joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b94d0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x634e11
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x6d45e0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x24], ecx
mov ebx, dword [ebp + 8]
push dword [0x6f6340]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebx]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4b9521
cmp dword [eax], edi
je 0x4b955a
mov eax, dword [eax + 8]
test eax, eax
jne 0x4b9516
push esi
push 0xd0
mov dword [ebp - 0x38], esi
call fcn.0046ff90
add esp, 8
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], 0
mov dword [ebp - 4], 1
mov dword [ebp - 0x28], eax
mov byte [ebp - 4], 2
test eax, eax
je 0x4b9587
push esi
mov ecx, eax
call fcn.004b9c20
mov edi, eax
jmp 0x4b9589
cmp dword [eax + 4], 0
je 0x4b9521
push ecx
lea ecx, [ebp - 0x1d]
call fcn.004705f0
push esi
push esi
mov dword [ebp - 4], 0
call fcn.004bbc00
add esp, 8
lea ecx, [ebp - 0x1d]
call fcn.00470600
jmp 0x4b9620
xor edi, edi
mov ecx, dword [ebp - 0x24]
push edi
push ebx
mov byte [ebp - 4], 1
call fcn.00475330
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x34], 0
test al, al
je 0x4b9620
mov eax, dword [ebx]
xorps xmm0, xmm0
push dword [0x6f6340]
movq qword [ebp - 0x1c], xmm0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x1c], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x1c]
push eax
push dword [0x6f6340]
mov dword [ebp - 0x18], eax
call esi
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 0x14]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebx]
mov dword [ebp - 0x28], eax
mov byte [ebp - 4], 4
call fcn.005acf90
push 0
lea eax, [ebp - 0x40]
push eax
mov eax, dword [ebp - 0x24]
push edi
push dword [eax + 0x14]
call fcn.004b9c70
add esp, 0x10
lea ecx, [ebp - 0x2c]
call fcn.00474f60
push dword [ebp - 0x14]
push dword [0x6f6340]
call esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004c392d
mov esp, ebp
pop ebp
ret 8
Function at 0x4b9640
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x634e71
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x6d45e0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x24], ecx
mov ebx, dword [ebp + 8]
push dword [0x6f6340]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebx]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4b9691
cmp dword [eax], edi
je 0x4b96ca
mov eax, dword [eax + 8]
test eax, eax
jne 0x4b9686
push esi
push 0xa0
mov dword [ebp - 0x38], esi
call fcn.0046ff90
add esp, 8
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], 0
mov dword [ebp - 4], 1
mov dword [ebp - 0x28], eax
mov byte [ebp - 4], 2
test eax, eax
je 0x4b96f7
push esi
mov ecx, eax
call fcn.004b9e10
mov edi, eax
jmp 0x4b96f9
cmp dword [eax + 4], 0
je 0x4b9691
push ecx
lea ecx, [ebp - 0x1d]
call fcn.004705f0
push esi
push esi
mov dword [ebp - 4], 0
call fcn.004bbc20
add esp, 8
lea ecx, [ebp - 0x1d]
call fcn.00470600
jmp 0x4b9790
xor edi, edi
mov ecx, dword [ebp - 0x24]
push edi
push ebx
mov byte [ebp - 4], 1
call fcn.00475330
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x34], 0
test al, al
je 0x4b9790
mov eax, dword [ebx]
xorps xmm0, xmm0
push dword [0x6f6340]
movq qword [ebp - 0x1c], xmm0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x1c], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x1c]
push eax
push dword [0x6f6340]
mov dword [ebp - 0x18], eax
call esi
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 0x14]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebx]
mov dword [ebp - 0x28], eax
mov byte [ebp - 4], 4
call fcn.005acf90
push 0
lea eax, [ebp - 0x40]
push eax
mov eax, dword [ebp - 0x24]
push edi
push dword [eax + 0x14]
call fcn.004b9e60
add esp, 0x10
lea ecx, [ebp - 0x2c]
call fcn.00474f60
push dword [ebp - 0x14]
push dword [0x6f6340]
call esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004c392d
mov esp, ebp
pop ebp
ret 8
Function at 0x4b97b0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x631b51
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x6d45e0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x24], ecx
mov ebx, dword [ebp + 8]
push dword [0x6f6340]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebx]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4b9801
cmp dword [eax], edi
je 0x4b9837
mov eax, dword [eax + 8]
test eax, eax
jne 0x4b97f6
push esi
push 0x78
mov dword [ebp - 0x38], esi
call fcn.0046ff90
add esp, 8
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], 0
mov dword [ebp - 4], 1
mov dword [ebp - 0x28], eax
mov byte [ebp - 4], 2
test eax, eax
je 0x4b9864
push esi
mov ecx, eax
call fcn.004b9fd0
mov edi, eax
jmp 0x4b9866
cmp dword [eax + 4], 0
je 0x4b9801
push ecx
lea ecx, [ebp - 0x1d]
call fcn.004705f0
push esi
push esi
mov dword [ebp - 4], 0
call fcn.004a9fe0
add esp, 8
lea ecx, [ebp - 0x1d]
call fcn.00470600
jmp 0x4b98fd
xor edi, edi
mov ecx, dword [ebp - 0x24]
push edi
push ebx
mov byte [ebp - 4], 1
call fcn.00475330
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x34], 0
test al, al
je 0x4b98fd
mov eax, dword [ebx]
xorps xmm0, xmm0
push dword [0x6f6340]
movq qword [ebp - 0x1c], xmm0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x1c], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x1c]
push eax
push dword [0x6f6340]
mov dword [ebp - 0x18], eax
call esi
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 0x14]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebx]
mov dword [ebp - 0x28], eax
mov byte [ebp - 4], 4
call fcn.005acf90
push 0
lea eax, [ebp - 0x40]
push eax
mov eax, dword [ebp - 0x24]
push edi
push dword [eax + 0x14]
call fcn.004ba020
add esp, 0x10
lea ecx, [ebp - 0x2c]
call fcn.00474f60
push dword [ebp - 0x14]
push dword [0x6f6340]
call esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004c392d
mov esp, ebp
pop ebp
ret 8
Function at 0x4b9920
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x634ed1
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x6d45e0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x24], ecx
mov ebx, dword [ebp + 8]
push dword [0x6f6340]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebx]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4b9971
cmp dword [eax], edi
je 0x4b99a7
mov eax, dword [eax + 8]
test eax, eax
jne 0x4b9966
push esi
push 0x60
mov dword [ebp - 0x38], esi
call fcn.0046ff90
add esp, 8
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], 0
mov dword [ebp - 4], 1
mov dword [ebp - 0x28], eax
mov byte [ebp - 4], 2
test eax, eax
je 0x4b99d4
push esi
mov ecx, eax
call fcn.004ba140
mov edi, eax
jmp 0x4b99d6
cmp dword [eax + 4], 0
je 0x4b9971
push ecx
lea ecx, [ebp - 0x1d]
call fcn.004705f0
push esi
push esi
mov dword [ebp - 4], 0
call fcn.004aa0c0
add esp, 8
lea ecx, [ebp - 0x1d]
call fcn.00470600
jmp 0x4b9a75
xor edi, edi
mov ecx, dword [ebp - 0x24]
push edi
push ebx
mov byte [ebp - 4], 1
call fcn.00475330
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x34], 0
test al, al
je 0x4b9a6d
mov eax, dword [ebx]
xorps xmm0, xmm0
push dword [0x6f6340]
movq qword [ebp - 0x1c], xmm0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x1c], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x1c]
push eax
push dword [0x6f6340]
mov dword [ebp - 0x18], eax
call esi
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 0x14]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebx]
mov dword [ebp - 0x28], eax
mov byte [ebp - 4], 4
call fcn.005acf90
push 0
lea eax, [ebp - 0x40]
push eax
mov eax, dword [ebp - 0x24]
push edi
push dword [eax + 0x14]
call fcn.004ba200
add esp, 0x10
lea ecx, [ebp - 0x2c]
call fcn.00474f60
push dword [ebp - 0x14]
push dword [0x6f6340]
call esi
lea ecx, [ebp - 0x38]
call fcn.004ba350
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004c392d
mov esp, ebp
pop ebp
ret 8
Function at 0x4b9aa0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x634f31
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x6d45e0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x24], ecx
mov ebx, dword [ebp + 8]
push dword [0x6f6340]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebx]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4b9af1
cmp dword [eax], edi
je 0x4b9b27
mov eax, dword [eax + 8]
test eax, eax
jne 0x4b9ae6
push esi
push 0x38
mov dword [ebp - 0x38], esi
call fcn.0046ff90
add esp, 8
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], 0
mov dword [ebp - 4], 1
mov dword [ebp - 0x28], eax
mov byte [ebp - 4], 2
test eax, eax
je 0x4b9b54
push esi
mov ecx, eax
call fcn.004a5f50
mov edi, eax
jmp 0x4b9b56
cmp dword [eax + 4], 0
je 0x4b9af1
push ecx
lea ecx, [ebp - 0x1d]
call fcn.004705f0
push esi
push esi
mov dword [ebp - 4], 0
call fcn.004af3b0
add esp, 8
lea ecx, [ebp - 0x1d]
call fcn.00470600
jmp 0x4b9bf5
xor edi, edi
mov ecx, dword [ebp - 0x24]
push edi
push ebx
mov byte [ebp - 4], 1
call fcn.00475330
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x34], 0
test al, al
je 0x4b9bed
mov eax, dword [ebx]
xorps xmm0, xmm0
push dword [0x6f6340]
movq qword [ebp - 0x1c], xmm0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x1c], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x1c]
push eax
push dword [0x6f6340]
mov dword [ebp - 0x18], eax
call esi
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 0x14]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebx]
mov dword [ebp - 0x28], eax
mov byte [ebp - 4], 4
call fcn.005acf90
push 0
lea eax, [ebp - 0x40]
push eax
mov eax, dword [ebp - 0x24]
push edi
push dword [eax + 0x14]
call fcn.004a69c0
add esp, 0x10
lea ecx, [ebp - 0x2c]
call fcn.00474f60
push dword [ebp - 0x14]
push dword [0x6f6340]
call esi
lea ecx, [ebp - 0x38]
call fcn.004a6af0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004c392d
mov esp, ebp
pop ebp
ret 8
Function at 0x4bab40
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x635281
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x6d45e0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x24], ecx
mov ebx, dword [ebp + 8]
push dword [0x6f6340]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebx]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4bab91
cmp dword [eax], edi
je 0x4baba8
mov eax, dword [eax + 8]
test eax, eax
jne 0x4bab86
mov eax, dword [esi]
mov dword [ebp - 0x38], esi
cmp byte [eax + 0x400], 0
jne 0x4babd5
mov byte [eax + 0x400], 1
jmp 0x4babe2
cmp dword [eax + 4], 0
je 0x4bab91
push ecx
lea ecx, [ebp - 0x1d]
call fcn.004705f0
push esi
push esi
mov dword [ebp - 4], 0
call fcn.004bc7f0
add esp, 8
lea ecx, [ebp - 0x1d]
call fcn.00470600
jmp 0x4baca3
push 0xe8
call fcn.004c4200
add esp, 4
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], 0
mov dword [ebp - 4], 1
mov dword [ebp - 0x28], eax
mov byte [ebp - 4], 2
test eax, eax
je 0x4bac0a
push esi
mov ecx, eax
call fcn.004bb180
mov edi, eax
jmp 0x4bac0c
xor edi, edi
mov ecx, dword [ebp - 0x24]
push edi
push ebx
mov byte [ebp - 4], 1
call fcn.00475330
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x34], 0
test al, al
je 0x4baca3
mov eax, dword [ebx]
xorps xmm0, xmm0
push dword [0x6f6340]
movq qword [ebp - 0x1c], xmm0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x1c], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x1c]
push eax
push dword [0x6f6340]
mov dword [ebp - 0x18], eax
call esi
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 0x14]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebx]
mov dword [ebp - 0x28], eax
mov byte [ebp - 4], 4
call fcn.005acf90
push 0
lea eax, [ebp - 0x40]
push eax
mov eax, dword [ebp - 0x24]
push edi
push dword [eax + 0x14]
call fcn.004bb250
add esp, 0x10
lea ecx, [ebp - 0x2c]
call fcn.00474f60
push dword [ebp - 0x14]
push dword [0x6f6340]
call esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004c392d
mov esp, ebp
pop ebp
ret 8
Function at 0x4bacd0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x635281
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x6d45e0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x24], ecx
mov ebx, dword [ebp + 8]
push dword [0x6f6340]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebx]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4bad21
cmp dword [eax], edi
je 0x4bad38
mov eax, dword [eax + 8]
test eax, eax
jne 0x4bad16
mov eax, dword [esi]
mov dword [ebp - 0x38], esi
cmp byte [eax + 0x400], 0
jne 0x4bad65
mov byte [eax + 0x400], 1
jmp 0x4bad72
cmp dword [eax + 4], 0
je 0x4bad21
push ecx
lea ecx, [ebp - 0x1d]
call fcn.004705f0
push esi
push esi
mov dword [ebp - 4], 0
call fcn.004bc820
add esp, 8
lea ecx, [ebp - 0x1d]
call fcn.00470600
jmp 0x4bae33
push 0xe0
call fcn.004c4200
add esp, 4
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], 0
mov dword [ebp - 4], 1
mov dword [ebp - 0x28], eax
mov byte [ebp - 4], 2
test eax, eax
je 0x4bad9a
push esi
mov ecx, eax
call fcn.004bb410
mov edi, eax
jmp 0x4bad9c
xor edi, edi
mov ecx, dword [ebp - 0x24]
push edi
push ebx
mov byte [ebp - 4], 1
call fcn.00475330
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x34], 0
test al, al
je 0x4bae33
mov eax, dword [ebx]
xorps xmm0, xmm0
push dword [0x6f6340]
movq qword [ebp - 0x1c], xmm0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x1c], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x1c]
push eax
push dword [0x6f6340]
mov dword [ebp - 0x18], eax
call esi
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 0x14]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebx]
mov dword [ebp - 0x28], eax
mov byte [ebp - 4], 4
call fcn.005acf90
push 0
lea eax, [ebp - 0x40]
push eax
mov eax, dword [ebp - 0x24]
push edi
push dword [eax + 0x14]
call fcn.004bb4d0
add esp, 0x10
lea ecx, [ebp - 0x2c]
call fcn.00474f60
push dword [ebp - 0x14]
push dword [0x6f6340]
call esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004c392d
mov esp, ebp
pop ebp
ret 8
Function at 0x4bae60
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6352e1
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x6d45e0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x24], ecx
mov ebx, dword [ebp + 8]
push dword [0x6f6340]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebx]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4baeb1
cmp dword [eax], edi
je 0x4baec8
mov eax, dword [eax + 8]
test eax, eax
jne 0x4baea6
mov eax, dword [esi]
mov dword [ebp - 0x38], esi
cmp byte [eax + 0x400], 0
jne 0x4baef5
mov byte [eax + 0x400], 1
jmp 0x4baf02
cmp dword [eax + 4], 0
je 0x4baeb1
push ecx
lea ecx, [ebp - 0x1d]
call fcn.004705f0
push esi
push esi
mov dword [ebp - 4], 0
call fcn.004bc840
add esp, 8
lea ecx, [ebp - 0x1d]
call fcn.00470600
jmp 0x4bafcb
push 0x118
call fcn.004c4200
add esp, 4
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], 0
mov dword [ebp - 4], 1
mov dword [ebp - 0x28], eax
mov byte [ebp - 4], 2
test eax, eax
je 0x4baf2a
push esi
mov ecx, eax
call fcn.004bb670
mov edi, eax
jmp 0x4baf2c
xor edi, edi
mov ecx, dword [ebp - 0x24]
push edi
push ebx
mov byte [ebp - 4], 1
call fcn.00475330
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x34], 0
test al, al
je 0x4bafc3
mov eax, dword [ebx]
xorps xmm0, xmm0
push dword [0x6f6340]
movq qword [ebp - 0x1c], xmm0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x1c], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x1c]
push eax
push dword [0x6f6340]
mov dword [ebp - 0x18], eax
call esi
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 0x14]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebx]
mov dword [ebp - 0x28], eax
mov byte [ebp - 4], 4
call fcn.005acf90
push 0
lea eax, [ebp - 0x40]
push eax
mov eax, dword [ebp - 0x24]
push edi
push dword [eax + 0x14]
call fcn.004bb740
add esp, 0x10
lea ecx, [ebp - 0x2c]
call fcn.00474f60
push dword [ebp - 0x14]
push dword [0x6f6340]
call esi
lea ecx, [ebp - 0x38]
call fcn.004bb8e0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004c392d
mov esp, ebp
pop ebp
ret 8
Function at 0x4baff0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6352e1
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x6d45e0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x24], ecx
mov ebx, dword [ebp + 8]
push dword [0x6f6340]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebx]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4bb041
cmp dword [eax], edi
je 0x4bb058
mov eax, dword [eax + 8]
test eax, eax
jne 0x4bb036
mov eax, dword [esi]
mov dword [ebp - 0x38], esi
cmp byte [eax + 0x400], 0
jne 0x4bb085
mov byte [eax + 0x400], 1
jmp 0x4bb092
cmp dword [eax + 4], 0
je 0x4bb041
push ecx
lea ecx, [ebp - 0x1d]
call fcn.004705f0
push esi
push esi
mov dword [ebp - 4], 0
call fcn.004bc870
add esp, 8
lea ecx, [ebp - 0x1d]
call fcn.00470600
jmp 0x4bb15b
push 0x110
call fcn.004c4200
add esp, 4
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], 0
mov dword [ebp - 4], 1
mov dword [ebp - 0x28], eax
mov byte [ebp - 4], 2
test eax, eax
je 0x4bb0ba
push esi
mov ecx, eax
call fcn.004bb940
mov edi, eax
jmp 0x4bb0bc
xor edi, edi
mov ecx, dword [ebp - 0x24]
push edi
push ebx
mov byte [ebp - 4], 1
call fcn.00475330
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x34], 0
test al, al
je 0x4bb153
mov eax, dword [ebx]
xorps xmm0, xmm0
push dword [0x6f6340]
movq qword [ebp - 0x1c], xmm0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x1c], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x1c]
push eax
push dword [0x6f6340]
mov dword [ebp - 0x18], eax
call esi
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 0x14]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebx]
mov dword [ebp - 0x28], eax
mov byte [ebp - 4], 4
call fcn.005acf90
push 0
lea eax, [ebp - 0x40]
push eax
mov eax, dword [ebp - 0x24]
push edi
push dword [eax + 0x14]
call fcn.004bba00
add esp, 0x10
lea ecx, [ebp - 0x2c]
call fcn.00474f60
push dword [ebp - 0x14]
push dword [0x6f6340]
call esi
lea ecx, [ebp - 0x38]
call fcn.004bb8e0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004c392d
mov esp, ebp
pop ebp
ret 8
Function at 0x4bc0a0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6355a1
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x6d45e0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x24], ecx
mov ebx, dword [ebp + 8]
push dword [0x6f6340]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebx]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4bc0f1
cmp dword [eax], edi
je 0x4bc108
mov eax, dword [eax + 8]
test eax, eax
jne 0x4bc0e6
mov eax, dword [esi]
mov dword [ebp - 0x38], esi
cmp byte [eax + 0x400], 0
jne 0x4bc135
mov byte [eax + 0x400], 1
jmp 0x4bc142
cmp dword [eax + 4], 0
je 0x4bc0f1
push ecx
lea ecx, [ebp - 0x1d]
call fcn.004705f0
push esi
push esi
mov dword [ebp - 4], 0
call fcn.004bc890
add esp, 8
lea ecx, [ebp - 0x1d]
call fcn.00470600
jmp 0x4bc203
push 0x100
call fcn.004c4200
add esp, 4
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], 0
mov dword [ebp - 4], 1
mov dword [ebp - 0x28], eax
mov byte [ebp - 4], 2
test eax, eax
je 0x4bc16a
push esi
mov ecx, eax
call fcn.004bc3c0
mov edi, eax
jmp 0x4bc16c
xor edi, edi
mov ecx, dword [ebp - 0x24]
push edi
push ebx
mov byte [ebp - 4], 1
call fcn.00475330
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x34], 0
test al, al
je 0x4bc203
mov eax, dword [ebx]
xorps xmm0, xmm0
push dword [0x6f6340]
movq qword [ebp - 0x1c], xmm0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x1c], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x1c]
push eax
push dword [0x6f6340]
mov dword [ebp - 0x18], eax
call esi
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 0x14]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebx]
mov dword [ebp - 0x28], eax
mov byte [ebp - 4], 4
call fcn.005acf90
push 0
lea eax, [ebp - 0x40]
push eax
mov eax, dword [ebp - 0x24]
push edi
push dword [eax + 0x14]
call fcn.004bc410
add esp, 0x10
lea ecx, [ebp - 0x2c]
call fcn.00474f60
push dword [ebp - 0x14]
push dword [0x6f6340]
call esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004c392d
mov esp, ebp
pop ebp
ret 8