joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49d0b0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
cmp dword [ebp + 8], 0xffffffff
jne 0x49d0ec
mov eax, dword [ebx + 0x10]
and eax, 0x8000
je 0x49d0e6
mov eax, dword [ebx + 0x18]
movzx eax, word [eax + 0xc]
test eax, eax
je 0x49d0e6
mov esi, 1
jmp 0x49d0e8
xor esi, esi
mov eax, esi
jmp 0x49d12e
mov eax, dword [ebp + 8]
test eax, eax
jl 0x49d12c
mov edx, dword [ebx + 0x30]
mov edx, dword [edx]
movzx edx, word [edx + 0xe]
cmp eax, edx
jg 0x49d12c
mov eax, dword [ebp + 8]
mov edx, dword [ebx + 0x30]
mov eax, dword [edx + eax*4 + 4]
mov edx, dword [eax]
and edx, 0x8000
je 0x49d126
mov eax, dword [eax + 8]
movzx eax, word [eax + 0xc]
test eax, eax
je 0x49d126
mov edi, 1
jmp 0x49d128
xor edi, edi
mov eax, edi
jmp 0x49d12e
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x49d140
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov eax, dword [ebp + 8]
test eax, eax
jl 0x49d16b
mov edx, dword [ebx + 0x30]
mov edx, dword [edx]
movzx edx, word [edx + 0xe]
cmp eax, edx
jle 0x49d175
cmp dword [ebp + 8], 0xffffffff
jne 0x49d1d3
cmp dword [ebp + 8], 0xffffffff
jne 0x49d180
lea edi, [ebx + 0x10]
jmp 0x49d18a
mov eax, dword [ebp + 8]
mov edx, dword [ebx + 0x30]
mov edi, dword [edx + eax*4 + 4]
mov esi, edi
mov eax, dword [esi]
and eax, 0x2000
je 0x49d19e
push esi
call fcn.004a0990
pop ecx
mov esi, eax
mov eax, dword [esi]
and eax, 0x400
je 0x49d1ac
mov eax, dword [esi + 0x10]
jmp 0x49d1d5
mov eax, dword [esi]
and eax, 0x8000
je 0x49d1d3
lea eax, [ebp + 0xc]
mov dword [ebp - 4], eax
lea eax, [eax + 4]
mov dword [ebp - 4], eax
mov eax, dword [eax - 4]
mov dword [ebp - 8], eax
push eax
push esi
call fcn.004a3380
add esp, 8
jmp 0x49d1d5
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x49d1e0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov eax, dword [ebp + 8]
test eax, eax
jl 0x49d20b
mov edx, dword [ebx + 0x30]
mov edx, dword [edx]
movzx edx, word [edx + 0xe]
cmp eax, edx
jle 0x49d215
cmp dword [ebp + 8], 0xffffffff
jne 0x49d273
cmp dword [ebp + 8], 0xffffffff
jne 0x49d220
lea edi, [ebx + 0x10]
jmp 0x49d22a
mov eax, dword [ebp + 8]
mov edx, dword [ebx + 0x30]
mov edi, dword [edx + eax*4 + 4]
mov esi, edi
mov eax, dword [esi]
and eax, 0x2000
je 0x49d23e
push esi
call fcn.004a0990
pop ecx
mov esi, eax
mov eax, dword [esi]
and eax, 0x400
je 0x49d24c
mov eax, dword [esi + 0x10]
jmp 0x49d279
mov eax, dword [esi]
and eax, 0x8000
je 0x49d273
lea eax, [ebp + 0xc]
mov dword [ebp - 4], eax
lea eax, [eax + 4]
mov dword [ebp - 4], eax
mov eax, dword [eax - 4]
mov dword [ebp - 8], eax
push eax
push esi
call fcn.004a3380
add esp, 8
jmp 0x49d279
lea eax, [0x69bf00]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x49d280
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov eax, dword [ebp + 8]
test eax, eax
jl 0x49d2ab
mov edx, dword [ebx + 0x30]
mov edx, dword [edx]
movzx edx, word [edx + 0xe]
cmp eax, edx
jle 0x49d2b5
cmp dword [ebp + 8], 0xffffffff
jne 0x49d313
cmp dword [ebp + 8], 0xffffffff
jne 0x49d2c0
lea edi, [ebx + 0x10]
jmp 0x49d2ca
mov eax, dword [ebp + 8]
mov edx, dword [ebx + 0x30]
mov edi, dword [edx + eax*4 + 4]
mov esi, edi
mov eax, dword [esi]
and eax, 0x2000
je 0x49d2de
push esi
call fcn.004a0990
pop ecx
mov esi, eax
mov eax, dword [esi]
and eax, 0x400
je 0x49d2ec
mov eax, dword [esi + 8]
jmp 0x49d315
mov eax, dword [esi]
and eax, 0x8000
je 0x49d313
lea eax, [ebp + 0xc]
mov dword [ebp - 4], eax
lea eax, [eax + 4]
mov dword [ebp - 4], eax
mov eax, dword [eax - 4]
mov dword [ebp - 8], eax
push eax
push esi
call fcn.004a33d0
add esp, 8
jmp 0x49d315
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x49d320
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov eax, dword [ebp + 8]
test eax, eax
jl 0x49d34b
mov edx, dword [ebx + 0x30]
mov edx, dword [edx]
movzx edx, word [edx + 0xe]
cmp eax, edx
jle 0x49d355
cmp dword [ebp + 8], 0xffffffff
jne 0x49d3b5
cmp dword [ebp + 8], 0xffffffff
jne 0x49d360
lea edi, [ebx + 0x10]
jmp 0x49d36a
mov eax, dword [ebp + 8]
mov edx, dword [ebx + 0x30]
mov edi, dword [edx + eax*4 + 4]
mov esi, edi
mov eax, dword [esi]
and eax, 0x2000
je 0x49d3b5
push esi
call fcn.004a0990
pop ecx
mov esi, eax
mov eax, dword [esi]
and eax, 0x400
je 0x49d38d
mov eax, dword [esi + 8]
inc eax
jmp 0x49d3b7
mov eax, dword [esi]
and eax, 0x8000
je 0x49d3b5
lea eax, [ebp + 0xc]
mov dword [ebp - 4], eax
lea eax, [eax + 4]
mov dword [ebp - 4], eax
mov eax, dword [eax - 4]
mov dword [ebp - 8], eax
push eax
push esi
call fcn.004a33d0
add esp, 8
inc eax
jmp 0x49d3b7
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x49d3c0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov eax, dword [ebp + 8]
test eax, eax
jl 0x49d3eb
mov edx, dword [ebx + 0x30]
mov edx, dword [edx]
movzx edx, word [edx + 0xe]
cmp eax, edx
jle 0x49d3f5
cmp dword [ebp + 8], 0xffffffff
jne 0x49d465
cmp dword [ebp + 8], 0xffffffff
jne 0x49d400
lea edi, [ebx + 0x10]
jmp 0x49d40a
mov eax, dword [ebp + 8]
mov edx, dword [ebx + 0x30]
mov edi, dword [edx + eax*4 + 4]
mov esi, edi
mov eax, dword [esi]
and eax, 0x2000
je 0x49d41e
push esi
call fcn.004a0990
pop ecx
mov esi, eax
mov eax, dword [esi]
and eax, 0x20
je 0x49d437
mov eax, dword [esi + 8]
push eax
lea eax, [ebx + 0x46]
push eax
call fcn.004bccf0
add esp, 8
jmp 0x49d473
mov eax, dword [esi]
and eax, 0x8000
je 0x49d465
lea eax, [ebp + 0xc]
mov dword [ebp - 4], eax
lea eax, [eax + 4]
mov dword [ebp - 4], eax
mov eax, dword [eax - 4]
mov dword [ebp - 8], eax
lea eax, [ebx + 0x46]
push eax
mov eax, dword [ebp - 8]
push eax
push esi
call fcn.004a2ee0
add esp, 0xc
jmp 0x49d473
push 0
lea eax, [ebx + 0x46]
push eax
call fcn.004bccf0
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x49d540
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov eax, dword [ebp + 0xc]
test eax, eax
jl 0x49d56b
mov edx, dword [ebx + 0x30]
mov edx, dword [edx]
movzx edx, word [edx + 0xe]
cmp eax, edx
jle 0x49d575
cmp dword [ebp + 0xc], 0xffffffff
jne 0x49d5e5
cmp dword [ebp + 0xc], 0xffffffff
jne 0x49d580
lea edi, [ebx + 0x10]
jmp 0x49d58a
mov eax, dword [ebp + 0xc]
mov edx, dword [ebx + 0x30]
mov edi, dword [edx + eax*4 + 4]
mov esi, edi
mov eax, dword [esi]
and eax, 0x2000
je 0x49d59e
push esi
call fcn.004a0990
pop ecx
mov esi, eax
mov eax, dword [esi]
and eax, 0x20
je 0x49d5b7
mov eax, dword [esi + 8]
push eax
mov eax, dword [ebp + 8]
push eax
call fcn.004bccf0
add esp, 8
jmp 0x49d5f3
mov eax, dword [esi]
and eax, 0x8000
je 0x49d5e5
lea eax, [ebp + 0x10]
mov dword [ebp - 4], eax
lea eax, [eax + 4]
mov dword [ebp - 4], eax
mov eax, dword [eax - 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 8]
push eax
push esi
call fcn.004a2ee0
add esp, 0xc
jmp 0x49d5f3
push 0
mov eax, dword [ebp + 8]
push eax
call fcn.004bccf0
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x49d600
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov eax, dword [ebp + 8]
test eax, eax
jl 0x49d62b
mov edx, dword [ebx + 0x30]
mov edx, dword [edx]
movzx edx, word [edx + 0xe]
cmp eax, edx
jle 0x49d631
cmp dword [ebp + 8], 0xffffffff
jne 0x49d68d
cmp dword [ebp + 8], 0xffffffff
jne 0x49d63c
lea edi, [ebx + 0x10]
jmp 0x49d646
mov eax, dword [ebp + 8]
mov edx, dword [ebx + 0x30]
mov edi, dword [edx + eax*4 + 4]
mov esi, edi
mov eax, dword [esi]
and eax, 0x2000
je 0x49d65a
push esi
call fcn.004a0990
pop ecx
mov esi, eax
mov eax, dword [esi]
and eax, 0x20
je 0x49d666
mov eax, dword [esi + 8]
jmp 0x49d695
mov eax, dword [esi]
and eax, 0x8000
je 0x49d68d
lea eax, [ebp + 0xc]
mov dword [ebp - 4], eax
lea eax, [eax + 4]
mov dword [ebp - 4], eax
mov eax, dword [eax - 4]
mov dword [ebp - 8], eax
push eax
push esi
call fcn.004a2fa0
add esp, 8
jmp 0x49d695
push 0
call fcn.0049fa20
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x49d6a0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov eax, dword [ebp + 0xc]
test eax, eax
jl 0x49d6cb
mov edx, dword [ebx + 0x30]
mov edx, dword [edx]
movzx edx, word [edx + 0xe]
cmp eax, edx
jle 0x49d6d5
cmp dword [ebp + 0xc], 0xffffffff
jne 0x49d749
cmp dword [ebp + 0xc], 0xffffffff
jne 0x49d6e0
lea edi, [ebx + 0x10]
jmp 0x49d6ea
mov eax, dword [ebp + 0xc]
mov edx, dword [ebx + 0x30]
mov edi, dword [edx + eax*4 + 4]
mov esi, edi
mov eax, dword [esi]
and eax, 0x2000
je 0x49d6fe
push esi
call fcn.004a0990
pop ecx
mov esi, eax
mov eax, dword [esi]
and eax, 0x20
je 0x49d71b
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi + 8]
push eax
mov eax, dword [ebp + 8]
push eax
call fcn.004bdc70
add esp, 0xc
jmp 0x49d759
mov eax, dword [esi]
and eax, 0x8000
je 0x49d749
lea eax, [ebp + 0x10]
mov dword [ebp - 4], eax
lea eax, [eax + 4]
mov dword [ebp - 4], eax
mov eax, dword [eax - 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 8]
push eax
push esi
call fcn.004a2f40
add esp, 0xc
jmp 0x49d759
push 0
push 0
mov eax, dword [ebp + 8]
push eax
call fcn.004bdc70
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x49d970
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
test eax, eax
jl 0x49d99d
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x30]
mov edx, dword [edx]
movzx edx, word [edx + 0xe]
cmp eax, edx
jle 0x49d9a7
cmp dword [ebp + 8], 0xffffffff
jne 0x49dae6
cmp dword [ebp + 8], 0xffffffff
jne 0x49d9b8
mov eax, dword [ebp - 4]
lea eax, [eax + 0x10]
mov dword [ebp - 8], eax
jmp 0x49d9c8
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x30]
mov eax, dword [edx + eax*4 + 4]
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
mov eax, dword [ebx]
and eax, 0x2000
je 0x49d9dd
push ebx
call fcn.004a0990
pop ecx
mov ebx, eax
mov eax, dword [ebx]
and eax, 0x80
je 0x49da04
cmp dword [ebx + 8], 0
je 0x49d9f5
mov dword [ebp - 0xc], 1
jmp 0x49d9fc
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
jmp 0x49dae8
mov eax, dword [ebx]
and eax, 2
je 0x49da29
cmp dword [ebx + 0xc], 0
je 0x49da1a
mov dword [ebp - 0xc], 1
jmp 0x49da21
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
jmp 0x49dae8
mov eax, dword [ebx]
and eax, 8
je 0x49da61
push dword [ebx + 0xc]
push dword [ebx + 8]
push dword [0x69befc]
push dword [0x69bef8]
call fcn.00531f10
jae 0x49da52
mov dword [ebp - 0xc], 1
jmp 0x49da59
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
jmp 0x49dae8
mov eax, dword [ebx]
and eax, 0x10
je 0x49da8c
fld qword [0x69bef0]
fcomp qword [ebx + 8]
wait
fnstsw ax
sahf
je 0x49da80
mov dword [ebp - 0xc], 1
jmp 0x49da87
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
jmp 0x49dae8
mov eax, dword [ebx]
and eax, 0x400
je 0x49daa8
mov eax, dword [ebx + 8]
cmp eax, 1
jne 0x49daa8
mov eax, dword [ebx + 0x10]
movsx eax, byte [eax]
movzx eax, al
jmp 0x49dae8
mov eax, dword [ebx]
and eax, 0x8000
je 0x49dae6
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
lea eax, [eax + 4]
mov dword [ebp - 0xc], eax
mov eax, dword [eax - 4]
mov dword [ebp - 0x10], eax
push eax
push ebx
call fcn.004a3120
add esp, 8
test eax, eax
je 0x49dada
mov dword [ebp - 0x14], 1
jmp 0x49dae1
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x14]
jmp 0x49dae8
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x49daf0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
test eax, eax
jl 0x49db1d
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x30]
mov edx, dword [edx]
movzx edx, word [edx + 0xe]
cmp eax, edx
jle 0x49db27
cmp dword [ebp + 8], 0xffffffff
jne 0x49dbe5
cmp dword [ebp + 8], 0xffffffff
jne 0x49db38
mov eax, dword [ebp - 4]
lea eax, [eax + 0x10]
mov dword [ebp - 8], eax
jmp 0x49db48
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x30]
mov eax, dword [edx + eax*4 + 4]
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
mov eax, dword [ebx]
and eax, 0x2000
je 0x49db5d
push ebx
call fcn.004a0990
pop ecx
mov ebx, eax
mov eax, dword [ebx]
and eax, 0x10
je 0x49db6c
fld qword [ebx + 8]
jmp 0x49dbeb
mov eax, dword [ebx]
and eax, 2
je 0x49db7b
fild dword [ebx + 0xc]
jmp 0x49dbeb
mov eax, dword [ebx]
and eax, 8
je 0x49db8a
fild qword [ebx + 8]
jmp 0x49dbeb
mov eax, dword [ebx]
and eax, 0x80
je 0x49db98
fild dword [ebx + 8]
jmp 0x49dbeb
mov eax, dword [ebx]
and eax, 0x400
je 0x49dbbb
mov eax, dword [ebx + 8]
cmp eax, 1
jne 0x49dbbb
mov eax, dword [ebx + 0x10]
movsx eax, byte [eax]
movzx eax, al
push eax
fild dword [esp]
add esp, 4
jmp 0x49dbeb
mov eax, dword [ebx]
and eax, 0x8000
je 0x49dbe5
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
lea eax, [eax + 4]
mov dword [ebp - 0xc], eax
mov eax, dword [eax - 4]
mov dword [ebp - 0x10], eax
push eax
push ebx
call fcn.004a3280
add esp, 8
fst qword [ebp - 0x18]
jmp 0x49dbeb
fld qword [0x69bef0]
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x49dbf0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
test eax, eax
jl 0x49dc1d
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x30]
mov edx, dword [edx]
movzx edx, word [edx + 0xe]
cmp eax, edx
jle 0x49dc27
cmp dword [ebp + 8], 0xffffffff
jne 0x49dce1
cmp dword [ebp + 8], 0xffffffff
jne 0x49dc38
mov eax, dword [ebp - 4]
lea eax, [eax + 0x10]
mov dword [ebp - 8], eax
jmp 0x49dc48
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x30]
mov eax, dword [edx + eax*4 + 4]
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
mov eax, dword [ebx]
and eax, 0x2000
je 0x49dc5d
push ebx
call fcn.004a0990
pop ecx
mov ebx, eax
mov eax, dword [ebx]
and eax, 2
je 0x49dc6c
mov eax, dword [ebx + 0xc]
jmp 0x49dce3
mov eax, dword [ebx]
and eax, 8
je 0x49dc7f
push dword [ebx + 0xc]
mov eax, dword [ebx + 8]
pop edx
jmp 0x49dce3
mov eax, dword [ebx]
and eax, 0x10
je 0x49dc90
fld qword [ebx + 8]
call fcn.00532060
jmp 0x49dce3
mov eax, dword [ebx]
and eax, 0x80
je 0x49dc9e
mov eax, dword [ebx + 8]
jmp 0x49dce3
mov eax, dword [ebx]
and eax, 0x400
je 0x49dcba
mov eax, dword [ebx + 8]
cmp eax, 1
jne 0x49dcba
mov eax, dword [ebx + 0x10]
movsx eax, byte [eax]
movzx eax, al
jmp 0x49dce3
mov eax, dword [ebx]
and eax, 0x8000
je 0x49dce1
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
lea eax, [eax + 4]
mov dword [ebp - 0xc], eax
mov eax, dword [eax - 4]
mov dword [ebp - 0x10], eax
push eax
push ebx
call fcn.004a3160
add esp, 8
jmp 0x49dce3
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x49dcf0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
test eax, eax
jl 0x49dd1d
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x30]
mov edx, dword [edx]
movzx edx, word [edx + 0xe]
cmp eax, edx
jle 0x49dd27
cmp dword [ebp + 8], 0xffffffff
jne 0x49ddf0
cmp dword [ebp + 8], 0xffffffff
jne 0x49dd38
mov eax, dword [ebp - 4]
lea eax, [eax + 0x10]
mov dword [ebp - 8], eax
jmp 0x49dd48
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x30]
mov eax, dword [edx + eax*4 + 4]
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
mov eax, dword [ebx]
and eax, 0x2000
je 0x49dd5d
push ebx
call fcn.004a0990
pop ecx
mov ebx, eax
mov eax, dword [ebx]
and eax, 8
je 0x49dd70
push dword [ebx + 0xc]
mov eax, dword [ebx + 8]
pop edx
jmp 0x49ddf2
mov eax, dword [ebx]
and eax, 2
je 0x49dd7f
mov eax, dword [ebx + 0xc]
jmp 0x49ddf2
mov eax, dword [ebx]
and eax, 0x10
je 0x49dd93
fld qword [ebx + 8]
call fcn.00532060
jmp 0x49ddf2
mov eax, dword [ebx]
and eax, 0x20
je 0x49dd9f
mov eax, dword [ebx + 8]
jmp 0x49ddf2
mov eax, dword [ebx]
and eax, 0x80
je 0x49ddad
mov eax, dword [ebx + 8]
jmp 0x49ddf2
mov eax, dword [ebx]
and eax, 0x400
je 0x49ddc9
mov eax, dword [ebx + 8]
cmp eax, 1
jne 0x49ddc9
mov eax, dword [ebx + 0x10]
movsx eax, byte [eax]
movzx eax, al
jmp 0x49ddf2
mov eax, dword [ebx]
and eax, 0x8000
je 0x49ddf0
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
lea eax, [eax + 4]
mov dword [ebp - 0xc], eax
mov eax, dword [eax - 4]
mov dword [ebp - 0x10], eax
push eax
push ebx
call fcn.004a31a0
add esp, 8
jmp 0x49ddf2
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x49de00
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
test eax, eax
jl 0x49de2d
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x30]
mov edx, dword [edx]
movzx edx, word [edx + 0xe]
cmp eax, edx
jle 0x49de37
cmp dword [ebp + 8], 0xffffffff
jne 0x49df07
cmp dword [ebp + 8], 0xffffffff
jne 0x49de48
mov eax, dword [ebp - 4]
lea eax, [eax + 0x10]
mov dword [ebp - 8], eax
jmp 0x49de58
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x30]
mov eax, dword [edx + eax*4 + 4]
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
mov eax, dword [ebx]
and eax, 0x2000
je 0x49de6d
push ebx
call fcn.004a0990
pop ecx
mov ebx, eax
mov eax, dword [ebx]
and eax, 8
je 0x49de80
push dword [ebx + 0xc]
mov eax, dword [ebx + 8]
pop edx
jmp 0x49df13
mov eax, dword [ebx]
and eax, 2
je 0x49de90
mov eax, dword [ebx + 0xc]
cdq
jmp 0x49df13
mov eax, dword [ebx]
and eax, 0x10
je 0x49dea4
fld qword [ebx + 8]
call fcn.00532060
jmp 0x49df13
mov eax, dword [ebx]
and eax, 0x20
je 0x49deb4
mov eax, dword [ebx + 8]
cdq
jmp 0x49df13
mov eax, dword [ebx]
and eax, 0x80
je 0x49dec3
mov eax, dword [ebx + 8]
cdq
jmp 0x49df13
mov eax, dword [ebx]
and eax, 0x400
je 0x49dee0
mov eax, dword [ebx + 8]
cmp eax, 1
jne 0x49dee0
mov eax, dword [ebx + 0x10]
movsx eax, byte [eax]
movzx eax, al
cdq
jmp 0x49df13
mov eax, dword [ebx]
and eax, 0x8000
je 0x49df07
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
lea eax, [eax + 4]
mov dword [ebp - 0xc], eax
mov eax, dword [eax - 4]
mov dword [ebp - 0x10], eax
push eax
push ebx
call fcn.004a3230
add esp, 8
jmp 0x49df13
push dword [0x69befc]
mov eax, dword [0x69bef8]
pop edx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x49df20
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov eax, dword [ebp + 8]
test eax, eax
jl 0x49df4b
mov edx, dword [ebx + 0x30]
mov edx, dword [edx]
movzx edx, word [edx + 0xe]
cmp eax, edx
jle 0x49df51
cmp dword [ebp + 8], 0xffffffff
jne 0x49dfad
cmp dword [ebp + 8], 0xffffffff
jne 0x49df5c
lea edi, [ebx + 0x10]
jmp 0x49df66
mov eax, dword [ebp + 8]
mov edx, dword [ebx + 0x30]
mov edi, dword [edx + eax*4 + 4]
mov esi, edi
mov eax, dword [esi]
and eax, 0x2000
je 0x49df7a
push esi
call fcn.004a0990
pop ecx
mov esi, eax
mov eax, dword [esi]
and eax, 1
je 0x49df86
mov eax, dword [esi + 8]
jmp 0x49dfaf
mov eax, dword [esi]
and eax, 0x8000
je 0x49dfad
lea eax, [ebp + 0xc]
mov dword [ebp - 4], eax
lea eax, [eax + 4]
mov dword [ebp - 4], eax
mov eax, dword [eax - 4]
mov dword [ebp - 8], eax
push eax
push esi
call fcn.004a3420
add esp, 8
jmp 0x49dfaf
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x49e0e0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
cmp dword [ebp + 8], 0
jne 0x49e10b
mov eax, dword [ebx + 0x30]
mov eax, dword [eax]
movzx eax, word [eax + 0xe]
jmp 0x49e17b
mov eax, dword [ebp + 8]
test eax, eax
jle 0x49e11f
mov edx, dword [ebx + 0x30]
mov edx, dword [edx]
movzx edx, word [edx + 0xe]
cmp eax, edx
jle 0x49e125
cmp dword [ebp + 8], 0xffffffff
jne 0x49e179
cmp dword [ebp + 8], 0xffffffff
jne 0x49e130
mov esi, dword [ebx + 0x10]
jmp 0x49e13c
mov eax, dword [ebp + 8]
mov edx, dword [ebx + 0x30]
mov eax, dword [edx + eax*4 + 4]
mov esi, dword [eax]
mov dword [ebp - 4], esi
mov eax, dword [ebp - 4]
and eax, 0x2000
je 0x49e174
cmp dword [ebp + 8], 0xffffffff
jne 0x49e154
lea edi, [ebx + 0x10]
jmp 0x49e15e
mov eax, dword [ebp + 8]
mov edx, dword [ebx + 0x30]
mov edi, dword [edx + eax*4 + 4]
push edi
call fcn.004a0990
pop ecx
mov dword [ebp - 8], eax
test eax, eax
je 0x49e174
mov eax, dword [ebp - 8]
mov eax, dword [eax]
or dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x49e17b
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x49e1f0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edx, dword [ebp + 8]
push edx
lea eax, [eax + 0x10]
push eax
call fcn.004a2750
add esp, 8
pop ebp
ret

Function at 0x49e220
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edx, dword [ebp + 8]
push edx
lea eax, [eax + 0x10]
push eax
call fcn.004a4aa0
add esp, 8
pop ebp
ret

Function at 0x49e250
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edx, dword [ebp + 0xc]
push edx
mov edx, dword [ebp + 8]
push edx
lea eax, [eax + 0x10]
push eax
call fcn.004a4ad0
add esp, 0xc
pop ebp
ret

Function at 0x49e280
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edx, dword [ebp + 8]
push edx
lea eax, [eax + 0x10]
push eax
call fcn.004a0150
add esp, 8
pop ebp
ret

Function at 0x49e2e0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edx, dword [ebp + 0x10]
push edx
mov edx, dword [ebp + 0xc]
push edx
mov edx, dword [ebp + 8]
push edx
lea eax, [eax + 0x10]
push eax
call fcn.004a01a0
add esp, 0x10
pop ebp
ret