joyce8/EMBER2024-capa huggingface dataset:
Function at 0x423a30
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov ebx, eax
mov eax, dword [ebx]
mov esi, dword [eax - 4]
test byte [esi + 1], 4
je 0x423b3f
mov edi, dword [esi + 0x10]
mov al, byte [edi]
cmp al, 0x4d
je 0x423a5f
cmp al, 0x6d
jne 0x423acd
cmp dword [esi + 8], 1
je 0x423a89
cmp dword [esi + 8], 4
jb 0x423b3f
mov edx, dword [esi + 8]
push edx
push 0x5386c9
push edi
call fcn.004a86ec
add esp, 0xc
test eax, eax
jne 0x423b3f
mov ecx, dword [ebx]
mov eax, dword [ecx - 8]
push eax
mov edx, dword [ebp + 8]
push edx
call fcn.00443a4c
add esp, 8
sub dword [ebx], 4
mov ecx, dword [ebx]
mov eax, dword [ecx]
test dword [eax], 0xb405
je 0x423ab1
push eax
call fcn.0043edc0
pop ecx
sub dword [ebx], 4
mov edx, dword [ebx]
mov eax, dword [edx]
test dword [eax], 0xb405
je 0x423b49
push eax
call fcn.0043edc0
pop ecx
jmp 0x423b49
cmp dword [esi + 8], 4
jb 0x423b3f
mov edx, dword [esi + 8]
push edx
push 0x5386d0
push edi
call fcn.004a86ec
add esp, 0xc
test eax, eax
je 0x423aff
mov ecx, dword [esi + 8]
push ecx
push 0x5386d6
push edi
call fcn.004a86ec
add esp, 0xc
test eax, eax
jne 0x423b3f
mov eax, dword [ebp + 8]
push eax
mov edx, dword [ebx]
mov ecx, dword [edx - 8]
push ecx
call fcn.00483938
add esp, 8
sub dword [ebx], 4
mov eax, dword [ebx]
mov eax, dword [eax]
test dword [eax], 0xb405
je 0x423b27
push eax
call fcn.0043edc0
pop ecx
sub dword [ebx], 4
mov edx, dword [ebx]
mov eax, dword [edx]
test dword [eax], 0xb405
je 0x423b49
push eax
call fcn.0043edc0
pop ecx
jmp 0x423b49
mov edx, dword [ebp + 8]
push edx
call fcn.004239cc
pop ecx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x423b50
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov ebx, eax
mov eax, dword [ebx]
mov edi, dword [eax - 4]
and dword [edi], 0xfffbf7ff
test esi, esi
jl 0x423bb4
mov eax, dword [ebx + 0xc]
mov eax, dword [eax]
mov dx, word [eax + 0x12]
cmp dx, word [eax + 0x10]
jae 0x423ba7
mov ecx, dword [ebx + 0xc]
mov eax, dword [ecx]
movzx edx, word [eax + 0x12]
cmp esi, edx
jle 0x423ba7
mov ecx, dword [ebx + 0xc]
mov eax, dword [ecx]
mov ecx, dword [ebx + 0xc]
movzx edx, word [eax + 0x10]
mov eax, dword [ecx]
movzx ecx, word [eax + 0x12]
sub edx, ecx
jmp 0x423ba9
xor edx, edx
add esi, edx
mov eax, dword [ebx + 0xc]
mov eax, dword [eax + esi*4 + 4]
jmp 0x423bc7
push esi
mov edx, dword [ebx + 0xc]
mov ecx, dword [edx + 4]
mov eax, dword [ecx + 8]
push eax
call fcn.004322e8
add esp, 8
push edi
push eax
call fcn.0043f0fc
add esp, 8
sub dword [ebx], 4
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x423bdc
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov ebx, eax
mov eax, dword [ebx]
mov eax, dword [eax - 4]
and dword [eax], 0xfffbf7ff
mov edx, dword [ebx + 0x8c]
mov ecx, dword [edx + 8]
mov edx, dword [ecx]
movzx ecx, word [ebp + 8]
shl ecx, 3
lea ecx, [ecx + ecx*2]
add edx, ecx
add edx, 0xffffffe8
push eax
push edx
call fcn.0043f0fc
add esp, 8
sub dword [ebx], 4
pop ebx
pop ebp
ret

Function at 0x424954
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
push edi
push ecx
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov dword [esp], eax
mov ebx, dword [0x53854c]
cmp dword [0x538540], 0
je 0x4249de
mov edx, dword [esp]
xor eax, eax
mov dword [0x538540], eax
test ebx, ebx
mov word [edx + 0x34], 0
je 0x4249de
cmp dword [ebx + 0x18], 0
je 0x4249d7
test byte [ebx + 0xc], 0x10
je 0x4249d7
xor esi, esi
jmp 0x4249d1
movzx edi, si
shl edi, 4
mov edx, dword [ebx]
mov ax, word [edx + edi + 4]
and ax, 0x18
cmp ax, 0x10
jne 0x4249d0
add edi, edx
push edi
call fcn.004231dc
pop ecx
call fcn.00422ba8
push 0
call fcn.00422014
pop ecx
mov ecx, dword [esp]
cmp word [ecx + 0x34], 0
jne 0x4249de
inc esi
cmp si, word [ebx + 4]
jb 0x424999
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x424989
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x424af4
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov esi, eax
push 0x20
call fcn.0043b120
pop ecx
mov ebx, eax
push 0x18
call fcn.0043b120
pop ecx
mov edi, eax
mov dword [ebx + 0x18], edi
mov dword [edi], 0x22000
mov eax, dword [ebp + 8]
mov dword [edi + 8], eax
mov dword [edi + 0xc], 0x5385e8
mov dword [ebx], 0x6000
mov edx, dword [ebx + 0x18]
mov dword [ebx + 8], edx
add dword [esi], 4
mov ecx, dword [esi]
cmp ecx, dword [esi + 4]
jne 0x424b4c
call fcn.00432adc
mov eax, dword [esi]
mov eax, dword [eax - 4]
mov dword [eax], 0x22000
mov dword [eax + 8], ebx
mov dword [eax + 0xc], 0x5385fc
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x424e30
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov esi, eax
push 0x38
call fcn.0043b120
mov ebx, eax
pop ecx
mov eax, dword [ebp + 0x10]
xor ecx, ecx
mov dword [ebx], eax
mov edx, dword [ebp + 0xc]
mov dword [ebx + 4], edx
lea edx, [ebx + 8]
mov dword [ebx + 0x20], 0x40000
mov dword [ebx + 8], ecx
mov eax, dword [ebp + 8]
push eax
push edx
call fcn.0043f03c
add esp, 8
add esi, 0x10
test dword [esi], 0xb405
je 0x424e85
push esi
call fcn.0043edc0
pop ecx
mov dword [esi], 0x22000
mov dword [esi + 8], ebx
mov dword [esi + 0xc], 0x538610
mov eax, 1
pop esi
pop ebx
pop ebp
ret
Function at 0x4251dc
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov ebx, eax
mov eax, dword [ebx + 0x30]
jmp 0x4251fc
mov edx, dword [ebx + 8]
mov ecx, dword [edx + eax*4 - 4]
mov eax, dword [ecx + 0xc]
test eax, eax
je 0x42520d
mov edx, dword [ebx + 8]
mov ecx, dword [edx + eax*4 - 4]
test byte [ecx + 0x10], 0x80
jne 0x4251f2
test eax, eax
je 0x425234
cmp dword [ebp + 8], 0
je 0x42522b
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebx + 8]
mov eax, dword [ecx + eax*4 - 8]
push eax
call fcn.0043ee8c
add esp, 8
mov word [ebx + 0x34], 2
pop ebx
pop ebp
ret
call fcn.004251b4
pop ebx
pop ebp
ret

Function at 0x42523c
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffe64
mov edi, 0x538638
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov esi, eax
cmp dword [esi + 0xdc], 0
je 0x425328
xor ebx, ebx
push 0
call fcn.004537ec
push eax
call fcn.00453834
add esp, 8
push 0
lea eax, [edi + 0x125]
push eax
call fcn.00453834
add esp, 8
jmp 0x4252f5
lea edx, [esp + 4]
push edx
call fcn.004ab624
pop ecx
lea ecx, [esp + 0x94]
push ecx
cmp byte [esp + 0x98], 0
je 0x4252ae
lea edx, [edi + 0x13f]
jmp 0x4252b1
lea edx, [edi + 4]
push edx
lea edx, [edi + 0x134]
movzx ecx, word [esp + 8]
push ecx
mov ecx, 0x8d
sub ecx, eax
push edx
push ecx
lea edx, [esp + 0x18]
add eax, edx
push eax
call fcn.004a8478
add esp, 0x18
push 0
lea eax, [esp + 8]
push eax
call fcn.00453834
add esp, 8
push 0
call fcn.004537ec
push eax
call fcn.00453834
add esp, 8
lea ecx, [esp + 0x94]
push ecx
lea eax, [esp + 4]
push eax
lea edx, [esp + 0xc]
push edx
mov ecx, ebx
inc ebx
push ecx
call fcn.0044deec
add esp, 0x10
test eax, eax
jne 0x425289
xor eax, eax
mov dword [0x538540], eax
mov word [esi + 0x34], 1
add esp, 0x19c
pop edi
pop esi
pop ebx
ret

Function at 0x425334
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
test byte [0x538504], 2
je 0x42535b
cmp word [eax + 0x36], 0
jne 0x42535b
mov word [eax + 0x36], 1
mov word [eax + 0x34], 1
mov ax, word [eax + 0x34]
ret
Function at 0x425360
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
push edi
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov ebx, eax
xor esi, esi
cmp dword [0x53853c], 0
je 0x42537f
test ebx, ebx
jne 0x425389
xor eax, eax
jmp 0x4253f3
call fcn.0041aab8
inc esi
cmp dword [ebx + 0x1c0], 0
jg 0x425383
mov edx, dword [ebx]
mov ecx, dword [edx]
push esi
mov edi, ecx
lea esi, [ebx + 0x10]
mov ecx, 6
rep movsd dword es:[edi], dword [esi]
pop esi
xor eax, eax
mov dword [ebx + 0x10], eax
add dword [ebx], 4
mov edx, dword [ebx]
cmp edx, dword [ebx + 4]
jne 0x4253b8
call fcn.00432adc
add dword [ebx], 4
mov ecx, dword [ebx]
cmp ecx, dword [ebx + 4]
jne 0x4253c7
call fcn.00432adc
mov eax, dword [ebx]
xor edx, edx
mov eax, dword [eax - 4]
mov dword [eax], 0x80000
mov dword [eax + 8], edx
mov dword [eax + 0xc], esi
mov word [eax + 0x10], 0
mov cx, word [ebx + 0x34]
mov word [eax + 0x12], cx
mov eax, 1
mov word [ebx + 0x34], 0
pop edi
pop esi
pop ebx
ret

Function at 0x4253f8
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
push edi
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov ebx, eax
mov eax, dword [ebx]
mov esi, dword [eax - 4]
cmp dword [esi], 0x80000
je 0x42542b
push 0
push 0
push str.hb_vmRequestRestore
push 0x2328
call fcn.00457320
add esp, 0x10
mov ax, word [esi + 0x12]
or ax, word [ebx + 0x34]
mov edx, eax
test dh, 1
je 0x425441
call fcn.0041afd4
jmp 0x4254b4
test dl, 1
mov esi, dword [esi + 0xc]
je 0x425451
mov word [ebx + 0x34], 1
jmp 0x425471
test dl, 2
je 0x42545e
mov word [ebx + 0x34], 2
jmp 0x425471
test dl, 4
je 0x42546b
mov word [ebx + 0x34], 4
jmp 0x425471
mov word [ebx + 0x34], 0
sub dword [ebx], 4
test dword [ebx + 0x10], 0xb405
je 0x425487
lea ecx, [ebx + 0x10]
push ecx
call fcn.0043edc0
pop ecx
sub dword [ebx], 4
lea edi, [ebx + 0x10]
mov eax, dword [ebx]
mov ecx, 6
mov edx, dword [eax]
push esi
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebx]
xor ecx, ecx
pop esi
mov edx, dword [eax]
mov dword [edx], ecx
jmp 0x4254ab
call fcn.0041aa48
mov eax, esi
add esi, 0xffffffff
test eax, eax
jg 0x4254a6
pop edi
pop esi
pop ebx
ret

Function at 0x425d78
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, dword [ebp + 8]
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
test ebx, ebx
jl 0x425dc8
mov edx, dword [eax + 0xc]
mov edx, dword [edx]
mov si, word [edx + 0x12]
cmp si, word [edx + 0x10]
jae 0x425dbb
movzx edx, si
cmp ebx, edx
jle 0x425dbb
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx]
movzx ecx, word [edx + 0x10]
mov edx, dword [eax + 0xc]
mov edx, dword [edx]
movzx edx, word [edx + 0x12]
sub ecx, edx
jmp 0x425dbd
xor ecx, ecx
add ebx, ecx
mov eax, dword [eax + 0xc]
mov eax, dword [eax + ebx*4 + 4]
jmp 0x425ddb
push ebx
mov eax, dword [eax + 0xc]
mov edx, dword [eax + 4]
mov ecx, dword [edx + 8]
push ecx
call fcn.004322e8
add esp, 8
pop esi
pop ebx
pop ebp
ret
Function at 0x429898
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, dword [ebp + 8]
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
add dword [eax], 4
mov esi, dword [eax]
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
cmp esi, dword [eax + 4]
jne 0x4298c5
call fcn.00432adc
mov edx, dword [0x54d750]
push edx
call sub.KERNEL32.DLL_TlsGetValue
mov ecx, dword [eax]
mov eax, dword [ecx - 4]
mov dword [eax], 0x8000
mov dword [eax + 8], ebx
push ebx
call fcn.0043b7d0
pop ecx
pop esi
pop ebx
pop ebp
ret
Function at 0x42b338
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
push eax
call fcn.00433174
pop ecx
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jle 0x42b36f
mov edx, dword [0x54d750]
push edx
call sub.KERNEL32.DLL_TlsGetValue
mov ecx, dword [eax + 8]
mov eax, dword [ebp - 8]
mov edx, dword [ecx + eax*4]
mov di, word [edx + 0x10]
jmp 0x42b371
xor edi, edi
movzx eax, di
push eax
call fcn.0043d994
pop ecx
mov dword [ebp - 4], eax
mov bx, 1
cmp di, bx
jb 0x42b3b5
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
movzx esi, bx
mov edx, dword [eax + 8]
mov eax, esi
add eax, dword [ebp - 8]
mov edx, dword [edx + eax*4 + 4]
push edx
push esi
mov ecx, dword [ebp - 4]
push ecx
call fcn.00429df4
add esp, 0xc
inc ebx
cmp di, bx
jae 0x42b387
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x42b3c0
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
push edi
push 0
call fcn.0043d7dc
pop ecx
mov esi, eax
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov edx, dword [eax + 0xc]
mov ecx, dword [edx]
mov di, word [ecx + 0x10]
movzx eax, di
push eax
push esi
call fcn.004299e4
mov bx, 1
add esp, 8
cmp di, bx
jb 0x42b420
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
movzx ecx, bx
mov edx, dword [eax + 0xc]
mov eax, dword [edx + ecx*4 + 4]
movzx edx, bx
push eax
push edx
push esi
call fcn.00429df4
add esp, 0xc
inc ebx
cmp di, bx
jae 0x42b3f7
mov eax, esi
pop edi
pop esi
pop ebx
ret

Function at 0x42b428
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
push edi
push 0
call fcn.0043d7dc
pop ecx
mov esi, eax
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov edx, dword [eax + 0xc]
mov ecx, dword [edx]
mov di, word [ecx + 0x10]
movzx eax, di
inc eax
push eax
push esi
call fcn.004299e4
add esp, 8
xor ebx, ebx
cmp di, bx
jb 0x42b488
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
movzx ecx, bx
mov edx, dword [eax + 0xc]
mov eax, dword [edx + ecx*4 + 4]
movzx edx, bx
inc edx
push eax
push edx
push esi
call fcn.00429df4
add esp, 0xc
inc ebx
cmp di, bx
jae 0x42b45e
mov eax, esi
pop edi
pop esi
pop ebx
ret
Function at 0x42bee4
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
xor ebp, ebp
mov dword [esp], 0x538bec
mov edi, 0x538bbc
mov eax, dword [edi]
push eax
call fcn.004319e0
pop ecx
mov esi, eax
test esi, esi
je 0x42bf69
push esi
call fcn.00431a74
pop ecx
test eax, eax
je 0x42bf69
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov ebx, eax
add ebx, 0x10
test dword [ebx], 0xb405
je 0x42bf32
push ebx
call fcn.0043edc0
pop ecx
jmp 0x42bf36
xor eax, eax
mov dword [ebx], eax
push esi
call fcn.00423218
pop ecx
call fcn.00422ba8
push 0
call fcn.00422014
test byte [ebx + 1], 0x80
pop ecx
je 0x42bf69
mov edx, dword [ebx + 8]
cmp word [edx + 0xc], 0
je 0x42bf69
mov ecx, dword [ebx + 8]
mov edx, dword [esp]
mov ax, word [ecx + 0xc]
mov ecx, dword [edx]
mov word [ecx], ax
inc ebp
add dword [esp], 4
add edi, 4
cmp ebp, 0xc
jl 0x42bef7
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x42c620
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push 1
call fcn.00433174
pop ecx
mov ebx, eax
test ebx, ebx
jle 0x42c669
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov edx, dword [eax + 8]
mov ecx, dword [edx + ebx*4]
mov eax, dword [ecx + 0xc]
mov dx, word [eax + 0xc]
test dx, dx
je 0x42c669
movzx ecx, dx
movzx eax, word [eax + 0xe]
mov edx, dword [0x538bb0]
shl eax, 5
mov ecx, dword [edx + ecx*4]
mov edx, dword [ecx + 8]
mov ax, word [edx + eax + 0x14]
pop ebx
ret
xor eax, eax
pop ebx
ret

Function at 0x42c670
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
xor ebx, ebx
push 1
call fcn.00433174
pop ecx
mov esi, eax
test esi, esi
jle 0x42c6c8
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov edx, dword [eax + 8]
mov ecx, dword [edx + esi*4]
mov ebx, dword [ecx + 8]
cmp ebx, 0x53852c
je 0x42c6a9
mov eax, dword [ebx + 0xc]
cmp eax, dword [0x538538]
jne 0x42c6c8
mov edx, dword [0x54d750]
push edx
call sub.KERNEL32.DLL_TlsGetValue
mov ecx, dword [eax + 8]
mov eax, dword [ecx + esi*4 + 4]
test byte [eax + 1], 0x10
je 0x42c6c8
mov edx, dword [eax + 8]
mov ebx, dword [edx + 8]
push ebx
call fcn.00423c24
pop ecx
pop esi
pop ebx
ret

Function at 0x42c6d4
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push 1
call fcn.00433174
pop ecx
mov ebx, eax
test ebx, ebx
jle 0x42c704
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov edx, dword [eax + 8]
mov eax, dword [edx + ebx*4 + 4]
test byte [eax + 1], 0x80
je 0x42c704
mov edx, dword [eax + 8]
mov ax, word [edx + 0xc]
pop ebx
ret
xor eax, eax
pop ebx
ret
Function at 0x42d18c
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov ebx, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
push ebx
push edi
push esi
call fcn.0042c990
add esp, 0xc
test eax, eax
je 0x42d377
mov edx, 0x431040
cmp edx, dword [eax + 8]
jne 0x42d268
mov eax, dword [esi + 8]
mov edx, dword [0x538bb0]
mov cx, word [eax + 0xc]
mov word [ebp - 2], cx
movzx eax, word [ebx + 0xc]
movzx ecx, word [ebx + 0xe]
mov eax, dword [edx + eax*4]
shl ecx, 5
mov edx, dword [eax + 8]
add edx, ecx
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
movzx edi, word [eax + 0x18]
mov ax, word [ebx + 0xc]
cmp ax, word [ebp - 2]
je 0x42d227
mov edx, dword [ebp - 8]
mov eax, dword [0x538bb0]
movzx ecx, word [edx + 0x14]
mov edx, dword [eax + ecx*4]
mov ecx, dword [edx + 4]
mov edx, dword [0x538bb0]
push ecx
movzx eax, word [ebp - 2]
mov ecx, dword [edx + eax*4]
push ecx
call fcn.0042b7a0
add esp, 8
movzx eax, ax
add edi, eax
jmp 0x42d230
mov edx, dword [ebp - 8]
movzx ecx, word [edx + 0x1a]
add edi, ecx
push esi
call fcn.00429b78
pop ecx
cmp edi, eax
jbe 0x42d245
push edi
push esi
call fcn.00429a64
add esp, 8
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
add eax, 0x10
push eax
push edi
push esi
call fcn.00429ee0
add esp, 0xc
jmp 0x42d379
mov edx, 0x430d60
cmp edx, dword [eax + 8]
jne 0x42d2b7
movzx ecx, word [ebx + 0xc]
movzx edx, word [ebx + 0xe]
mov eax, dword [0x538bb0]
shl edx, 5
mov esi, dword [eax + ecx*4]
mov ecx, dword [0x54d750]
mov eax, dword [esi + 8]
add eax, edx
push ecx
mov ebx, eax
call sub.KERNEL32.DLL_TlsGetValue
add eax, 0x10
push eax
movzx eax, word [ebx + 0x18]
push eax
mov edx, dword [esi + 0x18]
push edx
call fcn.00429ee0
add esp, 0xc
jmp 0x42d379
mov ecx, 0x430e94
cmp ecx, dword [eax + 8]
jne 0x42d30c
movzx eax, word [ebx + 0xc]
movzx ecx, word [ebx + 0xe]
mov edx, dword [0x538bb0]
shl ecx, 5
mov eax, dword [edx + eax*4]
mov edx, dword [eax + 8]
mov eax, dword [0x54d750]
add edx, ecx
push eax
mov ebx, edx
call sub.KERNEL32.DLL_TlsGetValue
add eax, 0x10
push eax
mov eax, dword [0x538bb0]
movzx edx, word [ebx + 0x18]
push edx
movzx ecx, word [ebx + 0x14]
mov edx, dword [eax + ecx*4]
mov ecx, dword [edx + 0x1c]
push ecx
call fcn.00429ee0
add esp, 0xc
jmp 0x42d379
mov edx, 0x430afc
cmp edx, dword [eax + 8]
jne 0x42d31b
call dword [eax + 8]
jmp 0x42d377
movzx eax, word [ebx + 0xc]
mov ecx, dword [0x538bb0]
mov eax, dword [ecx + eax*4]
movzx ecx, word [ebx + 0xe]
shl ecx, 5
mov edx, dword [eax + 8]
add edx, ecx
mov ebx, edx
mov eax, dword [ebx]
cmp eax, dword [0x538978]
jne 0x42d351
push 0
mov edx, dword [edi + 0xc]
push edx
push esi
call fcn.00424e30
add esp, 0xc
jmp 0x42d379
cmp dword [ebx + 4], 0
jne 0x42d364
mov ecx, dword [edi]
inc ecx
push ecx
call fcn.00431944
pop ecx
mov dword [ebx + 4], eax
mov eax, dword [ebx + 4]
push eax
mov edx, dword [edi + 0xc]
push edx
push esi
call fcn.00424e30
add esp, 0xc
jmp 0x42d379
xor eax, eax
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x42d3ac
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
movzx edx, word [0x538bb6]
push ebx
push esi
push edi
inc edx
mov esi, dword [ebp + 0xc]
movzx eax, word [esi + 0x4c]
mov ebx, dword [esi + 8]
mov dword [ebp - 4], eax
push edx
call fcn.0043b120
pop ecx
mov edi, eax
movzx eax, word [0x538bb6]
inc eax
push eax
push 0
push edi
call fcn.004ab4f0
add esp, 0xc
cmp dword [ebx], 0
je 0x42d42a
mov edx, dword [ebx + 8]
cmp edx, 0x5389fc
jne 0x42d418
movzx ecx, word [ebx + 0x14]
mov eax, dword [0x538bb0]
mov eax, dword [eax + ecx*4]
cmp word [eax + 0x32], 0
je 0x42d42a
cmp esi, eax
je 0x42d42a
movzx edx, word [ebx + 0x14]
or byte [edi + edx], 1
jmp 0x42d42a
mov ecx, dword [ebx]
cmp ecx, dword [0x538968]
jne 0x42d42a
movzx eax, word [ebx + 0x14]
or byte [edi + eax], 2
add ebx, 0x20
dec dword [ebp - 4]
jne 0x42d3e7
mov bx, word [0x538bb6]
movzx eax, bx
lea esi, [edi + eax]
test bx, bx
je 0x42d4fc
cmp byte [esi], 1
jne 0x42d4f1
movzx edx, bx
mov ecx, dword [0x538bb0]
mov eax, dword [0x538968]
push eax
mov eax, dword [ecx + edx*4]
push eax
call fcn.0042b5e0
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x42d4f1
mov edx, dword [ebp - 8]
movzx ecx, word [edx + 0x14]
cmp byte [edi + ecx], 1
jne 0x42d4f1
push 0x53895c
call fcn.004231dc
pop ecx
push ebx
mov eax, dword [ebp + 8]
push eax
mov edx, dword [0x54d750]
push edx
call sub.KERNEL32.DLL_TlsGetValue
add dword [eax], 4
mov ecx, dword [eax]
push ecx
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
pop edx
cmp edx, dword [eax + 4]
jne 0x42d4ba
call fcn.00432adc
mov ecx, dword [0x54d750]
push ecx
call sub.KERNEL32.DLL_TlsGetValue
mov eax, dword [eax]
mov edx, dword [eax - 4]
push edx
call fcn.0042c950
add esp, 0xc
push 0
call fcn.004221c0
pop ecx
call fcn.00425334
test ax, ax
jne 0x42d4fc
mov ecx, dword [ebp - 8]
movzx eax, word [ecx + 0x14]
or byte [edi + eax], 2
dec ebx
dec esi
test bx, bx
jne 0x42d448
push edi
call fcn.0043b208
pop ecx
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x42d5d0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0x14]
mov esi, dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
push ebx
push esi
call fcn.0042d58c
add esp, 8
test eax, eax
je 0x42d6a1
movzx eax, bx
shl eax, 4
add eax, 0x53879c
push eax
call fcn.004231dc
pop ecx
push esi
call fcn.00422b70
pop ecx
mov edx, dword [0x54d750]
push edx
call sub.KERNEL32.DLL_TlsGetValue
test dword [eax + 0x10], 0xb405
je 0x42d638
mov ecx, dword [0x54d750]
push ecx
call sub.KERNEL32.DLL_TlsGetValue
add eax, 0x10
push eax
call fcn.0043edc0
pop ecx
jmp 0x42d648
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
xor edx, edx
mov dword [eax + 0x10], edx
test edi, edi
je 0x42d677
push edi
call fcn.00422b70
cmp dword [ebp + 0x18], 0
pop ecx
je 0x42d66d
mov ecx, dword [ebp + 0x18]
push ecx
call fcn.00422b70
pop ecx
push 2
call fcn.004221c0
pop ecx
jmp 0x42d67f
push 1
call fcn.004221c0
pop ecx
jmp 0x42d67f
push 0
call fcn.004221c0
pop ecx
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
add eax, 0x10
push eax
mov edx, dword [ebp + 0xc]
push edx
call fcn.0043f03c
add esp, 8
mov eax, 1
jmp 0x42d6a3
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret