joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44c450
Capabilities:
Execute anti-debugging instructions
Get thread local storage value

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
add ebx, 0x108
push edi
mov edi, dword [ebx + 4]
sub edi, 1
js 0x44c4e8
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
mov eax, dword [ebx]
cmp dword [eax + edi*4], 0
je 0x44c4e1
mov ecx, dword [0x4c6074]
push ecx
call ebp
mov esi, eax
mov ecx, dword [esi + 4]
cmp ecx, dword [esi + 0xc]
jae 0x44c4a5
mov dword [ecx], str.TtphntAddCb
rdtsc
mov dword [esp + 0x18], eax
mov edx, dword [esp + 0x18]
mov dword [ecx + 4], edx
add ecx, 0xc
mov dword [esi + 4], ecx
mov eax, dword [ebx]
mov ecx, dword [eax + edi*4]
mov edx, dword [ecx]
mov eax, dword [esp + 0x1c]
mov edx, dword [edx + 4]
push eax
call edx
mov eax, dword [0x4c6074]
push eax
call ebp
mov ecx, eax
mov esi, dword [ecx + 4]
cmp esi, dword [ecx + 0xc]
jae 0x44c4e1
mov dword [esi], 0x4b2454
rdtsc
mov dword [esp + 0x10], eax
mov edx, dword [esp + 0x10]
mov dword [esi + 4], edx
add esi, 0xc
mov dword [ecx + 4], esi
sub edi, 1
jns 0x44c471
pop esi
pop ebp
pop edi
mov eax, ebx
pop ebx
add esp, 4
jmp fcn.0044c050

Function at 0x44c500
Capabilities:
Execute anti-debugging instructions
Get thread local storage value

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
add ebx, 0x108
push edi
mov edi, dword [ebx + 4]
sub edi, 1
js 0x44c598
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
mov eax, dword [ebx]
cmp dword [eax + edi*4], 0
je 0x44c591
mov ecx, dword [0x4c6074]
push ecx
call ebp
mov esi, eax
mov ecx, dword [esi + 4]
cmp ecx, dword [esi + 0xc]
jae 0x44c555
mov dword [ecx], str.TtphntRemCb
rdtsc
mov dword [esp + 0x18], eax
mov edx, dword [esp + 0x18]
mov dword [ecx + 4], edx
add ecx, 0xc
mov dword [esi + 4], ecx
mov eax, dword [ebx]
mov ecx, dword [eax + edi*4]
mov edx, dword [ecx]
mov eax, dword [esp + 0x1c]
mov edx, dword [edx + 8]
push eax
call edx
mov eax, dword [0x4c6074]
push eax
call ebp
mov ecx, eax
mov esi, dword [ecx + 4]
cmp esi, dword [ecx + 0xc]
jae 0x44c591
mov dword [esi], 0x4b2454
rdtsc
mov dword [esp + 0x10], eax
mov edx, dword [esp + 0x10]
mov dword [esi + 4], edx
add esi, 0xc
mov dword [ecx + 4], esi
sub edi, 1
jns 0x44c521
pop esi
pop ebp
pop edi
mov eax, ebx
pop ebx
add esp, 4
jmp fcn.0044c050
Function at 0x44c660
Capabilities:
Execute anti-debugging instructions
Get thread local storage value

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
add ebx, 0x114
push edi
mov edi, dword [ebx + 4]
sub edi, 1
js 0x44c6f8
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
mov eax, dword [ebx]
cmp dword [eax + edi*4], 0
je 0x44c6f1
mov ecx, dword [0x4c6074]
push ecx
call ebp
mov esi, eax
mov ecx, dword [esi + 4]
cmp ecx, dword [esi + 0xc]
jae 0x44c6b5
mov dword [ecx], str.TtconAddCb
rdtsc
mov dword [esp + 0x18], eax
mov edx, dword [esp + 0x18]
mov dword [ecx + 4], edx
add ecx, 0xc
mov dword [esi + 4], ecx
mov eax, dword [ebx]
mov ecx, dword [eax + edi*4]
mov edx, dword [ecx]
mov eax, dword [esp + 0x1c]
mov edx, dword [edx + 4]
push eax
call edx
mov eax, dword [0x4c6074]
push eax
call ebp
mov ecx, eax
mov esi, dword [ecx + 4]
cmp esi, dword [ecx + 0xc]
jae 0x44c6f1
mov dword [esi], 0x4b2454
rdtsc
mov dword [esp + 0x10], eax
mov edx, dword [esp + 0x10]
mov dword [esi + 4], edx
add esi, 0xc
mov dword [ecx + 4], esi
sub edi, 1
jns 0x44c681
pop esi
pop ebp
pop edi
mov eax, ebx
pop ebx
add esp, 4
jmp fcn.0044c050

Function at 0x44c710
Capabilities:
Execute anti-debugging instructions
Get thread local storage value

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
add ebx, 0x114
push edi
mov edi, dword [ebx + 4]
sub edi, 1
js 0x44c7a8
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
mov eax, dword [ebx]
cmp dword [eax + edi*4], 0
je 0x44c7a1
mov ecx, dword [0x4c6074]
push ecx
call ebp
mov esi, eax
mov ecx, dword [esi + 4]
cmp ecx, dword [esi + 0xc]
jae 0x44c765
mov dword [ecx], str.TtconRemCb
rdtsc
mov dword [esp + 0x18], eax
mov edx, dword [esp + 0x18]
mov dword [ecx + 4], edx
add ecx, 0xc
mov dword [esi + 4], ecx
mov eax, dword [ebx]
mov ecx, dword [eax + edi*4]
mov edx, dword [ecx]
mov eax, dword [esp + 0x1c]
mov edx, dword [edx + 8]
push eax
call edx
mov eax, dword [0x4c6074]
push eax
call ebp
mov ecx, eax
mov esi, dword [ecx + 4]
cmp esi, dword [ecx + 0xc]
jae 0x44c7a1
mov dword [esi], 0x4b2454
rdtsc
mov dword [esp + 0x10], eax
mov edx, dword [esp + 0x10]
mov dword [esi + 4], edx
add esi, 0xc
mov dword [ecx + 4], esi
sub edi, 1
jns 0x44c731
pop esi
pop ebp
pop edi
mov eax, ebx
pop ebx
add esp, 4
jmp fcn.0044c050
Function at 0x44c7c0
Capabilities:
Execute anti-debugging instructions
Get thread local storage value

Disassembly:
push ecx
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0xc]
add ebx, 0x174
push edi
mov dword [eax + 0xc], 0
mov edi, dword [ebx + 4]
sub edi, 1
js 0x44c85e
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
mov ecx, dword [ebx]
cmp dword [ecx + edi*4], 0
je 0x44c857
mov edx, dword [0x4c6074]
push edx
call ebp
mov esi, eax
mov ecx, dword [esi + 4]
cmp ecx, dword [esi + 0xc]
jae 0x44c81c
mov dword [ecx], str.TtcpAddCb
rdtsc
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
mov dword [ecx + 4], eax
add ecx, 0xc
mov dword [esi + 4], ecx
mov ecx, dword [ebx]
mov ecx, dword [ecx + edi*4]
mov edx, dword [ecx]
mov eax, dword [esp + 0x1c]
mov edx, dword [edx]
push eax
call edx
mov eax, dword [0x4c6074]
push eax
call ebp
mov ecx, eax
mov esi, dword [ecx + 4]
cmp esi, dword [ecx + 0xc]
jae 0x44c857
mov dword [esi], 0x4b2454
rdtsc
mov dword [esp + 0x10], eax
mov edx, dword [esp + 0x10]
mov dword [esi + 4], edx
add esi, 0xc
mov dword [ecx + 4], esi
sub edi, 1
jns 0x44c7e8
pop esi
pop ebp
pop edi
mov eax, ebx
pop ebx
add esp, 4
jmp fcn.0044c050

Function at 0x44c870
Capabilities:
Execute anti-debugging instructions
Get thread local storage value

Disassembly:
push ecx
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0xc]
add ebx, 0x174
push edi
mov dword [eax + 8], 0
mov edi, dword [ebx + 4]
sub edi, 1
js 0x44c90f
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
mov ecx, dword [ebx]
cmp dword [ecx + edi*4], 0
je 0x44c908
mov edx, dword [0x4c6074]
push edx
call ebp
mov esi, eax
mov ecx, dword [esi + 4]
cmp ecx, dword [esi + 0xc]
jae 0x44c8cc
mov dword [ecx], str.TtcpConfCb
rdtsc
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
mov dword [ecx + 4], eax
add ecx, 0xc
mov dword [esi + 4], ecx
mov ecx, dword [ebx]
mov ecx, dword [ecx + edi*4]
mov edx, dword [ecx]
mov eax, dword [esp + 0x1c]
mov edx, dword [edx + 4]
push eax
call edx
mov eax, dword [0x4c6074]
push eax
call ebp
mov ecx, eax
mov esi, dword [ecx + 4]
cmp esi, dword [ecx + 0xc]
jae 0x44c908
mov dword [esi], 0x4b2454
rdtsc
mov dword [esp + 0x10], eax
mov edx, dword [esp + 0x10]
mov dword [esi + 4], edx
add esi, 0xc
mov dword [ecx + 4], esi
sub edi, 1
jns 0x44c898
pop esi
pop ebp
pop edi
mov eax, ebx
pop ebx
add esp, 4
jmp fcn.0044c050
Function at 0x44c920
Capabilities:
Execute anti-debugging instructions
Get thread local storage value

Disassembly:
push ecx
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0xc]
add ebx, 0x174
push edi
mov dword [eax + 0x10], 0
mov edi, dword [ebx + 4]
sub edi, 1
js 0x44c9bf
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
mov ecx, dword [ebx]
cmp dword [ecx + edi*4], 0
je 0x44c9b8
mov edx, dword [0x4c6074]
push edx
call ebp
mov esi, eax
mov ecx, dword [esi + 4]
cmp ecx, dword [esi + 0xc]
jae 0x44c97c
mov dword [ecx], str.TtcpRemCb
rdtsc
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
mov dword [ecx + 4], eax
add ecx, 0xc
mov dword [esi + 4], ecx
mov ecx, dword [ebx]
mov ecx, dword [ecx + edi*4]
mov edx, dword [ecx]
mov eax, dword [esp + 0x1c]
mov edx, dword [edx + 8]
push eax
call edx
mov eax, dword [0x4c6074]
push eax
call ebp
mov ecx, eax
mov esi, dword [ecx + 4]
cmp esi, dword [ecx + 0xc]
jae 0x44c9b8
mov dword [esi], 0x4b2454
rdtsc
mov dword [esp + 0x10], eax
mov edx, dword [esp + 0x10]
mov dword [esi + 4], edx
add esi, 0xc
mov dword [ecx + 4], esi
sub edi, 1
jns 0x44c948
pop esi
pop ebp
pop edi
mov eax, ebx
pop ebx
add esp, 4
jmp fcn.0044c050

Function at 0x44ca80
Capabilities:
Execute anti-debugging instructions
Get thread local storage value

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [esp + 0x10]
add ebx, 0x120
push edi
mov edi, dword [ebx + 4]
sub edi, 1
js 0x44cb1a
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
mov eax, dword [ebx]
cmp dword [eax + edi*4], 0
je 0x44cb13
mov ecx, dword [0x4c6074]
push ecx
call ebp
mov esi, eax
mov ecx, dword [esi + 4]
cmp ecx, dword [esi + 0xc]
jae 0x44cad7
mov dword [ecx], str.TtworldDelCb
rdtsc
mov dword [esp + 0x10], eax
mov edx, dword [esp + 0x10]
mov dword [ecx + 4], edx
add ecx, 0xc
mov dword [esi + 4], ecx
mov eax, dword [ebx]
mov ecx, dword [eax + edi*4]
mov edx, dword [ecx]
mov eax, dword [esp + 0x1c]
mov edx, dword [edx + 4]
push eax
call edx
mov eax, dword [0x4c6074]
push eax
call ebp
mov ecx, eax
mov esi, dword [ecx + 4]
cmp esi, dword [ecx + 0xc]
jae 0x44cb13
mov dword [esi], 0x4b2454
rdtsc
mov dword [esp + 0x14], eax
mov edx, dword [esp + 0x14]
mov dword [esi + 4], edx
add esi, 0xc
mov dword [ecx + 4], esi
sub edi, 1
jns 0x44caa3
pop esi
pop ebp
pop edi
mov eax, ebx
pop ebx
add esp, 8
jmp fcn.0044c050
Function at 0x44cb30
Capabilities:
Execute anti-debugging instructions
Get thread local storage value
Resolve function by parsing pe exports

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [esp + 0x10]
add dword [ebx + 0x84], 1
push ebp
push esi
add ebx, 0x12c
push edi
mov edi, dword [ebx + 4]
sub edi, 1
js 0x44cbcb
mov eax, dword [ebx]
cmp dword [eax + edi*4], 0
je 0x44cbc6
mov ecx, dword [0x4c6074]
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
push ecx
call ebp
mov esi, eax
mov ecx, dword [esi + 4]
cmp ecx, dword [esi + 0xc]
jae 0x44cb8a
mov dword [ecx], str.TtislActCb
rdtsc
mov dword [esp + 0x10], eax
mov edx, dword [esp + 0x10]
mov dword [ecx + 4], edx
add ecx, 0xc
mov dword [esi + 4], ecx
mov eax, dword [ebx]
mov ecx, dword [eax + edi*4]
mov edx, dword [ecx]
mov eax, dword [esp + 0x20]
mov edx, dword [edx + 4]
push eax
call edx
mov eax, dword [0x4c6074]
push eax
call ebp
mov ecx, eax
mov esi, dword [ecx + 4]
cmp esi, dword [ecx + 0xc]
jae 0x44cbc6
mov dword [esi], 0x4b2454
rdtsc
mov dword [esp + 0x14], eax
mov edx, dword [esp + 0x14]
mov dword [esi + 4], edx
add esi, 0xc
mov dword [ecx + 4], esi
sub edi, 1
jns 0x44cb50
mov eax, ebx
call fcn.0044c050
mov esi, dword [esp + 0x20]
xor ebp, ebp
cmp dword [esi + 0x4c], ebp
jle 0x44cca4
mov eax, dword [esi + 0x48]
mov eax, dword [eax + ebp*4]
mov ebx, dword [eax + 0xcc]
test ebx, ebx
je 0x44cc98
movzx edi, word [ebx + 4]
sub edi, 1
js 0x44cc91
mov ecx, dword [ebx]
cmp dword [ecx + edi*4], 0
je 0x44cc84
mov edx, dword [0x4c6074]
push edx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
mov ecx, dword [esi + 4]
cmp ecx, dword [esi + 0xc]
jae 0x44cc3e
mov dword [ecx], str.TtentActCb
rdtsc
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
mov dword [ecx + 4], eax
add ecx, 0xc
mov dword [esi + 4], ecx
mov ecx, dword [ebx]
mov eax, dword [esp + 0x20]
mov ecx, dword [ecx + edi*4]
mov eax, dword [eax + 0x48]
mov edx, dword [ecx]
mov eax, dword [eax + ebp*4]
mov edx, dword [edx + 8]
push eax
call edx
mov eax, dword [0x4c6074]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, eax
mov esi, dword [ecx + 4]
cmp esi, dword [ecx + 0xc]
jae 0x44cc84
mov dword [esi], 0x4b2454
rdtsc
mov dword [esp + 0x10], eax
mov edx, dword [esp + 0x10]
mov dword [esi + 4], edx
add esi, 0xc
mov dword [ecx + 4], esi
sub edi, 1
jns 0x44cc02
mov esi, dword [esp + 0x20]
mov eax, ebx
call fcn.0044c090
add ebp, 1
cmp ebp, dword [esi + 0x4c]
jl 0x44cbe1
mov ecx, dword [esp + 0x1c]
add dword [ecx + 0x84], 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
jne 0x44cccf
cmp byte [ecx + 0x8c], 0
jne 0x44cccf
cmp dword [ecx + 0x80], 0
je 0x44cccf
add esp, 8
jmp fcn.0043eff0
add esp, 8
ret
Function at 0x44cce0
Capabilities:
Execute anti-debugging instructions
Get thread local storage value
Resolve function by parsing pe exports

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [esp + 0x10]
add dword [ebx + 0x84], 1
push ebp
push esi
add ebx, 0x12c
push edi
mov edi, dword [ebx + 4]
sub edi, 1
js 0x44cd7b
mov eax, dword [ebx]
cmp dword [eax + edi*4], 0
je 0x44cd76
mov ecx, dword [0x4c6074]
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
push ecx
call ebp
mov esi, eax
mov ecx, dword [esi + 4]
cmp ecx, dword [esi + 0xc]
jae 0x44cd3a
mov dword [ecx], str.TtislDeacCb
rdtsc
mov dword [esp + 0x10], eax
mov edx, dword [esp + 0x10]
mov dword [ecx + 4], edx
add ecx, 0xc
mov dword [esi + 4], ecx
mov eax, dword [ebx]
mov ecx, dword [eax + edi*4]
mov edx, dword [ecx]
mov eax, dword [esp + 0x20]
mov edx, dword [edx + 8]
push eax
call edx
mov eax, dword [0x4c6074]
push eax
call ebp
mov ecx, eax
mov esi, dword [ecx + 4]
cmp esi, dword [ecx + 0xc]
jae 0x44cd76
mov dword [esi], 0x4b2454
rdtsc
mov dword [esp + 0x14], eax
mov edx, dword [esp + 0x14]
mov dword [esi + 4], edx
add esi, 0xc
mov dword [ecx + 4], esi
sub edi, 1
jns 0x44cd00
mov eax, ebx
call fcn.0044c050
mov esi, dword [esp + 0x20]
xor ebp, ebp
cmp dword [esi + 0x4c], ebp
jle 0x44ce54
mov eax, dword [esi + 0x48]
mov eax, dword [eax + ebp*4]
mov ebx, dword [eax + 0xcc]
test ebx, ebx
je 0x44ce48
movzx edi, word [ebx + 4]
sub edi, 1
js 0x44ce41
mov ecx, dword [ebx]
cmp dword [ecx + edi*4], 0
je 0x44ce34
mov edx, dword [0x4c6074]
push edx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
mov ecx, dword [esi + 4]
cmp ecx, dword [esi + 0xc]
jae 0x44cdee
mov dword [ecx], str.TtentDeacCb
rdtsc
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
mov dword [ecx + 4], eax
add ecx, 0xc
mov dword [esi + 4], ecx
mov ecx, dword [ebx]
mov eax, dword [esp + 0x20]
mov ecx, dword [ecx + edi*4]
mov eax, dword [eax + 0x48]
mov edx, dword [ecx]
mov eax, dword [eax + ebp*4]
mov edx, dword [edx + 4]
push eax
call edx
mov eax, dword [0x4c6074]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, eax
mov esi, dword [ecx + 4]
cmp esi, dword [ecx + 0xc]
jae 0x44ce34
mov dword [esi], 0x4b2454
rdtsc
mov dword [esp + 0x10], eax
mov edx, dword [esp + 0x10]
mov dword [esi + 4], edx
add esi, 0xc
mov dword [ecx + 4], esi
sub edi, 1
jns 0x44cdb2
mov esi, dword [esp + 0x20]
mov eax, ebx
call fcn.0044c090
add ebp, 1
cmp ebp, dword [esi + 0x4c]
jl 0x44cd91
mov ecx, dword [esp + 0x1c]
add dword [ecx + 0x84], 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
jne 0x44ce7f
cmp byte [ecx + 0x8c], 0
jne 0x44ce7f
cmp dword [ecx + 0x80], 0
je 0x44ce7f
add esp, 8
jmp fcn.0043eff0
add esp, 8
ret
Function at 0x44ce90
Capabilities:
Execute anti-debugging instructions
Get thread local storage value

Disassembly:
sub esp, 8
push ebx
push ebp
push edi
mov edi, dword [esp + 0x18]
mov ebp, dword [edi + 0x13c]
add edi, 0x138
lea ebx, [ebp - 1]
test ebx, ebx
jl 0x44cf43
push esi
cmp ebp, dword [edi + 4]
jle 0x44cec2
mov eax, dword [edi + 4]
mov ecx, eax
sub ecx, ebp
add ebx, ecx
mov ebp, eax
mov edx, dword [edi]
cmp dword [edx + ebx*4], 0
je 0x44cf39
mov eax, dword [0x4c6074]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
mov ecx, dword [esi + 4]
cmp ecx, dword [esi + 0xc]
jae 0x44cef9
mov dword [ecx], str.TtpostSimCb
rdtsc
mov dword [esp + 0x10], eax
mov edx, dword [esp + 0x10]
mov dword [ecx + 4], edx
add ecx, 0xc
mov dword [esi + 4], ecx
mov eax, dword [edi]
mov ecx, dword [eax + ebx*4]
mov edx, dword [ecx]
mov eax, dword [esp + 0x1c]
mov edx, dword [edx + 4]
push eax
call edx
mov eax, dword [0x4c6074]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, eax
mov esi, dword [ecx + 4]
cmp esi, dword [ecx + 0xc]
jae 0x44cf39
mov dword [esi], 0x4b2454
rdtsc
mov dword [esp + 0x14], eax
mov edx, dword [esp + 0x14]
mov dword [esi + 4], edx
add esi, 0xc
mov dword [ecx + 4], esi
sub ebx, 1
jns 0x44ceb2
pop esi
mov eax, edi
pop edi
pop ebp
pop ebx
add esp, 8
jmp fcn.0044c050

Function at 0x44cf50
Capabilities:
Execute anti-debugging instructions
Get thread local storage value

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [esp + 0x10]
add ebx, 0x144
push edi
mov edi, dword [ebx + 4]
sub edi, 1
js 0x44cfef
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
mov eax, dword [ebx]
cmp dword [eax + edi*4], 0
je 0x44cfe8
mov ecx, dword [0x4c6074]
push ecx
call ebp
mov esi, eax
mov ecx, dword [esi + 4]
cmp ecx, dword [esi + 0xc]
jae 0x44cfa7
mov dword [ecx], str.TtpostIntCb
rdtsc
mov dword [esp + 0x10], eax
mov edx, dword [esp + 0x10]
mov dword [ecx + 4], edx
add ecx, 0xc
mov dword [esi + 4], ecx
mov eax, dword [ebx]
mov ecx, dword [eax + edi*4]
mov eax, dword [esp + 0x20]
mov edx, dword [ecx]
mov edx, dword [edx + 4]
push eax
mov eax, dword [esp + 0x20]
push eax
call edx
mov eax, dword [0x4c6074]
push eax
call ebp
mov ecx, eax
mov esi, dword [ecx + 4]
cmp esi, dword [ecx + 0xc]
jae 0x44cfe8
mov dword [esi], 0x4b2454
rdtsc
mov dword [esp + 0x14], eax
mov edx, dword [esp + 0x14]
mov dword [esi + 4], edx
add esi, 0xc
mov dword [ecx + 4], esi
sub edi, 1
jns 0x44cf73
pop esi
pop ebp
pop edi
mov eax, ebx
pop ebx
add esp, 8
jmp fcn.0044c050
Function at 0x44d000
Capabilities:
Execute anti-debugging instructions
Get thread local storage value

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [esp + 0x10]
add ebx, 0x150
push edi
mov edi, dword [ebx + 4]
sub edi, 1
js 0x44d09f
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
mov eax, dword [ebx]
cmp dword [eax + edi*4], 0
je 0x44d098
mov ecx, dword [0x4c6074]
push ecx
call ebp
mov esi, eax
mov ecx, dword [esi + 4]
cmp ecx, dword [esi + 0xc]
jae 0x44d057
mov dword [ecx], str.TtpostCollCb
rdtsc
mov dword [esp + 0x10], eax
mov edx, dword [esp + 0x10]
mov dword [ecx + 4], edx
add ecx, 0xc
mov dword [esi + 4], ecx
mov eax, dword [ebx]
mov ecx, dword [eax + edi*4]
mov eax, dword [esp + 0x20]
mov edx, dword [ecx]
mov edx, dword [edx + 4]
push eax
mov eax, dword [esp + 0x20]
push eax
call edx
mov eax, dword [0x4c6074]
push eax
call ebp
mov ecx, eax
mov esi, dword [ecx + 4]
cmp esi, dword [ecx + 0xc]
jae 0x44d098
mov dword [esi], 0x4b2454
rdtsc
mov dword [esp + 0x14], eax
mov edx, dword [esp + 0x14]
mov dword [esi + 4], edx
add esi, 0xc
mov dword [ecx + 4], esi
sub edi, 1
jns 0x44d023
pop esi
pop ebp
pop edi
mov eax, ebx
pop ebx
add esp, 8
jmp fcn.0044c050

Function at 0x44d0b0
Capabilities:
Execute anti-debugging instructions
Get thread local storage value

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
add ebx, 0x15c
push edi
mov edi, dword [ebx + 4]
sub edi, 1
js 0x44d14d
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
mov eax, dword [ebx]
cmp dword [eax + edi*4], 0
je 0x44d146
mov ecx, dword [0x4c6074]
push ecx
call ebp
mov esi, eax
mov ecx, dword [esi + 4]
cmp ecx, dword [esi + 0xc]
jae 0x44d105
mov dword [ecx], str.TtpostIntCb
rdtsc
mov dword [esp + 0x18], eax
mov edx, dword [esp + 0x18]
mov dword [ecx + 4], edx
add ecx, 0xc
mov dword [esi + 4], ecx
mov eax, dword [ebx]
mov ecx, dword [eax + edi*4]
mov eax, dword [esp + 0x20]
mov edx, dword [ecx]
mov edx, dword [edx + 4]
push eax
mov eax, dword [esp + 0x20]
push eax
call edx
mov eax, dword [0x4c6074]
push eax
call ebp
mov ecx, eax
mov esi, dword [ecx + 4]
cmp esi, dword [ecx + 0xc]
jae 0x44d146
mov dword [esi], 0x4b2454
rdtsc
mov dword [esp + 0x10], eax
mov edx, dword [esp + 0x10]
mov dword [esi + 4], edx
add esi, 0xc
mov dword [ecx + 4], esi
sub edi, 1
jns 0x44d0d1
pop esi
pop ebp
pop edi
mov eax, ebx
pop ebx
add esp, 4
jmp fcn.0044c050
Function at 0x44d160
Capabilities:
Execute anti-debugging instructions
Get thread local storage value

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
add ebx, 0x168
push edi
mov edi, dword [ebx + 4]
sub edi, 1
js 0x44d1fd
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
mov eax, dword [ebx]
cmp dword [eax + edi*4], 0
je 0x44d1f6
mov ecx, dword [0x4c6074]
push ecx
call ebp
mov esi, eax
mov ecx, dword [esi + 4]
cmp ecx, dword [esi + 0xc]
jae 0x44d1b5
mov dword [ecx], str.TtpostCollCb
rdtsc
mov dword [esp + 0x18], eax
mov edx, dword [esp + 0x18]
mov dword [ecx + 4], edx
add ecx, 0xc
mov dword [esi + 4], ecx
mov eax, dword [ebx]
mov ecx, dword [eax + edi*4]
mov eax, dword [esp + 0x20]
mov edx, dword [ecx]
mov edx, dword [edx + 4]
push eax
mov eax, dword [esp + 0x20]
push eax
call edx
mov eax, dword [0x4c6074]
push eax
call ebp
mov ecx, eax
mov esi, dword [ecx + 4]
cmp esi, dword [ecx + 0xc]
jae 0x44d1f6
mov dword [esi], 0x4b2454
rdtsc
mov dword [esp + 0x10], eax
mov edx, dword [esp + 0x10]
mov dword [esi + 4], edx
add esi, 0xc
mov dword [ecx + 4], esi
sub edi, 1
jns 0x44d181
pop esi
pop ebp
pop edi
mov eax, ebx
pop ebx
add esp, 4
jmp fcn.0044c050

Function at 0x44d210
Capabilities:
Execute anti-debugging instructions
Get thread local storage value

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
add ebx, 0x180
push edi
mov edi, dword [ebx + 4]
sub edi, 1
js 0x44d2ad
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
mov eax, dword [ebx]
cmp dword [eax + edi*4], 0
je 0x44d2a6
mov ecx, dword [0x4c6074]
push ecx
call ebp
mov esi, eax
mov ecx, dword [esi + 4]
cmp ecx, dword [esi + 0xc]
jae 0x44d265
mov dword [ecx], str.TtimpLimitCb
rdtsc
mov dword [esp + 0x18], eax
mov edx, dword [esp + 0x18]
mov dword [ecx + 4], edx
add ecx, 0xc
mov dword [esi + 4], ecx
mov eax, dword [ebx]
mov ecx, dword [eax + edi*4]
mov eax, dword [esp + 0x20]
mov edx, dword [ecx]
mov edx, dword [edx + 4]
push eax
mov eax, dword [esp + 0x20]
push eax
call edx
mov eax, dword [0x4c6074]
push eax
call ebp
mov ecx, eax
mov esi, dword [ecx + 4]
cmp esi, dword [ecx + 0xc]
jae 0x44d2a6
mov dword [esi], 0x4b2454
rdtsc
mov dword [esp + 0x10], eax
mov edx, dword [esp + 0x10]
mov dword [esi + 4], edx
add esi, 0xc
mov dword [ecx + 4], esi
sub edi, 1
jns 0x44d231
pop esi
pop ebp
pop edi
mov eax, ebx
pop ebx
add esp, 4
jmp fcn.0044c050
Function at 0x44d2c0
Capabilities:
Execute anti-debugging instructions
Get thread local storage value

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
add ebx, 0x138
push edi
mov edi, dword [ebx + 4]
sub edi, 1
js 0x44d358
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
mov eax, dword [ebx]
cmp dword [eax + edi*4], 0
je 0x44d351
mov ecx, dword [0x4c6074]
push ecx
call ebp
mov esi, eax
mov ecx, dword [esi + 4]
cmp ecx, dword [esi + 0xc]
jae 0x44d315
mov dword [ecx], str.TtentMvdCb
rdtsc
mov dword [esp + 0x18], eax
mov edx, dword [esp + 0x18]
mov dword [ecx + 4], edx
add ecx, 0xc
mov dword [esi + 4], ecx
mov eax, dword [ebx]
mov ecx, dword [eax + edi*4]
mov edx, dword [ecx]
mov eax, dword [esp + 0x1c]
mov edx, dword [edx + 8]
push eax
call edx
mov eax, dword [0x4c6074]
push eax
call ebp
mov ecx, eax
mov esi, dword [ecx + 4]
cmp esi, dword [ecx + 0xc]
jae 0x44d351
mov dword [esi], 0x4b2454
rdtsc
mov dword [esp + 0x10], eax
mov edx, dword [esp + 0x10]
mov dword [esi + 4], edx
add esi, 0xc
mov dword [ecx + 4], esi
sub edi, 1
jns 0x44d2e1
pop esi
pop ebp
pop edi
mov eax, ebx
pop ebx
add esp, 4
jmp fcn.0044c050