joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48f6f0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
cmp dword [ebx + 0x7c], 0
je 0x48f741
movzx eax, word [ebx + 0x80]
test eax, eax
jne 0x48f741
push 0x7d87d8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
dec dword [0x7d87f0]
mov dword [ebx + 0x7c], 0
push 0x7d87f8
call fcn.0048dab0
pop ecx
push 0x7d87d8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0x7d87c0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [ebx + 0x1654], 0
je 0x48f765
push 0x7d87c0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.0048d580
mov dword [ebx + 0x1658], 1
push 0x7d87c0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [ebp + 0xc], 0
je 0x48f788
call dword [sym.imp.USER32.dll_WaitMessage]
jmp 0x48f792
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x7d87c0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [ebx + 0x1658], 0
push 0x7d87c0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [ebx + 0x7c], 0
jne 0x48f805
movzx eax, word [ebx + 0x80]
test eax, eax
jne 0x48f805
push 0x7d87d8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
jmp 0x48f7e4
push 0xffffffffffffffff
push 0x7d87d8
push 0x7d87f8
call fcn.0048db80
add esp, 0xc
mov eax, dword [0x7d87f4]
test eax, eax
jne 0x48f7d0
inc dword [0x7d87f0]
mov dword [ebx + 0x7c], 1
push 0x7d87d8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop ebx
pop ebp
ret
Function at 0x48fb60
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
xor ebx, ebx
mov eax, dword [ebp + 8]
test eax, eax
je 0x48fd07
xor esi, esi
mov eax, dword [ebp + 8]
mov eax, dword [eax]
and eax, 0x400
je 0x48fbaf
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x10]
push eax
call fcn.004a2000
pop ecx
mov dword [ebp - 8], eax
test eax, eax
je 0x48fbd3
mov eax, dword [ebp - 8]
mov esi, dword [eax + 8]
jmp 0x48fbd3
mov eax, dword [ebp + 8]
mov eax, dword [eax]
and eax, 1
je 0x48fbc1
mov eax, dword [ebp + 8]
mov esi, dword [eax + 8]
jmp 0x48fbd3
mov eax, dword [ebp + 8]
mov eax, dword [eax]
and eax, 0x100
je 0x48fbd3
mov eax, dword [ebp + 8]
mov esi, dword [eax + 0x14]
mov eax, esi
test eax, eax
je 0x48fc46
call fcn.0046a920
push esi
call fcn.0046b2e0
pop ecx
call fcn.0046a9c0
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x48fc17
lea eax, [ebp + 0x10]
mov dword [ebp - 8], eax
mov edi, 1
jmp 0x48fc12
mov eax, dword [ebp - 8]
lea eax, [eax + 4]
mov dword [ebp - 8], eax
mov eax, dword [eax - 4]
push eax
call fcn.0046a8b0
pop ecx
inc edi
cmp edi, dword [ebp + 0xc]
jbe 0x48fbfe
movzx eax, word [ebp + 0xc]
push eax
call fcn.00468e20
pop ecx
push 0
call fcn.0049f730
pop ecx
mov ebx, eax
mov eax, dword [ebp - 4]
lea eax, [eax + 0x10]
push eax
push ebx
call fcn.004a44a0
add esp, 8
call fcn.0046bcd0
jmp 0x48fd07
mov eax, dword [ebp + 8]
mov eax, dword [eax]
and eax, 0x1000
je 0x48fcc9
call fcn.0046a920
push 0x7be268
call fcn.0046b2e0
pop ecx
mov eax, dword [ebp + 8]
push eax
call fcn.0046a8b0
pop ecx
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x48fc9d
lea eax, [ebp + 0x10]
mov dword [ebp - 8], eax
mov edi, 1
jmp 0x48fc98
mov eax, dword [ebp - 8]
lea eax, [eax + 4]
mov dword [ebp - 8], eax
mov eax, dword [eax - 4]
push eax
call fcn.0046a8b0
pop ecx
inc edi
cmp edi, dword [ebp + 0xc]
jbe 0x48fc84
movzx eax, word [ebp + 0xc]
push eax
call fcn.00469190
pop ecx
push 0
call fcn.0049f730
pop ecx
mov ebx, eax
mov eax, dword [ebp - 4]
lea eax, [eax + 0x10]
push eax
push ebx
call fcn.004a44a0
add esp, 8
call fcn.0046bcd0
jmp 0x48fd07
mov eax, dword [ebp + 8]
mov eax, dword [eax]
and eax, 0x8000
je 0x48fd07
call fcn.0046a920
mov eax, dword [ebp + 8]
push eax
call fcn.004903d0
pop ecx
test eax, eax
je 0x48fd02
push 0
call fcn.0049f730
pop ecx
mov ebx, eax
mov eax, dword [ebp - 4]
lea eax, [eax + 0x10]
push eax
push ebx
call fcn.004a44a0
add esp, 8
call fcn.0046bcd0
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x48fd10
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
xor ebx, ebx
mov eax, dword [ebp + 8]
test eax, eax
je 0x48fdb3
mov eax, dword [ebp + 8]
push eax
call fcn.004a2000
pop ecx
mov dword [ebp - 8], eax
test eax, eax
je 0x48fdb3
call fcn.0046a920
mov eax, dword [ebp - 8]
mov eax, dword [eax + 8]
push eax
call fcn.0046b2e0
pop ecx
call fcn.0046a9c0
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x48fd89
lea eax, [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov esi, 1
jmp 0x48fd84
mov eax, dword [ebp - 0xc]
lea eax, [eax + 4]
mov dword [ebp - 0xc], eax
mov eax, dword [eax - 4]
push eax
call fcn.0046a8b0
pop ecx
inc esi
cmp esi, dword [ebp + 0xc]
jbe 0x48fd70
movzx eax, word [ebp + 0xc]
push eax
call fcn.00468e20
pop ecx
push 0
call fcn.0049f730
pop ecx
mov ebx, eax
mov eax, dword [ebp - 4]
lea eax, [eax + 0x10]
push eax
push ebx
call fcn.004a44a0
add esp, 8
call fcn.0046bcd0
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4910d0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov eax, dword [ebx + 0x88]
push eax
call fcn.0049f730
pop ecx
mov esi, eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x491109
push eax
mov eax, dword [ebx + 0x88]
push eax
call fcn.004a4960
add esp, 8
mov eax, esi
pop esi
pop ebx
pop ebp
ret

Function at 0x491110
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov esi, dword [ebx + 0x84]
mov eax, dword [ebp + 8]
test eax, eax
je 0x491139
mov edx, dword [ebx + 0x84]
mov dword [eax + 0xc], edx
mov eax, dword [ebp + 8]
mov dword [ebx + 0x84], eax
mov eax, esi
pop esi
pop ebx
pop ebp
ret

Function at 0x4911a0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov dword [ebx + 0x84], 0
mov dword [ebx + 0x8c], 0
mov word [ebx + 0x90], 0
push 0x699f45
call fcn.004a1ea0
pop ecx
mov dword [0x7cd834], eax
test eax, eax
jne 0x4911f9
push 0
push 0
push str.Couldnt_locate_ErrorNew___symbol_in_hb_errInit__
push 0x2328
call fcn.00492ef0
add esp, 0x10
pop ebx
pop ebp
ret
Function at 0x491210
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
push esi
push edi
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
mov eax, dword [esi + 0x30]
mov eax, dword [eax]
mov eax, dword [eax + 0x14]
mov eax, dword [eax + 0xc]
mov edi, dword [eax + 0x18]
mov eax, edi
test eax, eax
je 0x491243
mov eax, dword [edi + 0x20]
mov dword [ebp - 4], eax
jmp 0x49124a
mov dword [ebp - 4], 0
mov eax, dword [0x7cd834]
mov eax, dword [eax + 8]
push eax
call fcn.0046b2e0
pop ecx
call fcn.0046a9c0
push 0
call fcn.00468e20
pop ecx
push 0
call fcn.0049f730
pop ecx
mov ebx, eax
lea eax, [esi + 0x10]
push eax
push ebx
call fcn.004a44a0
add esp, 8
mov eax, dword [ebx]
and eax, 0x8000
je 0x491291
mov eax, dword [ebx + 8]
movzx eax, word [eax + 0xc]
test eax, eax
jne 0x4912a7
push 0
push 0
push str.Couldnt_create_Error_object_in_hb_errNew__
push 0x2328
call fcn.00492ef0
add esp, 0x10
mov eax, dword [ebp - 4]
test eax, eax
je 0x4912b8
push eax
push ebx
call fcn.00492010
add esp, 8
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4915e0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
push esi
push edi
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
call fcn.0046d3e0
test ax, ax
je 0x491608
xor eax, eax
jmp 0x4917fc
cmp dword [0x7be2a0], 0
je 0x491618
xor eax, eax
jmp 0x4917fc
mov eax, dword [0x7da158]
mov dword [ebp - 4], eax
mov dword [0x7da158], 1
call fcn.0048d8d0
mov eax, dword [ebp - 4]
mov dword [0x7da158], eax
xor si, si
mov eax, dword [ebp + 8]
test eax, eax
je 0x4917e3
mov eax, dword [ebx + 0x88]
push eax
call fcn.004a0870
pop ecx
cmp eax, 0x1000
je 0x491676
mov eax, dword [ebp + 8]
push eax
call fcn.0049f7d0
pop ecx
push 0
push 0
push 0
push 0x232a
call fcn.00492ef0
add esp, 0x10
mov eax, dword [0x7d80f0]
cmp dword [ebx + 0x8c], eax
jne 0x4916a0
mov eax, dword [ebp + 8]
push eax
call fcn.0049f7d0
pop ecx
push 0
push 0
push 0
push 0x232b
call fcn.00492ef0
add esp, 0x10
lea eax, [ebx + 0x8c]
inc dword [eax]
mov eax, dword [ebp + 8]
push eax
call fcn.00491ae0
pop ecx
mov word [ebx + 0x90], ax
mov eax, dword [ebx + 0x84]
test eax, eax
je 0x4916f3
mov edx, dword [ebp + 8]
mov dword [eax + 4], edx
mov eax, dword [ebx + 0x84]
mov edx, dword [ebx + 0x88]
mov dword [eax + 0x10], edx
mov eax, dword [ebx + 0x84]
push eax
call dword [eax]
pop ecx
mov edi, eax
mov eax, dword [ebx + 0x84]
mov dword [eax + 4], 0
jmp 0x491747
cmp dword [0x7be2a4], 0
je 0x491730
mov eax, dword [ebx + 0x88]
mov eax, dword [eax + 0x10]
mov edx, dword [0x7be2a8]
mov edx, dword [edx + 0x10]
cmp eax, edx
jne 0x491730
mov eax, dword [ebp + 8]
push eax
call fcn.0046d240
pop ecx
lea eax, [ebx + 0x8c]
dec dword [eax]
call fcn.0048d9a0
xor eax, eax
jmp 0x4917fc
mov eax, dword [ebp + 8]
push eax
push 1
mov eax, dword [ebx + 0x88]
push eax
call fcn.0048fb60
add esp, 0xc
mov edi, eax
lea eax, [ebx + 0x8c]
dec dword [eax]
call fcn.0046d3e0
mov esi, eax
movzx eax, si
cmp eax, 1
jne 0x491794
mov eax, edi
test eax, eax
je 0x49176d
push edi
call fcn.0049f7d0
pop ecx
xor edi, edi
mov eax, dword [ebp + 8]
push eax
call fcn.0049f7d0
pop ecx
mov dword [0x7d80f4], 0
call fcn.0048d9a0
call fcn.0045b7d0
push eax
call fcn.00533dc0
pop ecx
jmp 0x4917ed
movzx eax, si
cmp eax, 2
je 0x4917a1
cmp eax, 4
jne 0x4917b2
mov eax, edi
test eax, eax
je 0x4917ae
push edi
call fcn.0049f7d0
pop ecx
xor edi, edi
jmp 0x4917ed
mov eax, dword [ebp + 8]
push eax
call fcn.004920f0
pop ecx
movzx eax, ax
and eax, 2
jne 0x4917ed
mov eax, dword [ebp + 8]
push eax
call fcn.0049f7d0
pop ecx
push 0
push 0
push 0
push 0x2329
call fcn.00492ef0
add esp, 0x10
jmp 0x4917ed
push 0
call fcn.0049f730
pop ecx
mov edi, eax
movzx eax, si
cmp eax, 1
je 0x4917fa
call fcn.0048d9a0
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x491a50
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
lea edx, [0x7beb4c]
cmp eax, edx
jne 0x491a90
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
mov eax, dword [eax]
push eax
call fcn.004a00d0
pop ecx
mov dword [ebp - 8], eax
test eax, eax
je 0x491a90
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ebp + 0xc], eax
push 0x699e94
call fcn.004a2190
pop ecx
push eax
call fcn.0046b2e0
pop ecx
mov eax, dword [ebp + 8]
push eax
call fcn.0046a8b0
pop ecx
mov eax, dword [ebp + 0xc]
mov edx, eax
or eax, 0xffffffff
inc eax
cmp byte [edx + eax], 0
jne 0x491ab4
push eax
mov eax, dword [ebp + 0xc]
push eax
call fcn.0046b270
add esp, 8
push 1
call fcn.00469190
pop ecx
mov eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret

Function at 0x4920f0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
xor si, si
push str.CANRETRY
call fcn.004a1ea0
pop ecx
mov eax, dword [eax + 8]
push eax
call fcn.0046b2e0
pop ecx
mov eax, dword [ebp + 8]
push eax
call fcn.0046a8b0
pop ecx
push 0
call fcn.00469190
pop ecx
lea eax, [ebx + 0x10]
push eax
call fcn.0049fc50
pop ecx
test eax, eax
je 0x492143
movzx eax, si
or eax, 1
mov esi, eax
push str.CANSUBSTITUTE
call fcn.004a1ea0
pop ecx
mov eax, dword [eax + 8]
push eax
call fcn.0046b2e0
pop ecx
mov eax, dword [ebp + 8]
push eax
call fcn.0046a8b0
pop ecx
push 0
call fcn.00469190
pop ecx
lea eax, [ebx + 0x10]
push eax
call fcn.0049fc50
pop ecx
test eax, eax
je 0x492180
movzx eax, si
or eax, 2
mov esi, eax
push str.CANDEFAULT
call fcn.004a1ea0
pop ecx
mov eax, dword [eax + 8]
push eax
call fcn.0046b2e0
pop ecx
mov eax, dword [ebp + 8]
push eax
call fcn.0046a8b0
pop ecx
push 0
call fcn.00469190
pop ecx
lea eax, [ebx + 0x10]
push eax
call fcn.0049fc50
pop ecx
test eax, eax
je 0x4921bd
movzx eax, si
or eax, 4
mov esi, eax
movzx eax, si
pop esi
pop ebx
pop ebp
ret
Function at 0x492330
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
push ebx
push esi
push edi
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
call fcn.0046d3e0
movzx eax, ax
test eax, eax
je 0x492404
call fcn.0046d3e0
mov dword [ebp - 0x94], eax
mov edx, dword [ebp + 0x18]
test edx, edx
je 0x492371
mov edi, dword [ebp + 0x18]
jmp 0x492380
mov edx, dword [ebp + 0x10]
lea edx, [edx + 0x26]
push edx
call fcn.004aafb0
pop ecx
mov edi, eax
push edi
mov eax, dword [ebp + 0x1c]
test eax, eax
je 0x492390
mov dword [ebp - 0x8c], eax
jmp 0x49239c
lea eax, [0x699eba]
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 0x8c]
push eax
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x4923b6
mov dword [ebp - 0x90], eax
jmp 0x4923c2
lea eax, [0x699d39]
mov dword [ebp - 0x90], eax
mov eax, dword [ebp - 0x90]
push eax
movzx eax, word [ebp - 0x94]
push eax
push str.hb_vmRequestQuery____i_for:__s__i__s__s_n
push str.error.log
call fcn.004a9610
add esp, 0x1c
mov eax, dword [ebp + 0x18]
push eax
mov eax, dword [ebp + 0x1c]
push eax
push str.hb_vmRequestQuery___is_set___Couldnt_create_error__s__s
push 0x2328
call fcn.00492ef0
add esp, 0x10
xor eax, eax
jmp 0x492527
call fcn.00491210
mov ebx, eax
movzx eax, word [ebp + 8]
push eax
push ebx
call fcn.00491bc0
add esp, 8
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x492425
mov edi, dword [ebp + 0xc]
jmp 0x49242b
lea edi, [0x699d39]
push edi
push ebx
call fcn.00491ce0
add esp, 8
movzx eax, word [ebp + 0x10]
push eax
push ebx
call fcn.004919c0
add esp, 8
movzx eax, word [ebp + 0x14]
push eax
push ebx
call fcn.00491c50
add esp, 8
mov eax, dword [ebp + 0x18]
test eax, eax
je 0x492460
mov dword [ebp - 0x8c], eax
jmp 0x492473
mov eax, dword [ebp + 0x10]
lea eax, [eax + 0x26]
push eax
call fcn.004aafb0
pop ecx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 0x8c]
push eax
push ebx
call fcn.00491860
add esp, 8
mov eax, dword [ebp + 0x1c]
test eax, eax
je 0x492492
mov dword [ebp - 0x90], eax
jmp 0x49249e
lea eax, [0x699eba]
mov dword [ebp - 0x90], eax
mov eax, dword [ebp - 0x90]
push eax
push ebx
call fcn.00491a50
add esp, 8
movzx eax, word [ebp + 0x20]
push eax
push ebx
call fcn.00491b30
add esp, 8
movzx eax, word [ebp + 0x24]
push eax
push ebx
call fcn.004921d0
add esp, 8
push 0
lea eax, [ebp - 2]
push eax
lea eax, [ebp - 0x85]
push eax
push 0
call fcn.0049cc00
add esp, 0x10
push eax
push ebx
call fcn.00491d80
add esp, 8
movzx eax, word [ebp - 2]
push eax
push ebx
call fcn.00491e20
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push ebx
call fcn.00491eb0
add esp, 8
mov eax, dword [esi + 0x68]
push eax
push ebx
call fcn.00491fd0
add esp, 8
call fcn.0048d4d0
push eax
push ebx
call fcn.00491f40
add esp, 8
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x492870
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 0xc], eax
push 0
push 0
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
push 0x699d39
push 2
call fcn.00492330
add esp, 0x20
mov esi, eax
mov eax, dword [ebp + 0x18]
test eax, eax
jne 0x4928bb
xor ebx, ebx
jmp 0x492935
mov eax, dword [ebp + 0x18]
cmp eax, 0xffffffff
jne 0x4928e2
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x30]
mov eax, dword [eax]
movzx eax, word [eax + 0xe]
test eax, eax
jne 0x4928d9
xor ebx, ebx
jmp 0x492935
call fcn.004a4260
mov ebx, eax
jmp 0x492935
mov eax, dword [ebp + 0x18]
cmp eax, 0xfffffffe
jne 0x4928f5
call fcn.004a4300
mov ebx, eax
jmp 0x492935
mov eax, dword [ebp + 0x18]
push eax
call fcn.0049f7f0
pop ecx
mov ebx, eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 8], eax
mov edi, 1
jmp 0x492930
mov eax, dword [ebp - 8]
lea eax, [eax + 4]
mov dword [ebp - 8], eax
mov eax, dword [eax - 4]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x49292f
mov eax, dword [ebp - 0x10]
push eax
push edi
push ebx
call fcn.004a2c30
add esp, 0xc
inc edi
cmp edi, dword [ebp + 0x18]
jbe 0x49290e
mov eax, ebx
test eax, eax
je 0x49296a
push 0x699d73
call fcn.004a2190
pop ecx
push eax
call fcn.0046b2e0
pop ecx
push esi
call fcn.0046a8b0
pop ecx
push ebx
call fcn.0046a8b0
pop ecx
push 1
call fcn.00469190
pop ecx
push ebx
call fcn.0049f7d0
pop ecx
push esi
call fcn.004912d0
pop ecx
mov word [ebp - 2], ax
push esi
call fcn.0049f7d0
pop ecx
movzx eax, word [ebp - 2]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x492990
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 0xc], eax
movzx eax, word [ebp + 0x1c]
push eax
movzx eax, word [ebp + 0x18]
push eax
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
push 0x699d39
push 2
call fcn.00492330
add esp, 0x20
mov esi, eax
mov eax, dword [ebp + 0x20]
test eax, eax
jne 0x4929e1
xor ebx, ebx
jmp 0x492a5b
mov eax, dword [ebp + 0x20]
cmp eax, 0xffffffff
jne 0x492a08
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x30]
mov eax, dword [eax]
movzx eax, word [eax + 0xe]
test eax, eax
jne 0x4929ff
xor ebx, ebx
jmp 0x492a5b
call fcn.004a4260
mov ebx, eax
jmp 0x492a5b
mov eax, dword [ebp + 0x20]
cmp eax, 0xfffffffe
jne 0x492a1b
call fcn.004a4300
mov ebx, eax
jmp 0x492a5b
mov eax, dword [ebp + 0x20]
push eax
call fcn.0049f7f0
pop ecx
mov ebx, eax
lea eax, [ebp + 0x24]
mov dword [ebp - 8], eax
mov edi, 1
jmp 0x492a56
mov eax, dword [ebp - 8]
lea eax, [eax + 4]
mov dword [ebp - 8], eax
mov eax, dword [eax - 4]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x492a55
mov eax, dword [ebp - 0x10]
push eax
push edi
push ebx
call fcn.004a2c30
add esp, 0xc
inc edi
cmp edi, dword [ebp + 0x20]
jbe 0x492a34
mov eax, ebx
test eax, eax
je 0x492a90
push 0x699d73
call fcn.004a2190
pop ecx
push eax
call fcn.0046b2e0
pop ecx
push esi
call fcn.0046a8b0
pop ecx
push ebx
call fcn.0046a8b0
pop ecx
push 1
call fcn.00469190
pop ecx
push ebx
call fcn.0049f7d0
pop ecx
push esi
call fcn.004912d0
pop ecx
mov word [ebp - 2], ax
push esi
call fcn.0049f7d0
pop ecx
movzx eax, word [ebp - 2]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x492ab0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 0xc], eax
push 0
push 0
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
push 0x699d39
push 2
call fcn.00492530
add esp, 0x20
mov esi, eax
mov eax, dword [ebp + 0x18]
test eax, eax
jne 0x492afb
xor ebx, ebx
jmp 0x492b75
mov eax, dword [ebp + 0x18]
cmp eax, 0xffffffff
jne 0x492b22
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x30]
mov eax, dword [eax]
movzx eax, word [eax + 0xe]
test eax, eax
jne 0x492b19
xor ebx, ebx
jmp 0x492b75
call fcn.004a4260
mov ebx, eax
jmp 0x492b75
mov eax, dword [ebp + 0x18]
cmp eax, 0xfffffffe
jne 0x492b35
call fcn.004a4300
mov ebx, eax
jmp 0x492b75
mov eax, dword [ebp + 0x18]
push eax
call fcn.0049f7f0
pop ecx
mov ebx, eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 8], eax
mov edi, 1
jmp 0x492b70
mov eax, dword [ebp - 8]
lea eax, [eax + 4]
mov dword [ebp - 8], eax
mov eax, dword [eax - 4]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x492b6f
mov eax, dword [ebp - 0x10]
push eax
push edi
push ebx
call fcn.004a2c30
add esp, 0xc
inc edi
cmp edi, dword [ebp + 0x18]
jbe 0x492b4e
mov eax, ebx
test eax, eax
je 0x492baa
push 0x699d73
call fcn.004a2190
pop ecx
push eax
call fcn.0046b2e0
pop ecx
push esi
call fcn.0046a8b0
pop ecx
push ebx
call fcn.0046a8b0
pop ecx
push 1
call fcn.00469190
pop ecx
push ebx
call fcn.0049f7d0
pop ecx
push esi
call fcn.004915e0
pop ecx
mov dword [ebp - 4], eax
push esi
call fcn.0049f7d0
pop ecx
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x492c70
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 0xc], eax
push 0
push 0
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
push 0x699d39
push 2
call fcn.00492530
add esp, 0x20
mov esi, eax
mov eax, dword [ebp + 0x18]
test eax, eax
jne 0x492cbb
xor ebx, ebx
jmp 0x492d35
mov eax, dword [ebp + 0x18]
cmp eax, 0xffffffff
jne 0x492ce2
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x30]
mov eax, dword [eax]
movzx eax, word [eax + 0xe]
test eax, eax
jne 0x492cd9
xor ebx, ebx
jmp 0x492d35
call fcn.004a4260
mov ebx, eax
jmp 0x492d35
mov eax, dword [ebp + 0x18]
cmp eax, 0xfffffffe
jne 0x492cf5
call fcn.004a4300
mov ebx, eax
jmp 0x492d35
mov eax, dword [ebp + 0x18]
push eax
call fcn.0049f7f0
pop ecx
mov ebx, eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 8], eax
mov edi, 1
jmp 0x492d30
mov eax, dword [ebp - 8]
lea eax, [eax + 4]
mov dword [ebp - 8], eax
mov eax, dword [eax - 4]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x492d2f
mov eax, dword [ebp - 0x10]
push eax
push edi
push ebx
call fcn.004a2c30
add esp, 0xc
inc edi
cmp edi, dword [ebp + 0x18]
jbe 0x492d0e
mov eax, ebx
test eax, eax
je 0x492d6a
push 0x699d73
call fcn.004a2190
pop ecx
push eax
call fcn.0046b2e0
pop ecx
push esi
call fcn.0046a8b0
pop ecx
push ebx
call fcn.0046a8b0
pop ecx
push 1
call fcn.00469190
pop ecx
push ebx
call fcn.0049f7d0
pop ecx
push esi
call fcn.004915e0
pop ecx
mov dword [ebp - 4], eax
push esi
call fcn.0049f7d0
pop ecx
mov eax, dword [ebp - 4]
test eax, eax
je 0x492d90
push eax
call fcn.004a4540
pop ecx
push eax
call fcn.0049f7d0
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret