joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6ccfc0
Capabilities:
Execute anti-debugging instructions
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x18
push esi
push edi
push dword [0x884c50]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
mov esi, dword [edi + 4]
cmp esi, dword [edi + 0xc]
jae 0x6ccffa
mov dword [esi], str.TtSphereBox
rdtsc
mov dword [esp + 0xc], eax
mov ecx, dword [esp + 0xc]
lea eax, [esi + 0xc]
mov dword [esi + 4], ecx
mov dword [edi + 4], eax
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
mov esi, dword [ecx + 8]
lea ecx, [esp + 0x10]
mov dword [esp + 0xc], eax
add esi, 0x30
mov eax, dword [ebp + 0xc]
push esi
push dword [eax + 8]
mov edi, dword [eax]
call fcn.0046ea30
movaps xmm0, xmmword [esp + 0x10]
mov edx, dword [ebp + 0xc]
movaps xmm1, xmm0
andps xmm1, xmmword [0x719140]
minps xmm1, xmmword [edi + 0x20]
mov eax, dword [edx + 8]
andps xmm0, xmmword [0x77f7f0]
xorps xmm1, xmm0
movaps xmm2, xmm1
movaps xmm0, xmm1
shufps xmm2, xmm1, 0x55
mulps xmm2, xmmword [eax + 0x10]
shufps xmm0, xmm1, 0
mulps xmm0, xmmword [eax]
shufps xmm1, xmm1, 0xaa
mulps xmm1, xmmword [eax + 0x20]
addps xmm2, xmm0
addps xmm1, xmmword [eax + 0x30]
mov eax, dword [esp + 0xc]
addps xmm2, xmm1
subps xmm2, xmmword [esi]
mulps xmm2, xmm2
movaps xmm0, xmm2
shufps xmm0, xmm2, 0x55
addss xmm0, xmm2
shufps xmm2, xmm2, 0xaa
addss xmm2, xmm0
movss xmm0, dword [edi + 0x10]
addss xmm0, dword [eax + 0x10]
mulss xmm0, xmm0
comiss xmm0, xmm2
jbe 0x6cd0a1
mov ecx, dword [ebp + 0x14]
push edx
push dword [ebp + 8]
mov eax, dword [ecx]
call dword [eax + 4]
push dword [0x884c50]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
mov esi, dword [edi + 4]
cmp esi, dword [edi + 0xc]
jae 0x6cd0d0
mov dword [esi], 0x77f5ec
rdtsc
mov dword [esp + 0xc], eax
mov ecx, dword [esp + 0xc]
lea eax, [esi + 0xc]
mov dword [esi + 4], ecx
mov dword [edi + 4], eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x6cd194
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, ecx
mov dword [esi], vtable.hkBaseObject.0
test al, 1
je 0x6cd1e3
test al, 4
jne 0x6cd1d8
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0x10
cmp ax, cx
je 0x6cd1bb
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0x10
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4

Function at 0x6cd1f4
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, ecx
mov dword [esi], vtable.hkBaseObject.0
test al, 1
je 0x6cd243
test al, 4
jne 0x6cd238
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0x10
cmp ax, cx
je 0x6cd21b
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0x10
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4
Function at 0x6cde24
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, ecx
mov dword [esi], vtable.hkBaseObject.0
test al, 1
je 0x6cde73
test al, 4
jne 0x6cde68
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0x2c
cmp ax, cx
je 0x6cde4b
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0x2c
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4

Function at 0x6cde84
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, ecx
mov dword [esi], vtable.hkBaseObject.0
test al, 1
je 0x6cded3
test al, 4
jne 0x6cdec8
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0x2c
cmp ax, cx
je 0x6cdeab
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0x2c
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4
Function at 0x6ce4e0
Capabilities:
Execute anti-debugging instructions
Get thread local storage value
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0xd8
push esi
push edi
push dword [0x884c50]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
mov esi, dword [edi + 4]
cmp esi, dword [edi + 0xc]
jae 0x6ce51d
mov dword [esi], str.TtmultiRay_cnvx_getPen
rdtsc
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 0x18]
lea eax, [esi + 0xc]
mov dword [esi + 4], ecx
mov dword [edi + 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
push dword [eax + 8]
mov edx, dword [ecx]
push dword [ecx + 8]
mov esi, dword [eax]
lea ecx, [esp + 0x58]
mov dword [esp + 0x24], edx
call fcn.0046efa0
mov edi, dword [esi + 0x14]
mov eax, dword [esi + 0x10]
mov dword [esp + 0x18], eax
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0
mov dword [esp + 0xa0], 0x3f800000
mov dword [esp + 0xa8], 0xffffffff
mov dword [esp + 0xa4], 0xffffffff
mov dword [esp + 0xd0], 0
mov dword [esp + 0xb0], 0xffffffff
test edi, edi
je 0x6ce65c
mov esi, dword [ebp + 0x14]
nop word [eax + eax]
dec edi
cmp byte [esi + 4], 0
jne 0x6ce65c
movaps xmm2, xmmword [eax]
lea edx, [esp + 0x90]
movaps xmm1, xmm2
mov ecx, dword [esp + 0x1c]
shufps xmm1, xmm2, 0x55
movaps xmm0, xmm2
mulps xmm1, xmmword [esp + 0x60]
push edx
shufps xmm0, xmm2, 0
lea edx, [esp + 0x24]
mulps xmm0, xmmword [esp + 0x54]
push edx
shufps xmm2, xmm2, 0xaa
lea edx, [esp + 0x1f]
mulps xmm2, xmmword [esp + 0x78]
push edx
addps xmm1, xmm0
addps xmm2, xmmword [esp + 0x8c]
addps xmm1, xmm2
movaps xmmword [esp + 0x2c], xmm1
movaps xmm2, xmmword [eax + 0x10]
movaps xmm1, xmm2
movaps xmm0, xmm2
shufps xmm1, xmm2, 0x55
mulps xmm1, xmmword [esp + 0x6c]
shufps xmm0, xmm2, 0
mulps xmm0, xmmword [esp + 0x5c]
shufps xmm2, xmm2, 0xaa
mulps xmm2, xmmword [esp + 0x7c]
addps xmm1, xmm0
addps xmm2, xmmword [esp + 0x8c]
addps xmm1, xmm2
movaps xmmword [esp + 0x3c], xmm1
mov eax, dword [ecx]
call dword [eax + 0x20]
cmp byte [esp + 0x17], 0
je 0x6ce649
push dword [ebp + 0xc]
mov eax, dword [esi]
mov ecx, esi
push dword [ebp + 8]
call dword [eax + 4]
mov eax, dword [esp + 0x18]
add eax, 0x20
mov dword [esp + 0x18], eax
test edi, edi
jne 0x6ce5a0
push dword [0x884c50]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
mov esi, dword [edi + 4]
cmp esi, dword [edi + 0xc]
jae 0x6ce68b
mov dword [esi], 0x77f5ec
rdtsc
mov dword [esp + 0x1c], eax
mov ecx, dword [esp + 0x1c]
lea eax, [esi + 0xc]
mov dword [esi + 4], ecx
mov dword [edi + 4], eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x6ced10
Capabilities:
Get thread local storage value

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x14]
mov dword [esi + 0x10], 0
test eax, eax
js 0x6ced39
and eax, 0x3fffffff
mov ecx, 0x7d8954
add eax, eax
push eax
mov eax, dword [0x7d8954]
push dword [esi + 0xc]
call dword [eax + 0x10]
mov eax, dword [esp + 8]
mov dword [esi + 0xc], 0
mov dword [esi + 0x14], connect
mov dword [esi], vtable.hkBaseObject.0
test al, 1
je 0x6ced97
test al, 4
jne 0x6ced8c
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0x20
cmp ax, cx
je 0x6ced6f
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0x20
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4

Function at 0x6ceda0
Capabilities:
Get thread local storage value

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x14]
mov dword [esi + 0x10], 0
test eax, eax
js 0x6cedc9
and eax, 0x3fffffff
mov ecx, 0x7d8954
add eax, eax
push eax
mov eax, dword [0x7d8954]
push dword [esi + 0xc]
call dword [eax + 0x10]
mov eax, dword [esp + 8]
mov dword [esi + 0xc], 0
mov dword [esi + 0x14], connect
mov dword [esi], vtable.hkBaseObject.0
test al, 1
je 0x6cee27
test al, 4
jne 0x6cee1c
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0x20
cmp ax, cx
je 0x6cedff
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0x20
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4
Function at 0x6cf440
Capabilities:
Execute anti-debugging instructions
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0xc8
push esi
push edi
push dword [0x884c50]
mov dword [esp + 0x10], ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
mov esi, dword [edi + 4]
cmp esi, dword [edi + 0xc]
jae 0x6cf481
mov dword [esi], str.TtTransform
rdtsc
mov dword [esp + 8], eax
mov ecx, dword [esp + 8]
lea eax, [esi + 0xc]
mov dword [esi + 4], ecx
mov dword [edi + 4], eax
mov esi, dword [ebp + 8]
lea ecx, [esp + 0x20]
mov eax, dword [esi]
mov dword [esp + 8], eax
add eax, 0x30
push eax
push dword [esi + 8]
call fcn.0046ef00
mov edi, dword [esi + 8]
lea ecx, [esp + 0x80]
mov esi, dword [esp + 8]
add esi, 0x20
push esi
movaps xmm0, xmmword [edi + 0x40]
lea eax, [edi + 0x60]
movaps xmmword [esp + 0x64], xmm0
movaps xmm0, xmmword [edi + 0x50]
push eax
movaps xmmword [esp + 0x78], xmm0
call fcn.004782a0
push esi
lea eax, [edi + 0x70]
push eax
lea ecx, [esp + 0x98]
call fcn.004782a0
mov edx, dword [esp + 8]
movaps xmm6, xmmword [edi + 0x80]
mov ecx, dword [ebp + 8]
push dword [ebp + 0x14]
movaps xmm5, xmmword [edx + 0x30]
subps xmm6, xmmword [edx + 0x60]
movaps xmm4, xmmword [edx + 0x50]
movaps xmm1, xmm5
unpcklps xmm1, xmmword [edx + 0x40]
unpckhps xmm5, xmmword [edx + 0x40]
movaps xmm2, xmm1
mov eax, dword [ecx + 8]
movlhps xmm2, xmm4
movaps xmm0, xmm6
shufps xmm0, xmm6, 0x55
movaps xmm3, xmm2
movhlps xmm3, xmm1
shufps xmm3, xmm4, 0xd4
mulps xmm3, xmm0
movaps xmm0, xmm6
shufps xmm0, xmm6, 0
mulps xmm0, xmm2
push dword [ebp + 0x10]
shufps xmm5, xmm4, 0xe4
push dword [ebp + 0xc]
addps xmm3, xmm0
shufps xmm6, xmm6, 0xaa
mulps xmm5, xmm6
addps xmm3, xmm5
movaps xmmword [esp + 0xac], xmm3
movaps xmm0, xmmword [eax + 0x90]
movaps xmmword [esp + 0xbc], xmm0
movss xmm0, dword [eax + 0xa0]
lea eax, [esp + 0x2c]
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x18]
movss dword [esp + 0xcc], xmm0
mov dword [esp + 0x24], eax
mov eax, dword [edx + 0x14]
lea edx, [esp + 0x1c]
mov ecx, dword [ecx + 0xc]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], 0
push edx
mov eax, dword [ecx]
call dword [eax + 0x18]
push dword [0x884c50]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
mov esi, dword [edi + 4]
cmp esi, dword [edi + 0xc]
jae 0x6cf5c1
mov dword [esi], 0x77f5ec
rdtsc
mov dword [esp + 0xc], eax
mov ecx, dword [esp + 0xc]
lea eax, [esi + 0xc]
mov dword [esi + 4], ecx
mov dword [edi + 4], eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10

Function at 0x6cfc54
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, ecx
mov dword [esi], vtable.hkBaseObject.0
test al, 1
je 0x6cfca3
test al, 4
jne 0x6cfc98
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0x10
cmp ax, cx
je 0x6cfc7b
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0x10
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4
Function at 0x6cfd14
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, ecx
mov dword [esi], vtable.hkBaseObject.0
test al, 1
je 0x6cfd63
test al, 4
jne 0x6cfd58
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0x10
cmp ax, cx
je 0x6cfd3b
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0x10
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4
Function at 0x6d01b0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x98
mov edx, dword [ebp + 8]
mov eax, ecx
mov dword [esp + 0x18], edx
mov dword [esp + 0x20], 0
push esi
mov edx, dword [edx + 8]
mov esi, dword [ebp + 0xc]
mov dword [esp + 0x20], esi
mov dword [esp + 0x10], eax
mov eax, dword [eax + 8]
mov ecx, dword [esi + 8]
mov dword [esp + 0x2c], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x28], eax
movss xmm4, dword [edx + 0x5c]
movss xmm3, dword [ecx + 0x5c]
mulss xmm4, dword [eax + 0x58]
push edi
movaps xmm2, xmmword [edx + 0x40]
subps xmm2, xmmword [edx + 0x50]
movaps xmm1, xmmword [ecx + 0x50]
movaps xmm0, xmm4
subps xmm1, xmmword [ecx + 0x40]
mulss xmm3, dword [eax + 0x58]
mov edi, dword [esi]
shufps xmm0, xmm0, 0
mulps xmm2, xmm0
mov dword [esp + 0x10], edi
movaps xmm0, xmm3
shufps xmm0, xmm0, 0
mulps xmm1, xmm0
push ecx
push edx
addps xmm2, xmm1
movaps xmmword [esp + 0x98], xmm2
movss xmm1, dword [ecx + 0x9c]
movss xmm0, dword [edx + 0x9c]
mulss xmm1, xmm3
mulss xmm0, xmm4
mulss xmm1, dword [ecx + 0xa0]
lea ecx, [esp + 0x48]
mulss xmm0, dword [edx + 0xa0]
addss xmm1, xmm0
movss dword [esp + 0xa4], xmm1
call fcn.0046efa0
mov esi, dword [edi + 0x1c]
push dword [0x884adc]
mov dword [esp + 0xc], esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
lea ecx, [esi*4 + 0x83]
and ecx, 0xffffff80
mov dword [esp + 0x18], ecx
mov edi, dword [eax + 0xc]
mov dword [esp + 0xc], edi
lea edx, [edi + ecx]
cmp ecx, dword [eax + 8]
jg 0x6d02b1
cmp edx, dword [eax + 0x10]
ja 0x6d02b1
mov dword [eax + 0xc], edx
jmp 0x6d02bf
push ecx
mov ecx, eax
call fcn.0046a3c0
mov edi, eax
mov dword [esp + 0xc], eax
mov eax, dword [esp + 8]
xor esi, esi
xor ecx, ecx
test eax, eax
jle 0x6d02fc
lea edx, [esi + 1]
nop
cmp ecx, 0x100
jae 0x6d02f1
mov edi, dword [esp + 0x10]
mov eax, ecx
shr eax, 5
mov eax, dword [edi + eax*4 + 0x50]
mov edi, dword [esp + 0xc]
and eax, edx
mov eax, dword [esp + 8]
je 0x6d02f5
mov dword [edi + esi*4], ecx
inc esi
inc ecx
rol edx, 1
cmp ecx, eax
jl 0x6d02d0
push dword [ebp + 0x14]
mov eax, dword [esp + 0x14]
add eax, 0x10
mov dword [edi + esi*4], 0xffffffff
push edi
push eax
lea eax, [esp + 0x2c]
push eax
mov eax, dword [esp + 0x24]
add eax, 0x10
push eax
call fcn.006d9470
add esp, 0x14
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [esp + 0x18]
lea edx, [ecx + 0xf]
and edx, 0xfffffff0
cmp ecx, dword [eax + 8]
jg 0x6d0357
lea ecx, [edx + edi]
cmp ecx, dword [eax + 0xc]
jne 0x6d0357
cmp dword [eax + 0x14], edi
je 0x6d0357
mov dword [eax + 0xc], edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
push edx
push edi
mov ecx, eax
call fcn.0046a590
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x6d05d0
Capabilities:
Get thread local storage value

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x18]
mov dword [esi + 0x14], 0
test eax, eax
js 0x6d05fa
and eax, 0x3fffffff
mov ecx, 0x7d8954
shl eax, 2
push eax
mov eax, dword [0x7d8954]
push dword [esi + 0x10]
call dword [eax + 0x10]
mov eax, dword [esp + 8]
mov dword [esi + 0x10], 0
mov dword [esi + 0x18], connect
mov dword [esi], vtable.hkBaseObject.0
test al, 1
je 0x6d0658
test al, 4
jne 0x6d064d
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0x1c
cmp ax, cx
je 0x6d0630
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0x1c
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4

Function at 0x6d06f0
Capabilities:
Get thread local storage value

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x18]
mov dword [esi + 0x14], 0
test eax, eax
js 0x6d071a
and eax, 0x3fffffff
mov ecx, 0x7d8954
shl eax, 2
push eax
mov eax, dword [0x7d8954]
push dword [esi + 0x10]
call dword [eax + 0x10]
mov eax, dword [esp + 8]
mov dword [esi + 0x10], 0
mov dword [esi + 0x18], connect
mov dword [esi], vtable.hkBaseObject.0
test al, 1
je 0x6d0778
test al, 4
jne 0x6d076d
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0x1c
cmp ax, cx
je 0x6d0750
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0x1c
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4
Function at 0x6d1140
Capabilities:
Execute anti-debugging instructions
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x38
push esi
push edi
push dword [0x884c50]
mov edi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
call edi
mov esi, eax
mov ecx, dword [esi + 4]
cmp ecx, dword [esi + 0xc]
jae 0x6d1183
mov dword [ecx], str.LtCvsListAgent
mov dword [ecx + 0xc], str.StcheckHull
rdtsc
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
mov dword [ecx + 4], eax
lea eax, [ecx + 0x10]
mov dword [esi + 4], eax
lea eax, [esp + 0x10]
mov dword [esp + 0x10], vtable.hkpSimpleClosestContactCollector.0
push eax
push eax
push dword [ebp + 0x10]
mov byte [esp + 0x24], 0
push dword [ebp + 0xc]
mov dword [esp + 0x4c], 0x7f7fffee
push dword [ebp + 8]
mov dword [esp + 0x28], 0x7f7fffee
call fcn.006dc560
add esp, 0x14
cmp byte [esp + 0x18], 0
je 0x6d1206
push dword [0x884c50]
call edi
mov dword [esp + 0xc], eax
mov esi, dword [eax + 4]
cmp esi, dword [eax + 0xc]
jae 0x6d11ef
mov dword [esi], str.Stchild
rdtsc
mov dword [esp + 8], eax
mov ecx, dword [esp + 8]
lea eax, [esi + 0xc]
mov dword [esi + 4], ecx
mov ecx, dword [esp + 0xc]
mov dword [ecx + 4], eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.006d0a40
add esp, 0x14
push dword [0x884c50]
call edi
mov edi, eax
mov esi, dword [edi + 4]
cmp esi, dword [edi + 0xc]
jae 0x6d1231
mov dword [esi], 0x77f784
rdtsc
mov dword [esp + 0xc], eax
mov ecx, dword [esp + 0xc]
lea eax, [esi + 0xc]
mov dword [esi + 4], ecx
mov dword [edi + 4], eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x6d1260
Capabilities:
Execute anti-debugging instructions
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0xa8
push esi
push edi
push dword [0x884c50]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
mov ecx, dword [esi + 4]
cmp ecx, dword [esi + 0xc]
jae 0x6d12a4
mov dword [ecx], str.LtCvxList
mov dword [ecx + 0xc], str.StcheckHull
rdtsc
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
mov dword [ecx + 4], eax
lea eax, [ecx + 0x10]
mov dword [esi + 4], eax
mov esi, dword [ebp + 0xc]
lea eax, [esp + 0x18]
mov edi, dword [ebp + 8]
push eax
push dword [ebp + 0x10]
mov dword [esp + 0x20], vtable.hkpFlagCdBodyPairCollector.0
push esi
push edi
mov byte [esp + 0x2c], 0
call fcn.006dcb70
add esp, 0x10
cmp byte [esp + 0x1c], 0
je 0x6d131c
push dword [0x884c50]
mov eax, dword [sym.imp.KERNEL32.dll_TlsGetValue]
call eax
mov ecx, eax
mov dword [esp + 0x10], ecx
mov eax, dword [ecx + 4]
mov dword [esp + 0x14], eax
cmp eax, dword [ecx + 0xc]
jae 0x6d1310
mov dword [eax], str.Stchildren
rdtsc
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0xc]
mov dword [eax + 4], ecx
add eax, 0xc
mov ecx, dword [esp + 0x10]
mov dword [ecx + 4], eax
push dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
push eax
jmp 0x6d13ea
lea eax, [esp + 0x20]
mov dword [esp + 0x20], vtable.hkpClosestCdPointCollector.0
push eax
mov eax, dword [ebp + 0x10]
push eax
push esi
push edi
mov dword [esp + 0x60], 0
mov dword [esp + 0x5c], 0x7f7fffee
mov dword [esp + 0x34], 0x7f7fffee
call fcn.006dce30
add esp, 0x10
cmp dword [esp + 0x50], 0
je 0x6d13f4
mov eax, dword [esi]
movss xmm0, dword [esp + 0x4c]
comiss xmm0, dword [eax + 0x18]
jbe 0x6d13a4
mov ecx, dword [ebp + 0x14]
lea edx, [esp + 0x70]
movaps xmm0, xmmword [esp + 0x30]
movaps xmmword [esp + 0x70], xmm0
movaps xmm0, xmmword [esp + 0x40]
mov eax, dword [ecx]
push edx
mov dword [esp + 0xa4], edi
mov dword [esp + 0xa8], esi
movaps xmmword [esp + 0x84], xmm0
movaps xmmword [esp + 0x94], xmm0
call dword [eax + 4]
jmp 0x6d13f4
push dword [0x884c50]
mov eax, dword [sym.imp.KERNEL32.dll_TlsGetValue]
call eax
mov ecx, eax
mov dword [esp + 0xc], ecx
mov eax, dword [ecx + 4]
mov dword [esp + 0x14], eax
cmp eax, dword [ecx + 0xc]
jae 0x6d13e4
mov dword [eax], str.Stchildren
rdtsc
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov dword [eax + 4], ecx
add eax, 0xc
mov ecx, dword [esp + 0xc]
mov dword [ecx + 4], eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push esi
push edi
call fcn.006d09c0
add esp, 0x10
push dword [0x884c50]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
mov esi, dword [edi + 4]
cmp esi, dword [edi + 0xc]
jae 0x6d1423
mov dword [esi], 0x77f784
rdtsc
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x10]
lea eax, [esi + 0xc]
mov dword [esi + 4], ecx
mov dword [edi + 4], eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x6d1be4
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, ecx
mov dword [esi], vtable.hkBaseObject.0
test al, 1
je 0x6d1c36
test al, 4
jne 0x6d1c28
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0x90
cmp ax, cx
je 0x6d1c0b
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0x90
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4

Function at 0x6d1ca4
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, ecx
mov dword [esi], vtable.hkBaseObject.0
test al, 1
je 0x6d1cf6
test al, 4
jne 0x6d1ce8
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0x90
cmp ax, cx
je 0x6d1ccb
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0x90
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4

Function at 0x6d2100
Capabilities:
Execute anti-debugging instructions
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x228
push esi
push edi
push dword [0x884c50]
mov dword [esp + 0x20], ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
mov esi, dword [edi + 4]
cmp esi, dword [edi + 0xc]
jae 0x6d2141
mov dword [esi], str.TtShapeCollection
rdtsc
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x14]
lea eax, [esi + 0xc]
mov dword [esi + 4], ecx
mov dword [edi + 4], eax
mov esi, dword [ebp + 8]
mov ecx, dword [esi]
mov eax, dword [ecx]
mov eax, dword [eax + 0x10]
call eax
mov ecx, dword [esi + 8]
mov edx, eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x28], ecx
mov dword [esp + 0x18], edx
mov dword [esp + 0x2c], esi
mov ecx, dword [eax + 0x10]
mov edi, dword [eax + 0xc]
sub ecx, 1
mov dword [esp + 0x14], ecx
js 0x6d21ae
mov eax, dword [edx]
lea ecx, [esp + 0x30]
mov esi, dword [edi]
push ecx
push esi
mov eax, dword [eax + 0x14]
mov ecx, edx
call eax
push dword [ebp + 0x14]
mov dword [esp + 0x24], eax
lea edx, [esp + 0x24]
push dword [ebp + 0x10]
mov dword [esp + 0x2c], esi
mov ecx, dword [edi + 4]
push dword [ebp + 0xc]
push edx
mov eax, dword [ecx]
call dword [eax + 0x18]
sub dword [esp + 0x14], 1
lea edi, [edi + 8]
mov edx, dword [esp + 0x18]
jns 0x6d2171
push dword [0x884c50]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
mov esi, dword [edi + 4]
cmp esi, dword [edi + 0xc]
jae 0x6d21dd
mov dword [esi], 0x77f5ec
rdtsc
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 0x18]
lea eax, [esi + 0xc]
mov dword [esi + 4], ecx
mov dword [edi + 4], eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10