Function at 0x47ec50
Capabilities:
Delete file
Get thread local storage value

Disassembly:
mov eax, dword [0x6c24b8]
push ebx
push ebp
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
xor edi, edi
cmp esi, edi
jne 0x47ec72
pop edi
pop esi
pop ebp
mov eax, 4
pop ebx
ret
mov ecx, dword [esi + 0x45e2]
cmp ecx, 0xffffffff
jne 0x47eca0
cmp word [esi + 0x45ea], di
je 0x47eca0
mov edx, dword [esi + 0x45ee]
mov eax, dword [esi + 0x45f2]
mov dword [esi + 0x4558], edx
mov dword [esi + 0x455c], eax
jmp 0x47ecac
mov dword [esi + 0x4558], ecx
mov dword [esi + 0x455c], edi
mov eax, dword [esi + 0x45de]
cmp eax, 0xffffffff
jne 0x47ecf8
cmp word [esi + 0x45ea], di
je 0x47ecf8
cmp ecx, eax
je 0x47ecde
mov ecx, dword [esi + 0x45ee]
mov edx, dword [esi + 0x45f2]
mov dword [esi + 0x4550], ecx
mov dword [esi + 0x4554], edx
jmp 0x47ed04
mov eax, dword [esi + 0x45f6]
mov ecx, dword [esi + 0x45fa]
mov dword [esi + 0x4550], eax
mov dword [esi + 0x4554], ecx
jmp 0x47ed04
mov dword [esi + 0x4550], eax
mov dword [esi + 0x4554], edi
cmp dword [esi + 0x54], edi
jne 0x47ee0f
mov al, byte [esi + 0x45d2]
mov bl, 8
test bl, al
je 0x47edc7
mov ecx, dword [esi + 0x4e98]
mov edx, dword [esi + 0x4e90]
cmp ecx, 0xffffffff
mov dword [esi + 0x45da], edx
jne 0x47ed57
cmp word [esi + 0x45ea], di
je 0x47ed57
mov eax, dword [esi + 0x4eb2]
mov edx, dword [esi + 0x4eb6]
mov dword [esi + 0x4558], eax
mov dword [esi + 0x455c], edx
jmp 0x47ed69
mov dword [esi + 0x4558], ecx
mov dword [esi + 0x45e2], ecx
mov dword [esi + 0x455c], edi
mov eax, dword [esi + 0x4e94]
cmp eax, 0xffffffff
jne 0x47edb5
cmp word [esi + 0x45ea], di
je 0x47edb5
cmp ecx, eax
je 0x47ed9b
mov eax, dword [esi + 0x4eb2]
mov ecx, dword [esi + 0x4eb6]
mov dword [esi + 0x4550], eax
mov dword [esi + 0x4554], ecx
jmp 0x47edc7
mov edx, dword [esi + 0x4eba]
mov eax, dword [esi + 0x4ebe]
mov dword [esi + 0x4550], edx
mov dword [esi + 0x4554], eax
jmp 0x47edc7
mov dword [esi + 0x4550], eax
mov dword [esi + 0x45de], eax
mov dword [esi + 0x4554], edi
push esi
call fcn.00485000
xor ecx, ecx
xor ebp, ebp
mov cx, word [esi + 0x45e8]
mov bp, word [esi + 0x45e6]
push edi
lea ecx, [ecx + ebp + 0x1e]
xor ebp, ebp
add ecx, eax
adc ebp, edx
mov edx, dword [esi + 0x14fa8]
push ebp
push ecx
push edx
call fcn.00487a80
mov al, byte [esi + 0x4ea6]
add esp, 0x14
test bl, al
je 0x47ee0f
pop edi
pop esi
pop ebp
mov eax, 0x2e
pop ebx
ret
mov eax, dword [esi + 0x4eec]
mov dword [esi + 0x14f98], edi
cmp eax, edi
je 0x47ee2c
call fcn.0047ebd0
cmp eax, edi
jne 0x47eecf
mov eax, dword [esi + 0x3d30]
mov ebp, dword [esp + 0x14]
cmp eax, edi
jne 0x47eed4
cmp dword [esi + 0x4c], edi
jne 0x47eed4
cmp dword [esi + 0x54], edi
jne 0x47eed4
push ebp
call fcn.004868b0
mov ebx, eax
add esp, 4
cmp ebx, edi
jne 0x47ee6e
call fcn.00487b40
mov ebx, eax
cmp ebx, edi
jne 0x47ee6e
cmp dword [esi], edi
je 0x47eecd
mov eax, dword [esi + 0x14fa8]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp eax, 0xffffffff
je 0x47ee8c
push eax
call edi
mov dword [esi + 0x14fa8], 0xffffffff
mov eax, dword [esi + 0x16808]
cmp eax, 0xffffffff
je 0x47eea4
push eax
call edi
mov dword [esi + 0x16808], 0xffffffff
mov eax, dword [esi + 0x3d30]
test eax, eax
jne 0x47eecd
mov eax, dword [esi + 0x4c]
test eax, eax
jne 0x47eecd
mov eax, dword [esi + 0x54]
test eax, eax
jne 0x47eecd
mov eax, dword [esi + 0x3d34]
test eax, eax
jne 0x47eecd
push ebp
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
ret
mov dword [esi + 0x16808], 0xffffffff
jmp 0x47ee5f