joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4255a8
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
push edi
mov eax, dword [0x555894]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov ebx, eax
xor esi, esi
cmp dword [0x540680], 0
je 0x4255c7
test ebx, ebx
jne 0x4255d1
xor eax, eax
jmp 0x42563b
call fcn.0041ad00
inc esi
cmp dword [ebx + 0x1c0], 0
jg 0x4255cb
mov edx, dword [ebx]
mov ecx, dword [edx]
push esi
mov edi, ecx
lea esi, [ebx + 0x10]
mov ecx, 6
rep movsd dword es:[edi], dword [esi]
pop esi
xor eax, eax
mov dword [ebx + 0x10], eax
add dword [ebx], 4
mov edx, dword [ebx]
cmp edx, dword [ebx + 4]
jne 0x425600
call fcn.00432d24
add dword [ebx], 4
mov ecx, dword [ebx]
cmp ecx, dword [ebx + 4]
jne 0x42560f
call fcn.00432d24
mov eax, dword [ebx]
xor edx, edx
mov eax, dword [eax - 4]
mov dword [eax], 0x80000
mov dword [eax + 8], edx
mov dword [eax + 0xc], esi
mov word [eax + 0x10], 0
mov cx, word [ebx + 0x34]
mov word [eax + 0x12], cx
mov eax, 1
mov word [ebx + 0x34], 0
pop edi
pop esi
pop ebx
ret

Function at 0x425640
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
push edi
mov eax, dword [0x555894]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov ebx, eax
mov eax, dword [ebx]
mov esi, dword [eax - 4]
cmp dword [esi], 0x80000
je 0x425673
push 0
push 0
push str.hb_vmRequestRestore
push 0x2328
call fcn.00457568
add esp, 0x10
mov ax, word [esi + 0x12]
or ax, word [ebx + 0x34]
mov edx, eax
test dh, 1
je 0x425689
call fcn.0041b21c
jmp 0x4256fc
test dl, 1
mov esi, dword [esi + 0xc]
je 0x425699
mov word [ebx + 0x34], 1
jmp 0x4256b9
test dl, 2
je 0x4256a6
mov word [ebx + 0x34], 2
jmp 0x4256b9
test dl, 4
je 0x4256b3
mov word [ebx + 0x34], 4
jmp 0x4256b9
mov word [ebx + 0x34], 0
sub dword [ebx], 4
test dword [ebx + 0x10], 0xb405
je 0x4256cf
lea ecx, [ebx + 0x10]
push ecx
call fcn.0043f008
pop ecx
sub dword [ebx], 4
lea edi, [ebx + 0x10]
mov eax, dword [ebx]
mov ecx, 6
mov edx, dword [eax]
push esi
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebx]
xor ecx, ecx
pop esi
mov edx, dword [eax]
mov dword [edx], ecx
jmp 0x4256f3
call fcn.0041ac90
mov eax, esi
add esi, 0xffffffff
test eax, eax
jg 0x4256ee
pop edi
pop esi
pop ebx
ret

Function at 0x425fc0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, dword [ebp + 8]
mov eax, dword [0x555894]
push eax
call sub.KERNEL32.DLL_TlsGetValue
test ebx, ebx
jl 0x426010
mov edx, dword [eax + 0xc]
mov edx, dword [edx]
mov si, word [edx + 0x12]
cmp si, word [edx + 0x10]
jae 0x426003
movzx edx, si
cmp ebx, edx
jle 0x426003
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx]
movzx ecx, word [edx + 0x10]
mov edx, dword [eax + 0xc]
mov edx, dword [edx]
movzx edx, word [edx + 0x12]
sub ecx, edx
jmp 0x426005
xor ecx, ecx
add ebx, ecx
mov eax, dword [eax + 0xc]
mov eax, dword [eax + ebx*4 + 4]
jmp 0x426023
push ebx
mov eax, dword [eax + 0xc]
mov edx, dword [eax + 4]
mov ecx, dword [edx + 8]
push ecx
call fcn.00432530
add esp, 8
pop esi
pop ebx
pop ebp
ret
Function at 0x429ae0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, dword [ebp + 8]
mov eax, dword [0x555894]
push eax
call sub.KERNEL32.DLL_TlsGetValue
add dword [eax], 4
mov esi, dword [eax]
mov eax, dword [0x555894]
push eax
call sub.KERNEL32.DLL_TlsGetValue
cmp esi, dword [eax + 4]
jne 0x429b0d
call fcn.00432d24
mov edx, dword [0x555894]
push edx
call sub.KERNEL32.DLL_TlsGetValue
mov ecx, dword [eax]
mov eax, dword [ecx - 4]
mov dword [eax], 0x8000
mov dword [eax + 8], ebx
push ebx
call fcn.0043ba18
pop ecx
pop esi
pop ebx
pop ebp
ret
Function at 0x42b580
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
push eax
call fcn.004333bc
pop ecx
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jle 0x42b5b7
mov edx, dword [0x555894]
push edx
call sub.KERNEL32.DLL_TlsGetValue
mov ecx, dword [eax + 8]
mov eax, dword [ebp - 8]
mov edx, dword [ecx + eax*4]
mov di, word [edx + 0x10]
jmp 0x42b5b9
xor edi, edi
movzx eax, di
push eax
call fcn.0043dbdc
pop ecx
mov dword [ebp - 4], eax
mov bx, 1
cmp di, bx
jb 0x42b5fd
mov eax, dword [0x555894]
push eax
call sub.KERNEL32.DLL_TlsGetValue
movzx esi, bx
mov edx, dword [eax + 8]
mov eax, esi
add eax, dword [ebp - 8]
mov edx, dword [edx + eax*4 + 4]
push edx
push esi
mov ecx, dword [ebp - 4]
push ecx
call fcn.0042a03c
add esp, 0xc
inc ebx
cmp di, bx
jae 0x42b5cf
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x42b608
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
push edi
push 0
call fcn.0043da24
pop ecx
mov esi, eax
mov eax, dword [0x555894]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov edx, dword [eax + 0xc]
mov ecx, dword [edx]
mov di, word [ecx + 0x10]
movzx eax, di
push eax
push esi
call fcn.00429c2c
mov bx, 1
add esp, 8
cmp di, bx
jb 0x42b668
mov eax, dword [0x555894]
push eax
call sub.KERNEL32.DLL_TlsGetValue
movzx ecx, bx
mov edx, dword [eax + 0xc]
mov eax, dword [edx + ecx*4 + 4]
movzx edx, bx
push eax
push edx
push esi
call fcn.0042a03c
add esp, 0xc
inc ebx
cmp di, bx
jae 0x42b63f
mov eax, esi
pop edi
pop esi
pop ebx
ret

Function at 0x42b670
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
push edi
push 0
call fcn.0043da24
pop ecx
mov esi, eax
mov eax, dword [0x555894]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov edx, dword [eax + 0xc]
mov ecx, dword [edx]
mov di, word [ecx + 0x10]
movzx eax, di
inc eax
push eax
push esi
call fcn.00429c2c
add esp, 8
xor ebx, ebx
cmp di, bx
jb 0x42b6d0
mov eax, dword [0x555894]
push eax
call sub.KERNEL32.DLL_TlsGetValue
movzx ecx, bx
mov edx, dword [eax + 0xc]
mov eax, dword [edx + ecx*4 + 4]
movzx edx, bx
inc edx
push eax
push edx
push esi
call fcn.0042a03c
add esp, 0xc
inc ebx
cmp di, bx
jae 0x42b6a6
mov eax, esi
pop edi
pop esi
pop ebx
ret
Function at 0x42c12c
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
xor ebp, ebp
mov dword [esp], 0x540d30
mov edi, 0x540d00
mov eax, dword [edi]
push eax
call fcn.00431c28
pop ecx
mov esi, eax
test esi, esi
je 0x42c1b1
push esi
call fcn.00431cbc
pop ecx
test eax, eax
je 0x42c1b1
mov eax, dword [0x555894]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov ebx, eax
add ebx, 0x10
test dword [ebx], 0xb405
je 0x42c17a
push ebx
call fcn.0043f008
pop ecx
jmp 0x42c17e
xor eax, eax
mov dword [ebx], eax
push esi
call fcn.00423460
pop ecx
call fcn.00422df0
push 0
call fcn.0042225c
test byte [ebx + 1], 0x80
pop ecx
je 0x42c1b1
mov edx, dword [ebx + 8]
cmp word [edx + 0xc], 0
je 0x42c1b1
mov ecx, dword [ebx + 8]
mov edx, dword [esp]
mov ax, word [ecx + 0xc]
mov ecx, dword [edx]
mov word [ecx], ax
inc ebp
add dword [esp], 4
add edi, 4
cmp ebp, 0xc
jl 0x42c13f
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x42c868
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push 1
call fcn.004333bc
pop ecx
mov ebx, eax
test ebx, ebx
jle 0x42c8b1
mov eax, dword [0x555894]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov edx, dword [eax + 8]
mov ecx, dword [edx + ebx*4]
mov eax, dword [ecx + 0xc]
mov dx, word [eax + 0xc]
test dx, dx
je 0x42c8b1
movzx ecx, dx
movzx eax, word [eax + 0xe]
mov edx, dword [0x540cf4]
shl eax, 5
mov ecx, dword [edx + ecx*4]
mov edx, dword [ecx + 8]
mov ax, word [edx + eax + 0x14]
pop ebx
ret
xor eax, eax
pop ebx
ret

Function at 0x42c8b8
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
xor ebx, ebx
push 1
call fcn.004333bc
pop ecx
mov esi, eax
test esi, esi
jle 0x42c910
mov eax, dword [0x555894]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov edx, dword [eax + 8]
mov ecx, dword [edx + esi*4]
mov ebx, dword [ecx + 8]
cmp ebx, 0x540670
je 0x42c8f1
mov eax, dword [ebx + 0xc]
cmp eax, dword [0x54067c]
jne 0x42c910
mov edx, dword [0x555894]
push edx
call sub.KERNEL32.DLL_TlsGetValue
mov ecx, dword [eax + 8]
mov eax, dword [ecx + esi*4 + 4]
test byte [eax + 1], 0x10
je 0x42c910
mov edx, dword [eax + 8]
mov ebx, dword [edx + 8]
push ebx
call fcn.00423e6c
pop ecx
pop esi
pop ebx
ret

Function at 0x42c91c
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push 1
call fcn.004333bc
pop ecx
mov ebx, eax
test ebx, ebx
jle 0x42c94c
mov eax, dword [0x555894]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov edx, dword [eax + 8]
mov eax, dword [edx + ebx*4 + 4]
test byte [eax + 1], 0x80
je 0x42c94c
mov edx, dword [eax + 8]
mov ax, word [edx + 0xc]
pop ebx
ret
xor eax, eax
pop ebx
ret
Function at 0x42d3d4
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov ebx, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
push ebx
push edi
push esi
call fcn.0042cbd8
add esp, 0xc
test eax, eax
je 0x42d5bf
mov edx, 0x431288
cmp edx, dword [eax + 8]
jne 0x42d4b0
mov eax, dword [esi + 8]
mov edx, dword [0x540cf4]
mov cx, word [eax + 0xc]
mov word [ebp - 2], cx
movzx eax, word [ebx + 0xc]
movzx ecx, word [ebx + 0xe]
mov eax, dword [edx + eax*4]
shl ecx, 5
mov edx, dword [eax + 8]
add edx, ecx
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
movzx edi, word [eax + 0x18]
mov ax, word [ebx + 0xc]
cmp ax, word [ebp - 2]
je 0x42d46f
mov edx, dword [ebp - 8]
mov eax, dword [0x540cf4]
movzx ecx, word [edx + 0x14]
mov edx, dword [eax + ecx*4]
mov ecx, dword [edx + 4]
mov edx, dword [0x540cf4]
push ecx
movzx eax, word [ebp - 2]
mov ecx, dword [edx + eax*4]
push ecx
call fcn.0042b9e8
add esp, 8
movzx eax, ax
add edi, eax
jmp 0x42d478
mov edx, dword [ebp - 8]
movzx ecx, word [edx + 0x1a]
add edi, ecx
push esi
call fcn.00429dc0
pop ecx
cmp edi, eax
jbe 0x42d48d
push edi
push esi
call fcn.00429cac
add esp, 8
mov eax, dword [0x555894]
push eax
call sub.KERNEL32.DLL_TlsGetValue
add eax, 0x10
push eax
push edi
push esi
call fcn.0042a128
add esp, 0xc
jmp 0x42d5c1
mov edx, 0x430fa8
cmp edx, dword [eax + 8]
jne 0x42d4ff
movzx ecx, word [ebx + 0xc]
movzx edx, word [ebx + 0xe]
mov eax, dword [0x540cf4]
shl edx, 5
mov esi, dword [eax + ecx*4]
mov ecx, dword [0x555894]
mov eax, dword [esi + 8]
add eax, edx
push ecx
mov ebx, eax
call sub.KERNEL32.DLL_TlsGetValue
add eax, 0x10
push eax
movzx eax, word [ebx + 0x18]
push eax
mov edx, dword [esi + 0x18]
push edx
call fcn.0042a128
add esp, 0xc
jmp 0x42d5c1
mov ecx, 0x4310dc
cmp ecx, dword [eax + 8]
jne 0x42d554
movzx eax, word [ebx + 0xc]
movzx ecx, word [ebx + 0xe]
mov edx, dword [0x540cf4]
shl ecx, 5
mov eax, dword [edx + eax*4]
mov edx, dword [eax + 8]
mov eax, dword [0x555894]
add edx, ecx
push eax
mov ebx, edx
call sub.KERNEL32.DLL_TlsGetValue
add eax, 0x10
push eax
mov eax, dword [0x540cf4]
movzx edx, word [ebx + 0x18]
push edx
movzx ecx, word [ebx + 0x14]
mov edx, dword [eax + ecx*4]
mov ecx, dword [edx + 0x1c]
push ecx
call fcn.0042a128
add esp, 0xc
jmp 0x42d5c1
mov edx, 0x430d44
cmp edx, dword [eax + 8]
jne 0x42d563
call dword [eax + 8]
jmp 0x42d5bf
movzx eax, word [ebx + 0xc]
mov ecx, dword [0x540cf4]
mov eax, dword [ecx + eax*4]
movzx ecx, word [ebx + 0xe]
shl ecx, 5
mov edx, dword [eax + 8]
add edx, ecx
mov ebx, edx
mov eax, dword [ebx]
cmp eax, dword [0x540abc]
jne 0x42d599
push 0
mov edx, dword [edi + 0xc]
push edx
push esi
call fcn.00425078
add esp, 0xc
jmp 0x42d5c1
cmp dword [ebx + 4], 0
jne 0x42d5ac
mov ecx, dword [edi]
inc ecx
push ecx
call fcn.00431b8c
pop ecx
mov dword [ebx + 4], eax
mov eax, dword [ebx + 4]
push eax
mov edx, dword [edi + 0xc]
push edx
push esi
call fcn.00425078
add esp, 0xc
jmp 0x42d5c1
xor eax, eax
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x42d5f4
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
movzx edx, word [0x540cfa]
push ebx
push esi
push edi
inc edx
mov esi, dword [ebp + 0xc]
movzx eax, word [esi + 0x4c]
mov ebx, dword [esi + 8]
mov dword [ebp - 4], eax
push edx
call fcn.0043b368
pop ecx
mov edi, eax
movzx eax, word [0x540cfa]
inc eax
push eax
push 0
push edi
call fcn.004ab738
add esp, 0xc
cmp dword [ebx], 0
je 0x42d672
mov edx, dword [ebx + 8]
cmp edx, 0x540b40
jne 0x42d660
movzx ecx, word [ebx + 0x14]
mov eax, dword [0x540cf4]
mov eax, dword [eax + ecx*4]
cmp word [eax + 0x32], 0
je 0x42d672
cmp esi, eax
je 0x42d672
movzx edx, word [ebx + 0x14]
or byte [edi + edx], 1
jmp 0x42d672
mov ecx, dword [ebx]
cmp ecx, dword [0x540aac]
jne 0x42d672
movzx eax, word [ebx + 0x14]
or byte [edi + eax], 2
add ebx, 0x20
dec dword [ebp - 4]
jne 0x42d62f
mov bx, word [0x540cfa]
movzx eax, bx
lea esi, [edi + eax]
test bx, bx
je 0x42d744
cmp byte [esi], 1
jne 0x42d739
movzx edx, bx
mov ecx, dword [0x540cf4]
mov eax, dword [0x540aac]
push eax
mov eax, dword [ecx + edx*4]
push eax
call fcn.0042b828
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x42d739
mov edx, dword [ebp - 8]
movzx ecx, word [edx + 0x14]
cmp byte [edi + ecx], 1
jne 0x42d739
push 0x540aa0
call fcn.00423424
pop ecx
push ebx
mov eax, dword [ebp + 8]
push eax
mov edx, dword [0x555894]
push edx
call sub.KERNEL32.DLL_TlsGetValue
add dword [eax], 4
mov ecx, dword [eax]
push ecx
mov eax, dword [0x555894]
push eax
call sub.KERNEL32.DLL_TlsGetValue
pop edx
cmp edx, dword [eax + 4]
jne 0x42d702
call fcn.00432d24
mov ecx, dword [0x555894]
push ecx
call sub.KERNEL32.DLL_TlsGetValue
mov eax, dword [eax]
mov edx, dword [eax - 4]
push edx
call fcn.0042cb98
add esp, 0xc
push 0
call fcn.00422408
pop ecx
call fcn.0042557c
test ax, ax
jne 0x42d744
mov ecx, dword [ebp - 8]
movzx eax, word [ecx + 0x14]
or byte [edi + eax], 2
dec ebx
dec esi
test bx, bx
jne 0x42d690
push edi
call fcn.0043b450
pop ecx
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x42d818
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0x14]
mov esi, dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
push ebx
push esi
call fcn.0042d7d4
add esp, 8
test eax, eax
je 0x42d8e9
movzx eax, bx
shl eax, 4
add eax, 0x5408e0
push eax
call fcn.00423424
pop ecx
push esi
call fcn.00422db8
pop ecx
mov edx, dword [0x555894]
push edx
call sub.KERNEL32.DLL_TlsGetValue
test dword [eax + 0x10], 0xb405
je 0x42d880
mov ecx, dword [0x555894]
push ecx
call sub.KERNEL32.DLL_TlsGetValue
add eax, 0x10
push eax
call fcn.0043f008
pop ecx
jmp 0x42d890
mov eax, dword [0x555894]
push eax
call sub.KERNEL32.DLL_TlsGetValue
xor edx, edx
mov dword [eax + 0x10], edx
test edi, edi
je 0x42d8bf
push edi
call fcn.00422db8
cmp dword [ebp + 0x18], 0
pop ecx
je 0x42d8b5
mov ecx, dword [ebp + 0x18]
push ecx
call fcn.00422db8
pop ecx
push 2
call fcn.00422408
pop ecx
jmp 0x42d8c7
push 1
call fcn.00422408
pop ecx
jmp 0x42d8c7
push 0
call fcn.00422408
pop ecx
mov eax, dword [0x555894]
push eax
call sub.KERNEL32.DLL_TlsGetValue
add eax, 0x10
push eax
mov edx, dword [ebp + 0xc]
push edx
call fcn.0043f284
add esp, 8
mov eax, 1
jmp 0x42d8eb
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x42f4fc
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
push 1
call fcn.0043393c
pop ecx
mov dword [esp], eax
push 0xffffffffffffffff
push 2
call fcn.004336c4
add esp, 8
mov ebp, eax
push 0xffffffffffffffff
push 3
call fcn.004336c4
add esp, 8
mov ebx, eax
test ebx, ebx
je 0x42f536
test dword [ebx], 0xfffbffff
jne 0x42f536
xor ebx, ebx
push 0xffffffffffffffff
push 4
call fcn.004336c4
add esp, 8
mov esi, eax
test esi, esi
je 0x42f552
test dword [esi], 0xfffbffff
jne 0x42f552
xor esi, esi
push 0xffffffffffffffff
push 5
call fcn.004336c4
add esp, 8
mov edi, eax
test edi, edi
je 0x42f56e
test dword [edi], 0xfffbffff
jne 0x42f56e
xor edi, edi
cmp dword [esp], 0
je 0x42f5e1
test ebp, ebp
je 0x42f57e
test byte [ebp], 0x1a
je 0x42f5e1
test ebx, ebx
je 0x42f588
test byte [ebx + 1], 0x80
je 0x42f5e1
test esi, esi
je 0x42f592
test byte [esi + 1], 1
je 0x42f5e1
test edi, edi
je 0x42f59b
test byte [edi], 0x80
je 0x42f5e1
push edi
call fcn.0043e12c
pop ecx
push eax
push esi
call fcn.0043e328
pop ecx
push eax
push ebx
push ebp
call fcn.0043e1c0
pop ecx
push eax
mov eax, dword [esp + 0x10]
push eax
call fcn.0042edf4
add esp, 0x14
mov ebx, eax
movzx edx, bx
push edx
mov ecx, dword [0x555894]
push ecx
call sub.KERNEL32.DLL_TlsGetValue
add eax, 0x10
push eax
call fcn.0043e63c
add esp, 8
jmp 0x42f5f6
push 0xffffffffffffffff
push 1
push 0
push 0xbb8
push 1
call fcn.00457160
add esp, 0x14
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x430cf8
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x555894]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov edx, dword [eax + 0xc]
mov ecx, dword [edx]
push ecx
call fcn.0043e328
pop ecx
mov edx, dword [eax]
cmp byte [edx], 0x5f
jne 0x430d2c
push 0xfffffffffffffffe
inc edx
push edx
push 0
push 0x3ed
push 0x10
call fcn.004573cc
add esp, 0x14
ret
push 0xfffffffffffffffe
mov eax, dword [eax]
push eax
push 0
push 0x3ec
push 0xd
call fcn.004573cc
add esp, 0x14
ret
Function at 0x4322ac
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
cmp dword [ebp + 0x18], 0
mov ebx, dword [ebp + 8]
je 0x4322d9
mov eax, dword [ebp + 0x18]
push eax
push ebx
mov edx, dword [ebp + 0x18]
push edx
call fcn.0043b368
pop ecx
push eax
call fcn.004ab6c8
add esp, 0xc
mov dword [ebp - 4], eax
jmp 0x4322dc
mov dword [ebp - 4], ebx
cmp word [ebp + 0xc], 0
je 0x4323ce
movzx eax, word [ebp + 0xc]
inc eax
mov bx, 1
mov edx, eax
shl edx, 3
lea edx, [edx + edx*2]
push edx
call fcn.0043b368
pop ecx
mov esi, eax
xor eax, eax
mov dword [esi], eax
mov edx, dword [ebp + 0x10]
mov eax, dword [0x555894]
movzx edi, word [edx]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov edx, dword [eax + 0xc]
mov ecx, dword [edx]
mov ax, word [ecx + 0x10]
push eax
mov edx, dword [0x555894]
push edx
call sub.KERNEL32.DLL_TlsGetValue
mov ecx, dword [eax + 0xc]
mov eax, dword [ecx]
pop edx
cmp dx, word [eax + 0x12]
jbe 0x432380
mov ecx, dword [0x555894]
push ecx
call sub.KERNEL32.DLL_TlsGetValue
mov eax, dword [eax + 0xc]
mov edx, dword [eax]
movzx ecx, word [edx + 0x12]
cmp edi, ecx
jle 0x432380
mov eax, dword [0x555894]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov edx, dword [eax + 0xc]
mov ecx, dword [edx]
movzx eax, word [ecx + 0x10]
push eax
mov edx, dword [0x555894]
push edx
call sub.KERNEL32.DLL_TlsGetValue
mov ecx, dword [eax + 0xc]
mov eax, dword [ecx]
pop ecx
movzx edx, word [eax + 0x12]
sub ecx, edx
jmp 0x432382
xor ecx, ecx
add edi, ecx
push edi
mov eax, dword [0x555894]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov edx, dword [eax + 0xc]
pop eax
mov eax, dword [edx + eax*4 + 4]
add dword [ebp + 0x10], 2
push eax
call fcn.00443a20
movzx edx, bx
pop ecx
push esi
lea ecx, [edx + edx*2]
lea edi, [esi + ecx*8]
mov esi, eax
mov ecx, 6
rep movsd dword es:[edi], dword [esi]
pop esi
mov eax, dword [eax + 8]
push eax
call fcn.0043b480
pop ecx
inc ebx
cmp bx, word [ebp + 0xc]
jbe 0x432305
jmp 0x432403
mov edx, dword [0x555894]
push edx
call sub.KERNEL32.DLL_TlsGetValue
mov ecx, dword [eax + 0xc]
mov eax, dword [ecx + 4]
test byte [eax + 1], 0x10
je 0x432401
mov eax, dword [eax + 8]
mov dx, word [eax + 0x14]
mov word [ebp + 0xc], dx
mov esi, dword [eax + 0xc]
test esi, esi
je 0x432403
push esi
call fcn.0043b480
pop ecx
jmp 0x432403
xor esi, esi
mov eax, dword [0x555894]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov edx, dword [eax + 0xc]
mov edi, dword [edx]
push 0x5413c0
push 0x18
call fcn.0043b8e4
add esp, 8
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [ebx], eax
cmp dword [ebp + 0x18], 0
setne dl
and edx, 1
mov word [ebx + 0x16], dx
mov ecx, dword [edi + 0xc]
cmp word [ecx + 0xc], 0
je 0x43244a
push edi
call fcn.0042c75c
pop ecx
jmp 0x43244d
mov eax, dword [edi + 8]
mov dword [ebx + 8], eax
mov edx, dword [ebp + 0x14]
mov dword [ebx + 4], edx
mov ecx, dword [0x555894]
push ecx
call sub.KERNEL32.DLL_TlsGetValue
mov eax, dword [eax + 0x8c]
mov dword [ebx + 0x10], eax
mov eax, ebx
mov dx, word [ebp + 0xc]
mov word [ebx + 0x14], dx
mov dword [ebx + 0xc], esi
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x432480
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, dword [ebp + 0xc]
push ebx
mov eax, dword [ebp + 8]
push eax
push ebx
call fcn.0043b368
pop ecx
push eax
call fcn.004ab6c8
add esp, 0xc
mov edi, eax
push 0x5413c0
push 0x18
call fcn.0043b8e4
add esp, 8
mov ebx, eax
mov eax, dword [0x555894]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov edx, dword [eax + 0xc]
mov esi, dword [edx]
mov dword [ebx], edi
mov word [ebx + 0x16], 1
mov eax, dword [esi + 0xc]
cmp word [eax + 0xc], 0
je 0x4324dc
push esi
call fcn.0042c75c
pop ecx
jmp 0x4324df
mov eax, dword [esi + 8]
mov dword [ebx + 8], eax
xor edx, edx
mov dword [ebx + 4], edx
mov ecx, dword [0x555894]
push ecx
call sub.KERNEL32.DLL_TlsGetValue
mov eax, dword [eax + 0x8c]
xor edx, edx
mov dword [ebx + 0x10], eax
mov eax, ebx
mov word [ebx + 0x14], 0
mov dword [ebx + 0xc], edx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x432754
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov eax, dword [0x555894]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov esi, eax
mov eax, dword [ebx]
test eax, eax
je 0x432788
cmp eax, dword [esi + 0x84]
jg 0x432788
mov edx, dword [esi + 0x88]
cmp dword [edx + eax*8], 0
jne 0x432859
test eax, eax
jne 0x4327b5
push 0x5413cc
call fcn.00449c3c
pop ecx
cmp dword [ebx], 0
jne 0x4327aa
inc dword [0x5413e8]
mov ecx, dword [0x5413e8]
mov dword [ebx], ecx
push 0x5413cc
call fcn.00449c5c
pop ecx
mov edi, dword [ebx]
cmp edi, dword [esi + 0x84]
jle 0x432806
inc edi
shl edi, 3
push edi
mov eax, dword [esi + 0x88]
push eax
call fcn.0043b3c0
add esp, 8
mov dword [esi + 0x88], eax
mov edx, dword [ebx]
mov eax, dword [esi + 0x84]
sub edx, eax
shl edx, 3
push edx
push 0
shl eax, 3
add eax, dword [esi + 0x88]
add eax, 8
push eax
call fcn.004ab738
add esp, 0xc
mov edx, dword [ebx]
mov dword [esi + 0x84], edx
mov ecx, dword [esi + 0x88]
mov eax, dword [ebx]
mov dword [ecx + eax*8], ebx
mov edx, dword [ebx + 4]
push edx
call fcn.0043b368
pop ecx
mov ecx, dword [esi + 0x88]
mov edx, dword [ebx]
mov dword [ecx + edx*8 + 4], eax
mov eax, dword [ebx + 4]
push eax
push 0
mov ecx, dword [esi + 0x88]
mov eax, dword [ebx]
mov edx, dword [ecx + eax*8 + 4]
push edx
call fcn.004ab738
add esp, 0xc
cmp dword [ebx + 8], 0
je 0x432859
mov ecx, dword [esi + 0x88]
mov eax, dword [ebx]
mov edx, dword [ecx + eax*8 + 4]
push edx
call dword [ebx + 8]
pop ecx
mov ecx, dword [esi + 0x88]
mov eax, dword [ebx]
mov eax, dword [ecx + eax*8 + 4]
pop edi
pop esi
pop ebx
pop ebp
ret