joyce8/EMBER2024-capa huggingface dataset:
Function at 0x53f690
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x580560
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x5fad8c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x14], ebx
push dword [0x603f98]
mov esi, dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x53f6e0
cmp dword [eax], esi
je 0x53f72d
mov eax, dword [eax + 8]
test eax, eax
jne 0x53f6d5
mov edi, dword [ebp + 0xc]
push edi
push 0x78
mov dword [ebp - 0x28], edi
call fcn.00556400
mov esi, eax
mov dword [ebp - 0x20], ebx
add esp, 8
mov dword [ebp - 0x24], esi
mov dword [ebp - 4], 1
mov dword [ebp + 0xc], esi
test esi, esi
je 0x53f75a
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ecx + 0x14]
call fcn.0055f820
push eax
mov ebx, 1
mov byte [ebp - 4], 3
push edi
mov ecx, esi
mov dword [ebp - 0x14], ebx
call fcn.00545ae0
jmp 0x53f75c
cmp dword [eax + 4], ebx
je 0x53f6e0
mov eax, dword [ebp + 0xc]
push eax
push eax
mov dword [ebp - 4], 0
call fcn.0053cc40
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
xor eax, eax
mov dword [ebp - 4], 1
test bl, 1
je 0x53f76c
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
push eax
push dword [ebp + 8]
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 0
call fcn.0055d960
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x53f7a0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5805c0
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x5fad8c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x14], ebx
push dword [0x603f98]
mov esi, dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x53f7f0
cmp dword [eax], esi
je 0x53f83d
mov eax, dword [eax + 8]
test eax, eax
jne 0x53f7e5
mov edi, dword [ebp + 0xc]
push edi
push 0x78
mov dword [ebp - 0x28], edi
call fcn.00556400
mov esi, eax
mov dword [ebp - 0x20], ebx
add esp, 8
mov dword [ebp - 0x24], esi
mov dword [ebp - 4], 1
mov dword [ebp + 0xc], esi
test esi, esi
je 0x53f86a
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ecx + 0x14]
call fcn.0055f820
push eax
mov ebx, 1
mov byte [ebp - 4], 3
push edi
mov ecx, esi
mov dword [ebp - 0x14], ebx
call fcn.00545b40
jmp 0x53f86c
cmp dword [eax + 4], ebx
je 0x53f7f0
mov eax, dword [ebp + 0xc]
push eax
push eax
mov dword [ebp - 4], 0
call fcn.0053cde0
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
xor eax, eax
mov dword [ebp - 4], 1
test bl, 1
je 0x53f87c
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
push eax
push dword [ebp + 8]
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 0
call fcn.0055d960
lea ecx, [ebp - 0x28]
call fcn.005700c0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x53f8c0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5805c0
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x5fad8c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x14], ebx
push dword [0x603f98]
mov esi, dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x53f910
cmp dword [eax], esi
je 0x53f95d
mov eax, dword [eax + 8]
test eax, eax
jne 0x53f905
mov edi, dword [ebp + 0xc]
push edi
push 0x78
mov dword [ebp - 0x28], edi
call fcn.00556400
mov esi, eax
mov dword [ebp - 0x20], ebx
add esp, 8
mov dword [ebp - 0x24], esi
mov dword [ebp - 4], 1
mov dword [ebp + 0xc], esi
test esi, esi
je 0x53f98a
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ecx + 0x14]
call fcn.0055f820
push eax
mov ebx, 1
mov byte [ebp - 4], 3
push edi
mov ecx, esi
mov dword [ebp - 0x14], ebx
call fcn.00545be0
jmp 0x53f98c
cmp dword [eax + 4], ebx
je 0x53f910
mov eax, dword [ebp + 0xc]
push eax
push eax
mov dword [ebp - 4], 0
call fcn.0053ce60
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
xor eax, eax
mov dword [ebp - 4], 1
test bl, 1
je 0x53f99c
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
push eax
push dword [ebp + 8]
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 0
call fcn.0055d960
lea ecx, [ebp - 0x28]
call fcn.005700c0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x53f9e0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x580620
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x5fad8c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x14], ebx
push dword [0x603f98]
mov esi, dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x53fa30
cmp dword [eax], esi
je 0x53fa80
mov eax, dword [eax + 8]
test eax, eax
jne 0x53fa25
mov edi, dword [ebp + 0xc]
push edi
push 0x90
mov dword [ebp - 0x28], edi
call fcn.00556400
mov esi, eax
mov dword [ebp - 0x20], ebx
add esp, 8
mov dword [ebp - 0x24], esi
mov dword [ebp - 4], 1
mov dword [ebp + 0xc], esi
test esi, esi
je 0x53faad
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ecx + 0x14]
call fcn.0055f820
push eax
mov ebx, 1
mov byte [ebp - 4], 3
push edi
mov ecx, esi
mov dword [ebp - 0x14], ebx
call fcn.00545c80
jmp 0x53faaf
cmp dword [eax + 4], ebx
je 0x53fa30
mov eax, dword [ebp + 0xc]
push eax
push eax
mov dword [ebp - 4], 0
call fcn.0053cee0
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
xor eax, eax
mov dword [ebp - 4], 1
test bl, 1
je 0x53fabf
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
push eax
push dword [ebp + 8]
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 0
call fcn.0055d960
lea ecx, [ebp - 0x28]
call fcn.00570140
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x53fb00
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x580620
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x5fad8c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x14], ebx
push dword [0x603f98]
mov esi, dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x53fb50
cmp dword [eax], esi
je 0x53fba0
mov eax, dword [eax + 8]
test eax, eax
jne 0x53fb45
mov edi, dword [ebp + 0xc]
push edi
push 0x90
mov dword [ebp - 0x28], edi
call fcn.00556400
mov esi, eax
mov dword [ebp - 0x20], ebx
add esp, 8
mov dword [ebp - 0x24], esi
mov dword [ebp - 4], 1
mov dword [ebp + 0xc], esi
test esi, esi
je 0x53fbcd
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ecx + 0x14]
call fcn.0055f820
push eax
mov ebx, 1
mov byte [ebp - 4], 3
push edi
mov ecx, esi
mov dword [ebp - 0x14], ebx
call fcn.00545ce0
jmp 0x53fbcf
cmp dword [eax + 4], ebx
je 0x53fb50
mov eax, dword [ebp + 0xc]
push eax
push eax
mov dword [ebp - 4], 0
call fcn.0053cf10
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
xor eax, eax
mov dword [ebp - 4], 1
test bl, 1
je 0x53fbdf
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
push eax
push dword [ebp + 8]
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 0
call fcn.0055d960
lea ecx, [ebp - 0x28]
call fcn.00570140
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x53fc20
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x580680
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x5fad8c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x14], ebx
push dword [0x603f98]
mov esi, dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x53fc70
cmp dword [eax], esi
je 0x53fc89
mov eax, dword [eax + 8]
test eax, eax
jne 0x53fc65
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x28], edi
mov esi, dword [edi]
cmp byte [esi + 0x400], bl
jne 0x53fcb6
mov byte [esi + 0x400], 1
jmp 0x53fcc5
cmp dword [eax + 4], ebx
je 0x53fc70
mov eax, dword [ebp + 0xc]
push eax
push eax
mov dword [ebp - 4], 0
call fcn.0053cf40
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push 0x80
call fcn.00535f9b
add esp, 4
mov esi, eax
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], ebx
mov dword [ebp - 4], 1
mov dword [ebp + 0xc], esi
test esi, esi
je 0x53fcff
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ecx + 0x14]
call fcn.0055f820
push eax
mov ebx, 1
mov byte [ebp - 4], 3
push edi
mov ecx, esi
mov dword [ebp - 0x14], ebx
call fcn.00545d40
jmp 0x53fd01
xor eax, eax
mov dword [ebp - 4], 1
test bl, 1
je 0x53fd11
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
push eax
push dword [ebp + 8]
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 0
call fcn.0055d960
lea ecx, [ebp - 0x28]
call fcn.005701b0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x53fd50
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5806e0
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x5fad8c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x14], ebx
push dword [0x603f98]
mov esi, dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x53fda0
cmp dword [eax], esi
je 0x53fded
mov eax, dword [eax + 8]
test eax, eax
jne 0x53fd95
mov edi, dword [ebp + 0xc]
push edi
push 0x50
mov dword [ebp - 0x28], edi
call fcn.00556400
mov esi, eax
mov dword [ebp - 0x20], ebx
add esp, 8
mov dword [ebp - 0x24], esi
mov dword [ebp - 4], 1
mov dword [ebp + 0xc], esi
test esi, esi
je 0x53fe1a
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ecx + 0x14]
call fcn.0055f820
push eax
mov ebx, 1
mov byte [ebp - 4], 3
push edi
mov ecx, esi
mov dword [ebp - 0x14], ebx
call fcn.00545df0
jmp 0x53fe1c
cmp dword [eax + 4], ebx
je 0x53fda0
mov eax, dword [ebp + 0xc]
push eax
push eax
mov dword [ebp - 4], 0
call fcn.0053d450
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
xor eax, eax
mov dword [ebp - 4], 1
test bl, 1
je 0x53fe2c
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
push eax
push dword [ebp + 8]
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 0
call fcn.0055d960
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x53fe60
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x580740
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x5fad8c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x14], ebx
push dword [0x603f98]
mov esi, dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x53feb0
cmp dword [eax], esi
je 0x53ff06
mov eax, dword [eax + 8]
test eax, eax
jne 0x53fea5
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x28], edi
lea eax, [edi + 0x80]
push eax
push 0x100
call fcn.00556400
mov esi, eax
mov dword [ebp - 0x20], ebx
add esp, 8
mov dword [ebp - 0x24], esi
mov dword [ebp - 4], 1
mov dword [ebp + 0xc], esi
test esi, esi
je 0x53ff33
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ecx + 0x14]
call fcn.0055f820
push eax
mov ebx, 1
mov byte [ebp - 4], 3
push edi
mov ecx, esi
mov dword [ebp - 0x14], ebx
call fcn.00545ec0
jmp 0x53ff35
cmp dword [eax + 4], ebx
je 0x53feb0
mov eax, dword [ebp + 0xc]
push eax
push eax
mov dword [ebp - 4], 0
call fcn.0053d470
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
xor eax, eax
mov dword [ebp - 4], 1
test bl, 1
je 0x53ff45
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
push eax
push dword [ebp + 8]
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 0
call fcn.0055d960
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x53ff80
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x580740
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x5fad8c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x14], ebx
push dword [0x603f98]
mov esi, dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x53ffd0
cmp dword [eax], esi
je 0x540026
mov eax, dword [eax + 8]
test eax, eax
jne 0x53ffc5
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x28], edi
lea eax, [edi + 0x80]
push eax
push 0x100
call fcn.00556400
mov esi, eax
mov dword [ebp - 0x20], ebx
add esp, 8
mov dword [ebp - 0x24], esi
mov dword [ebp - 4], 1
mov dword [ebp + 0xc], esi
test esi, esi
je 0x540053
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ecx + 0x14]
call fcn.0055f820
push eax
mov ebx, 1
mov byte [ebp - 4], 3
push edi
mov ecx, esi
mov dword [ebp - 0x14], ebx
call fcn.00545f20
jmp 0x540055
cmp dword [eax + 4], ebx
je 0x53ffd0
mov eax, dword [ebp + 0xc]
push eax
push eax
mov dword [ebp - 4], 0
call fcn.0053d470
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
xor eax, eax
mov dword [ebp - 4], 1
test bl, 1
je 0x540065
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
push eax
push dword [ebp + 8]
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 0
call fcn.0055d960
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x5400a0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5807a0
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x5fad8c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x14], ebx
push dword [0x603f98]
mov esi, dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x5400f0
cmp dword [eax], esi
je 0x540143
mov eax, dword [eax + 8]
test eax, eax
jne 0x5400e5
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x28], edi
lea eax, [edi + 0x50]
push eax
push 0xc8
call fcn.00556400
mov esi, eax
mov dword [ebp - 0x20], ebx
add esp, 8
mov dword [ebp - 0x24], esi
mov dword [ebp - 4], 1
mov dword [ebp + 0xc], esi
test esi, esi
je 0x540170
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ecx + 0x14]
call fcn.0055f820
push eax
mov ebx, 1
mov byte [ebp - 4], 3
push edi
mov ecx, esi
mov dword [ebp - 0x14], ebx
call fcn.00545f80
jmp 0x540172
cmp dword [eax + 4], ebx
je 0x5400f0
mov eax, dword [ebp + 0xc]
push eax
push eax
mov dword [ebp - 4], 0
call fcn.0053d4a0
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
xor eax, eax
mov dword [ebp - 4], 1
test bl, 1
je 0x540182
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
push eax
push dword [ebp + 8]
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 0
call fcn.0055d960
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x5401b0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x580800
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x5fad8c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x14], ebx
push dword [0x603f98]
mov esi, dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x540200
cmp dword [eax], esi
je 0x54021a
mov eax, dword [eax + 8]
test eax, eax
jne 0x5401f5
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x28], edi
mov esi, dword [edi + 0x68]
cmp byte [esi + 0x400], bl
jne 0x540247
mov byte [esi + 0x400], 1
jmp 0x540256
cmp dword [eax + 4], ebx
je 0x540200
mov eax, dword [ebp + 0xc]
push eax
push eax
mov dword [ebp - 4], 0
call fcn.0053d520
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push 0xe8
call fcn.00535f9b
add esp, 4
mov esi, eax
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], ebx
mov dword [ebp - 4], 1
mov dword [ebp + 0xc], esi
test esi, esi
je 0x540290
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ecx + 0x14]
call fcn.0055f820
push eax
mov ebx, 1
mov byte [ebp - 4], 3
push edi
mov ecx, esi
mov dword [ebp - 0x14], ebx
call fcn.00545fe0
jmp 0x540292
xor eax, eax
mov dword [ebp - 4], 1
test bl, 1
je 0x5402a2
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
push eax
push dword [ebp + 8]
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 0
call fcn.0055d960
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x5402d0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x580860
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x5fad8c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x14], ebx
push dword [0x603f98]
mov esi, dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x540320
cmp dword [eax], esi
je 0x540373
mov eax, dword [eax + 8]
test eax, eax
jne 0x540315
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x28], edi
lea eax, [edi + 0x70]
push eax
push 0xe8
call fcn.00556400
mov esi, eax
mov dword [ebp - 0x20], ebx
add esp, 8
mov dword [ebp - 0x24], esi
mov dword [ebp - 4], 1
mov dword [ebp + 0xc], esi
test esi, esi
je 0x5403a0
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ecx + 0x14]
call fcn.0055f820
push eax
mov ebx, 1
mov byte [ebp - 4], 3
push edi
mov ecx, esi
mov dword [ebp - 0x14], ebx
call fcn.00546040
jmp 0x5403a2
cmp dword [eax + 4], ebx
je 0x540320
mov eax, dword [ebp + 0xc]
push eax
push eax
mov dword [ebp - 4], 0
call fcn.0053d550
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
xor eax, eax
mov dword [ebp - 4], 1
test bl, 1
je 0x5403b2
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
push eax
push dword [ebp + 8]
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 0
call fcn.0055d960
lea ecx, [ebp - 0x28]
call fcn.00570240
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x5403f0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5808c0
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x5fad8c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x14], ebx
push dword [0x603f98]
mov esi, dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x540440
cmp dword [eax], esi
je 0x540493
mov eax, dword [eax + 8]
test eax, eax
jne 0x540435
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x28], edi
lea eax, [edi + 0x58]
push eax
push 0xe8
call fcn.00556400
mov esi, eax
mov dword [ebp - 0x20], ebx
add esp, 8
mov dword [ebp - 0x24], esi
mov dword [ebp - 4], 1
mov dword [ebp + 0xc], esi
test esi, esi
je 0x5404c0
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ecx + 0x14]
call fcn.0055f820
push eax
mov ebx, 1
mov byte [ebp - 4], 3
push edi
mov ecx, esi
mov dword [ebp - 0x14], ebx
call fcn.005460a0
jmp 0x5404c2
cmp dword [eax + 4], ebx
je 0x540440
mov eax, dword [ebp + 0xc]
push eax
push eax
mov dword [ebp - 4], 0
call fcn.0053d570
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
xor eax, eax
mov dword [ebp - 4], 1
test bl, 1
je 0x5404d2
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
push eax
push dword [ebp + 8]
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 0
call fcn.0055d960
lea ecx, [ebp - 0x28]
call fcn.005702e0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x540510
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x580920
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x5fad8c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x14], ebx
push dword [0x603f98]
mov esi, dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x540560
cmp dword [eax], esi
je 0x5405b3
mov eax, dword [eax + 8]
test eax, eax
jne 0x540555
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x28], edi
lea eax, [edi + 0x70]
push eax
push 0xe8
call fcn.00556400
mov esi, eax
mov dword [ebp - 0x20], ebx
add esp, 8
mov dword [ebp - 0x24], esi
mov dword [ebp - 4], 1
mov dword [ebp + 0xc], esi
test esi, esi
je 0x5405e0
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ecx + 0x14]
call fcn.0055f820
push eax
mov ebx, 1
mov byte [ebp - 4], 3
push edi
mov ecx, esi
mov dword [ebp - 0x14], ebx
call fcn.00546100
jmp 0x5405e2
cmp dword [eax + 4], ebx
je 0x540560
mov eax, dword [ebp + 0xc]
push eax
push eax
mov dword [ebp - 4], 0
call fcn.0053d590
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
xor eax, eax
mov dword [ebp - 4], 1
test bl, 1
je 0x5405f2
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
push eax
push dword [ebp + 8]
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 0
call fcn.0055d960
lea ecx, [ebp - 0x28]
call fcn.00570360
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8