecx, dword [0x555894]
push ecx
call sub.KERNEL32.DLL_TlsGetValue
mov eax, dword [eax]
mov edx, dword [eax]
test dword [edx], 0xb405
je 0x441f8a
mov ecx, dword [0x555894]
push ecx
call sub.KERNEL32.DLL_TlsGetValue
mov eax, dword [eax]
mov edx, dword [eax]
push edx
call fcn.0043f008
pop ecx
lea ecx, [ebp - 0x50]
push ecx
call fcn.00441be0
pop ecx
cmp edi, 0x2a
jne 0x441fb1
movzx eax, word [ebp - 0x1c]
inc eax
push eax
call fcn.00423000
pop ecx
jmp 0x441fb1
lea edx, [ebp - 0x50]
push edx
call fcn.00441bf8
pop ecx
test ebx, ebx
je 0x441fbc
push ebx
call fcn.0043b450
pop ecx
lea ecx, [ebp - 0x50]
push ecx
call fcn.00441aec
pop ecx
jmp 0x441fdf
cmp edi, 0x2a
jne 0x441fdf
call fcn.0042557c
test ax, ax
jne 0x441fdf
push 1
call fcn.00422f60
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x441fe8
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push ebx
call fcn.00441b28
pop ecx
test eax, eax
je 0x4420d0
mov dword [ebp - 0x50], 2
test esi, 0x40
je 0x44201e
call fcn.00441a70
mov edi, eax
jmp 0x442020
mov edi, esi
call fcn.004257e8
test byte [eax + 0x24], 4
je 0x442032
mov eax, 0x800
jmp 0x442034
xor eax, eax
or edi, eax
mov dword [ebp - 0x4c], edi
mov dword [ebp - 0x3c], 2
mov word [ebp - 0x1a], 0x3f
mov dword [ebp - 0x38], 1
mov edx, dword [ebx + 0x10]
mov dword [ebp - 0x44], edx
mov ecx, dword [ebx + 8]
mov dword [ebp - 0x40], ecx
lea eax, [ebp - 0x50]
push eax
call fcn.00441a98
pop ecx
test eax, eax
jne 0x4420b7
test byte [ebp - 0x38], 1
je 0x4420b7
mov edx, dword [0x555894]
push edx
call sub.KERNEL32.DLL_TlsGetValue
sub dword [eax], 4
mov ecx, dword [0x555894]
push ecx
call sub.KERNEL32.DLL_TlsGetValue
mov eax, dword [eax]
mov edx, dword [eax]
test dword [edx], 0xb405
je 0x4420ab
mov ecx, dword [0x555894]
push ecx
call sub.KERNEL32.DLL_TlsGetValue
mov eax, dword [eax]
mov edx, dword [eax]
push edx
call fcn.0043f008
pop ecx
lea ecx, [ebp - 0x50]
push ecx
call fcn.00441be0
pop ecx
jmp 0x4420c1
lea eax, [ebp - 0x50]
push eax
call fcn.00441bf8
pop ecx
lea edx, [ebp - 0x50]
push edx
call fcn.00441aec
pop ecx
jmp 0x442153
call fcn.0042557c
test ax, ax
jne 0x442153
mov ecx, dword [0x555894]
push ecx
call sub.KERNEL32.DLL_TlsGetValue
sub dword [eax], 4
mov eax, dword [0x555894]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov edx, dword [eax]
mov ecx, dword [edx]
test dword [ecx], 0xb405
je 0x442116
mov eax, dword [0x555894]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov edx, dword [eax]
mov ecx, dword [edx]
push ecx
call fcn.0043f008
pop ecx
mov eax, dword [0x555894]
push eax
call sub.KERNEL32.DLL_TlsGetValue
sub dword [eax], 4
mov edx, dword [0x555894]
push edx
call sub.KERNEL32.DLL_TlsGetValue
mov ecx, dword [eax]
mov eax, dword [ecx]
test dword [eax], 0xb405
je 0x442153
mov edx, dword [0x555894]
push edx
call sub.KERNEL32.DLL_TlsGetValue
mov ecx, dword [eax]
mov eax, dword [ecx]
push eax
call fcn.0043f008
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44215c
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
push ebx
mov ebx, dword [ebp + 8]
push ebx
call fcn.00441b28
pop ecx
test eax, eax
je 0x442214
mov dword [ebp - 0x50], 2
mov dword [ebp - 0x4c], 0x19
mov dword [ebp - 0x3c], 0x41
mov word [ebp - 0x1a], 0x3f
mov dword [ebp - 0x38], 1
mov eax, dword [ebx + 0x10]
mov dword [ebp - 0x44], eax
mov edx, dword [ebx + 8]
mov dword [ebp - 0x40], edx
lea ecx, [ebp - 0x50]
push ecx
call fcn.00441a98
pop ecx
test eax, eax
jne 0x442200
test byte [ebp - 0x38], 1
je 0x442200
mov eax, dword [0x555894]
push eax
call sub.KERNEL32.DLL_TlsGetValue
sub dword [eax], 4
mov edx, dword [0x555894]
push edx
call sub.KERNEL32.DLL_TlsGetValue
mov ecx, dword [eax]
mov eax, dword [ecx]
test dword [eax], 0xb405
je 0x4421f4
mov edx, dword [0x555894]
push edx
call sub.KERNEL32.DLL_TlsGetValue
mov ecx, dword [eax]
mov eax, dword [ecx]
push eax
call fcn.0043f008
pop ecx
lea edx, [ebp - 0x50]
push edx
call fcn.00441be0
pop ecx
jmp 0x44220a
lea ecx, [ebp - 0x50]
push ecx
call fcn.00441bf8
pop ecx
lea eax, [ebp - 0x50]
push eax
call fcn.00441aec
pop ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x442994
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov ebx, dword [ebp + 8]
push ebx
call fcn.00441b28
pop ecx
test eax, eax
je 0x442a2e
lea eax, [ebp - 4]
push eax
mov edx, dword [ebx + 8]
push edx
mov ecx, dword [ebx + 0x10]
push ecx
call fcn.00442514
add esp, 0xc
mov ebx, eax
test ebx, ebx
je 0x442a26
push ebx
call fcn.00431b8c
pop ecx
mov esi, eax
cmp dword [ebp - 4], 0
je 0x4429dc
push ebx
call fcn.0043b450
pop ecx
mov eax, dword [0x555894]
push eax
call sub.KERNEL32.DLL_TlsGetValue
sub dword [eax], 4
mov edx, dword [0x555894]
push edx
call sub.KERNEL32.DLL_TlsGetValue
mov ecx, dword [eax]
mov eax, dword [ecx]
test dword [eax], 0xb405
je 0x442a19
mov edx, dword [0x555894]
push edx
call sub.KERNEL32.DLL_TlsGetValue
mov ecx, dword [eax]
mov eax, dword [ecx]
push eax
call fcn.0043f008
pop ecx
mov edx, dword [esi]
push edx
call fcn.00423424
pop ecx
jmp 0x442a9d
push 0
call fcn.00441bf8
pop ecx
mov ecx, dword [0x555894]
push ecx
call sub.KERNEL32.DLL_TlsGetValue
mov eax, dword [eax]
mov edx, dword [eax - 4]
test byte [edx + 1], 1
jne 0x442a9d
call fcn.0042557c
test ax, ax
jne 0x442a9d
mov ecx, dword [0x555894]
push ecx
call sub.KERNEL32.DLL_TlsGetValue
sub dword [eax], 4
mov eax, dword [0x555894]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov edx, dword [eax]
mov ecx, dword [edx]
test dword [ecx], 0xb405
je 0x442a8b
mov eax, dword [0x555894]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov edx, dword [eax]
mov ecx, dword [edx]
push ecx
call fcn.0043f008
pop ecx
push 0x5415cd
call fcn.00431b8c
pop ecx
push eax
call fcn.00423460
pop ecx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x442ae4
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff9c
push ebx
push esi
push edi
mov edi, 0x5415cc
mov ebx, dword [ebp + 8]
lea esi, [ebp - 0x50]
push ebx
call fcn.00441b28
pop ecx
test eax, eax
je 0x442c47
mov dword [esi], 2
call fcn.004257e8
test byte [eax + 0x24], 4
je 0x442b1f
mov eax, 0x800
jmp 0x442b21
xor eax, eax
push eax
call fcn.00441a70
pop edx
or edx, eax
mov dword [esi + 4], edx
mov dword [esi + 0x14], 9
mov word [esi + 0x36], 0x3f
mov dword [esi + 0x18], 1
mov ecx, dword [ebx + 0x10]
mov dword [esi + 0xc], ecx
mov eax, dword [ebx + 8]
mov dword [esi + 0x10], eax
push esi
call fcn.00441a98
pop ecx
test eax, eax
jne 0x442c3b
cmp dword [esi + 0x30], 6
jne 0x442b6a
lea ebx, [edi + 2]
jmp 0x442c3e
mov eax, dword [esi + 0x18]
test al, 8
je 0x442b79
lea ebx, [edi + 4]
jmp 0x442c3e
test al, 4
je 0x442b85
lea ebx, [edi + 6]
jmp 0x442c3e
test al, 1
je 0x442c36
mov dword [ebp - 0x64], 0x441bb0
mov dword [ebp - 0x5c], esi
lea eax, [ebp - 0x64]
push eax
call fcn.00456848
pop ecx
mov ebx, eax
push esi
call fcn.00441be0
pop ecx
push ebx
call fcn.00456848
test byte [esi + 0x18], 1
pop ecx
je 0x442c0f
mov eax, dword [0x555894]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov edx, dword [eax]
mov ecx, dword [edx - 4]
push ecx
call fcn.0043ef00
pop ecx
mov ebx, eax
mov eax, dword [0x555894]
push eax
call sub.KERNEL32.DLL_TlsGetValue
sub dword [eax], 4
mov edx, dword [0x555894]
push edx
call sub.KERNEL32.DLL_TlsGetValue
mov ecx, dword [eax]
mov eax, dword [ecx]
test dword [eax], 0xb405
je 0x442c3e
mov edx, dword [0x555894]
push edx
call sub.KERNEL32.DLL_TlsGetValue
mov ecx, dword [eax]
mov eax, dword [ecx]
push eax
call fcn.0043f008
pop ecx
jmp 0x442c3e
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x442c31
push eax
call fcn.00456c88
pop ecx
cmp eax, 0xe
je 0x442c27
cmp eax, 0xf
jne 0x442c2c
lea ebx, [edi + 4]
jmp 0x442c3e
lea ebx, [edi + 9]
jmp 0x442c3e
lea ebx, [edi + 9]
jmp 0x442c3e
lea ebx, [edi + 9]
jmp 0x442c3e
lea ebx, [edi + 9]
push esi
call fcn.00441aec
pop ecx
jmp 0x442c4a
lea ebx, [edi + 4]
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x443ad4
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
mov eax, dword [0x555894]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov ebx, eax
push esi
add ebx, 0x90
call fcn.00431ce8
pop ecx
mov edi, eax
test edi, edi
je 0x443b1c
mov eax, dword [ebx + 8]
mov edx, dword [ebx]
lea edx, [edx + eax*8 - 8]
jmp 0x443b10
cmp esi, dword [edx]
je 0x443b15
dec eax
add edx, 0xfffffff8
cmp eax, dword [ebx + 0xc]
ja 0x443b08
cmp eax, dword [ebx + 0xc]
ja 0x443b1c
xor edi, edi
test edi, edi
jne 0x443b8e
mov eax, dword [ebx + 4]
cmp eax, dword [ebx + 8]
jne 0x443b62
test eax, eax
jne 0x443b4a
push 0x320
call fcn.0043b368
pop ecx
mov dword [ebx], eax
mov dword [ebx + 4], 0x64
xor edx, edx
mov dword [ebx + 0xc], edx
mov dword [ebx + 8], edx
jmp 0x443b62
add dword [ebx + 4], 0x32
mov eax, dword [ebx + 4]
shl eax, 3
push eax
mov ecx, dword [ebx]
push ecx
call fcn.0043b3c0
add esp, 8
mov dword [ebx], eax
mov eax, dword [ebx]
mov edx, dword [ebx + 8]
mov dword [eax + edx*8], esi
push esi
call fcn.00431ce8
pop ecx
mov ecx, dword [ebx + 8]
inc dword [ebx + 8]
mov edx, dword [ebx]
mov dword [edx + ecx*8 + 4], eax
call fcn.004439a8
mov edi, eax
push edi
push esi
call fcn.00431cfc
add esp, 8
cmp dword [ebp + 0xc], 0
je 0x443ba7
mov eax, dword [ebp + 0xc]
push eax
push edi
call fcn.0043f0d4
add esp, 8
and dword [edi], 0xfffff7ff
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x443be8
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov eax, dword [0x555894]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov ebx, eax
add ebx, 0x90
jmp 0x443c2b
dec dword [ebx + 8]
mov eax, dword [ebx + 8]
mov edx, dword [ebx]
mov esi, dword [edx + eax*8]
push esi
call fcn.00431ce8
pop ecx
test eax, eax
je 0x443c2b
mov eax, dword [ebx]
mov edx, dword [ebx + 8]
mov ecx, dword [eax + edx*8 + 4]
push ecx
push esi
call fcn.004439f4
add esp, 8
mov eax, dword [ebx + 8]
cmp eax, dword [ebx + 0xc]
ja 0x443c02
mov edx, dword [ebp + 8]
mov dword [ebx + 0xc], edx
pop esi
pop ebx
pop ebp
ret

Function at 0x443c68
Capabilities:
Get thread local storage value

Disassembly:
push ebx
mov eax, dword [0x555894]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov edx, dword [eax + 0xc]
mov ecx, dword [edx]
mov eax, dword [ecx + 0xc]
mov ebx, dword [eax + 4]
mov eax, dword [0x555894]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov dword [eax + 0x9c], ebx
pop ebx
ret
Function at 0x4440b8
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov eax, dword [ebp + 8]
test byte [eax + 1], 4
je 0x444138
mov edx, dword [eax + 8]
push edx
mov eax, dword [eax + 0x10]
push eax
call fcn.00443ee0
add esp, 8
mov ebx, eax
test ebx, ebx
je 0x444150
push ebx
call fcn.00431ce8
pop ecx
test eax, eax
je 0x444150
mov eax, dword [0x555894]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov esi, dword [eax + 0x98]
test esi, esi
jbe 0x44412b
mov eax, dword [0x555894]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov edx, dword [eax + 0x90]
dec esi
cmp ebx, dword [edx + esi*8]
jne 0x444127
push ebx
call fcn.00431ce8
pop ecx
test eax, eax
je 0x444150
push eax
call fcn.0043f008
pop ecx
jmp 0x444150
test esi, esi
ja 0x4440fc
push 0
push ebx
call fcn.004439f4
add esp, 8
jmp 0x444150
push 0xffffffffffffffff
push str.RELEASE
push 0
push 0xbc0
push 1
call fcn.00457160
add esp, 0x14
pop esi
pop ebx
pop ebp
ret

Function at 0x444154
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov eax, dword [0x555894]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov edi, dword [eax + 0x98]
mov eax, dword [0x555894]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov edx, dword [eax + 0xc]
mov ecx, dword [edx]
mov eax, dword [ecx + 0xc]
mov edx, dword [eax + 4]
mov dword [ebp - 4], edx
jmp 0x4441d8
mov ecx, dword [0x555894]
push ecx
call sub.KERNEL32.DLL_TlsGetValue
mov eax, dword [eax + 0x90]
mov ebx, dword [eax + edi*8]
push ebx
call fcn.00431ce8
pop ecx
mov esi, eax
test esi, esi
je 0x4441d8
mov eax, dword [ebp + 8]
push eax
mov edx, dword [ebx]
mov ecx, dword [edx]
push ecx
call fcn.004aa660
add esp, 8
cmp dword [ebp + 0xc], 0
je 0x4441c4
mov edx, eax
jmp 0x4441cd
mov edx, eax
cmp edx, 1
sbb edx, edx
neg edx
test edx, edx
je 0x4441d8
push esi
call fcn.0043f008
pop ecx
mov eax, edi
add edi, 0xffffffff
cmp eax, dword [ebp - 4]
ja 0x444187
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x4441e8
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
mov edi, 0x555894
push esi
call fcn.00431ce8
pop ecx
test eax, eax
jne 0x444206
or eax, 0xffffffff
jmp 0x444253
mov edx, dword [edi]
push edx
call sub.KERNEL32.DLL_TlsGetValue
mov ebx, dword [eax + 0x98]
test ebx, ebx
je 0x44424e
mov eax, dword [edi]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov edx, dword [eax + 0x90]
dec ebx
cmp esi, dword [edx + ebx*8]
jne 0x44424a
mov ecx, dword [edi]
push ecx
call sub.KERNEL32.DLL_TlsGetValue
cmp ebx, dword [eax + 0x9c]
jb 0x444243
mov eax, 4
jmp 0x444253
mov eax, 2
jmp 0x444253
test ebx, ebx
jne 0x444218
mov eax, 1
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4442f0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
jle 0x44432e
call fcn.00433384
cmp eax, ebx
jle 0x44432e
sub eax, ebx
dec eax
push eax
call fcn.004333bc
pop ecx
mov ebx, eax
test ebx, ebx
jle 0x44432e
mov eax, dword [0x555894]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov edx, dword [eax + 8]
mov ecx, dword [edx + ebx*4]
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + 4]
pop ebx
pop ebp
ret
mov edx, dword [0x555894]
push edx
call sub.KERNEL32.DLL_TlsGetValue
mov ecx, dword [eax + 0xc]
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
mov eax, dword [edx + 4]
pop ebx
pop ebp
ret

Function at 0x444348
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
cmp eax, 1
jne 0x444375
xor eax, eax
lea edx, [ebp - 4]
mov dword [ebp - 4], eax
push edx
push 0x4442d4
call fcn.00431ebc
add esp, 8
mov eax, dword [ebp - 4]
jmp 0x4443ba
cmp eax, 4
jne 0x44439a
mov edx, dword [0x555894]
push edx
call sub.KERNEL32.DLL_TlsGetValue
mov ecx, dword [eax + 0x98]
push ecx
push ebx
call fcn.004442f0
pop ecx
pop edx
xchg edx, eax
sub eax, edx
jmp 0x4443ba
cmp eax, 2
jne 0x4443a8
push ebx
call fcn.004442f0
pop ecx
jmp 0x4443ba
mov ecx, dword [0x555894]
push ecx
call sub.KERNEL32.DLL_TlsGetValue
mov eax, dword [eax + 0x98]
pop ebx
pop ecx
pop ebp
ret

Function at 0x4443f8
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
xor esi, esi
xor eax, eax
mov dword [edi], eax
test ebx, ebx
jle 0x444487
dec ebx
cmp dword [ebp + 8], 1
jne 0x44444e
mov dword [ebp - 0xc], ebx
xor edx, edx
mov dword [ebp - 8], edx
lea ecx, [ebp - 0xc]
push ecx
push 0x4443c0
call fcn.00431ebc
add esp, 8
cmp dword [ebp - 8], 0
je 0x444487
mov eax, dword [ebp - 4]
push eax
call fcn.00431ce8
mov esi, eax
mov eax, dword [ebp - 4]
pop ecx
mov edx, dword [eax]
mov ecx, dword [edx]
mov dword [edi], ecx
jmp 0x444487
mov eax, dword [0x555894]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov edx, dword [eax + 0x98]
cmp edx, ebx
jbe 0x444487
mov ecx, dword [0x555894]
push ecx
call sub.KERNEL32.DLL_TlsGetValue
mov eax, dword [eax + 0x90]
mov ebx, dword [eax + ebx*8]
push ebx
call fcn.00431ce8
mov esi, eax
mov eax, dword [ebx]
pop ecx
mov edx, dword [eax]
mov dword [edi], edx
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret