joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4aa900
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [0x551d48]
push esi
xor esi, esi
cmp eax, esi
jge 0x4aa915
xor eax, eax
jmp 0x4aa91c
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [eax]
push 0x10
push 0x18
call fcn.00547721
cmp eax, esi
je 0x4aa94c
mov dword [eax + 8], esi
mov dword [eax + 0xc], esi
mov dword [eax + 0x10], esi
mov dword [eax], 0x441a10
mov dword [eax + 4], 5
mov dword [eax + 0x14], edi
mov dword [edi + 0x10], eax
pop esi
pop ebp
ret 4
mov eax, dword [ebp + 8]
mov byte [eax + 0x188], 1
xor eax, eax
pop esi
pop ebp
ret 4

Function at 0x4aa9f0
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
mov edx, dword [ebp + 0x18]
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [ebp + 0x10]
xor ebx, ebx
cmp ecx, dword [edi + 0x44]
jne 0x4aaa4b
mov eax, dword [ebp + 0x14]
or eax, edx
jne 0x4aaa4b
cmp dword [ebp + 0xc], ebx
jne 0x4aaa4b
mov eax, dword [edi + 0x140]
cmp eax, ebx
je 0x4aaa31
cmp dword [ebp + 0x1c], 1
jne 0x4aaa31
cmp dword [ebp + 0x20], 4
je 0x4aab2f
mov eax, dword [edi + 0x144]
cmp eax, ebx
je 0x4aaa4b
cmp dword [ebp + 0x1c], 4
jne 0x4aaa4b
cmp dword [ebp + 0x20], 4
je 0x4aab2f
push ecx
mov ecx, dword [ebp + 0x14]
push edx
mov edx, dword [ebp + 8]
and ecx, 0xfffff3ff
push ecx
push edx
push edi
call fcn.004aa560
mov esi, eax
cmp esi, ebx
je 0x4aab24
mov ecx, dword [ebp + 0x1c]
cmp ecx, 1
ja 0x4aaa8c
cmp dword [ebp + 0x20], 1
ja 0x4aaa8c
mov eax, dword [ebp + 0xc]
cmp eax, 9
je 0x4aaa8f
cmp eax, 8
jne 0x4aab2d
jmp 0x4aaa8f
mov eax, dword [ebp + 0xc]
cmp ecx, 1
jne 0x4aaa99
cmp eax, 8
jne 0x4aaa9e
cmp eax, 9
jne 0x4aaad0
mov eax, dword [0x551d48]
cmp eax, ebx
jge 0x4aaaab
xor eax, eax
jmp 0x4aaab2
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [eax]
push 0x10
push 0x20
call fcn.00547721
cmp eax, ebx
je 0x4aab24
mov dword [eax], 0x441b60
mov dword [eax + 4], 9
jmp 0x4aaae8
push 0x20
call fcn.0049cdd0
cmp eax, ebx
je 0x4aab24
mov dword [eax], 0x441b30
mov dword [eax + 4], 8
mov ecx, dword [ebp + 0x1c]
mov edx, dword [ebp + 0x20]
mov dword [eax + 0x1c], ebx
mov dword [eax + 0x18], ebx
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], ebx
mov dword [eax + 0xc], ebx
mov dword [eax + 8], ebx
push eax
mov dword [eax + 0x14], esi
mov dword [eax + 0x18], ecx
mov dword [eax + 0x1c], edx
mov eax, dword [ebp + 0x14]
push ebx
and eax, 0xc00
push eax
mov eax, dword [ebp + 8]
push eax
push edi
call fcn.004aa560
mov esi, eax
cmp esi, ebx
jne 0x4aab2d
mov byte [edi + 0x188], 1
xor esi, esi
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x4aab40
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp ebx, esi
je 0x4aabbd
mov eax, dword [0x551d48]
cmp eax, esi
jge 0x4aab59
xor eax, eax
jmp 0x4aab60
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [eax]
push 0x10
push 0x20
call fcn.00547721
cmp eax, esi
je 0x4aabb6
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
push eax
push ebx
push edx
mov dword [eax + 8], esi
mov dword [eax + 0xc], esi
mov dword [eax + 0x10], esi
mov dword [eax], 0x441aa0
mov dword [eax + 4], 3
mov dword [eax + 0x18], esi
mov dword [eax + 0x1c], esi
push edi
mov dword [eax + 0x14], ecx
call fcn.004e5180
cmp eax, esi
je 0x4aabb6
mov dword [edi + 4], eax
mov byte [edi + 0x18d], 1
mov dword [edi + 0x154], eax
pop esi
pop ebp
ret 8
mov byte [edi + 0x188], 1
xor eax, eax
pop esi
pop ebp
ret 8

Function at 0x4aae50
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp ebx, esi
je 0x4aaec8
mov eax, dword [0x551d48]
cmp eax, esi
jge 0x4aae69
xor eax, eax
jmp 0x4aae70
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [eax]
push 0x10
push 0x20
call fcn.00547721
cmp eax, esi
je 0x4aaec1
push eax
mov dword [eax + 8], esi
mov dword [eax + 0xc], esi
mov dword [eax + 0x10], esi
mov dword [eax + 0x18], esi
mov dword [eax + 0x1c], esi
mov dword [eax], 0x441aa0
mov dword [eax + 4], 4
mov dword [eax + 0x14], 2
mov eax, dword [ebp + 8]
push ebx
push eax
push edi
call fcn.004e5180
cmp eax, esi
je 0x4aaec1
mov dword [edi + 4], eax
mov byte [edi + 0x18d], 1
pop esi
pop ebp
ret 4
mov byte [edi + 0x188], 1
xor eax, eax
pop esi
pop ebp
ret 4
Function at 0x4aaf60
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x14]
push ebx
mov ebx, dword [ebp + 8]
push esi
xor esi, esi
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 4], esi
test eax, eax
jne 0x4aaf8f
cmp byte [ebp + 0x18], al
jne 0x4aafc0
push 0x441704
mov ecx, 0xc00
jmp 0x4ab0b7
lea ecx, [ebp - 4]
push ecx
push eax
mov eax, ebx
call fcn.004eb610
test eax, eax
jge 0x4aafae
push 0x441730
mov ecx, 0xbf2
jmp 0x4ab0b7
mov esi, dword [ebp - 4]
lea edx, [esi - 1]
cmp edx, 0xffff
ja 0x4ab0ad
mov eax, dword [0x551d48]
test eax, eax
jge 0x4aafcd
xor eax, eax
jmp 0x4aafd4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [eax]
push 0x10
push 0x1c
call fcn.00547721
xor edx, edx
cmp eax, edx
je 0x4ab035
mov dword [eax + 8], edx
mov dword [eax + 0xc], edx
mov dword [eax + 0x10], edx
mov dword [eax], 0x441b00
mov dword [eax + 4], 7
mov dword [eax + 0x14], edx
mov dword [eax + 0x18], edx
mov dword [eax + 0x18], esi
cmp edi, edx
je 0x4ab043
cmp dword [edi + 4], 0xa
jne 0x4ab043
mov ecx, dword [edi + 0x20]
cmp ecx, dword [ebx + 0xc]
jne 0x4ab043
mov dword [eax + 0x14], edi
mov ecx, dword [ebp + 0x1c]
mov dword [ecx], eax
cmp esi, 0x10000
ja 0x4ab0ad
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov eax, 0x8007000e
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov ecx, dword [ebx + 0xc]
mov dword [eax + 0x14], ecx
mov ecx, dword [ebx + 0xc]
mov dword [ebp + 0x18], ecx
cmp edi, ecx
je 0x4ab019
cmp dword [ebp + 0x14], edx
jne 0x4ab064
push 0x441790
mov ecx, 0xc01
jmp 0x4ab0b7
mov edx, edi
mov ecx, dword [edx + 0x18]
imul esi, ecx
mov ecx, dword [edx + 0x14]
test ecx, ecx
je 0x4ab08d
cmp dword [ecx + 4], 0xa
jne 0x4ab08d
cmp dword [ecx + 0x18], 0x20000200
jne 0x4ab08d
cmp dword [ecx + 0x1c], 0
jne 0x4ab08d
mov edi, dword [ecx + 0x20]
jmp 0x4ab08f
mov edi, ecx
cmp edi, dword [ebp + 0x18]
je 0x4ab098
mov edx, ecx
jmp 0x4ab066
mov dword [eax + 0x14], ecx
mov dword [edx + 0x14], eax
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0x1c]
mov dword [eax], edx
xor edx, edx
jmp 0x4ab01e
mov ecx, 0xbf3
push 0x441764
mov edx, dword [ebp + 0xc]
mov esi, ebx
call fcn.004a7840
add esp, 4
pop edi
pop esi
mov eax, 0x80070057
pop ebx
mov esp, ebp
pop ebp
ret 0x18
Function at 0x4b10d0
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [esi + 0x34]
push ebx
push edi
test eax, eax
je 0x4b125c
cmp dword [esi + 0x84], 0
je 0x4b125c
cmp dword [esi + 0x94], 0
jne 0x4b125c
xor edx, edx
mov dword [esi + 0x90], 0
test eax, eax
jbe 0x4b113b
mov ecx, dword [esi + 0x30]
add ecx, ecx
add ecx, ecx
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x1c]
mov eax, dword [ecx + eax]
mov eax, dword [eax + 0x9c]
inc eax
cmp dword [esi + 0x90], eax
jae 0x4b1132
mov dword [esi + 0x90], eax
inc edx
add ecx, 4
cmp edx, dword [esi + 0x34]
jb 0x4b1114
mov edi, dword [esi + 0x90]
mov eax, dword [0x551d48]
mov ebx, dword [sym.imp.KERNEL32.dll_TlsGetValue]
add edi, edi
add edi, edi
test eax, eax
jl 0x4b115b
push eax
call ebx
test eax, eax
jne 0x4b115f
xor eax, eax
jmp 0x4b116a
mov ecx, dword [eax + 0x1c]
push 0x10
push edi
call fcn.00547721
mov dword [esi + 0x94], eax
test eax, eax
jne 0x4b1181
pop edi
mov eax, 0x8007000e
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [0x551d48]
mov edi, dword [esi + 0x34]
test eax, eax
jl 0x4b1194
push eax
call ebx
test eax, eax
jne 0x4b1198
xor eax, eax
jmp 0x4b11aa
push 0x10
lea ecx, [edi*4]
push ecx
mov ecx, dword [eax + 0x1c]
call fcn.00547721
mov dword [esi + 0x98], eax
test eax, eax
je 0x4b1174
mov edx, dword [esi + 0x90]
mov eax, dword [esi + 0x94]
add edx, edx
add edx, edx
push edx
push 0
push eax
call sub.msvcrt.dll_memset
mov ecx, dword [esi + 0x34]
mov edx, dword [esi + 0x98]
add ecx, ecx
add ecx, ecx
push ecx
push 0
push edx
call sub.msvcrt.dll_memset
mov eax, dword [esi + 0x84]
mov ebx, dword [eax + 0x24]
xor edi, edi
add esp, 0x18
mov dword [ebp - 4], ebx
cmp dword [esi + 0x34], edi
jbe 0x4b125c
lea esp, [esp]
test ebx, ebx
je 0x4b125c
mov edx, dword [ebp + 8]
mov ecx, dword [esi + 0x30]
mov eax, dword [edx + 0x1c]
add ecx, edi
mov ecx, dword [eax + ecx*4]
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + 8]
and eax, 0x800080
xor edx, edx
or eax, edx
jne 0x4b1250
mov edx, dword [ebx + 8]
mov eax, dword [ecx + 0x9c]
mov ebx, dword [esi + 0x94]
add edx, 0x18
mov dword [ebx + eax*4], edx
mov ebx, dword [ebp - 4]
mov edx, dword [ebx + 8]
mov eax, dword [ecx + 0x88]
mov ecx, dword [esi + 0x98]
add edx, 0x18
mov dword [ecx + eax*4], edx
mov ebx, dword [ebx + 0xc]
inc edi
mov dword [ebp - 4], ebx
cmp edi, dword [esi + 0x34]
jb 0x4b1200
pop edi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4e6ef0
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0x18]
push ebx
push esi
test ecx, ecx
je 0x4e6f78
mov esi, edi
call fcn.004acd50
mov ebx, eax
test ebx, ebx
je 0x4e6f78
test byte [ebx + 0xb4], 8
je 0x4e6f78
mov eax, dword [edi + 0x48]
mov ecx, dword [ebx + 0x48]
cmp ecx, eax
je 0x4e6f52
test ecx, ecx
je 0x4e6f36
test eax, eax
je 0x4e6f36
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 0x2c]
call eax
test al, al
jne 0x4e6f52
mov eax, dword [edi + 0xc]
mov esi, dword [ebp + 8]
push eax
push 0x4443dc
lea edx, [edi + 0x10]
mov ecx, 0xc25
call fcn.004a7840
add esp, 8
or byte [edi + 0xb4], 8
mov ecx, dword [ebx + 0xb0]
mov dword [edi + 0xb0], ecx
mov ecx, dword [ebp + 0xc]
push edi
push ecx
push ebx
call fcn.004ace40
test eax, eax
jl 0x4e70cd
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 0x1c]
mov dword [ebp - 4], eax
test eax, eax
je 0x4e70c3
lea esp, [esp]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
mov ebx, dword [edx + 0x50]
test ebx, ebx
je 0x4e70b2
mov ecx, dword [edi + 8]
cmp byte [ecx], 0
mov eax, dword [ebx + 8]
jne 0x4e6fb3
cmp byte [eax], 0
jmp 0x4e6fbe
cmp byte [eax], 0
je 0x4e70a7
cmp ecx, eax
sete al
test al, al
je 0x4e70a7
mov ecx, edi
mov eax, ebx
call fcn.0049d860
test al, al
je 0x4e70a7
cmp dword [edi + 4], 4
jne 0x4e70a7
mov eax, dword [ebx + 0x6c]
test eax, eax
jne 0x4e6ff8
cmp dword [edi + 0x6c], eax
je 0x4e7013
test eax, eax
je 0x4e70a7
cmp dword [edi + 0x6c], 0
je 0x4e70a7
mov eax, dword [ebx + 0x70]
cmp eax, dword [edi + 0x70]
sete al
test al, al
je 0x4e70a7
mov eax, dword [edi + 0x48]
mov ecx, dword [ebx + 0x48]
cmp ecx, eax
je 0x4e7053
test ecx, ecx
je 0x4e7031
test eax, eax
je 0x4e7031
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 0x2c]
call eax
test al, al
jne 0x4e7053
mov ecx, dword [edi + 0xc]
push ecx
push 0x4443dc
mov eax, edi
call fcn.0045e6f0
mov esi, dword [ebp + 8]
mov ecx, 0xc25
mov edx, eax
call fcn.004a7840
add esp, 8
or byte [edi + 0xb4], 8
mov dword [edi + 0xb0], ebx
mov eax, dword [0x551d48]
test eax, eax
jge 0x4e706d
xor eax, eax
jmp 0x4e7074
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [eax]
push 0x10
push 0xc
call fcn.00547721
test eax, eax
jne 0x4e708a
mov eax, 0x8007000e
jmp 0x4e70a3
mov edx, dword [ebp + 0xc]
mov dword [eax], edi
mov dword [eax + 4], edx
mov ecx, dword [ebx + 0xac]
mov dword [eax + 8], ecx
mov dword [ebx + 0xac], eax
xor eax, eax
test eax, eax
jl 0x4e70cd
mov ebx, dword [ebx + 0x58]
test ebx, ebx
jne 0x4e6fa3
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
mov dword [ebp - 4], eax
test eax, eax
jne 0x4e6f90
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp eax, 0x8007000e
jne 0x4e70de
mov ecx, dword [ebp + 8]
mov byte [ecx + 0x188], 1
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4fcd00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [ebp + 8]
xor ecx, ecx
push edi
xor edi, edi
xor ebx, ebx
mov dword [ebp - 0xc], edi
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ebx
mov dword [ebp - 0x10], ecx
cmp dword [esi + 0x1c], ecx
jbe 0x4fcdb7
lea esp, [esp]
mov eax, dword [esi + 0x20]
mov edx, dword [eax + ecx*4]
mov eax, dword [edx + 0x2c]
mov dword [eax + 4], edi
mov dword [eax], 0
test dword [edx + 0x3c], 0xfff00000
je 0x4fcdaa
mov esi, dword [eax + 0xc]
xor ecx, ecx
test esi, esi
jbe 0x4fcd6c
mov edi, dword [eax + 0x10]
mov edi, dword [edi + ecx*4]
mov ebx, dword [edx + 0x10]
cmp ebx, dword [edi + 0x78]
jne 0x4fcd64
dec dword [eax]
inc ecx
cmp ecx, esi
jb 0x4fcd54
mov edi, dword [ebp - 0xc]
mov edx, dword [eax + 0x14]
mov esi, dword [eax + 0x18]
xor ecx, ecx
test edx, edx
jbe 0x4fcd90
jmp 0x4fcd80
mov ebx, dword [esi + ecx*4]
cmp dword [ebx + 0x7c], 0
je 0x4fcd8b
inc dword [eax]
inc ecx
cmp ecx, edx
jb 0x4fcd80
mov ebx, dword [ebp - 8]
add dword [ebp - 4], edi
cmp edi, ebx
jbe 0x4fcd9f
mov ebx, edi
mov dword [ebp - 8], ebx
add edi, dword [eax]
mov esi, dword [ebp + 8]
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0xc], edi
inc ecx
mov dword [ebp - 0x10], ecx
cmp ecx, dword [esi + 0x1c]
jb 0x4fcd30
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x4fcdc3
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x4fcdcc
mov dword [eax], ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x507d80
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [0x551d48]
test eax, eax
jge 0x507d92
xor eax, eax
jmp 0x507d99
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [ebp + 8]
mov dword [eax + 4], ecx
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
pop ebp
ret 4

Function at 0x507dc0
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x551d48]
test eax, eax
jge 0x507dcd
xor eax, eax
jmp 0x507dd4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp dword [eax + 8], 0
je 0x507df9
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x507de4
xor eax, eax
ret
mov edx, dword [ecx]
mov dword [eax + 8], edx
test edx, edx
jne 0x507df0
mov dword [eax + 0xc], edx
mov dword [ecx], 0xfefefefe
mov eax, ecx
ret
mov ecx, dword [eax + 4]
push 0x10
push 0xf0
call fcn.00547721
ret

Function at 0x507e10
Capabilities:
Get thread local storage value

Disassembly:
test esi, esi
je 0x507e59
mov eax, dword [0x551d48]
push edi
test eax, eax
jge 0x507e22
xor edi, edi
jmp 0x507e2b
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
push 0xf0
push 0xfe
push esi
call sub.msvcrt.dll_memset
mov dword [esi], 0
mov eax, dword [edi + 0xc]
add esp, 0xc
test eax, eax
je 0x507e52
mov dword [eax], esi
mov dword [edi + 0xc], esi
pop edi
ret
mov dword [edi + 8], esi
mov dword [edi + 0xc], esi
pop edi
ret
Function at 0x507e90
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x14], 0
mov dword [edi], 0x44558c
je 0x507ed6
xor ebx, ebx
cmp dword [edi + 0x10], ebx
jbe 0x507eca
mov edi, edi
mov eax, dword [edi + 0x14]
mov esi, dword [eax + ebx*4]
test esi, esi
je 0x507ec4
call fcn.0050a890
call fcn.0050cb90
inc ebx
cmp ebx, dword [edi + 0x10]
jb 0x507eb0
mov ecx, dword [edi + 0x14]
push ecx
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
add esp, 4
cmp dword [edi + 0x38], 0
je 0x507f8c
xor eax, eax
mov dword [ebp - 4], eax
cmp dword [edi + 0xc], eax
jbe 0x507f80
mov edi, edi
mov edx, dword [edi + 0x38]
mov esi, dword [edx + eax*4]
test esi, esi
je 0x507f73
mov ecx, dword [esi + 0x10]
test ecx, ecx
je 0x507f30
cmp ecx, 0xffffffff
je 0x507f30
mov eax, dword [esi + 0x18]
test eax, eax
je 0x507f15
mov edx, dword [esi + 0x14]
mov dword [eax + 0x14], edx
jmp 0x507f1b
mov eax, dword [esi + 0x14]
mov dword [ecx + 0x24], eax
mov eax, dword [esi + 0x14]
test eax, eax
je 0x507f2a
mov ecx, dword [esi + 0x18]
mov dword [eax + 0x18], ecx
jmp 0x507f30
mov edx, dword [esi + 0x18]
mov dword [ecx + 0x28], edx
mov eax, dword [0x551d48]
test eax, eax
jge 0x507f3d
xor ebx, ebx
jmp 0x507f46
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
push 0xf0
push 0xfe
push esi
call sub.msvcrt.dll_memset
mov dword [esi], 0
mov eax, dword [ebx + 0xc]
add esp, 0xc
test eax, eax
je 0x507f6a
mov dword [eax], esi
jmp 0x507f6d
mov dword [ebx + 8], esi
mov eax, dword [ebp - 4]
mov dword [ebx + 0xc], esi
inc eax
mov dword [ebp - 4], eax
cmp eax, dword [edi + 0xc]
jb 0x507ef0
mov eax, dword [edi + 0x38]
push eax
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
add esp, 4
cmp dword [edi + 0x30], 0
je 0x507fe0
xor eax, eax
mov dword [ebp - 4], eax
cmp dword [edi + 8], eax
jbe 0x507fd4
lea esp, [esp]
mov ecx, dword [edi + 0x30]
mov esi, dword [ecx + eax*4]
test esi, esi
je 0x507fcb
lea ebx, [esi + 0x24]
mov dword [ebx], 0
mov dword [ebx + 4], 0
call fcn.00530f40
push esi
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
mov eax, dword [ebp - 4]
add esp, 4
inc eax
mov dword [ebp - 4], eax
cmp eax, dword [edi + 8]
jb 0x507fa0
mov edx, dword [edi + 0x30]
push edx
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
add esp, 4
cmp dword [edi + 0x28], 0
je 0x508030
xor ebx, ebx
cmp dword [edi + 4], ebx
jbe 0x508024
lea ecx, [ecx]
mov eax, dword [edi + 0x28]
mov esi, dword [eax + ebx*4]
test esi, esi
je 0x50801e
mov ecx, dword [esi + 0x3c]
mov dword [ebp - 4], ecx
test ecx, ecx
je 0x508015
call fcn.004ae650
mov ecx, dword [ebp - 4]
push ecx
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
add esp, 4
push esi
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
add esp, 4
inc ebx
cmp ebx, dword [edi + 4]
jb 0x507ff0
mov edx, dword [edi + 0x28]
push edx
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x508af0
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [0x551d48]
push esi
xor esi, esi
cmp eax, esi
push edi
jge 0x508b06
xor eax, eax
jmp 0x508b0d
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp dword [eax + 0x14], esi
je 0x508b35
mov ecx, dword [eax + 0x14]
cmp ecx, esi
jne 0x508b1f
xor ecx, ecx
mov edi, ecx
jmp 0x508b43
mov edx, dword [ecx]
mov dword [eax + 0x14], edx
cmp edx, esi
jne 0x508b2b
mov dword [eax + 0x18], esi
mov dword [ecx], 0xfefefefe
mov edi, ecx
jmp 0x508b43
mov ecx, dword [eax + 0x10]
push 0x10
push 0x44
call fcn.00547721
mov edi, eax
cmp edi, esi
je 0x508bb0
or eax, 0xffffffff
push ebx
xor ecx, ecx
xor edx, edx
push esi
mov dword [edi + 0x10], eax
mov word [edi + 0x40], cx
mov ecx, dword [ebp + 0x14]
mov word [edi + 0x42], dx
mov edx, dword [ebp + 0x18]
mov dword [edi + 0x20], eax
mov eax, dword [ebp + 0x10]
push edi
mov dword [edi], esi
mov dword [edi + 8], esi
mov dword [edi + 0x3c], esi
mov dword [edi + 4], esi
mov dword [edi + 0xc], esi
mov dword [edi + 0x14], esi
mov dword [edi + 0x18], esi
mov dword [edi + 0x1c], esi
mov dword [edi + 0x24], esi
mov dword [edi + 0x34], esi
mov dword [edi + 0x38], esi
call fcn.0050a980
mov ebx, eax
cmp ebx, esi
jl 0x508bbb
mov esi, dword [ebp + 8]
push edi
call fcn.00508740
mov ebx, eax
test ebx, ebx
jl 0x508bbb
mov ecx, dword [ebp + 0xc]
pop ebx
mov dword [ecx], edi
pop edi
xor eax, eax
pop esi
pop ebp
ret 0x14
pop edi
mov eax, 0x8007000e
pop esi
pop ebp
ret 0x14
mov esi, edi
call fcn.0050a890
call fcn.0050cb90
mov eax, ebx
pop ebx
pop edi
pop esi
pop ebp
ret 0x14
Function at 0x508dd0
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [0x551d48]
push esi
xor esi, esi
cmp eax, esi
push edi
jge 0x508de6
xor eax, eax
jmp 0x508ded
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp dword [eax + 0x14], esi
je 0x508e15
mov ecx, dword [eax + 0x14]
cmp ecx, esi
jne 0x508dff
xor ecx, ecx
mov edi, ecx
jmp 0x508e23
mov edx, dword [ecx]
mov dword [eax + 0x14], edx
cmp edx, esi
jne 0x508e0b
mov dword [eax + 0x18], esi
mov dword [ecx], 0xfefefefe
mov edi, ecx
jmp 0x508e23
mov ecx, dword [eax + 0x10]
push 0x10
push 0x44
call fcn.00547721
mov edi, eax
cmp edi, esi
je 0x508e8e
or eax, 0xffffffff
mov dword [edi + 0x10], eax
mov dword [edi + 0x20], eax
mov eax, dword [ebp + 0xc]
push ebx
push eax
xor ecx, ecx
xor edx, edx
push edi
mov dword [edi], esi
mov dword [edi + 8], esi
mov dword [edi + 0x3c], esi
mov dword [edi + 4], esi
mov word [edi + 0x40], cx
mov dword [edi + 0xc], esi
mov word [edi + 0x42], dx
mov dword [edi + 0x14], esi
mov dword [edi + 0x18], esi
mov dword [edi + 0x1c], esi
mov dword [edi + 0x24], esi
mov dword [edi + 0x34], esi
mov dword [edi + 0x38], esi
call fcn.0050b3a0
mov ebx, eax
cmp ebx, esi
jl 0x508e99
mov esi, dword [ebp + 8]
push edi
call fcn.00508740
mov ebx, eax
test ebx, ebx
jl 0x508e99
mov ecx, dword [ebp + 0x10]
xor eax, eax
test ecx, ecx
je 0x508ea7
pop ebx
mov dword [ecx], edi
pop edi
pop esi
pop ebp
ret 0xc
pop edi
mov eax, 0x8007000e
pop esi
pop ebp
ret 0xc
mov esi, edi
call fcn.0050a890
call fcn.0050cb90
mov eax, ebx
pop ebx
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x509110
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
cmp ebx, dword [eax + 0xc]
jae 0x5091b9
push esi
push edi
mov ecx, dword [eax + 0x38]
mov esi, dword [ecx + ebx*4]
test esi, esi
je 0x5091aa
mov ecx, dword [esi + 0x10]
test ecx, ecx
je 0x509167
cmp ecx, 0xffffffff
je 0x509167
mov eax, dword [esi + 0x18]
test eax, eax
je 0x50914c
mov edx, dword [esi + 0x14]
mov dword [eax + 0x14], edx
jmp 0x509152
mov eax, dword [esi + 0x14]
mov dword [ecx + 0x24], eax
mov eax, dword [esi + 0x14]
test eax, eax
je 0x509161
mov ecx, dword [esi + 0x18]
mov dword [eax + 0x18], ecx
jmp 0x509167
mov edx, dword [esi + 0x18]
mov dword [ecx + 0x28], edx
mov eax, dword [0x551d48]
test eax, eax
jge 0x509174
xor edi, edi
jmp 0x50917d
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
push 0xf0
push 0xfe
push esi
call sub.msvcrt.dll_memset
mov dword [esi], 0
mov eax, dword [edi + 0xc]
add esp, 0xc
test eax, eax
je 0x5091a1
mov dword [eax], esi
jmp 0x5091a4
mov dword [edi + 8], esi
mov eax, dword [ebp + 8]
mov dword [edi + 0xc], esi
inc ebx
cmp ebx, dword [eax + 0xc]
jb 0x509127
mov ebx, dword [ebp + 0xc]
pop edi
pop esi
or dword [eax + 0x18], 4
mov dword [eax + 0xc], ebx
pop ebx
pop ebp
ret 8

Function at 0x509290
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
cmp ebx, dword [edi + 0x10]
jae 0x5092fc
push esi
mov eax, dword [edi + 0x14]
mov esi, dword [eax + ebx*4]
test esi, esi
je 0x5092f2
call fcn.0050a890
mov eax, dword [0x551d48]
test eax, eax
jl 0x5092f2
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
test edi, edi
je 0x5092ef
push 0x44
push 0xfe
push esi
call sub.msvcrt.dll_memset
mov dword [esi], 0
mov eax, dword [edi + 0x18]
add esp, 0xc
test eax, eax
je 0x5092e9
mov dword [eax], esi
jmp 0x5092ec
mov dword [edi + 0x14], esi
mov dword [edi + 0x18], esi
mov edi, dword [ebp + 8]
inc ebx
cmp ebx, dword [edi + 0x10]
jb 0x5092a3
mov ebx, dword [ebp + 0xc]
pop esi
or dword [edi + 0x18], 7
mov dword [edi + 0x10], ebx
pop edi
pop ebx
pop ebp
ret 8