joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f4280
Capabilities:
Execute anti-debugging instructions
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x218
push esi
push edi
push dword [0x884c50]
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [esp + 0x14], eax
mov esi, dword [eax + 4]
cmp esi, dword [eax + 0xc]
jae 0x4f42c5
mov dword [esi], str.TtrcConvxPiece
rdtsc
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 0x18]
lea eax, [esi + 0xc]
mov dword [esi + 4], ecx
mov ecx, dword [esp + 0x14]
mov dword [ecx + 4], eax
mov eax, dword [ebp + 0x10]
or ecx, 0xffffffff
xor esi, esi
mov dword [esp + 0x14], ecx
inc dword [eax + 0x40]
cmp dword [edi + 0x28], esi
jle 0x4f4371
nop dword [eax]
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x24]
test eax, eax
je 0x4f4324
mov ecx, dword [edi + 0x20]
test ecx, ecx
je 0x4f42fa
lea edx, [ecx + 0x10]
mov dword [esp + 0x18], edx
jmp 0x4f4302
mov dword [esp + 0x18], 0
mov edx, dword [eax]
mov eax, dword [edi + 0x24]
push dword [eax + esi*4]
mov eax, dword [ebp + 0xc]
push dword [esp + 0x1c]
push ecx
push eax
lea ecx, [esp + 0x2f]
push ecx
mov ecx, dword [eax + 0x24]
mov eax, dword [edx]
call eax
cmp byte [eax], 0
je 0x4f4360
mov ecx, dword [edi + 0x20]
lea eax, [esp + 0x20]
add ecx, 0x10
push eax
mov eax, dword [edi + 0x24]
mov edx, dword [ecx]
push dword [eax + esi*4]
mov eax, dword [edx + 0x14]
call eax
push dword [ebp + 0x10]
lea ecx, [esp + 0x17]
push dword [ebp + 0xc]
mov edx, dword [eax]
push ecx
mov ecx, eax
call dword [edx + 0x20]
mov ecx, dword [esp + 0x14]
cmp byte [esp + 0x13], 0
cmovne ecx, esi
mov dword [esp + 0x14], ecx
jmp 0x4f4364
mov ecx, dword [esp + 0x14]
inc esi
cmp esi, dword [edi + 0x28]
jl 0x4f42e0
mov eax, dword [ebp + 0x10]
dec dword [eax + 0x40]
mov edx, dword [eax + 0x40]
cmp ecx, 0xffffffff
je 0x4f4380
mov dword [eax + edx*4 + 0x20], ecx
push dword [0x884c50]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
mov esi, dword [edi + 4]
cmp esi, dword [edi + 0xc]
jae 0x4f43af
mov dword [esi], 0x77f5ec
rdtsc
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 0x18]
lea eax, [esi + 0xc]
mov dword [esi + 4], ecx
mov dword [edi + 4], eax
cmp dword [esp + 0x14], 0xffffffff
mov eax, dword [ebp + 8]
setne cl
pop edi
pop esi
mov byte [eax], cl
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4f43d0
Capabilities:
Execute anti-debugging instructions
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x228
push esi
push edi
push dword [0x884c50]
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [esp + 0x1c], eax
mov esi, dword [eax + 4]
cmp esi, dword [eax + 0xc]
jae 0x4f4415
mov dword [esi], str.TtrcConvxPiece
rdtsc
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x14]
lea eax, [esi + 0xc]
mov dword [esi + 4], ecx
mov ecx, dword [esp + 0x1c]
mov dword [ecx + 4], eax
xor esi, esi
cmp dword [edi + 0x28], esi
jle 0x4f44ae
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x24]
test eax, eax
je 0x4f4464
mov ecx, dword [edi + 0x20]
test ecx, ecx
je 0x4f443a
lea edx, [ecx + 0x10]
mov dword [esp + 0x14], edx
jmp 0x4f4442
mov dword [esp + 0x14], 0
mov edx, dword [eax]
mov eax, dword [edi + 0x24]
push dword [eax + esi*4]
mov eax, dword [ebp + 8]
push dword [esp + 0x18]
push ecx
push eax
lea ecx, [esp + 0x2b]
push ecx
mov ecx, dword [eax + 0x24]
mov eax, dword [edx]
call eax
cmp byte [eax], 0
je 0x4f44a4
mov ecx, dword [edi + 0x20]
lea eax, [esp + 0x30]
add ecx, 0x10
push eax
mov eax, dword [edi + 0x24]
mov edx, dword [ecx]
push dword [eax + esi*4]
mov eax, dword [edx + 0x14]
call eax
mov ecx, dword [ebp + 0xc]
push dword [ebp + 0x10]
mov dword [esp + 0x30], ecx
mov dword [esp + 0x24], eax
mov ecx, dword [ecx + 8]
mov dword [esp + 0x2c], ecx
lea ecx, [esp + 0x24]
mov dword [esp + 0x28], esi
mov edx, dword [eax]
push ecx
push dword [ebp + 8]
mov ecx, eax
call dword [edx + 0x24]
inc esi
cmp esi, dword [edi + 0x28]
jl 0x4f4420
push dword [0x884c50]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
mov esi, dword [edi + 4]
cmp esi, dword [edi + 0xc]
jae 0x4f44dd
mov dword [esi], 0x77f5ec
rdtsc
mov dword [esp + 0x1c], eax
mov ecx, dword [esp + 0x1c]
lea eax, [esi + 0xc]
mov dword [esi + 4], ecx
mov dword [edi + 4], eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4f45b4
Capabilities:
Get thread local storage value

Disassembly:
sub ecx, 0x14
jmp method.hkpConvexPieceShape.virtual_0
mov eax, dword [esp + 4]
push esi
mov esi, ecx
mov dword [esi + 0x14], vtable.hkpShapeContainer.0
mov dword [esi], vtable.hkBaseObject.0
test al, 1
je 0x4f460a
test al, 4
jne 0x4f45ff
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0x2c
cmp ax, cx
je 0x4f45e2
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0x2c
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4
Function at 0x4f4910
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push esi
mov ebp, ecx
push edi
push dword [0x884adc]
movzx edi, word [ebp + 0x22]
mov esi, dword [ebp + 0x24]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
shl edi, 5
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
movzx edi, word [ebp + 0x22]
push dword [0x884adc]
mov esi, dword [ebp + 0x28]
add edi, 3
and edi, 0xfffffffc
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [eax + 0x2c]
lea eax, [edi*4]
push eax
push esi
mov edx, dword [ecx]
call dword [edx + 8]
pop edi
xor eax, eax
mov dword [ebp + 0x24], 0
pop esi
mov dword [ebp + 0x28], 0
mov dword [ebp + 0x20], eax
pop ebp
ret

Function at 0x4f4980
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [esp + 4]
push ebx
mov ebx, ecx
mov word [ebx + 0x20], ax
mov word [ebx + 0x22], ax
test eax, eax
je 0x4f49dc
push esi
push dword [0x884adc]
movzx esi, ax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
shl esi, 5
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 4]
movzx esi, word [ebx + 0x22]
mov dword [ebx + 0x24], eax
add esi, 3
push dword [0x884adc]
and esi, 0xfffffffc
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [eax + 0x2c]
lea eax, [esi*4]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov dword [ebx + 0x28], eax
pop esi
pop ebx
ret 4

Function at 0x4f4c64
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, ecx
mov dword [esi], vtable.hkBaseObject.0
test al, 1
je 0x4f4cb3
test al, 4
jne 0x4f4ca8
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0xc
cmp ax, cx
je 0x4f4c8b
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0xc
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4

Function at 0x4f6a00
Capabilities:
Get thread local storage value

Disassembly:
push esi
mov esi, ecx
call fcn.0051f270
mov eax, dword [esp + 8]
test al, 1
je 0x4f6a55
test al, 4
jne 0x4f6a47
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0xe0
cmp ax, cx
je 0x4f6a2a
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0xe0
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4
Function at 0x4f6a60
Capabilities:
Get thread local storage value

Disassembly:
push esi
mov esi, ecx
lea ecx, [esi + 0x14]
mov dword [esi], vtable.hkpAction.0
call fcn.0045d990
mov eax, dword [esp + 8]
mov dword [esi], vtable.hkBaseObject.0
test al, 1
je 0x4f6ac1
test al, 4
jne 0x4f6ab6
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0x18
cmp ax, cx
je 0x4f6a99
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0x18
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4

Function at 0x4f6ad4
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, ecx
mov dword [esi], vtable.hkBaseObject.0
test al, 1
je 0x4f6b23
test al, 4
jne 0x4f6b18
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0x60
cmp ax, cx
je 0x4f6afb
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0x60
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4

Function at 0x4f6b34
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, ecx
mov dword [esi], vtable.hkBaseObject.0
test al, 1
je 0x4f6b86
test al, 4
jne 0x4f6b78
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0x120
cmp ax, cx
je 0x4f6b5b
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0x120
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4

Function at 0x4f6b90
Capabilities:
Get thread local storage value

Disassembly:
push esi
mov esi, ecx
call fcn.005200b0
mov eax, dword [esp + 8]
test al, 1
je 0x4f6be5
test al, 4
jne 0x4f6bd7
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0x170
cmp ax, cx
je 0x4f6bba
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0x170
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4

Function at 0x4f6bf4
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, ecx
mov dword [esi], vtable.hkBaseObject.0
test al, 1
je 0x4f6c43
test al, 4
jne 0x4f6c38
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0x28
cmp ax, cx
je 0x4f6c1b
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0x28
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4
Function at 0x4f6c54
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, ecx
mov dword [esi], vtable.hkBaseObject.0
test al, 1
je 0x4f6ca6
test al, 4
jne 0x4f6c98
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0x120
cmp ax, cx
je 0x4f6c7b
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0x120
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4

Function at 0x4f6cb4
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, ecx
mov dword [esi], vtable.hkBaseObject.0
test al, 1
je 0x4f6d06
test al, 4
jne 0x4f6cf8
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0xb0
cmp ax, cx
je 0x4f6cdb
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0xb0
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4

Function at 0x4f6d10
Capabilities:
Get thread local storage value

Disassembly:
push esi
mov esi, ecx
call fcn.0051c060
mov eax, dword [esp + 8]
test al, 1
je 0x4f6d62
test al, 4
jne 0x4f6d57
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0x48
cmp ax, cx
je 0x4f6d3a
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0x48
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4

Function at 0x4f6d70
Capabilities:
Get thread local storage value

Disassembly:
push esi
mov esi, ecx
lea ecx, [esi + 0x14]
mov dword [esi], vtable.hkpAction.0
call fcn.0045d990
mov eax, dword [esp + 8]
mov dword [esi], vtable.hkBaseObject.0
test al, 1
je 0x4f6dd1
test al, 4
jne 0x4f6dc6
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0x1c
cmp ax, cx
je 0x4f6da9
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0x1c
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4

Function at 0x4f6de0
Capabilities:
Get thread local storage value

Disassembly:
sub ecx, 8
jmp method.hkpConstraintCollisionFilter.virtual_0
push esi
mov esi, ecx
call fcn.005135b0
mov eax, dword [esp + 8]
test al, 1
je 0x4f6e32
test al, 4
jne 0x4f6e27
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0x44
cmp ax, cx
je 0x4f6e0a
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0x44
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4
Function at 0x4f6ea0
Capabilities:
Get thread local storage value

Disassembly:
push esi
mov esi, ecx
call fcn.00506280
mov eax, dword [esp + 8]
test al, 1
je 0x4f6ef2
test al, 4
jne 0x4f6ee7
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0x38
cmp ax, cx
je 0x4f6eca
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0x38
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4

Function at 0x4f6f04
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, ecx
mov dword [esi], vtable.hkpConstraintListener.0
test al, 1
je 0x4f6f3d
test al, 4
jne 0x4f6f32
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push 4
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
mov eax, esi
pop esi
ret 4
push 4
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4

Function at 0x4f6f54
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, ecx
mov dword [esi], vtable.hkBaseObject.0
test al, 1
je 0x4f6fa3
test al, 4
jne 0x4f6f98
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0xc
cmp ax, cx
je 0x4f6f7b
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0xc
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4

Function at 0x4f6fb4
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, ecx
mov dword [esi], vtable.hkBaseObject.0
test al, 1
je 0x4f7003
test al, 4
jne 0x4f6ff8
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0xc
cmp ax, cx
je 0x4f6fdb
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0xc
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4

Function at 0x4f7010
Capabilities:
Get thread local storage value

Disassembly:
push esi
mov esi, ecx
call fcn.005071c0
mov eax, dword [esp + 8]
test al, 1
je 0x4f7065
test al, 4
jne 0x4f7057
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0x120
cmp ax, cx
je 0x4f703a
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0x120
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4
Function at 0x4f7074
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, ecx
mov dword [esi], vtable.hkBaseObject.0
test al, 1
je 0x4f70c6
test al, 4
jne 0x4f70b8
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0xd0
cmp ax, cx
je 0x4f709b
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0xd0
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4

Function at 0x4f70d4
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, ecx
mov dword [esi], vtable.hkBaseObject.0
test al, 1
je 0x4f7126
test al, 4
jne 0x4f7118
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0xa0
cmp ax, cx
je 0x4f70fb
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0xa0
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4

Function at 0x4f7130
Capabilities:
Get thread local storage value

Disassembly:
push esi
mov esi, ecx
call fcn.005071c0
mov eax, dword [esp + 8]
test al, 1
je 0x4f7185
test al, 4
jne 0x4f7177
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0x120
cmp ax, cx
je 0x4f715a
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0x120
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4

Function at 0x4f7194
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, ecx
mov dword [esi], vtable.hkBaseObject.0
test al, 1
je 0x4f71e3
test al, 4
jne 0x4f71d8
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0x14
cmp ax, cx
je 0x4f71bb
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0x14
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4

Function at 0x4f71f0
Capabilities:
Get thread local storage value

Disassembly:
push esi
mov esi, ecx
call fcn.00514ef0
mov eax, dword [esp + 8]
test al, 1
je 0x4f7245
test al, 4
jne 0x4f7237
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0x100
cmp ax, cx
je 0x4f721a
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0x100
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4
Function at 0x4f7250
Capabilities:
Get thread local storage value

Disassembly:
push esi
mov esi, ecx
call fcn.004f6840
mov eax, dword [esp + 8]
test al, 1
je 0x4f72a2
test al, 4
jne 0x4f7297
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0x40
cmp ax, cx
je 0x4f727a
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0x40
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4

Function at 0x4f72b0
Capabilities:
Get thread local storage value

Disassembly:
push esi
mov esi, ecx
call fcn.005071c0
mov eax, dword [esp + 8]
test al, 1
je 0x4f7305
test al, 4
jne 0x4f72f7
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0x120
cmp ax, cx
je 0x4f72da
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0x120
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4

Function at 0x4f7314
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, ecx
mov dword [esi], vtable.hkBaseObject.0
test al, 1
je 0x4f7366
test al, 4
jne 0x4f7358
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0x120
cmp ax, cx
je 0x4f733b
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0x120
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4

Function at 0x4f7370
Capabilities:
Get thread local storage value

Disassembly:
sub ecx, 8
jmp method.hkpPairCollisionFilter.virtual_0
push esi
mov esi, ecx
call fcn.00512b20
mov eax, dword [esp + 8]
test al, 1
je 0x4f73c2
test al, 4
jne 0x4f73b7
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0x40
cmp ax, cx
je 0x4f739a
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0x40
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4

Function at 0x4f7430
Capabilities:
Get thread local storage value

Disassembly:
push esi
mov esi, ecx
call fcn.0051e830
mov eax, dword [esp + 8]
test al, 1
je 0x4f7485
test al, 4
jne 0x4f7477
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0xa4
cmp ax, cx
je 0x4f745a
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0xa4
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4