joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42ebc0
Capabilities:
Get thread local storage value

Disassembly:
push esi
push edi
mov edi, ecx
mov esi, dword [edi + 8]
test esi, esi
je 0x42ebea
lea ecx, [esi + 0x38]
call fcn.00428f80
lea ecx, [esi + 0x10]
call fcn.0042a230
lea ecx, [esi + 4]
call fcn.00428f80
mov dword [edi + 8], 0
mov esi, dword [edi + 4]
test esi, esi
je 0x42ec30
push dword [0x4ba668]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x42ec20
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x42ec20
cmp dword [ecx + 8], 0
jne 0x42ec20
mov al, byte [esi + 0x54]
mov byte [esi], al
mov dword [ecx + 8], esi
mov dword [edi + 4], 0
pop edi
pop esi
ret
push esi
call fcn.00451a43
add esp, 4
mov dword [edi + 4], 0
pop edi
pop esi
ret

Function at 0x430950
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48d858
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
mov eax, dword [0x4b1070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [ebp + 0x4c]
mov dword [ebp - 4], 0
push dword [0x4ba668]
mov dword [ebp - 0x18], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4309bf
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x4309bf
mov eax, dword [ecx + 8]
test eax, eax
je 0x4309bf
mov dword [ecx + 8], 0
mov cl, byte [eax]
cmp cl, 0x13
jb 0x4309b6
mov byte [eax + 0x4c], cl
jmp 0x4309cd
push eax
call fcn.00451a43
add esp, 4
push 0x4d
call fcn.00451ccf
add esp, 4
mov byte [eax + 0x4c], 0x13
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 0
test eax, eax
je 0x4309e9
push ecx
lea ecx, [ebp + 8]
push ecx
mov ecx, eax
call fcn.004316e0
jmp 0x4309eb
xor eax, eax
lea ecx, [ebp - 0x18]
mov dword [esi], eax
mov dword [ebp - 0x14], 0
call fcn.00430ec0
lea ecx, [ebp + 0x34]
call fcn.00428f80
lea ecx, [ebp + 0xc]
call fcn.0042a230
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0x48

Function at 0x430ec0
Capabilities:
Get thread local storage value

Disassembly:
push esi
push edi
mov edi, ecx
mov esi, dword [edi + 8]
test esi, esi
je 0x430ee2
lea ecx, [esi + 0x30]
call fcn.00428f80
lea ecx, [esi + 8]
call fcn.0042a230
mov dword [edi + 8], 0
mov esi, dword [edi + 4]
test esi, esi
je 0x430f28
push dword [0x4ba668]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x430f18
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x430f18
cmp dword [ecx + 8], 0
jne 0x430f18
mov al, byte [esi + 0x4c]
mov byte [esi], al
mov dword [ecx + 8], esi
mov dword [edi + 4], 0
pop edi
pop esi
ret
push esi
call fcn.00451a43
add esp, 4
mov dword [edi + 4], 0
pop edi
pop esi
ret
Function at 0x433a80
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48bc06
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x4b1070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [edi], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov esi, dword [eax + 4]
mov eax, dword [eax]
mov dword [ebp + 8], esi
mov dword [ebp + 0xc], eax
test esi, esi
je 0x433ad9
lock inc dword [esi + 4]
mov esi, dword [edi + 8]
test esi, esi
je 0x433b01
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [esi + 4], eax
jne 0x433b01
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lock xadd dword [esi + 8], ebx
dec ebx
jne 0x433b01
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
mov dword [edi + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [edi + 4], eax
mov eax, dword [ecx]
mov dword [edi + 0xc], eax
mov eax, dword [ecx + 4]
mov ecx, dword [ebp + 0x18]
mov dword [edi + 0x10], eax
mov eax, dword [ecx]
mov dword [edi + 0x18], eax
mov eax, dword [ecx + 4]
mov ecx, dword [ebp + 0x20]
mov dword [edi + 0x1c], eax
mov eax, dword [ecx]
mov dword [edi + 0x24], eax
mov eax, dword [ecx + 4]
mov ecx, dword [ebp + 0x24]
mov dword [edi + 0x28], eax
mov eax, dword [ecx]
mov dword [edi + 0x2c], eax
mov eax, dword [ecx + 4]
mov dword [edi + 0x30], eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x24
Function at 0x433b70
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48dbe8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x4b1070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [ebp + 0x78]
mov dword [ebp - 4], 0
push dword [0x4ba668]
mov dword [ebp - 0x18], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x433be0
mov eax, dword [eax + 4]
test eax, eax
je 0x433be0
mov edi, dword [eax + 8]
test edi, edi
je 0x433be0
mov dword [eax + 8], 0
mov al, byte [edi]
cmp al, 0x1e
jb 0x433bd7
mov byte [edi + 0x78], al
jmp 0x433bf0
push edi
call fcn.00451a43
add esp, 4
push 0x79
call fcn.00451ccf
mov edi, eax
add esp, 4
mov byte [edi + 0x78], 0x1e
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], 0
test edi, edi
je 0x433c44
mov dword [edi], 0x435910
lea ecx, [edi + 0xc]
mov eax, dword [ebp + 8]
mov dword [edi + 4], eax
mov al, byte [ebp + 0xc]
mov dword [ebp + 8], 0
mov byte [edi + 8], al
lea eax, [ebp + 0x10]
push eax
mov byte [ebp + 0xc], 0
call fcn.0042fb80
mov dword [edi + 0xc], 0x4a2154
mov eax, dword [ebp + 0x60]
mov dword [edi + 0x5c], eax
mov eax, dword [ebp + 0x64]
mov dword [edi + 0x60], eax
movups xmm0, xmmword [ebp + 0x68]
movups xmmword [edi + 0x64], xmm0
jmp 0x433c46
xor edi, edi
lea ecx, [ebp - 0x18]
mov dword [ebx], edi
mov dword [ebp - 0x14], 0
call fcn.00434680
lea ecx, [ebp + 0x58]
call fcn.00428f80
lea ecx, [ebp + 0x40]
call fcn.00428f80
lea ecx, [ebp + 0x18]
call fcn.0042a230
lea ecx, [ebp + 8]
call fcn.00428f80
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x74

Function at 0x433c90
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48dc18
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x4b1070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [ebp + 0x90]
mov dword [ebp - 4], 0
push dword [0x4ba668]
mov dword [ebp - 0x18], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x433d06
mov eax, dword [eax + 4]
test eax, eax
je 0x433d06
mov edi, dword [eax + 8]
test edi, edi
je 0x433d06
mov dword [eax + 8], 0
mov al, byte [edi]
cmp al, 0x24
jb 0x433cfd
mov byte [edi + 0x90], al
jmp 0x433d1c
push edi
call fcn.00451a43
add esp, 4
push 0x91
call fcn.00451ccf
mov edi, eax
add esp, 4
mov byte [edi + 0x90], 0x24
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], 0
test edi, edi
je 0x433d63
lea eax, [ebp + 8]
mov dword [edi], 0x435840
push eax
lea ecx, [edi + 4]
call fcn.00430cd0
movq xmm0, qword [ebp + 0x80]
movq qword [edi + 0x7c], xmm0
mov eax, dword [ebp + 0x88]
mov dword [edi + 0x84], eax
mov eax, dword [ebp + 0x8c]
mov dword [edi + 0x88], eax
jmp 0x433d65
xor edi, edi
lea ecx, [ebp - 0x18]
mov dword [ebx], edi
mov dword [ebp - 0x14], 0
call fcn.00434610
lea ecx, [ebp + 8]
call fcn.0042c8f0
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x8c
Function at 0x433e70
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48dc84
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
mov eax, dword [0x4b1070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [ebp + 0x38]
mov dword [ebp - 4], 0
push dword [0x4ba668]
mov dword [ebp - 0x18], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x433ede
mov eax, dword [eax + 4]
test eax, eax
je 0x433ede
mov ecx, dword [eax + 8]
test ecx, ecx
je 0x433ede
mov dword [eax + 8], 0
mov al, byte [ecx]
cmp al, 0x10
jb 0x433ed5
mov byte [ecx + 0x40], al
jmp 0x433eee
push ecx
call fcn.00451a43
add esp, 4
push 0x41
call fcn.00451ccf
mov ecx, eax
add esp, 4
mov byte [ecx + 0x40], 0x10
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], 0
test ecx, ecx
je 0x433f4d
mov dword [ecx], 0x435740
mov eax, dword [ebp + 8]
mov dword [ecx + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ecx + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [ecx + 0x10], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp + 0x10], 0
mov dword [ebp + 0xc], 0
mov dword [ecx + 0x18], eax
mov eax, dword [ebp + 0x1c]
mov dword [ecx + 0x1c], eax
mov eax, dword [ebp + 0x20]
mov dword [ecx + 0x20], eax
movq xmm0, qword [ebp + 0x28]
mov dword [ebp + 0x20], 0
movq qword [ecx + 0x28], xmm0
mov eax, dword [ebp + 0x30]
mov dword [ecx + 0x30], eax
jmp 0x433f4f
xor ecx, ecx
mov dword [esi], ecx
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x14], 0
call fcn.00434550
mov dword [ebp - 4], 1
mov ecx, dword [ebp + 0x20]
test ecx, ecx
je 0x433f73
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x433f9c
mov dword [ebp - 4], 2
lea eax, [ecx + 8]
or edx, 0xffffffff
lock xadd dword [eax], edx
cmp edx, 1
jne 0x433f9c
mov eax, dword [ecx]
call dword [eax + 8]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0x34
Function at 0x434550
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48d8ec
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x4b1070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [edi + 8]
test esi, esi
je 0x4345c0
mov dword [ebp - 4], 0
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x434590
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [esi + 0x10]
test ecx, ecx
je 0x4345b9
mov dword [ebp - 4], 1
lea eax, [ecx + 8]
or edx, 0xffffffff
lock xadd dword [eax], edx
cmp edx, 1
jne 0x4345b9
mov eax, dword [ecx]
call dword [eax + 8]
mov dword [edi + 8], 0
mov esi, dword [edi + 4]
test esi, esi
je 0x4345fe
push dword [0x4ba668]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4345ee
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x4345ee
cmp dword [ecx + 8], 0
jne 0x4345ee
mov al, byte [esi + 0x40]
mov byte [esi], al
mov dword [ecx + 8], esi
jmp 0x4345f7
push esi
call fcn.00451a43
add esp, 4
mov dword [edi + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x434610
Capabilities:
Get thread local storage value

Disassembly:
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 8]
test ecx, ecx
je 0x43462a
add ecx, 4
call fcn.0042c8f0
mov dword [edi + 8], 0
mov esi, dword [edi + 4]
test esi, esi
je 0x434673
push dword [0x4ba668]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x434663
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x434663
cmp dword [ecx + 8], 0
jne 0x434663
mov al, byte [esi + 0x90]
mov byte [esi], al
mov dword [ecx + 8], esi
mov dword [edi + 4], 0
pop edi
pop esi
ret
push esi
call fcn.00451a43
add esp, 4
mov dword [edi + 4], 0
pop edi
pop esi
ret

Function at 0x434680
Capabilities:
Get thread local storage value

Disassembly:
push esi
push edi
mov edi, ecx
mov esi, dword [edi + 8]
test esi, esi
je 0x4346b2
lea ecx, [esi + 0x54]
call fcn.00428f80
lea ecx, [esi + 0x3c]
call fcn.00428f80
lea ecx, [esi + 0x14]
call fcn.0042a230
lea ecx, [esi + 4]
call fcn.00428f80
mov dword [edi + 8], 0
mov esi, dword [edi + 4]
test esi, esi
je 0x4346f8
push dword [0x4ba668]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4346e8
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x4346e8
cmp dword [ecx + 8], 0
jne 0x4346e8
mov al, byte [esi + 0x78]
mov byte [esi], al
mov dword [ecx + 8], esi
mov dword [edi + 4], 0
pop edi
pop esi
ret
push esi
call fcn.00451a43
add esp, 4
mov dword [edi + 4], 0
pop edi
pop esi
ret
Function at 0x434ba0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48dce4
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
mov eax, dword [0x4b1070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [ebp + 0x20]
mov dword [ebp - 4], 0
push dword [0x4ba668]
mov dword [ebp - 0x18], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x434c0e
mov eax, dword [eax + 4]
test eax, eax
je 0x434c0e
mov ecx, dword [eax + 8]
test ecx, ecx
je 0x434c0e
mov dword [eax + 8], 0
mov al, byte [ecx]
cmp al, 8
jb 0x434c05
mov byte [ecx + 0x20], al
jmp 0x434c1e
push ecx
call fcn.00451a43
add esp, 4
push 0x21
call fcn.00451ccf
mov ecx, eax
add esp, 4
mov byte [ecx + 0x20], 8
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], 0
test ecx, ecx
je 0x434c6b
mov dword [ecx], 0x437500
mov eax, dword [ebp + 8]
mov dword [ecx + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp + 8], 0
mov dword [ecx + 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ecx + 0xc], eax
movq xmm0, qword [ebp + 0x14]
mov dword [ebp + 0x10], 0
mov dword [ebp + 0xc], 0
movq qword [ecx + 0x10], xmm0
mov eax, dword [ebp + 0x1c]
mov dword [ecx + 0x18], eax
jmp 0x434c6d
xor ecx, ecx
mov dword [esi], ecx
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x14], 0
call fcn.00435a90
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x434ca0
mov dword [ebp - 4], 1
lea eax, [ecx + 8]
or edx, 0xffffffff
lock xadd dword [eax], edx
cmp edx, 1
jne 0x434ca0
mov eax, dword [ecx]
call dword [eax + 8]
mov dword [ebp - 4], 2
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x434cb3
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0x1c

Function at 0x435a90
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48d8ec
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x4b1070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [edi + 8]
test esi, esi
je 0x435af9
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x435adf
mov dword [ebp - 4], 0
lea eax, [ecx + 8]
or edx, 0xffffffff
lock xadd dword [eax], edx
cmp edx, 1
jne 0x435adf
mov eax, dword [ecx]
call dword [eax + 8]
mov dword [ebp - 4], 1
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x435af2
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [edi + 8], 0
mov esi, dword [edi + 4]
test esi, esi
je 0x435b37
push dword [0x4ba668]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x435b27
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x435b27
cmp dword [ecx + 8], 0
jne 0x435b27
mov al, byte [esi + 0x20]
mov byte [esi], al
mov dword [ecx + 8], esi
jmp 0x435b30
push esi
call fcn.00451a43
add esp, 4
mov dword [edi + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x439700
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48e068
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x4b1070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [ebp + 0x70]
mov dword [ebp - 4], 0
push dword [0x4ba668]
mov dword [ebp - 0x18], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x439770
mov eax, dword [eax + 4]
test eax, eax
je 0x439770
mov edi, dword [eax + 8]
test edi, edi
je 0x439770
mov dword [eax + 8], 0
mov al, byte [edi]
cmp al, 0x1c
jb 0x439767
mov byte [edi + 0x70], al
jmp 0x439780
push edi
call fcn.00451a43
add esp, 4
push 0x71
call fcn.00451ccf
mov edi, eax
add esp, 4
mov byte [edi + 0x70], 0x1c
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], 0
test edi, edi
je 0x4397bd
lea eax, [ebp + 8]
mov dword [edi], 0x43b520
push eax
lea ecx, [edi + 4]
call fcn.0042fb80
mov dword [edi + 4], 0x4a2154
mov eax, dword [ebp + 0x58]
mov dword [edi + 0x54], eax
mov eax, dword [ebp + 0x5c]
mov dword [edi + 0x58], eax
movups xmm0, xmmword [ebp + 0x60]
movups xmmword [edi + 0x5c], xmm0
jmp 0x4397bf
xor edi, edi
lea ecx, [ebp - 0x18]
mov dword [ebx], edi
mov dword [ebp - 0x14], 0
call fcn.0043a550
lea ecx, [ebp + 0x50]
call fcn.00428f80
lea ecx, [ebp + 0x38]
call fcn.00428f80
lea ecx, [ebp + 0x10]
call fcn.0042a230
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x6c

Function at 0x43a550
Capabilities:
Get thread local storage value

Disassembly:
push esi
push edi
mov edi, ecx
mov esi, dword [edi + 8]
test esi, esi
je 0x43a57a
lea ecx, [esi + 0x4c]
call fcn.00428f80
lea ecx, [esi + 0x34]
call fcn.00428f80
lea ecx, [esi + 0xc]
call fcn.0042a230
mov dword [edi + 8], 0
mov esi, dword [edi + 4]
test esi, esi
je 0x43a5c0
push dword [0x4ba668]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x43a5b0
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x43a5b0
cmp dword [ecx + 8], 0
jne 0x43a5b0
mov al, byte [esi + 0x70]
mov byte [esi], al
mov dword [ecx + 8], esi
mov dword [edi + 4], 0
pop edi
pop esi
ret
push esi
call fcn.00451a43
add esp, 4
mov dword [edi + 4], 0
pop edi
pop esi
ret
Function at 0x442cf0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48e308
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x4b1070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [ebp + 0x94]
mov dword [ebp - 4], 0
push dword [0x4ba668]
mov dword [ebp - 0x18], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x442d66
mov eax, dword [eax + 4]
test eax, eax
je 0x442d66
mov edi, dword [eax + 8]
test edi, edi
je 0x442d66
mov dword [eax + 8], 0
mov al, byte [edi]
cmp al, 0x25
jb 0x442d5d
mov byte [edi + 0x94], al
jmp 0x442d7c
push edi
call fcn.00451a43
add esp, 4
push 0x95
call fcn.00451ccf
mov edi, eax
add esp, 4
mov byte [edi + 0x94], 0x25
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], 0
test edi, edi
je 0x442dc6
lea eax, [ebp + 8]
mov dword [edi], 0x443ba0
push eax
lea ecx, [edi + 4]
call fcn.0043eef0
movq xmm0, qword [ebp + 0x84]
movq qword [edi + 0x80], xmm0
mov eax, dword [ebp + 0x8c]
mov dword [edi + 0x88], eax
mov eax, dword [ebp + 0x90]
mov dword [edi + 0x8c], eax
jmp 0x442dc8
xor edi, edi
lea ecx, [ebp - 0x18]
mov dword [ebx], edi
mov dword [ebp - 0x14], 0
call fcn.00443580
lea ecx, [ebp + 8]
call fcn.00435650
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x90

Function at 0x442e00
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48e308
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x4b1070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [ebp + 0x94]
mov dword [ebp - 4], 0
push dword [0x4ba668]
mov dword [ebp - 0x18], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x442e76
mov eax, dword [eax + 4]
test eax, eax
je 0x442e76
mov edi, dword [eax + 8]
test edi, edi
je 0x442e76
mov dword [eax + 8], 0
mov al, byte [edi]
cmp al, 0x25
jb 0x442e6d
mov byte [edi + 0x94], al
jmp 0x442e8c
push edi
call fcn.00451a43
add esp, 4
push 0x95
call fcn.00451ccf
mov edi, eax
add esp, 4
mov byte [edi + 0x94], 0x25
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], 0
test edi, edi
je 0x442ed6
lea eax, [ebp + 8]
mov dword [edi], 0x443ad0
push eax
lea ecx, [edi + 4]
call fcn.0043efa0
movq xmm0, qword [ebp + 0x84]
movq qword [edi + 0x80], xmm0
mov eax, dword [ebp + 0x8c]
mov dword [edi + 0x88], eax
mov eax, dword [ebp + 0x90]
mov dword [edi + 0x8c], eax
jmp 0x442ed8
xor edi, edi
lea ecx, [ebp - 0x18]
mov dword [ebx], edi
mov dword [ebp - 0x14], 0
call fcn.00443580
lea ecx, [ebp + 8]
call fcn.00435650
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x90
Function at 0x442f10
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48e308
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x4b1070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [ebp + 0x94]
mov dword [ebp - 4], 0
push dword [0x4ba668]
mov dword [ebp - 0x18], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x442f86
mov eax, dword [eax + 4]
test eax, eax
je 0x442f86
mov edi, dword [eax + 8]
test edi, edi
je 0x442f86
mov dword [eax + 8], 0
mov al, byte [edi]
cmp al, 0x25
jb 0x442f7d
mov byte [edi + 0x94], al
jmp 0x442f9c
push edi
call fcn.00451a43
add esp, 4
push 0x95
call fcn.00451ccf
mov edi, eax
add esp, 4
mov byte [edi + 0x94], 0x25
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], 0
test edi, edi
je 0x442fe6
lea eax, [ebp + 8]
mov dword [edi], 0x443a00
push eax
lea ecx, [edi + 4]
call fcn.0043f050
movq xmm0, qword [ebp + 0x84]
movq qword [edi + 0x80], xmm0
mov eax, dword [ebp + 0x8c]
mov dword [edi + 0x88], eax
mov eax, dword [ebp + 0x90]
mov dword [edi + 0x8c], eax
jmp 0x442fe8
xor edi, edi
lea ecx, [ebp - 0x18]
mov dword [ebx], edi
mov dword [ebp - 0x14], 0
call fcn.00443580
lea ecx, [ebp + 8]
call fcn.00435650
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x90

Function at 0x443020
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48e308
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x4b1070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [ebp + 0x94]
mov dword [ebp - 4], 0
push dword [0x4ba668]
mov dword [ebp - 0x18], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x443096
mov eax, dword [eax + 4]
test eax, eax
je 0x443096
mov edi, dword [eax + 8]
test edi, edi
je 0x443096
mov dword [eax + 8], 0
mov al, byte [edi]
cmp al, 0x25
jb 0x44308d
mov byte [edi + 0x94], al
jmp 0x4430ac
push edi
call fcn.00451a43
add esp, 4
push 0x95
call fcn.00451ccf
mov edi, eax
add esp, 4
mov byte [edi + 0x94], 0x25
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], 0
test edi, edi
je 0x4430f6
lea eax, [ebp + 8]
mov dword [edi], 0x443930
push eax
lea ecx, [edi + 4]
call fcn.0043f100
movq xmm0, qword [ebp + 0x84]
movq qword [edi + 0x80], xmm0
mov eax, dword [ebp + 0x8c]
mov dword [edi + 0x88], eax
mov eax, dword [ebp + 0x90]
mov dword [edi + 0x8c], eax
jmp 0x4430f8
xor edi, edi
lea ecx, [ebp - 0x18]
mov dword [ebx], edi
mov dword [ebp - 0x14], 0
call fcn.00443580
lea ecx, [ebp + 8]
call fcn.00435650
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x90