joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5d1ec0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0xd8]
mov eax, dword [eax + 0x10]
test eax, eax
jle 0x5d1fbc
push ebx
xor ebx, ebx
test eax, eax
jle 0x5d1f04
xor edi, edi
mov eax, dword [esi + 0xd8]
mov ecx, dword [eax + 8]
add ecx, edi
call fcn.0059b8f0
mov eax, dword [esi + 0xd8]
inc ebx
add edi, 0x50
cmp ebx, dword [eax + 0x10]
jl 0x5d1ee5
mov eax, dword [esi + 0xd8]
push dword [0x884adc]
mov edi, dword [eax + 0x10]
mov ebx, dword [eax + 8]
call ebp
mov ecx, dword [eax + 0x2c]
lea eax, [edi + edi*4]
shl eax, 4
push eax
push ebx
mov edx, dword [ecx]
call dword [edx + 8]
mov eax, dword [esi + 0xd8]
xor ebx, ebx
cmp dword [eax + 0x10], ebx
jle 0x5d1f73
nop word [eax + eax]
mov eax, dword [esi + 0xd8]
mov eax, dword [eax + 4]
cmp byte [eax + ebx*8 + 4], 0
je 0x5d1f67
push dword [0x884adc]
mov edi, dword [eax + ebx*8]
call ebp
push edi
push dword [eax + 0x2c]
call fcn.00460680
add esp, 8
mov eax, dword [esi + 0xd8]
inc ebx
cmp ebx, dword [eax + 0x10]
jl 0x5d1f40
mov eax, dword [esi + 0xd8]
push dword [0x884adc]
mov edi, dword [eax + 0x10]
mov ebx, dword [eax + 4]
call ebp
mov ecx, dword [eax + 0x2c]
lea eax, [edi*8]
push eax
push ebx
mov edx, dword [ecx]
call dword [edx + 8]
mov eax, dword [esi + 0xd8]
push dword [0x884adc]
mov edi, dword [eax + 0x10]
mov ebx, dword [eax]
call ebp
mov ecx, dword [eax + 0x2c]
lea eax, [edi + edi*4]
shl eax, 3
push eax
push ebx
mov edx, dword [ecx]
call dword [edx + 8]
pop ebx
mov eax, dword [esi + 0xd8]
mov edi, dword [eax + 0xc]
test edi, edi
je 0x5d1fe3
push edi
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push dword [0x884adc]
call ebp
push 0x18
push edi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
push dword [0x884adc]
mov edi, dword [esi + 0xd8]
call ebp
push 0x18
push edi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov dword [esi + 0xd8], 0
pop esi
pop ebp
ret
Function at 0x5d2070
Capabilities:
Execute anti-debugging instructions
Get thread local storage value

Disassembly:
push ecx
push esi
push edi
push dword [0x884c50]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
mov esi, dword [edi + 4]
cmp esi, dword [edi + 0xc]
jae 0x5d20a2
mov dword [esi], str.TthkbWorld::updateCharacter
rdtsc
mov dword [esp + 8], eax
mov ecx, dword [esp + 8]
lea eax, [esi + 0xc]
mov dword [esi + 4], ecx
mov dword [edi + 4], eax
mov esi, dword [esp + 0x18]
mov edi, dword [esp + 0x1c]
push ebx
push ebp
mov eax, dword [esi + 0x30]
mov ebx, dword [esi + 0x44]
mov dword [esp + 0x20], eax
test edi, edi
je 0x5d20c9
push 0
push ebx
push esi
mov ecx, edi
call fcn.005d23e0
mov eax, dword [esp + 0x20]
mov ebp, dword [esp + 0x1c]
mov ecx, eax
push ebx
push ebp
call fcn.00598330
mov ecx, dword [esp + 0x20]
movss xmm0, dword [esp + 0x18]
push ecx
movss dword [esp], xmm0
mov eax, dword [ecx]
push ebp
call dword [eax + 0x14]
test edi, edi
je 0x5d20fb
push 1
push ebx
push esi
mov ecx, edi
call fcn.005d23e0
mov ecx, dword [esp + 0x20]
push ebx
push ebp
call fcn.00598330
mov ecx, dword [esi + 0x1c]
test ecx, ecx
je 0x5d2113
push ebp
call fcn.005ccc20
push dword [0x884c50]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
pop ebp
pop ebx
mov esi, dword [edi + 4]
cmp esi, dword [edi + 0xc]
jae 0x5d2144
mov dword [esi], 0x77f5ec
rdtsc
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 0x18]
lea eax, [esi + 0xc]
mov dword [esi + 4], ecx
mov dword [edi + 4], eax
pop edi
pop esi
pop ecx
ret
Function at 0x5d2150
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 0x28
push ebp
push esi
mov esi, ecx
mov ebp, dword [esi + 0xc]
mov dword [esp + 0x10], ebp
test ebp, ebp
jle 0x5d2309
push ebx
push edi
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
lea edi, [ebp*4 + 0x7f]
and edi, 0xffffff80
mov dword [esp + 0x1c], edi
mov ebx, dword [eax + 0xc]
mov dword [esp + 0x14], ebx
lea ecx, [ebx + edi]
cmp edi, dword [eax + 8]
jg 0x5d219b
cmp ecx, dword [eax + 0x10]
ja 0x5d219b
mov dword [eax + 0xc], ecx
jmp 0x5d21a9
push edi
mov ecx, eax
call fcn.0046a3c0
mov ebx, eax
mov dword [esp + 0x14], eax
xor ecx, ecx
test ebp, ebp
jle 0x5d21be
nop
mov eax, dword [esi + 8]
mov eax, dword [eax + ecx*4]
mov dword [ebx + ecx*4], eax
inc ecx
cmp ecx, ebp
jl 0x5d21b0
lea ecx, [esp + 0x28]
call fcn.005e32c0
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, dword [esp + 0x48]
mov ecx, eax
mov eax, dword [ecx + 0xc]
lea edx, [esi*8 + 0x7f]
and edx, 0xffffff80
mov dword [esp + 0x10], eax
mov dword [esp + 0x24], edx
lea edi, [eax + edx]
mov dword [esp + 0x20], edi
mov edi, dword [esp + 0x1c]
cmp edx, dword [ecx + 8]
jg 0x5d2213
lea ebp, [eax + edx]
cmp ebp, dword [ecx + 0x10]
mov ebp, dword [esp + 0x18]
ja 0x5d2213
mov edx, dword [esp + 0x20]
mov dword [ecx + 0xc], edx
jmp 0x5d221d
push edx
call fcn.0046a3c0
mov dword [esp + 0x10], eax
test esi, esi
jle 0x5d2261
mov ebx, dword [esp + 0x40]
mov esi, eax
mov edi, dword [esp + 0x3c]
sub ebx, eax
mov ebp, dword [esp + 0x48]
lea eax, [ebx + esi]
mov dword [esi + 4], edi
push esi
mov dword [esi], eax
lea ecx, [esp + 0x2c]
push dword [edi]
push 0x7d8954
call fcn.0046ba50
add esi, 8
add edi, 0x28
sub ebp, 1
jne 0x5d2231
mov ebx, dword [esp + 0x14]
mov ebp, dword [esp + 0x18]
mov edi, dword [esp + 0x1c]
movss xmm0, dword [esp + 0x44]
lea eax, [esp + 0x28]
push ecx
movss dword [esp], xmm0
push ebp
push ebx
push eax
call fcn.005e3e10
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
add esp, 0x10
push dword [0x884adc]
call ebp
mov edx, eax
mov eax, dword [esp + 0x24]
lea esi, [eax + 0xf]
and esi, 0xfffffff0
cmp eax, dword [edx + 8]
mov eax, dword [esp + 0x10]
jg 0x5d22b1
lea ecx, [esi + eax]
cmp ecx, dword [edx + 0xc]
jne 0x5d22b1
cmp dword [edx + 0x14], eax
je 0x5d22b1
mov dword [edx + 0xc], eax
jmp 0x5d22ba
push esi
push eax
mov ecx, edx
call fcn.0046a590
push 0x7d8954
lea ecx, [esp + 0x2c]
call fcn.0046b3e0
lea ecx, [esp + 0x28]
call fcn.0046b110
push dword [0x884adc]
call ebp
lea edx, [edi + 0xf]
and edx, 0xfffffff0
cmp edi, dword [eax + 8]
jg 0x5d22fe
lea ecx, [edx + ebx]
cmp ecx, dword [eax + 0xc]
jne 0x5d22fe
cmp dword [eax + 0x14], ebx
je 0x5d22fe
pop edi
mov dword [eax + 0xc], ebx
pop ebx
pop esi
pop ebp
add esp, 0x28
ret 0x10
push edx
push ebx
mov ecx, eax
call fcn.0046a590
pop edi
pop ebx
pop esi
pop ebp
add esp, 0x28
ret 0x10
Function at 0x5d2530
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 0x14
push ebx
mov ebx, ecx
mov eax, dword [ebx + 0xe0]
cmp dword [eax + 4], 0
jle 0x5d264e
mov eax, dword [ebx + 0xd8]
push esi
push edi
push dword [eax + 0x10]
call fcn.0046b820
add esp, 4
mov esi, eax
mov dword [esp + 0x1c], esi
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
add esi, 0x7f
and esi, 0xffffff80
mov ecx, dword [eax + 0xc]
lea edx, [ecx + esi]
cmp esi, dword [eax + 8]
jg 0x5d2586
cmp edx, dword [eax + 0x10]
ja 0x5d2586
mov dword [eax + 0xc], edx
jmp 0x5d2590
push esi
mov ecx, eax
call fcn.0046a3c0
mov ecx, eax
push dword [esp + 0x1c]
mov dword [esp + 0x1c], ecx
push ecx
lea ecx, [esp + 0x14]
call fcn.0046b980
mov eax, dword [ebx + 0xd8]
xor edi, edi
cmp dword [eax + 0x10], edi
jle 0x5d25d7
xor esi, esi
mov eax, dword [eax]
lea ecx, [esp + 0xc]
mov eax, dword [esi + eax]
push dword [eax + 0x44]
push eax
push 0x7d8954
call fcn.0046ba50
mov eax, dword [ebx + 0xd8]
lea esi, [esi + 0x28]
inc edi
cmp edi, dword [eax + 0x10]
jl 0x5d25b1
mov ecx, dword [ebx + 0xe0]
lea eax, [esp + 0xc]
push eax
call fcn.005e3170
push 0x7d8954
lea ecx, [esp + 0x10]
call fcn.0046b3e0
mov esi, dword [esp + 0x1c]
push dword [0x884adc]
mov edi, dword [esp + 0x1c]
add esi, 0x7f
and esi, 0xffffff80
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
lea edx, [esi + 0xf]
and edx, 0xfffffff0
cmp esi, dword [eax + 8]
jg 0x5d262c
lea ecx, [edx + edi]
cmp ecx, dword [eax + 0xc]
jne 0x5d262c
cmp dword [eax + 0x14], edi
je 0x5d262c
mov dword [eax + 0xc], edi
jmp 0x5d2635
push edx
push edi
mov ecx, eax
call fcn.0046a590
push 0x7d8954
lea ecx, [esp + 0x10]
call fcn.0046b3e0
lea ecx, [esp + 0xc]
call fcn.0046b110
pop edi
pop esi
pop ebx
add esp, 0x14
ret

Function at 0x5d2660
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
lea ecx, [edi + 0x14]
call fcn.0046a7e0
mov eax, dword [edi]
cmp dword [edi + 0xc], eax
jne 0x5d2696
mov esi, dword [edi + 4]
sub esi, 1
js 0x5d268f
lea ebx, [eax + esi*4]
nop
mov ecx, ebx
call fcn.0045d990
sub ebx, 4
sub esi, 1
jns 0x5d2680
mov dword [edi + 4], 0
mov eax, dword [edi + 0x10]
push dword [0x884adc]
mov ebx, dword [edi + 0xc]
lea esi, [eax*4 + 0x7f]
and esi, 0xffffff80
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
lea edx, [esi + 0xf]
and edx, 0xfffffff0
cmp esi, dword [eax + 8]
jg 0x5d26cf
lea ecx, [edx + ebx]
cmp ecx, dword [eax + 0xc]
jne 0x5d26cf
cmp dword [eax + 0x14], ebx
je 0x5d26cf
mov dword [eax + 0xc], ebx
jmp 0x5d26d8
push edx
push ebx
mov ecx, eax
call fcn.0046a590
mov esi, dword [edi + 4]
sub esi, 1
mov eax, dword [edi]
js 0x5d26f4
lea ebx, [eax + esi*4]
mov ecx, ebx
call fcn.0045d990
sub ebx, 4
sub esi, 1
jns 0x5d26e5
mov eax, dword [edi + 8]
mov dword [edi + 4], 0
test eax, eax
js 0x5d271a
and eax, 0x3fffffff
mov ecx, 0x7d8954
shl eax, 2
push eax
mov eax, dword [0x7d8954]
push dword [edi]
call dword [eax + 0x10]
mov dword [edi + 8], connect
mov dword [edi], 0
pop edi
pop esi
pop ebx
ret
Function at 0x5d2734
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, ecx
mov dword [esi], vtable.hkBaseObject.0
test al, 1
je 0x5d2783
test al, 4
jne 0x5d2778
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 8
cmp ax, cx
je 0x5d275b
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 8
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4

Function at 0x5d2794
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, ecx
mov dword [esi], vtable.hkBaseObject.0
test al, 1
je 0x5d27e3
test al, 4
jne 0x5d27d8
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 8
cmp ax, cx
je 0x5d27bb
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 8
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4

Function at 0x5d27f4
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, ecx
mov dword [esi], vtable.hkBaseObject.0
test al, 1
je 0x5d2843
test al, 4
jne 0x5d2838
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 8
cmp ax, cx
je 0x5d281b
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 8
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4

Function at 0x5d28b0
Capabilities:
Get thread local storage value

Disassembly:
push esi
mov esi, ecx
call fcn.005d0ab0
mov eax, dword [esp + 8]
test al, 1
je 0x5d2905
test al, 4
jne 0x5d28f7
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0xf0
cmp ax, cx
je 0x5d28da
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0xf0
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4
Function at 0x5d2e70
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 0x64
push ebx
mov ebx, dword [esp + 0x74]
push edi
mov edi, ecx
test ebx, ebx
jne 0x5d2ea8
mov eax, dword [esp + 0x7c]
mov dword [eax], 0xffffffff
mov dword [eax + 4], 0xffffffff
movss xmm0, dword [edi + 0x40]
mulss xmm0, dword [esp + 0x70]
pop edi
pop ebx
movss dword [eax + 8], xmm0
add esp, 0x64
ret 0x10
push ebp
push esi
push ebx
call fcn.0046b820
add esp, 4
mov esi, eax
mov dword [esp + 0x20], esi
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
add esi, 0x7f
and esi, 0xffffff80
mov ecx, dword [eax + 0xc]
lea edx, [ecx + esi]
cmp esi, dword [eax + 8]
jg 0x5d2ee0
cmp edx, dword [eax + 0x10]
ja 0x5d2ee0
mov dword [eax + 0xc], edx
jmp 0x5d2eea
push esi
mov ecx, eax
call fcn.0046a3c0
mov ecx, eax
push dword [esp + 0x20]
mov dword [esp + 0x20], ecx
push ecx
lea ecx, [esp + 0x18]
call fcn.0046b980
xor esi, esi
test ebx, ebx
jle 0x5d2f21
mov ebp, dword [esp + 0x7c]
mov eax, dword [ebp + esi*4]
lea ecx, [esp + 0x10]
push 1
inc eax
push eax
push 0x7d8954
call fcn.0046ba50
inc esi
cmp esi, ebx
jl 0x5d2f06
movss xmm0, dword [edi + 0x40]
lea ebp, [edi + 0x4c]
mov al, byte [edi + 0x4d]
xor ecx, ecx
movss dword [esp + 0x64], xmm0
xor ebx, ebx
movss xmm0, dword [edi + 0x48]
movss dword [esp + 0x6c], xmm0
mov byte [esp + 0x71], al
mov dword [esp + 0x80], ecx
cmp byte [ebp], cl
jle 0x5d2f90
lea esi, [esp + 0x24]
mov eax, dword [edi]
lea ecx, [esp + 0x10]
inc eax
push eax
call fcn.0046b460
mov ecx, dword [esp + 0x80]
cmp eax, dword [esp + 0x18]
jg 0x5d2f84
mov eax, dword [edi]
inc ecx
mov dword [esi], eax
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
add esi, 8
mov dword [esp + 0x80], ecx
movsx eax, byte [ebp]
inc ebx
add edi, 8
cmp ebx, eax
jl 0x5d2f55
push dword [esp + 0x84]
movss xmm0, dword [esp + 0x7c]
push ecx
mov byte [esp + 0x78], cl
lea ecx, [esp + 0x2c]
movss dword [esp], xmm0
call fcn.005d2cd0
push 0x7d8954
lea ecx, [esp + 0x14]
call fcn.0046b3e0
mov esi, dword [esp + 0x20]
push dword [0x884adc]
mov edi, dword [esp + 0x20]
add esi, 0x7f
and esi, 0xffffff80
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
lea edx, [esi + 0xf]
and edx, 0xfffffff0
cmp esi, dword [eax + 8]
pop esi
pop ebp
jg 0x5d2ff7
lea ecx, [edx + edi]
cmp ecx, dword [eax + 0xc]
jne 0x5d2ff7
cmp dword [eax + 0x14], edi
je 0x5d2ff7
mov dword [eax + 0xc], edi
jmp 0x5d3000
push edx
push edi
mov ecx, eax
call fcn.0046a590
push 0x7d8954
lea ecx, [esp + 0xc]
call fcn.0046b3e0
lea ecx, [esp + 8]
call fcn.0046b110
pop edi
pop ebx
add esp, 0x64
ret 0x10
Function at 0x5d3870
Capabilities:
Get thread local storage value

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
push edi
push dword [0x884adc]
mov eax, dword [ebx]
movsx esi, word [eax]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
lea edi, [esi*4 + 0x7f]
and edi, 0xffffff80
mov esi, dword [eax + 0xc]
lea ecx, [esi + edi]
cmp edi, dword [eax + 8]
jg 0x5d38a7
cmp ecx, dword [eax + 0x10]
ja 0x5d38a7
mov dword [eax + 0xc], ecx
jmp 0x5d38b1
push edi
mov ecx, eax
call fcn.0046a3c0
mov esi, eax
mov ecx, dword [esp + 0x14]
push 1
push esi
push dword [ecx + 4]
push dword [ecx]
push ecx
mov dword [esp], 0x3f800000
push ebx
call fcn.005d4be0
add esp, 0x18
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
lea edx, [edi + 0xf]
and edx, 0xfffffff0
cmp edi, dword [eax + 8]
jg 0x5d38f9
lea ecx, [edx + esi]
cmp ecx, dword [eax + 0xc]
jne 0x5d38f9
cmp dword [eax + 0x14], esi
je 0x5d38f9
pop edi
mov dword [eax + 0xc], esi
pop esi
pop ebx
ret
push edx
push esi
mov ecx, eax
call fcn.0046a590
pop edi
pop esi
pop ebx
ret

Function at 0x5d3910
Capabilities:
Get thread local storage value

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
push edi
push dword [0x884adc]
mov eax, dword [ebx]
movsx esi, word [eax]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
lea edi, [esi*4 + 0x7f]
and edi, 0xffffff80
mov esi, dword [eax + 0xc]
lea ecx, [esi + edi]
cmp edi, dword [eax + 8]
jg 0x5d3947
cmp ecx, dword [eax + 0x10]
ja 0x5d3947
mov dword [eax + 0xc], ecx
jmp 0x5d3951
push edi
mov ecx, eax
call fcn.0046a3c0
mov esi, eax
mov ecx, dword [esp + 0x14]
push 1
push esi
push dword [ecx + 4]
push dword [ecx]
push ecx
mov dword [esp], 0x3f800000
push ebx
call fcn.005d5360
add esp, 0x18
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
lea edx, [edi + 0xf]
and edx, 0xfffffff0
cmp edi, dword [eax + 8]
jg 0x5d3999
lea ecx, [edx + esi]
cmp ecx, dword [eax + 0xc]
jne 0x5d3999
cmp dword [eax + 0x14], esi
je 0x5d3999
pop edi
mov dword [eax + 0xc], esi
pop esi
pop ebx
ret
push edx
push esi
mov ecx, eax
call fcn.0046a590
pop edi
pop esi
pop ebx
ret
Function at 0x5d5ea0
Capabilities:
Execute anti-debugging instructions
Get thread local storage value

Disassembly:
sub esp, 0xc
push esi
push edi
push dword [0x884c50]
mov edi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
call edi
mov esi, eax
mov ecx, dword [esi + 4]
cmp ecx, dword [esi + 0xc]
jae 0x5d5edd
mov dword [ecx], str.LtSingleModifierUpdate
mov dword [ecx + 0xc], str.StCopyVariablestoMembers
rdtsc
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
mov dword [ecx + 4], eax
lea eax, [ecx + 0x10]
mov dword [esi + 4], eax
mov esi, dword [esp + 0x1c]
mov ecx, esi
push ebx
mov ebx, dword [esp + 0x1c]
push ebp
cmp byte [esi + 0x28], 0
push 0
push ebx
setne byte [esp + 0x2c]
call fcn.00594f40
cmp byte [esi + 0x28], 0
push dword [0x884c50]
mov dword [esp + 0x14], eax
je 0x5d5fcd
call edi
mov dword [esp + 0x14], eax
mov ebp, dword [eax + 4]
cmp ebp, dword [eax + 0xc]
jae 0x5d5f3a
mov dword [ebp], str.StActivateModifier
rdtsc
mov dword [esp + 0x24], eax
mov ecx, dword [esp + 0x24]
lea eax, [ebp + 0xc]
mov dword [ebp + 4], ecx
mov ecx, dword [esp + 0x14]
mov dword [ecx + 4], eax
push dword [esp + 0x2c]
push esi
push ebx
call fcn.005d6090
add esp, 0xc
push dword [0x884c50]
call edi
mov dword [esp + 0x14], eax
mov ebp, dword [eax + 4]
cmp ebp, dword [eax + 0xc]
jae 0x5d5f7a
mov dword [ebp], str.StUpdateModifier
rdtsc
mov dword [esp + 0x24], eax
mov ecx, dword [esp + 0x24]
lea eax, [ebp + 0xc]
mov dword [ebp + 4], ecx
mov ecx, dword [esp + 0x14]
mov dword [ecx + 4], eax
movss xmm0, dword [esp + 0x28]
mov eax, dword [esi]
push ecx
movss dword [esp], xmm0
mov ecx, esi
push ebx
call dword [eax + 0x14]
push dword [0x884c50]
call edi
mov dword [esp + 0x14], eax
mov ebp, dword [eax + 4]
cmp ebp, dword [eax + 0xc]
jae 0x5d5fc0
mov dword [ebp], str.StCopyVariablesFromMembers
rdtsc
mov dword [esp + 0x24], eax
mov ecx, dword [esp + 0x24]
lea eax, [ebp + 0xc]
mov dword [ebp + 4], ecx
mov ecx, dword [esp + 0x14]
mov dword [ecx + 4], eax
cmp dword [esp + 0x10], 0
je 0x5d6055
jmp 0x5d604b
call edi
mov dword [esp + 0x18], eax
mov ebp, dword [eax + 4]
cmp ebp, dword [eax + 0xc]
jae 0x5d5ff9
mov dword [ebp], str.StDeactivateModifier
rdtsc
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x14]
lea eax, [ebp + 0xc]
mov dword [ebp + 4], ecx
mov ecx, dword [esp + 0x18]
mov dword [ecx + 4], eax
push dword [esp + 0x2c]
push esi
push ebx
call fcn.005d60d0
add esp, 0xc
test al, al
je 0x5d6055
cmp dword [esp + 0x10], 0
je 0x5d6055
cmp byte [esp + 0x24], 0
je 0x5d6055
push dword [0x884c50]
call edi
mov dword [esp + 0x18], eax
mov ebp, dword [eax + 4]
cmp ebp, dword [eax + 0xc]
jae 0x5d604b
mov dword [ebp], str.StCopyVariablesFromMembers
rdtsc
mov dword [esp + 0x24], eax
mov ecx, dword [esp + 0x24]
lea eax, [ebp + 0xc]
mov dword [ebp + 4], ecx
mov ecx, dword [esp + 0x18]
mov dword [ecx + 4], eax
push 1
push ebx
mov ecx, esi
call fcn.00594f40
push dword [0x884c50]
call edi
mov edi, eax
pop ebp
pop ebx
mov esi, dword [edi + 4]
cmp esi, dword [edi + 0xc]
jae 0x5d6082
mov dword [esi], 0x77f784
rdtsc
mov dword [esp + 0x1c], eax
mov ecx, dword [esp + 0x1c]
lea eax, [esi + 0xc]
mov dword [esi + 4], ecx
mov dword [edi + 4], eax
pop edi
pop esi
add esp, 0xc
ret
Function at 0x5dc990
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 0x30
push ebx
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp dword [eax + 8], 0x80
mov ebx, dword [eax + 0xc]
lea ecx, [ebx + 0x80]
jl 0x5dc9bc
cmp ecx, dword [eax + 0x10]
ja 0x5dc9bc
mov dword [eax + 0xc], ecx
jmp 0x5dc9ca
push 0x80
mov ecx, eax
call fcn.0046a3c0
mov ebx, eax
push esi
mov esi, dword [esp + 0x40]
lea eax, [esp + 0x18]
push edi
mov edi, dword [esp + 0x48]
push eax
push 2
mov dword [ebx], esi
push ebx
mov dword [ebx + 4], edi
call fcn.005dc340
movss xmm0, dword [esp + 0x4c]
lea ecx, [esp + 0x1c]
add esp, 0xc
push ecx
push eax
lea eax, [esp + 0x24]
push eax
push ecx
mov ecx, esi
movss dword [esp], xmm0
call fcn.005d2e70
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0
push eax
lea eax, [esp + 0x14]
mov ecx, edi
push eax
call fcn.005d3020
movss xmm0, dword [esp + 0xc]
push dword [0x884adc]
movss dword [esp + 0x48], xmm0
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
pop edi
pop esi
cmp dword [eax + 8], 0x80
jl 0x5dca5f
lea ecx, [ebx + 0x80]
cmp ecx, dword [eax + 0xc]
jne 0x5dca5f
cmp dword [eax + 0x14], ebx
je 0x5dca5f
fld dword [esp + 0x3c]
mov dword [eax + 0xc], ebx
pop ebx
add esp, 0x30
ret
push 0x80
push ebx
mov ecx, eax
call fcn.0046a590
fld dword [esp + 0x3c]
pop ebx
add esp, 0x30
ret

Function at 0x5dcf70
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push ebp
mov ebp, ecx
push esi
push edi
mov byte [ebp + 4], 1
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, dword [esp + 0x24]
mov edi, dword [eax + 0xc]
lea ecx, [esi + esi*2]
lea ebx, [ecx*2 + 0x7f]
and ebx, 0xffffff80
lea ecx, [edi + ebx]
cmp ebx, dword [eax + 8]
jg 0x5dcfac
cmp ecx, dword [eax + 0x10]
ja 0x5dcfac
mov dword [eax + 0xc], ecx
jmp 0x5dcfb6
push ebx
mov ecx, eax
call fcn.0046a3c0
mov edi, eax
push edi
push esi
push dword [esp + 0x30]
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push dword [esp + 0x2c]
call fcn.005d3f20
push edi
push esi
call fcn.005d3fa0
add esp, 0x24
mov esi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, esi
and ecx, 0xfffffff0
push ecx
push dword [eax + 0x2c]
call fcn.00460640
push eax
push edi
push dword [esp + 0x34]
mov dword [ebp], eax
push esi
call fcn.005d4000
add esp, 0x18
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
lea edx, [ebx + 0xf]
and edx, 0xfffffff0
cmp ebx, dword [eax + 8]
jg 0x5dd039
lea ecx, [edx + edi]
cmp ecx, dword [eax + 0xc]
jne 0x5dd039
cmp dword [eax + 0x14], edi
je 0x5dd039
mov dword [eax + 0xc], edi
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
ret 0x18
push edx
push edi
mov ecx, eax
call fcn.0046a590
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
ret 0x18
Function at 0x5dd1d0
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
push edi
push dword [0x884adc]
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push 0x3c
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, eax
test esi, esi
je 0x5dd251
push 0x3c
push 0
push esi
call fcn.00609f40
mov dword [esi + 8], 0x1ffff
add esp, 0xc
mov dword [esi + 4], vtable.hkbHandle.0
or eax, 0xffffffff
mov dword [esi + 0x20], 0x1ffff
mov dword [esi + 0x1c], vtable.hkbHandle.0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov word [esi + 0x30], ax
jmp 0x5dd253
xor esi, esi
mov ecx, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
mov dword [esi], ebx
mov eax, dword [ecx + 8]
mov dword [esi + 0xc], eax
mov eax, dword [ecx + 0xc]
mov dword [esi + 0x10], eax
mov eax, dword [ecx + 0x10]
mov dword [esi + 0x14], eax
movzx eax, word [ecx + 0x14]
mov word [esi + 0x18], ax
mov eax, dword [ecx + 0x20]
mov dword [esi + 0x24], eax
mov eax, dword [ecx + 0x24]
mov dword [esi + 0x28], eax
mov eax, dword [ecx + 0x28]
mov dword [esi + 0x2c], eax
movzx eax, word [ecx + 0x2c]
mov word [esi + 0x30], ax
mov ecx, dword [esi + 0x10]
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
test ecx, ecx
je 0x5dd2ab
call fcn.0045c0c0
mov ecx, dword [esi + 0x28]
test ecx, ecx
je 0x5dd2b7
call fcn.0045c0c0
mov ecx, ebx
call fcn.0045c0c0
push esi
mov ecx, edi
call fcn.005dd3f0
push esi
push dword [esp + 0x14]
mov ecx, edi
call fcn.005de5b0
pop edi
mov eax, esi
pop esi
pop ebx
ret 0xc