joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4687a0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
mov eax, dword [ebp + 8]
lea esi, [eax + eax]
push 0
call fcn.004935d0
pop ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x4687dc
push eax
mov eax, dword [ebp - 4]
push eax
call fcn.00494630
add esp, 8
xor ebx, ebx
jmp 0x46883f
mov eax, ebx
sub eax, esi
mov edx, dword [edi + 4]
lea ecx, [eax + 1]
mov ecx, dword [edx + ecx*4]
push ecx
mov eax, dword [edx + eax*4]
push eax
push 0xffffffffffffffff
mov eax, dword [ebp - 4]
push eax
call fcn.004936b0
add esp, 0x10
test eax, eax
jne 0x46883c
mov eax, dword [ebp - 4]
push eax
call fcn.00494ec0
pop ecx
mov eax, dword [ebp - 4]
push eax
call fcn.0049f7d0
pop ecx
push 0x30
call fcn.004ab070
pop ecx
push 0
push eax
push 0x696cc0
push 0x46b
push 2
call fcn.00492870
add esp, 0x14
jmp 0x468910
lea ebx, [ebx + 2]
cmp ebx, esi
jb 0x4687e0
mov ebx, 1
jmp 0x46889a
mov eax, dword [edi + 4]
mov eax, dword [eax - 4]
mov eax, dword [eax]
and eax, 0xf405
je 0x468868
mov eax, dword [edi + 4]
mov eax, dword [eax - 4]
push eax
call fcn.004a45e0
pop ecx
jmp 0x468874
mov eax, dword [edi + 4]
mov eax, dword [eax - 4]
mov dword [eax], 0
lea eax, [edi + 4]
mov edx, dword [eax]
lea edx, [edx - 4]
mov dword [eax], edx
mov eax, edx
mov edx, dword [edi]
cmp eax, edx
jae 0x468899
push 0
push 0
push 0
push 0x233b
call fcn.00492ef0
add esp, 0x10
inc ebx
cmp ebx, esi
jb 0x46884a
mov eax, dword [ebp + 8]
test eax, eax
je 0x4688ba
mov eax, dword [ebp - 4]
push eax
mov eax, dword [edi + 4]
mov eax, dword [eax - 4]
push eax
call fcn.004a44a0
add esp, 8
jmp 0x468906
mov eax, dword [ebp - 4]
push eax
mov eax, dword [edi + 4]
mov eax, dword [eax]
push eax
call fcn.004a44a0
add esp, 8
mov eax, dword [edi + 8]
dec eax
mov dword [ebp - 0xc], eax
mov edx, dword [edi + 4]
mov ecx, dword [edi]
sub edx, ecx
mov dword [ebp - 8], edx
mov eax, edx
cdq
and edx, 3
add eax, edx
sar eax, 2
mov ecx, dword [ebp - 0xc]
cmp ecx, eax
jg 0x4688f4
call fcn.004a8c60
lea eax, [edi + 4]
mov edx, dword [eax]
lea edx, [edx + 4]
mov dword [eax], edx
mov eax, dword [edx]
mov dword [eax], 0
mov eax, dword [ebp - 4]
push eax
call fcn.0049f7d0
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x468920
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 8], eax
movzx eax, word [ebp + 0xc]
neg eax
mov edx, dword [ebp - 8]
mov edx, dword [edx + 4]
mov eax, dword [edx + eax*4]
mov dword [ebp - 4], eax
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
cmp eax, 8
je 0x468972
jg 0x46895e
mov eax, dword [ebp - 0xc]
cmp eax, 2
je 0x468968
jmp 0x46898f
mov eax, dword [ebp - 0xc]
cmp eax, 0x10
je 0x468980
jmp 0x46898f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov ebx, eax
jmp 0x468991
mov eax, dword [ebp - 4]
push dword [eax + 0xc]
mov eax, dword [eax + 8]
pop edx
mov ebx, eax
jmp 0x468991
mov eax, dword [ebp - 4]
fld qword [eax + 8]
call fcn.00532060
mov ebx, eax
jmp 0x468991
xor ebx, ebx
push ebx
mov eax, dword [ebp + 8]
push eax
call fcn.004a2750
add esp, 8
movzx eax, word [ebp + 0xc]
dec eax
mov word [ebp + 0xc], ax
movzx eax, ax
test eax, eax
je 0x4689d4
jmp 0x4689d0
mov eax, ebx
lea ebx, [eax - 1]
push eax
mov eax, dword [ebp + 8]
push eax
call fcn.004a30e0
add esp, 8
movzx edx, word [ebp + 0xc]
push edx
push eax
call fcn.00468920
add esp, 8
test ebx, ebx
jne 0x4689b0
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4689e0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov esi, 1
mov eax, dword [ebp + 0x10]
push eax
call fcn.004a2080
pop ecx
mov eax, dword [eax + 8]
push eax
call fcn.0046b2e0
pop ecx
mov eax, dword [ebp + 8]
push eax
call fcn.0046a8b0
pop ecx
mov eax, dword [ebp + 0xc]
push eax
call fcn.0046a8b0
pop ecx
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x468a33
push eax
call fcn.0046a8b0
pop ecx
mov esi, 2
mov eax, esi
movzx eax, ax
push eax
call fcn.00469190
pop ecx
jmp 0x468a90
mov eax, dword [ebx + 4]
mov eax, dword [eax - 4]
mov eax, dword [eax]
and eax, 0xf405
je 0x468a5f
mov eax, dword [ebx + 4]
mov eax, dword [eax - 4]
push eax
call fcn.004a45e0
pop ecx
jmp 0x468a6b
mov eax, dword [ebx + 4]
mov eax, dword [eax - 4]
mov dword [eax], 0
lea eax, [ebx + 4]
mov edx, dword [eax]
lea edx, [edx - 4]
mov dword [eax], edx
mov eax, edx
mov edx, dword [ebx]
cmp eax, edx
jae 0x468a90
push 0
push 0
push 0
push 0x233b
call fcn.00492ef0
add esp, 0x10
mov eax, dword [ebp + 0x18]
lea edx, [eax - 1]
mov dword [ebp + 0x18], edx
test eax, eax
jne 0x468a41
mov eax, dword [ebp + 0x1c]
test eax, eax
je 0x468ab4
lea eax, [ebx + 0x10]
push eax
mov eax, dword [ebp + 0x1c]
push eax
call fcn.004a44a0
add esp, 8
pop esi
pop ebx
pop ebp
ret
Function at 0x468ac0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push eax
call fcn.004a2080
pop ecx
mov eax, dword [eax + 8]
push eax
call fcn.0046b2e0
pop ecx
mov eax, dword [ebp + 8]
push eax
call fcn.0046a8b0
pop ecx
push 0
call fcn.00469190
pop ecx
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x468b15
mov eax, dword [ebp - 4]
lea eax, [eax + 0x10]
push eax
mov eax, dword [ebp + 0x10]
push eax
call fcn.004a44a0
add esp, 8
mov esp, ebp
pop ebp
ret
Function at 0x468dc0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov eax, dword [ebx + 4]
mov edi, dword [eax - 4]
mov eax, dword [ebx + 4]
mov esi, dword [eax - 8]
push 0
push esi
call fcn.00468b20
add esp, 8
push edi
push esi
call fcn.004a44a0
add esp, 8
lea eax, [ebx + 4]
mov edx, dword [eax]
lea edx, [edx - 4]
mov dword [eax], edx
mov eax, edx
mov edx, dword [ebx]
cmp eax, edx
jae 0x468e1a
push 0
push 0
push 0
push 0x233b
call fcn.00492ef0
add esp, 0x10
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x469e30
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
cmp eax, 0x1000
jne 0x469e73
push 0x7be268
call fcn.0046b2e0
pop ecx
mov eax, dword [ebp + 8]
push eax
call fcn.0046a8b0
pop ecx
push 0
call fcn.00469190
pop ecx
jmp 0x469f00
mov eax, dword [ebp + 8]
push eax
call fcn.004a0070
pop ecx
mov dword [ebp - 4], eax
test eax, eax
je 0x469ef6
mov eax, dword [ebp - 4]
push eax
call fcn.004a54e0
pop ecx
mov eax, dword [ebx + 4]
mov eax, dword [eax - 4]
push eax
lea eax, [ebx + 0x10]
push eax
call fcn.004a44a0
add esp, 8
mov eax, dword [ebx + 4]
mov eax, dword [eax - 4]
mov eax, dword [eax]
and eax, 0xf405
je 0x469ec3
mov eax, dword [ebx + 4]
mov eax, dword [eax - 4]
push eax
call fcn.004a45e0
pop ecx
jmp 0x469ecf
mov eax, dword [ebx + 4]
mov eax, dword [eax - 4]
mov dword [eax], 0
lea eax, [ebx + 4]
mov edx, dword [eax]
lea edx, [edx - 4]
mov dword [eax], edx
mov eax, edx
mov edx, dword [ebx]
cmp eax, edx
jae 0x469f00
push 0
push 0
push 0
push 0x233b
call fcn.00492ef0
add esp, 0x10
jmp 0x469f00
lea eax, [ebx + 0x10]
push eax
call fcn.004a45e0
pop ecx
lea eax, [ebx + 0x10]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x469f50
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
movzx eax, word [ebp + 8]
inc eax
neg eax
mov edx, dword [ebx + 4]
mov eax, dword [edx + eax*4]
mov eax, dword [eax]
test eax, eax
je 0x469f85
movzx eax, word [ebp + 8]
push eax
call fcn.00469190
pop ecx
jmp 0x469fad
mov eax, dword [ebx + 0x10]
and eax, 0xf405
je 0x469f9b
lea eax, [ebx + 0x10]
push eax
call fcn.004a45e0
pop ecx
jmp 0x469fa2
mov dword [ebx + 0x10], 0
movzx eax, word [ebp + 8]
push eax
call fcn.00468e20
pop ecx
lea eax, [ebx + 0x10]
push eax
mov eax, dword [ebx + 4]
mov eax, dword [eax]
push eax
call fcn.004a4960
add esp, 8
mov eax, dword [ebx + 8]
dec eax
mov dword [ebp - 8], eax
mov edx, dword [ebx + 4]
mov ecx, dword [ebx]
sub edx, ecx
mov dword [ebp - 4], edx
mov eax, edx
cdq
and edx, 3
add eax, edx
sar eax, 2
mov ecx, dword [ebp - 8]
cmp ecx, eax
jg 0x469fe7
call fcn.004a8c60
lea eax, [ebx + 4]
mov edx, dword [eax]
lea edx, [edx + 4]
mov dword [eax], edx
mov eax, dword [edx]
mov dword [eax], 0
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x46a000
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov eax, dword [ebp + 8]
cmp eax, 1
jl 0x46a237
cmp eax, 8
jg 0x46a237
jmp dword [eax*4 + 0x6968b0]
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46a2d0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
cmp dword [0x7cd4c8], 0
je 0x46a31f
mov dword [0x7cd4c8], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x38]
push eax
movzx eax, word [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
push 0
push 3
call dword [0x7cd4c4]
add esp, 0x14
mov dword [0x7cd4c8], 1
mov esp, ebp
pop ebp
ret

Function at 0x46a3e0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
mov eax, dword [esi + 0x30]
mov eax, dword [eax]
movzx edi, word [eax + 0xe]
mov eax, dword [esi + 0x30]
mov eax, dword [eax]
mov dword [ebp - 8], eax
movzx eax, byte [ebp + 0xc]
cmp eax, 0xff
jne 0x46a465
mov eax, dword [ebp - 8]
mov dx, word [ebp + 8]
mov word [eax + 0x10], dx
jmp 0x46a425
call fcn.0046a9c0
movzx eax, word [ebp + 8]
lea edx, [eax - 1]
mov word [ebp + 8], dx
test eax, eax
jg 0x46a420
mov eax, dword [ebp - 8]
mov ax, word [eax + 0x10]
mov word [ebp + 8], ax
jmp 0x46a45c
mov eax, dword [esi + 0x30]
lea eax, [eax + edi*4 + 4]
movzx edx, word [ebp + 8]
mov edx, dword [eax + edx*4]
push edx
mov eax, dword [eax]
push eax
call fcn.004a4920
add esp, 8
dec edi
test edi, edi
jg 0x46a441
jmp 0x46a4ce
movzx eax, byte [ebp + 0xc]
mov ebx, edi
sub ebx, eax
jmp 0x46a49b
mov eax, ebx
neg eax
mov edx, dword [esi + 4]
mov eax, dword [edx + eax*4]
mov dword [ebp - 0xc], eax
mov eax, dword [eax]
and eax, 0xf405
je 0x46a491
mov eax, dword [ebp - 0xc]
push eax
call fcn.004a45e0
pop ecx
jmp 0x46a49a
mov eax, dword [ebp - 0xc]
mov dword [eax], 0
dec ebx
test ebx, ebx
jg 0x46a46f
movzx eax, word [ebp + 8]
movzx edx, byte [ebp + 0xc]
add eax, edx
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x46a4ce
mov eax, dword [ebp - 4]
sub eax, edi
mov dword [ebp - 0xc], eax
jmp 0x46a4c1
call fcn.0046a9c0
mov eax, dword [ebp - 0xc]
lea edx, [eax - 1]
mov dword [ebp - 0xc], edx
test eax, eax
jg 0x46a4bc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x46a560
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov eax, dword [ebx + 4]
mov eax, dword [eax - 4]
push eax
lea eax, [ebx + 0x10]
push eax
call fcn.004a44a0
add esp, 8
lea eax, [ebx + 4]
mov edx, dword [eax]
lea edx, [edx - 4]
mov dword [eax], edx
mov eax, edx
mov edx, dword [ebx]
cmp eax, edx
jae 0x46a5aa
push 0
push 0
push 0
push 0x233b
call fcn.00492ef0
add esp, 0x10
pop ebx
pop ebp
ret
Function at 0x46a920
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov eax, dword [ebx + 8]
dec eax
mov dword [ebp - 8], eax
mov edx, dword [ebx + 4]
mov ecx, dword [ebx]
sub edx, ecx
mov dword [ebp - 4], edx
mov eax, edx
cdq
and edx, 3
add eax, edx
sar eax, 2
mov ecx, dword [ebp - 8]
cmp ecx, eax
jg 0x46a95d
call fcn.004a8c60
lea eax, [ebx + 4]
mov edx, dword [eax]
lea edx, [edx + 4]
mov dword [eax], edx
mov eax, dword [edx]
mov dword [eax], 0
lea eax, [ebx + 0x10]
push eax
mov eax, dword [ebx + 4]
mov eax, dword [eax]
push eax
call fcn.004a44a0
add esp, 8
mov eax, dword [ebx + 8]
dec eax
mov dword [ebp - 8], eax
mov edx, dword [ebx + 4]
mov ecx, dword [ebx]
sub edx, ecx
mov dword [ebp - 4], edx
mov eax, edx
cdq
and edx, 3
add eax, edx
sar eax, 2
mov ecx, dword [ebp - 8]
cmp ecx, eax
jg 0x46a9a9
call fcn.004a8c60
lea eax, [ebx + 4]
mov edx, dword [eax]
lea edx, [edx + 4]
mov dword [eax], edx
mov eax, dword [edx]
mov dword [eax], 0
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x46a9c0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov eax, dword [ebx + 4]
mov eax, dword [eax]
mov dword [eax], 0
mov eax, dword [ebx + 8]
dec eax
mov dword [ebp - 8], eax
mov edx, dword [ebx + 4]
mov ecx, dword [ebx]
sub edx, ecx
mov dword [ebp - 4], edx
mov eax, edx
cdq
and edx, 3
add eax, edx
sar eax, 2
mov ecx, dword [ebp - 8]
cmp ecx, eax
jg 0x46aa08
call fcn.004a8c60
lea eax, [ebx + 4]
mov edx, dword [eax]
lea edx, [edx + 4]
mov dword [eax], edx
mov eax, dword [edx]
mov dword [eax], 0
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x46aa20
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov eax, dword [ebx + 4]
mov eax, dword [eax]
mov dword [eax], pe_nt_image_headers32
mov eax, dword [ebx + 4]
mov eax, dword [eax]
mov edx, dword [ebp + 8]
mov dword [eax + 8], edx
mov eax, dword [ebx + 8]
dec eax
mov dword [ebp - 8], eax
mov edx, dword [ebx + 4]
mov ecx, dword [ebx]
sub edx, ecx
mov dword [ebp - 4], edx
mov eax, edx
cdq
and edx, 3
add eax, edx
sar eax, 2
mov ecx, dword [ebp - 8]
cmp ecx, eax
jg 0x46aa73
call fcn.004a8c60
lea eax, [ebx + 4]
mov edx, dword [eax]
lea edx, [edx + 4]
mov dword [eax], edx
mov eax, dword [edx]
mov dword [eax], 0
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46ac40
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov eax, dword [ebx + 4]
mov eax, dword [eax]
mov dword [eax], 2
mov eax, dword [ebx + 4]
mov eax, dword [eax]
mov edx, dword [ebp + 8]
mov dword [eax + 0xc], edx
cmp dword [ebp + 8], 0xc4653600
jg 0x46ac7c
mov esi, 0x14
jmp 0x46ac81
mov esi, 0xa
mov eax, dword [ebx + 4]
mov eax, dword [eax]
mov edx, esi
mov dword [eax + 8], edx
mov eax, dword [ebx + 8]
dec eax
mov dword [ebp - 8], eax
mov edx, dword [ebx + 4]
mov ecx, dword [ebx]
sub edx, ecx
mov dword [ebp - 4], edx
mov eax, edx
cdq
and edx, 3
add eax, edx
sar eax, 2
mov ecx, dword [ebp - 8]
cmp ecx, eax
jg 0x46acb3
call fcn.004a8c60
lea eax, [ebx + 4]
mov edx, dword [eax]
lea edx, [edx + 4]
mov dword [eax], edx
mov eax, dword [edx]
mov dword [eax], 0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x46acd0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov eax, dword [ebx + 4]
mov eax, dword [eax]
mov dword [eax], 2
mov eax, dword [ebx + 4]
mov eax, dword [eax]
mov edx, dword [ebp + 8]
mov dword [eax + 0xc], edx
mov eax, dword [ebp + 8]
cdq
push edx
push eax
call fcn.0046abd0
add esp, 8
mov edx, dword [ebx + 4]
mov edx, dword [edx]
mov dword [edx + 8], eax
mov eax, dword [ebx + 8]
dec eax
mov dword [ebp - 8], eax
mov edx, dword [ebx + 4]
mov ecx, dword [ebx]
sub edx, ecx
mov dword [ebp - 4], edx
mov eax, edx
cdq
and edx, 3
add eax, edx
sar eax, 2
mov ecx, dword [ebp - 8]
cmp ecx, eax
jg 0x46ad39
call fcn.004a8c60
lea eax, [ebx + 4]
mov edx, dword [eax]
lea edx, [edx + 4]
mov dword [eax], edx
mov eax, dword [edx]
mov dword [eax], 0
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x46ad50
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov eax, dword [ebx + 4]
mov eax, dword [eax]
mov dword [eax], 2
mov eax, dword [ebx + 4]
mov eax, dword [eax]
mov edx, dword [ebp + 8]
mov dword [eax + 0xc], edx
cmp dword [ebp + 8], 0xc4653600
jg 0x46ad8c
mov esi, 0x14
jmp 0x46ad91
mov esi, 0xa
mov eax, dword [ebx + 4]
mov eax, dword [eax]
mov edx, esi
mov dword [eax + 8], edx
mov eax, dword [ebx + 8]
dec eax
mov dword [ebp - 8], eax
mov edx, dword [ebx + 4]
mov ecx, dword [ebx]
sub edx, ecx
mov dword [ebp - 4], edx
mov eax, edx
cdq
and edx, 3
add eax, edx
sar eax, 2
mov ecx, dword [ebp - 8]
cmp ecx, eax
jg 0x46adc3
call fcn.004a8c60
lea eax, [ebx + 4]
mov edx, dword [eax]
lea edx, [edx + 4]
mov dword [eax], edx
mov eax, dword [edx]
mov dword [eax], 0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46ade0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov eax, dword [ebx + 4]
mov eax, dword [eax]
mov dword [eax], 8
mov eax, dword [ebx + 4]
mov eax, dword [eax]
push dword [ebp + 0xc]
mov esi, dword [ebp + 8]
pop edi
mov dword [eax + 8], esi
mov dword [eax + 0xc], edi
push dword [ebp + 0xc]
mov eax, dword [ebp + 8]
pop edx
push edx
push eax
push dword [0x696e78]
push dword [0x696e74]
call fcn.00531e80
jae 0x46ae45
push edx
push eax
push dword [0x696e70]
push dword [0x696e6c]
call fcn.00531e50
jae 0x46ae4e
mov dword [ebp - 4], 0x14
jmp 0x46ae55
mov dword [ebp - 4], 0xa
mov eax, dword [ebx + 4]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
mov dword [eax + 0x10], edx
mov eax, dword [ebx + 8]
dec eax
mov dword [ebp - 0xc], eax
mov edx, dword [ebx + 4]
mov ecx, dword [ebx]
sub edx, ecx
mov dword [ebp - 8], edx
mov eax, edx
cdq
and edx, 3
add eax, edx
sar eax, 2
mov ecx, dword [ebp - 0xc]
cmp ecx, eax
jg 0x46ae88
call fcn.004a8c60
lea eax, [ebx + 4]
mov edx, dword [eax]
lea edx, [edx + 4]
mov dword [eax], edx
mov eax, dword [edx]
mov dword [eax], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x46aeb0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov eax, dword [ebx + 4]
mov eax, dword [eax]
mov dword [eax], 8
mov eax, dword [ebx + 4]
mov eax, dword [eax]
push dword [ebp + 0xc]
mov esi, dword [ebp + 8]
pop edi
mov dword [eax + 8], esi
mov dword [eax + 0xc], edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0046abd0
add esp, 8
mov edx, dword [ebx + 4]
mov edx, dword [edx]
mov dword [edx + 0x10], eax
mov eax, dword [ebx + 8]
dec eax
mov dword [ebp - 8], eax
mov edx, dword [ebx + 4]
mov ecx, dword [ebx]
sub edx, ecx
mov dword [ebp - 4], edx
mov eax, edx
cdq
and edx, 3
add eax, edx
sar eax, 2
mov ecx, dword [ebp - 8]
cmp ecx, eax
jg 0x46af22
call fcn.004a8c60
lea eax, [ebx + 4]
mov edx, dword [eax]
lea edx, [edx + 4]
mov dword [eax], edx
mov eax, dword [edx]
mov dword [eax], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46af40
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov eax, dword [ebx + 4]
mov eax, dword [eax]
mov dword [eax], 0x10
mov eax, dword [ebx + 4]
mov eax, dword [eax]
fld qword [ebp + 8]
fstp qword [eax + 8]
fld qword [0x696e44]
fcomp qword [ebp + 8]
wait
fnstsw ax
sahf
jbe 0x46af8a
fld qword [0x696e3c]
fcomp qword [ebp + 8]
wait
fnstsw ax
sahf
jb 0x46af91
mov esi, 0x14
jmp 0x46af96
mov esi, 0xa
mov eax, dword [ebx + 4]
mov eax, dword [eax]
mov edx, esi
mov dword [eax + 0x10], edx
mov eax, dword [ebx + 4]
mov eax, dword [eax]
mov edx, dword [ebp + 0x10]
mov dword [eax + 0x14], edx
cmp dword [ebp + 0x10], 0xff
jne 0x46afc2
mov eax, dword [ebx + 4]
mov eax, dword [eax]
mov edx, dword [0x7d7f4c]
mov dword [eax + 0x14], edx
mov eax, dword [ebx + 8]
dec eax
mov dword [ebp - 0x10], eax
mov edx, dword [ebx + 4]
mov ecx, dword [ebx]
sub edx, ecx
mov dword [ebp - 0xc], edx
mov eax, edx
cdq
and edx, 3
add eax, edx
sar eax, 2
mov ecx, dword [ebp - 0x10]
cmp ecx, eax
jg 0x46afea
call fcn.004a8c60
lea eax, [ebx + 4]
mov edx, dword [eax]
lea edx, [edx + 4]
mov dword [eax], edx
mov eax, dword [edx]
mov dword [eax], 0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x46b010
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov eax, dword [ebx + 4]
mov eax, dword [eax]
mov dword [eax], 0x10
mov eax, dword [ebx + 4]
mov eax, dword [eax]
fld qword [ebp + 8]
fstp qword [eax + 8]
mov eax, dword [ebx + 4]
mov eax, dword [eax]
mov edx, dword [ebp + 0x14]
mov dword [eax + 0x14], edx
mov eax, dword [ebx + 4]
mov eax, dword [eax]
mov edx, dword [ebp + 0x10]
mov dword [eax + 0x10], edx
cmp dword [ebp + 0x14], 0xff
jne 0x46b069
mov eax, dword [ebx + 4]
mov eax, dword [eax]
mov edx, dword [0x7d7f4c]
mov dword [eax + 0x14], edx
cmp dword [ebp + 0x10], 0xff
jne 0x46b0a6
fld qword [0x696e44]
fcomp qword [ebp + 8]
wait
fnstsw ax
sahf
jbe 0x46b090
fld qword [0x696e3c]
fcomp qword [ebp + 8]
wait
fnstsw ax
sahf
jb 0x46b097
mov esi, 0x14
jmp 0x46b09c
mov esi, 0xa
mov eax, dword [ebx + 4]
mov eax, dword [eax]
mov edx, esi
mov dword [eax + 0x10], edx
mov eax, dword [ebx + 8]
dec eax
mov dword [ebp - 8], eax
mov edx, dword [ebx + 4]
mov ecx, dword [ebx]
sub edx, ecx
mov dword [ebp - 4], edx
mov eax, edx
cdq
and edx, 3
add eax, edx
sar eax, 2
mov ecx, dword [ebp - 8]
cmp ecx, eax
jg 0x46b0ce
call fcn.004a8c60
lea eax, [ebx + 4]
mov edx, dword [eax]
lea edx, [edx + 4]
mov dword [eax], edx
mov eax, dword [edx]
mov dword [eax], 0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret