joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4233e4
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, dword [0x555894]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov ebx, eax
add dword [ebx], 4
mov eax, dword [ebx]
cmp eax, dword [ebx + 4]
jne 0x423404
call fcn.00432d24
mov edx, dword [ebx]
xor ecx, ecx
mov eax, dword [edx - 4]
mov dword [eax], 0x400
mov edx, dword [ebp + 0xc]
mov dword [eax + 8], edx
mov dword [eax + 0xc], ecx
mov edx, dword [ebp + 8]
mov dword [eax + 0x10], edx
pop ebx
pop ebp
ret

Function at 0x423424
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, dword [0x555894]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov ebx, eax
add dword [ebx], 4
mov eax, dword [ebx]
cmp eax, dword [ebx + 4]
jne 0x423444
call fcn.00432d24
mov edx, dword [ebx]
xor ecx, ecx
mov eax, dword [edx - 4]
mov dword [eax], 0x100
mov edx, dword [ebp + 8]
mov dword [eax + 8], edx
mov dword [eax + 0xc], ecx
pop ebx
pop ebp
ret

Function at 0x423460
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, dword [0x555894]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov ebx, eax
add dword [ebx], 4
mov eax, dword [ebx]
cmp eax, dword [ebx + 4]
jne 0x423480
call fcn.00432d24
mov edx, dword [ebx]
mov eax, dword [edx - 4]
mov dword [eax], 0x100
mov edx, dword [ebp + 8]
mov ecx, dword [edx]
xor edx, edx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
pop ebx
pop ebp
ret

Function at 0x42349c
Capabilities:
Get thread local storage value

Disassembly:
push ebx
mov eax, dword [0x555894]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov ebx, eax
add dword [ebx], 4
mov eax, dword [ebx]
cmp eax, dword [ebx + 4]
jne 0x4234b9
call fcn.00432d24
mov edx, dword [ebx]
mov eax, dword [edx - 4]
xor edx, edx
mov dword [eax], 0x100
mov dword [eax + 8], 0x540670
mov dword [eax + 0xc], edx
pop ebx
ret

Function at 0x4234d4
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, dword [0x555894]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov ebx, eax
add dword [ebx], 4
mov eax, dword [ebx]
cmp eax, dword [ebx + 4]
jne 0x4234fa
call fcn.00432d24
mov edx, dword [ebx]
mov ax, word [edi + 2]
mov esi, dword [edx - 4]
mov word [ebp - 2], ax
cmp dword [ebp + 0x10], 0
je 0x423516
movzx edx, word [ebp - 2]
add edx, edx
sub dword [ebp + 0x10], edx
mov ecx, dword [ebp + 0x10]
lea edx, [edi + 4]
push ecx
mov eax, dword [ebp + 0xc]
push eax
push edx
mov cx, word [ebp - 2]
push ecx
movzx eax, word [ebp - 2]
add eax, eax
add eax, edi
add eax, 4
push eax
call fcn.004322ac
mov dword [esi + 8], eax
mov dword [esi], 0x1000
mov dx, word [edi]
add esp, 0x14
mov word [esi + 0xc], dx
mov ecx, dword [ebx + 0xc]
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
mov cx, word [edx + 0x10]
mov word [esi + 0xe], cx
mov eax, dword [ebx + 0xc]
mov edx, dword [eax]
mov ecx, dword [edx + 0xc]
mov ax, word [ecx + 0xc]
mov word [esi + 0x10], ax
mov edx, dword [ebx + 0xc]
mov ecx, dword [edx]
mov eax, dword [ecx + 0xc]
mov dx, word [eax + 0xe]
mov word [esi + 0x12], dx
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x423584
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov eax, dword [0x555894]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov ebx, eax
add dword [ebx], 4
mov eax, dword [ebx]
cmp eax, dword [ebx + 4]
jne 0x4235a5
call fcn.00432d24
mov edx, dword [ebx]
mov eax, dword [ebp + 0x10]
mov esi, dword [edx - 4]
push eax
mov edx, dword [ebp + 0xc]
push edx
push 0
push 0
mov ecx, dword [ebp + 8]
push ecx
call fcn.004322ac
mov dword [esi + 8], eax
mov dword [esi], 0x1000
mov word [esi + 0xc], 0
mov eax, dword [ebx + 0xc]
add esp, 0x14
mov edx, dword [eax]
mov ecx, dword [edx + 0xc]
mov ax, word [ecx + 0x10]
mov word [esi + 0xe], ax
mov edx, dword [ebx + 0xc]
mov ecx, dword [edx]
mov eax, dword [ecx + 0xc]
mov dx, word [eax + 0xc]
mov word [esi + 0x10], dx
mov ecx, dword [ebx + 0xc]
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
mov cx, word [edx + 0xe]
mov word [esi + 0x12], cx
pop esi
pop ebx
pop ebp
ret

Function at 0x423608
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov eax, dword [0x555894]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov ebx, eax
add dword [ebx], 4
mov eax, dword [ebx]
cmp eax, dword [ebx + 4]
jne 0x423629
call fcn.00432d24
mov edx, dword [ebx]
mov eax, dword [ebp + 0xc]
mov esi, dword [edx - 4]
push eax
mov edx, dword [ebp + 8]
push edx
call fcn.00432480
mov dword [esi + 8], eax
mov dword [esi], 0x1000
mov cx, word [ebp + 0x10]
add esp, 8
mov word [esi + 0xc], cx
mov eax, dword [ebx + 0xc]
mov edx, dword [eax]
mov ecx, dword [edx + 0xc]
mov ax, word [ecx + 0x10]
mov word [esi + 0xe], ax
mov edx, dword [ebx + 0xc]
mov ecx, dword [edx]
mov eax, dword [ecx + 0xc]
mov dx, word [eax + 0xc]
mov word [esi + 0x10], dx
mov ecx, dword [ebx + 0xc]
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
mov cx, word [edx + 0xe]
mov word [esi + 0x12], cx
pop esi
pop ebx
pop ebp
ret

Function at 0x423684
Capabilities:
Get thread local storage value

Disassembly:
push ebx
mov eax, dword [0x555894]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov ebx, eax
add dword [ebx], 4
mov eax, dword [ebx]
cmp eax, dword [ebx + 4]
jne 0x4236a1
call fcn.00432d24
mov edx, dword [ebx]
mov ecx, dword [edx - 4]
mov ebx, ecx
mov dword [ebx], 2
call fcn.00482f88
mov dword [ebx + 8], eax
mov word [ebx + 0xc], 0xa
pop ebx
ret

Function at 0x4236c0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, dword [0x555894]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov ebx, eax
call fcn.00482f88
mov esi, eax
mov eax, dword [ebx]
mov ebx, dword [eax - 4]
push edi
push ebx
call fcn.00422050
add esp, 8
test eax, eax
jne 0x4236fa
push edi
push ebx
call fcn.00483b00
add esp, 8
push esi
call fcn.00482f94
pop ecx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x423708
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, dword [0x555894]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov edx, dword [eax]
mov ebx, dword [edx - 4]
test byte [ebx + 1], 4
je 0x4237a0
mov esi, dword [ebx + 0x10]
mov al, byte [esi]
cmp al, 0x4d
je 0x423734
cmp al, 0x6d
jne 0x423762
cmp dword [ebx + 8], 1
je 0x423756
cmp dword [ebx + 8], 4
jb 0x4237a0
mov edx, dword [ebx + 8]
push edx
push 0x54080d
push esi
call fcn.004a8934
add esp, 0xc
test eax, eax
jne 0x4237a0
push edi
push ebx
call fcn.00443d58
add esp, 8
jmp 0x4237a7
cmp dword [ebx + 8], 4
jb 0x4237a0
mov ecx, dword [ebx + 8]
push ecx
push 0x540814
push esi
call fcn.004a8934
add esp, 0xc
test eax, eax
je 0x423794
mov eax, dword [ebx + 8]
push eax
push 0x54081a
push esi
call fcn.004a8934
add esp, 0xc
test eax, eax
jne 0x4237a0
push edi
push ebx
call fcn.00483b00
add esp, 8
jmp 0x4237a7
push edi
call fcn.004236c0
pop ecx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4237ac
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, dword [0x555894]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov ebx, eax
test esi, esi
jl 0x4237fe
mov eax, dword [ebx + 0xc]
mov eax, dword [eax]
mov dx, word [eax + 0x12]
cmp dx, word [eax + 0x10]
jae 0x4237f1
movzx ecx, dx
cmp esi, ecx
jle 0x4237f1
mov eax, dword [ebx + 0xc]
mov edx, dword [eax]
mov eax, dword [ebx + 0xc]
movzx ecx, word [edx + 0x10]
mov edx, dword [eax]
movzx eax, word [edx + 0x12]
sub ecx, eax
jmp 0x4237f3
xor ecx, ecx
add esi, ecx
mov edx, dword [ebx + 0xc]
mov esi, dword [edx + esi*4 + 4]
jmp 0x423813
push esi
mov eax, dword [ebx + 0xc]
mov edx, dword [eax + 4]
mov ecx, dword [edx + 8]
push ecx
call fcn.00432530
add esp, 8
mov esi, eax
test byte [esi + 1], 0x20
je 0x423822
push esi
call fcn.0043f7e0
pop ecx
jmp 0x423824
mov eax, esi
push eax
add dword [ebx], 4
mov edx, dword [ebx]
cmp edx, dword [ebx + 4]
jne 0x423834
call fcn.00432d24
mov ecx, dword [ebx]
mov eax, dword [ecx - 4]
push eax
call fcn.0043f0d4
add esp, 8
pop esi
pop ebx
pop ebp
ret
Function at 0x423848
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, dword [0x555894]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov ebx, eax
add dword [ebx], 4
mov eax, dword [ebx]
cmp eax, dword [ebx + 4]
jne 0x42386c
call fcn.00432d24
mov edx, dword [ebx]
test esi, esi
mov eax, dword [edx - 4]
jl 0x4238da
mov edx, dword [ebx + 0xc]
mov edx, dword [edx]
mov cx, word [edx + 0x12]
cmp cx, word [edx + 0x10]
jae 0x4238b0
mov edx, dword [ebx + 0xc]
mov ecx, dword [edx]
movzx edx, word [ecx + 0x12]
cmp esi, edx
jle 0x4238b0
mov ecx, dword [ebx + 0xc]
mov edx, dword [ecx]
movzx ecx, word [edx + 0x10]
mov edx, dword [ebx + 0xc]
mov edx, dword [edx]
movzx edx, word [edx + 0x12]
sub ecx, edx
add esi, ecx
mov ecx, dword [ebx + 0xc]
mov edx, dword [ecx + esi*4 + 4]
jmp 0x4238b7
mov ecx, dword [ebx + 0xc]
mov edx, dword [ecx + esi*4 + 4]
mov ecx, dword [edx]
test ch, 0x20
je 0x4238d2
test ecx, 0x10000
jne 0x4238d2
push edx
push eax
call fcn.0043f0d4
add esp, 8
jmp 0x423903
lea edx, [ebx + 8]
mov dword [eax + 8], edx
jmp 0x4238e6
mov ecx, dword [ebx + 0xc]
mov edx, dword [ecx + 4]
mov ecx, dword [edx + 8]
mov dword [eax + 8], ecx
mov dword [eax], 0x2000
mov dword [eax + 0x10], esi
mov edx, dword [ebx + 0xc]
sub edx, dword [ebx + 8]
test edx, edx
jns 0x4238fc
add edx, 3
sar edx, 2
inc edx
mov dword [eax + 0xc], edx
pop esi
pop ebx
pop ebp
ret

Function at 0x423908
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov eax, dword [0x555894]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov ebx, eax
mov eax, dword [ebx + 0x8c]
mov edx, dword [eax + 8]
movzx eax, word [ebp + 8]
mov esi, dword [edx]
mov edx, eax
shl edx, 3
lea edx, [edx + edx*2]
add esi, edx
add esi, 0xffffffe8
test byte [esi + 1], 0x20
je 0x423945
push esi
call fcn.0043f7e0
pop ecx
jmp 0x423947
mov eax, esi
push eax
add dword [ebx], 4
mov edx, dword [ebx]
cmp edx, dword [ebx + 4]
jne 0x423957
call fcn.00432d24
mov ecx, dword [ebx]
mov eax, dword [ecx - 4]
push eax
call fcn.0043f0d4
add esp, 8
pop esi
pop ebx
pop ebp
ret
Function at 0x42396c
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
mov eax, dword [0x555894]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov ebx, eax
add dword [ebx], 4
mov eax, dword [ebx]
cmp eax, dword [ebx + 4]
jne 0x423991
call fcn.00432d24
mov edx, dword [ebx]
movzx ecx, si
mov eax, dword [edx - 4]
mov edx, dword [ebx + 0x8c]
lea ebx, [ecx + ecx*2]
mov edi, dword [edx + 8]
mov edi, dword [edi]
test byte [edi + ebx*8 - 0x17], 0x20
je 0x4239dc
movzx ebx, si
lea ebx, [ebx + ebx*2]
mov edi, dword [edx + 8]
mov edi, dword [edi]
test byte [edi + ebx*8 - 0x16], 1
jne 0x4239dc
shl ecx, 3
mov edx, dword [edx + 8]
mov edx, dword [edx]
lea ecx, [ecx + ecx*2]
add edx, ecx
add edx, 0xffffffe8
push edx
push eax
call fcn.0043f0d4
add esp, 8
jmp 0x4239fb
mov dword [eax], 0x2000
dec ecx
mov dword [eax + 0x10], ecx
xor ecx, ecx
mov dword [eax + 0xc], ecx
mov ecx, dword [edx + 8]
mov dword [eax + 8], ecx
mov eax, dword [edx + 8]
push eax
call fcn.0043ba18
pop ecx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x423a00
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov eax, dword [0x555894]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov esi, eax
add dword [esi], 4
mov eax, dword [esi]
cmp eax, dword [esi + 4]
jne 0x423a25
call fcn.00432d24
mov edx, dword [esi]
mov ecx, dword [edx - 4]
mov esi, ecx
push ebx
push esi
call fcn.00483a70
add esp, 8
test eax, eax
je 0x423a98
push ebx
push esi
call fcn.00443cf0
add esp, 8
test eax, eax
je 0x423a98
push 1
push 0
mov eax, dword [ebx]
push eax
push 0
push 0x3eb
push 0xe
push 0
push 2
call fcn.00456e7c
add esp, 0x20
mov edi, eax
jmp 0x423a84
push ebx
push esi
call fcn.00483a70
add esp, 8
test eax, eax
je 0x423a91
push ebx
push esi
call fcn.00443cf0
add esp, 8
test eax, eax
je 0x423a91
push edi
call fcn.0045693c
pop ecx
cmp ax, 1
je 0x423a68
push edi
call fcn.00456bb8
pop ecx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x423aa0
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov eax, dword [0x555894]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov ebx, eax
mov eax, dword [ebx]
mov esi, dword [eax - 4]
push esi
add dword [ebx], 4
mov eax, dword [ebx]
cmp eax, dword [ebx + 4]
jne 0x423ac4
call fcn.00432d24
mov edx, dword [ebx]
mov ecx, dword [edx - 4]
push ecx
call fcn.0043f0d4
add esp, 8
pop esi
pop ebx
ret

Function at 0x423ad8
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov eax, dword [0x555894]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov ebx, eax
mov eax, dword [ebx]
mov esi, dword [eax - 4]
push esi
add dword [ebx], 4
mov eax, dword [ebx]
cmp eax, dword [ebx + 4]
jne 0x423afc
call fcn.00432d24
mov edx, dword [ebx]
mov ecx, dword [edx - 4]
push ecx
call fcn.0043f0d4
add esp, 8
test byte [esi + 1], 0x20
je 0x423b21
push esi
call fcn.0043f7e0
pop ecx
push eax
push esi
call fcn.0043f0d4
add esp, 8
pop esi
pop ebx
ret
Function at 0x423b24
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov eax, dword [0x555894]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov ebx, eax
mov eax, dword [ebx]
mov esi, dword [eax - 4]
test byte [esi + 1], 0x20
je 0x423b47
push esi
call fcn.0043f7e0
pop ecx
jmp 0x423b49
mov eax, esi
push eax
add dword [ebx], 4
mov edx, dword [ebx]
cmp edx, dword [ebx + 4]
jne 0x423b59
call fcn.00432d24
mov ecx, dword [ebx]
mov eax, dword [ecx - 4]
push eax
call fcn.0043f0d4
add esp, 8
pop esi
pop ebx
ret

Function at 0x423b6c
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov eax, dword [0x555894]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov esi, eax
or ebx, 0xffffffff
mov eax, dword [esi]
mov edx, dword [eax + ebx*4 - 4]
push edx
mov ecx, dword [esi]
mov eax, dword [ecx + ebx*4]
push eax
call fcn.0043f454
add esp, 8
dec ebx
mov edx, dword [ebp + 8]
add dword [ebp + 8], 0xffffffff
test edx, edx
jne 0x423b81
pop esi
pop ebx
pop ebp
ret

Function at 0x423ba8
Capabilities:
Get thread local storage value

Disassembly:
push ebx
mov eax, dword [0x555894]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov ebx, eax
mov eax, dword [ebx]
mov eax, dword [eax - 4]
test byte [eax], 0x80
je 0x423bca
mov eax, dword [eax + 8]
sub dword [ebx], 4
pop ebx
ret
mov edx, dword [ebx]
mov ecx, dword [edx - 4]
push ecx
push 1
push 0x32
call fcn.0046c000
pop ecx
push eax
push 0
push 0x42a
push 1
call fcn.00457160
add esp, 0x18
xor eax, eax
pop ebx
ret

Function at 0x423bf0
Capabilities:
Get thread local storage value

Disassembly:
push ebx
mov eax, dword [0x555894]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov ebx, eax
push 0
mov eax, dword [ebx]
mov edx, dword [eax - 4]
push edx
call fcn.00422050
add esp, 8
sub dword [ebx], 4
pop ebx
ret

Function at 0x423c14
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, dword [0x555894]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov ebx, eax
call fcn.00482f88
mov esi, eax
push edi
mov eax, dword [ebx]
mov edx, dword [eax - 4]
push edx
call fcn.00422050
add esp, 8
test eax, eax
jne 0x423c53
push edi
mov ecx, dword [ebx]
mov eax, dword [ecx - 8]
push eax
call fcn.00483b80
add esp, 8
push esi
call fcn.00482f94
pop ecx
sub dword [ebx], 4
sub dword [ebx], 4
mov edx, dword [ebx]
mov eax, dword [edx]
test dword [eax], 0xb405
je 0x423c73
push eax
call fcn.0043f008
pop ecx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x423c78
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov eax, dword [0x555894]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov ebx, eax
mov eax, dword [ebx]
mov esi, dword [eax - 4]
test byte [esi + 1], 4
je 0x423d87
mov edi, dword [esi + 0x10]
mov al, byte [edi]
cmp al, 0x4d
je 0x423ca7
cmp al, 0x6d
jne 0x423d15
cmp dword [esi + 8], 1
je 0x423cd1
cmp dword [esi + 8], 4
jb 0x423d87
mov edx, dword [esi + 8]
push edx
push 0x54080d
push edi
call fcn.004a8934
add esp, 0xc
test eax, eax
jne 0x423d87
mov ecx, dword [ebx]
mov eax, dword [ecx - 8]
push eax
mov edx, dword [ebp + 8]
push edx
call fcn.00443c94
add esp, 8
sub dword [ebx], 4
mov ecx, dword [ebx]
mov eax, dword [ecx]
test dword [eax], 0xb405
je 0x423cf9
push eax
call fcn.0043f008
pop ecx
sub dword [ebx], 4
mov edx, dword [ebx]
mov eax, dword [edx]
test dword [eax], 0xb405
je 0x423d91
push eax
call fcn.0043f008
pop ecx
jmp 0x423d91
cmp dword [esi + 8], 4
jb 0x423d87
mov edx, dword [esi + 8]
push edx
push 0x540814
push edi
call fcn.004a8934
add esp, 0xc
test eax, eax
je 0x423d47
mov ecx, dword [esi + 8]
push ecx
push 0x54081a
push edi
call fcn.004a8934
add esp, 0xc
test eax, eax
jne 0x423d87
mov eax, dword [ebp + 8]
push eax
mov edx, dword [ebx]
mov ecx, dword [edx - 8]
push ecx
call fcn.00483b80
add esp, 8
sub dword [ebx], 4
mov eax, dword [ebx]
mov eax, dword [eax]
test dword [eax], 0xb405
je 0x423d6f
push eax
call fcn.0043f008
pop ecx
sub dword [ebx], 4
mov edx, dword [ebx]
mov eax, dword [edx]
test dword [eax], 0xb405
je 0x423d91
push eax
call fcn.0043f008
pop ecx
jmp 0x423d91
mov edx, dword [ebp + 8]
push edx
call fcn.00423c14
pop ecx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x423d98
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
mov eax, dword [0x555894]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov ebx, eax
mov eax, dword [ebx]
mov edi, dword [eax - 4]
and dword [edi], 0xfffbf7ff
test esi, esi
jl 0x423dfc
mov eax, dword [ebx + 0xc]
mov eax, dword [eax]
mov dx, word [eax + 0x12]
cmp dx, word [eax + 0x10]
jae 0x423def
mov ecx, dword [ebx + 0xc]
mov eax, dword [ecx]
movzx edx, word [eax + 0x12]
cmp esi, edx
jle 0x423def
mov ecx, dword [ebx + 0xc]
mov eax, dword [ecx]
mov ecx, dword [ebx + 0xc]
movzx edx, word [eax + 0x10]
mov eax, dword [ecx]
movzx ecx, word [eax + 0x12]
sub edx, ecx
jmp 0x423df1
xor edx, edx
add esi, edx
mov eax, dword [ebx + 0xc]
mov eax, dword [eax + esi*4 + 4]
jmp 0x423e0f
push esi
mov edx, dword [ebx + 0xc]
mov ecx, dword [edx + 4]
mov eax, dword [ecx + 8]
push eax
call fcn.00432530
add esp, 8
push edi
push eax
call fcn.0043f344
add esp, 8
sub dword [ebx], 4
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x423e24
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, dword [0x555894]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov ebx, eax
mov eax, dword [ebx]
mov eax, dword [eax - 4]
and dword [eax], 0xfffbf7ff
mov edx, dword [ebx + 0x8c]
mov ecx, dword [edx + 8]
mov edx, dword [ecx]
movzx ecx, word [ebp + 8]
shl ecx, 3
lea ecx, [ecx + ecx*2]
add edx, ecx
add edx, 0xffffffe8
push eax
push edx
call fcn.0043f344
add esp, 8
sub dword [ebx], 4
pop ebx
pop ebp
ret

Function at 0x424b9c
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
push edi
push ecx
mov eax, dword [0x555894]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov dword [esp], eax
mov ebx, dword [0x540690]
cmp dword [0x540684], 0
je 0x424c26
mov edx, dword [esp]
xor eax, eax
mov dword [0x540684], eax
test ebx, ebx
mov word [edx + 0x34], 0
je 0x424c26
cmp dword [ebx + 0x18], 0
je 0x424c1f
test byte [ebx + 0xc], 0x10
je 0x424c1f
xor esi, esi
jmp 0x424c19
movzx edi, si
shl edi, 4
mov edx, dword [ebx]
mov ax, word [edx + edi + 4]
and ax, 0x18
cmp ax, 0x10
jne 0x424c18
add edi, edx
push edi
call fcn.00423424
pop ecx
call fcn.00422df0
push 0
call fcn.0042225c
pop ecx
mov ecx, dword [esp]
cmp word [ecx + 0x34], 0
jne 0x424c26
inc esi
cmp si, word [ebx + 4]
jb 0x424be1
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x424bd1
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x424d3c
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov eax, dword [0x555894]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov esi, eax
push 0x20
call fcn.0043b368
pop ecx
mov ebx, eax
push 0x18
call fcn.0043b368
pop ecx
mov edi, eax
mov dword [ebx + 0x18], edi
mov dword [edi], 0x22000
mov eax, dword [ebp + 8]
mov dword [edi + 8], eax
mov dword [edi + 0xc], 0x54072c
mov dword [ebx], 0x6000
mov edx, dword [ebx + 0x18]
mov dword [ebx + 8], edx
add dword [esi], 4
mov ecx, dword [esi]
cmp ecx, dword [esi + 4]
jne 0x424d94
call fcn.00432d24
mov eax, dword [esi]
mov eax, dword [eax - 4]
mov dword [eax], 0x22000
mov dword [eax + 8], ebx
mov dword [eax + 0xc], 0x540740
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x425078
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov eax, dword [0x555894]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov esi, eax
push 0x38
call fcn.0043b368
mov ebx, eax
pop ecx
mov eax, dword [ebp + 0x10]
xor ecx, ecx
mov dword [ebx], eax
mov edx, dword [ebp + 0xc]
mov dword [ebx + 4], edx
lea edx, [ebx + 8]
mov dword [ebx + 0x20], 0x40000
mov dword [ebx + 8], ecx
mov eax, dword [ebp + 8]
push eax
push edx
call fcn.0043f284
add esp, 8
add esi, 0x10
test dword [esi], 0xb405
je 0x4250cd
push esi
call fcn.0043f008
pop ecx
mov dword [esi], 0x22000
mov dword [esi + 8], ebx
mov dword [esi + 0xc], 0x540754
mov eax, 1
pop esi
pop ebx
pop ebp
ret
Function at 0x425424
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, dword [0x555894]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov ebx, eax
mov eax, dword [ebx + 0x30]
jmp 0x425444
mov edx, dword [ebx + 8]
mov ecx, dword [edx + eax*4 - 4]
mov eax, dword [ecx + 0xc]
test eax, eax
je 0x425455
mov edx, dword [ebx + 8]
mov ecx, dword [edx + eax*4 - 4]
test byte [ecx + 0x10], 0x80
jne 0x42543a
test eax, eax
je 0x42547c
cmp dword [ebp + 8], 0
je 0x425473
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebx + 8]
mov eax, dword [ecx + eax*4 - 8]
push eax
call fcn.0043f0d4
add esp, 8
mov word [ebx + 0x34], 2
pop ebx
pop ebp
ret
call fcn.004253fc
pop ebx
pop ebp
ret

Function at 0x425484
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffe64
mov edi, 0x54077c
mov eax, dword [0x555894]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov esi, eax
cmp dword [esi + 0xdc], 0
je 0x425570
xor ebx, ebx
push 0
call fcn.00453a34
push eax
call fcn.00453a7c
add esp, 8
push 0
lea eax, [edi + 0x125]
push eax
call fcn.00453a7c
add esp, 8
jmp 0x42553d
lea edx, [esp + 4]
push edx
call fcn.004ab86c
pop ecx
lea ecx, [esp + 0x94]
push ecx
cmp byte [esp + 0x98], 0
je 0x4254f6
lea edx, [edi + 0x13f]
jmp 0x4254f9
lea edx, [edi + 4]
push edx
lea edx, [edi + 0x134]
movzx ecx, word [esp + 8]
push ecx
mov ecx, 0x8d
sub ecx, eax
push edx
push ecx
lea edx, [esp + 0x18]
add eax, edx
push eax
call fcn.004a86c0
add esp, 0x18
push 0
lea eax, [esp + 8]
push eax
call fcn.00453a7c
add esp, 8
push 0
call fcn.00453a34
push eax
call fcn.00453a7c
add esp, 8
lea ecx, [esp + 0x94]
push ecx
lea eax, [esp + 4]
push eax
lea edx, [esp + 0xc]
push edx
mov ecx, ebx
inc ebx
push ecx
call fcn.0044e134
add esp, 0x10
test eax, eax
jne 0x4254d1
xor eax, eax
mov dword [0x540684], eax
mov word [esi + 0x34], 1
add esp, 0x19c
pop edi
pop esi
pop ebx
ret

Function at 0x42557c
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x555894]
push eax
call sub.KERNEL32.DLL_TlsGetValue
test byte [0x540648], 2
je 0x4255a3
cmp word [eax + 0x36], 0
jne 0x4255a3
mov word [eax + 0x36], 1
mov word [eax + 0x34], 1
mov ax, word [eax + 0x34]
ret