joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4fb670
Capabilities:
Execute anti-debugging instructions
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x24
push ebx
push esi
push edi
push dword [0x884c50]
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov edi, dword [ebx + 4]
cmp edi, dword [ebx + 0xc]
jae 0x4fb6ad
mov dword [edi], str.TtPhysics
rdtsc
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 0x18]
lea eax, [edi + 0xc]
mov dword [edi + 4], ecx
mov dword [ebx + 4], eax
cmp dword [esi + 0x28], 0
je 0x4fb6c7
mov ecx, esi
call fcn.004fc1a0
mov ebx, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
jmp 0x4fb7dc
movss xmm0, dword [esi + 0x18]
movaps xmm1, xmm0
movss dword [esp + 0x20], xmm0
addss xmm1, dword [esi + 0x1c]
movss dword [esp + 0x24], xmm1
subss xmm1, xmm0
xorps xmm0, xmm0
ucomiss xmm1, xmm0
movss dword [esp + 0x28], xmm1
lahf
test ah, 0x44
jnp 0x4fb702
movss xmm0, dword [0x718824]
divss xmm0, xmm1
mov eax, dword [esi]
lea ecx, [esp + 0x20]
push ecx
mov ecx, esi
movss dword [esp + 0x30], xmm0
call dword [eax + 0x44]
cmp dword [0x8d7868], 1
jne 0x4fb734
mov ebx, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [esi + 0x28], 2
mov esi, 2
jmp 0x4fb7dc
movss xmm0, dword [esi + 0x18]
addss xmm0, dword [esi + 0x1c]
mov ecx, dword [esi + 0xc]
movss dword [esi + 0x18], xmm0
call fcn.005104e0
mov eax, dword [esi + 0xc]
mov ebx, dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp dword [eax + 0x18c], 0
je 0x4fb7cf
push dword [0x884c50]
call ebx
mov dword [esp + 0x1c], eax
mov edi, dword [eax + 4]
cmp edi, dword [eax + 0xc]
jae 0x4fb78e
mov dword [edi], str.TtPostCollideCB
rdtsc
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 0x18]
lea eax, [edi + 0xc]
mov dword [edi + 4], ecx
mov ecx, dword [esp + 0x1c]
mov dword [ecx + 4], eax
lea eax, [esp + 0x20]
push eax
push dword [esi + 0xc]
call fcn.005286d0
add esp, 8
push dword [0x884c50]
call ebx
mov dword [esp + 0x18], eax
mov edi, dword [eax + 4]
cmp edi, dword [eax + 0xc]
jae 0x4fb7cf
mov dword [edi], 0x77f5ec
rdtsc
mov dword [esp + 0x1c], eax
mov ecx, dword [esp + 0x1c]
lea eax, [edi + 0xc]
mov dword [edi + 4], ecx
mov ecx, dword [esp + 0x18]
mov dword [ecx + 4], eax
mov byte [esi + 0x10], 1
mov dword [esi + 0x28], 0
xor esi, esi
push dword [0x884c50]
call ebx
mov ebx, eax
mov edi, dword [ebx + 4]
cmp edi, dword [ebx + 0xc]
jae 0x4fb807
mov dword [edi], 0x77f5ec
rdtsc
mov dword [esp + 0x1c], eax
mov ecx, dword [esp + 0x1c]
mov dword [edi + 4], ecx
lea ecx, [edi + 0xc]
mov dword [ebx + 4], ecx
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4fb811
Capabilities:
Execute anti-debugging instructions
Get thread local storage value

Disassembly:
push ecx
push esi
mov esi, ecx
call fcn.004fcb70
fstp dword [esp + 4]
movss xmm0, dword [esp + 4]
comiss xmm0, dword [esi + 0x20]
movss dword [esi + 0x14], xmm0
jb 0x4fb8b7
mov eax, dword [esi + 0xc]
cmp dword [eax + 0x174], 0
je 0x4fb8b7
push ebx
push edi
push dword [0x884c50]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov edi, dword [ebx + 4]
cmp edi, dword [ebx + 0xc]
jae 0x4fb86f
mov dword [edi], str.TtPostSimCb
rdtsc
mov dword [esp + 0xc], eax
mov ecx, dword [esp + 0xc]
lea eax, [edi + 0xc]
mov dword [edi + 4], ecx
mov dword [ebx + 4], eax
push dword [esi + 0xc]
call fcn.00528550
add esp, 4
push dword [0x884c50]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov edi, dword [ebx + 4]
cmp edi, dword [ebx + 0xc]
jae 0x4fb8a9
mov dword [edi], 0x77f5ec
rdtsc
mov dword [esp + 0xc], eax
mov ecx, dword [esp + 0xc]
lea eax, [edi + 0xc]
mov dword [edi + 4], ecx
mov dword [ebx + 4], eax
pop edi
pop ebx
mov dword [esi + 0x28], 0
xor eax, eax
pop esi
pop ecx
ret
mov dword [esi + 0x28], 0
xor eax, eax
pop esi
pop ecx
ret

Function at 0x4fb930
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x8c
push esi
mov esi, dword [ebp + 0x10]
mov dword [esp + 0xc], ecx
lea ecx, [esp + 0x10]
mov eax, dword [esi + 0x78]
push eax
movups xmm0, xmmword [eax]
movups xmmword [esp + 0x14], xmm0
movups xmm0, xmmword [eax + 0x10]
movups xmmword [esp + 0x24], xmm0
movups xmm0, xmmword [eax + 0x20]
movups xmmword [esp + 0x34], xmm0
movups xmm0, xmmword [eax + 0x30]
movups xmmword [esp + 0x44], xmm0
movups xmm0, xmmword [eax + 0x40]
mov dword [esp + 0x78], 0
movups xmmword [esp + 0x54], xmm0
call fcn.004fd5b0
mov eax, dword [ebp + 0x14]
push esi
push dword [ebp + 0xc]
movups xmm0, xmmword [eax]
inc dword [esi + 0x94]
mov esi, dword [ebp + 8]
push esi
movups xmmword [esp + 0x6c], xmm0
call fcn.004fba30
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x1c]
add esp, 0xc
push dword [ebp + 0x18]
push eax
push dword [ebp + 0xc]
push esi
call fcn.004fbfb0
mov esi, dword [ebp + 0x10]
add dword [esi + 0x94], 0xffffffff
jne 0x4fb9f9
cmp byte [esi + 0x9c], 0
jne 0x4fb9f9
cmp dword [esi + 0x8c], 0
je 0x4fb9e0
mov ecx, esi
call fcn.00510540
cmp dword [esi + 0xa4], 1
jne 0x4fb9f9
cmp dword [esi + 0x90], 0
je 0x4fb9f9
mov ecx, esi
call fcn.00510560
cmp dword [esp + 0x74], 0
je 0x4fba1d
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push 0x200
push dword [esp + 0x78]
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop esi
mov esp, ebp
pop ebp
ret 0x14
Function at 0x4fc1a0
Capabilities:
Execute anti-debugging instructions
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x14
push ebx
push esi
push edi
mov esi, ecx
push 1
push 0
mov ecx, dword [esi + 0xc]
call fcn.0050caa0
cmp dword [esi + 0x28], 3
jne 0x4fc1cc
movss xmm0, dword [esi + 0x14]
movss xmm1, dword [esi + 0x18]
jmp 0x4fc1da
movss xmm0, dword [esi + 0x18]
movss xmm1, dword [esi + 0x1c]
addss xmm1, xmm0
movss dword [esp + 0x14], xmm1
subss xmm1, xmm0
movss dword [esp + 0x10], xmm0
xorps xmm0, xmm0
ucomiss xmm1, xmm0
movss dword [esp + 0x18], xmm1
lahf
test ah, 0x44
jnp 0x4fc208
movss xmm0, dword [0x718824]
divss xmm0, xmm1
mov eax, dword [esi]
lea ecx, [esp + 0x10]
push ecx
mov ecx, esi
movss dword [esp + 0x20], xmm0
call dword [eax + 0x44]
cmp dword [0x8d7868], 1
jne 0x4fc25c
push dword [0x884c50]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov edi, dword [ebx + 4]
cmp edi, dword [ebx + 0xc]
jae 0x4fc252
mov dword [edi], 0x77f5ec
rdtsc
mov dword [esp + 0xc], eax
mov ecx, dword [esp + 0xc]
lea eax, [edi + 0xc]
mov dword [edi + 4], ecx
mov dword [ebx + 4], eax
mov eax, dword [esi + 0x28]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [esi + 0x28], 2
jne 0x4fc2f3
movss xmm0, dword [esi + 0x1c]
addss xmm0, dword [esi + 0x18]
mov eax, dword [esi + 0xc]
movss dword [esi + 0x18], xmm0
cmp dword [eax + 0x18c], 0
je 0x4fc2ef
push dword [0x884c50]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov edi, dword [ebx + 4]
cmp edi, dword [ebx + 0xc]
jae 0x4fc2b0
mov dword [edi], str.TtPostCollideCB
rdtsc
mov dword [esp + 0xc], eax
mov ecx, dword [esp + 0xc]
lea eax, [edi + 0xc]
mov dword [edi + 4], ecx
mov dword [ebx + 4], eax
lea eax, [esp + 0x10]
push eax
push dword [esi + 0xc]
call fcn.005286d0
add esp, 8
push dword [0x884c50]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov edi, dword [ebx + 4]
cmp edi, dword [ebx + 0xc]
jae 0x4fc2ef
mov dword [edi], 0x77f5ec
rdtsc
mov dword [esp + 0xc], eax
mov ecx, dword [esp + 0xc]
lea eax, [edi + 0xc]
mov dword [edi + 4], ecx
mov dword [ebx + 4], eax
mov byte [esi + 0x10], 1
pop edi
mov dword [esi + 0x28], 0
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4fd780
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
push esi
mov edi, ecx
call fcn.004fb460
mov dword [edi], vtable.hkpContinuousSimulation.0
lea ebx, [edi + 0x30]
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], connect
mov dword [edi + 0x3c], 0
mov dword [edi + 0x40], 0
mov dword [edi + 0x44], 0xffffffff
mov byte [edi + 0x10], 1
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push 0x10
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, 0x10
mov word [eax + 4], cx
mov ecx, eax
call fcn.0054ab90
mov dword [edi + 0x48], eax
mov dword [edi + 0x4c], 0
mov eax, dword [ebx + 8]
mov ecx, dword [esi + 0x344]
and eax, 0x3fffffff
cmp eax, ecx
jge 0x4fd81f
add eax, eax
cmp ecx, eax
push 0x70
cmovl ecx, eax
push ecx
push ebx
push 0x7d8954
call fcn.00467b80
add esp, 0x10
mov eax, edi
pop edi
pop esi
pop ebx
ret 4
Function at 0x4fe5d0
Capabilities:
Execute anti-debugging instructions
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
mov eax, 0x30b8
call fcn.00607e10
push esi
push edi
push dword [0x884c50]
mov dword [esp + 0x28], ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
mov esi, dword [edi + 4]
cmp esi, dword [edi + 0xc]
jae 0x4fe615
mov dword [esi], str.TtNarrowPhase
rdtsc
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 0x18]
lea eax, [esi + 0xc]
mov dword [esi + 4], ecx
mov dword [edi + 4], eax
mov ecx, dword [ebp + 8]
mov dword [esp + 0x3060], 0x7f7fffee
mov dword [esp + 0x3080], 0
mov dword [esp + 0x3084], 0
lea eax, [ecx + 0x70]
mov dword [esp + 0x34], ecx
mov dword [esp + 0x28], eax
lea eax, [ecx + 0x5c]
mov dword [esp + 0x2c], eax
xor eax, eax
mov dword [esp + 0x18], eax
mov edi, dword [esp + eax*4 + 0x28]
xor edx, edx
mov ecx, dword [edi + 8]
test ecx, ecx
jle 0x4fe764
mov eax, dword [edi + 4]
mov esi, dword [eax + edx*4]
inc edx
mov dword [esp + 0x14], edx
cmp edx, ecx
jne 0x4fe678
movzx edi, word [edi]
add edi, esi
jmp 0x4fe67e
lea edi, [esi + 0x200]
cmp esi, edi
jae 0x4fe751
mov eax, dword [esi + 0x10]
movsx ecx, byte [esi + 0xc]
mov edx, dword [ebp + 0xc]
add ecx, 0x73
prefetchnta byte [esi + 0x80]
mov dword [esp + 0x20], eax
mov eax, dword [esi + 0x14]
mov dword [esp + 0x1c], eax
mov eax, dword [esi + 8]
shl ecx, 6
prefetchnta byte [eax]
mov eax, dword [edx]
add eax, ecx
mov dword [edx + 0x60], eax
mov eax, dword [eax + 0x10]
mov dword [edx + 0x18], eax
lea eax, [esp + 0x40]
mov dword [esp + 0x30], eax
lea eax, [esp + 0x30]
mov dword [esp + 0x3060], 0x7f7fffee
mov dword [esp + 0x30b0], 0
push dword [esi + 8]
push eax
push edx
push esi
call fcn.006ad820
add esp, 0x10
cmp dword [0x8d7868], 1
je 0x4fe7aa
lea eax, [esp + 0x40]
cmp dword [esp + 0x30], eax
je 0x4fe71a
mov ecx, dword [esi + 8]
lea edx, [esp + 0x30]
push edx
push dword [ebp + 0xc]
push dword [esp + 0x24]
mov eax, dword [ecx]
push dword [esp + 0x2c]
call dword [eax + 0x18]
movss xmm0, dword [esp + 0x3060]
ucomiss xmm0, dword [0x77fe14]
lahf
test ah, 0x44
jnp 0x4fe73f
mov ecx, dword [esp + 0x24]
lea eax, [esp + 0x30]
push esi
push eax
call fcn.004fedf0
movzx eax, byte [esi + 3]
add esi, eax
cmp esi, edi
jb 0x4fe686
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov edi, dword [esp + eax*4 + 0x28]
mov ecx, dword [edi + 8]
cmp edx, ecx
jl 0x4fe662
inc eax
mov dword [esp + 0x18], eax
cmp eax, 2
jl 0x4fe651
push dword [0x884c50]
mov eax, dword [sym.imp.KERNEL32.dll_TlsGetValue]
call eax
mov edi, eax
mov esi, dword [edi + 4]
cmp esi, dword [edi + 0xc]
jae 0x4fe7a2
mov dword [esi], 0x77f5ec
rdtsc
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x14]
lea eax, [esi + 0xc]
mov dword [esi + 4], ecx
mov dword [edi + 4], eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
push dword [0x884c50]
mov eax, dword [sym.imp.KERNEL32.dll_TlsGetValue]
call eax
mov edi, eax
mov esi, dword [edi + 4]
cmp esi, dword [edi + 0xc]
jae 0x4fe7a2
mov dword [esi], 0x77f5ec
rdtsc
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x14]
lea eax, [esi + 0xc]
mov dword [esi + 4], ecx
mov dword [edi + 4], eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x500520
Capabilities:
Execute anti-debugging instructions
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
mov eax, 0x3098
call fcn.00607e10
push esi
push edi
push dword [0x884c50]
mov dword [esp + 0x10], ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
mov esi, dword [edi + 4]
cmp esi, dword [edi + 0xc]
jae 0x500565
mov dword [esi], str.TtNarrowPhaseTOI
rdtsc
mov dword [esp + 8], eax
mov ecx, dword [esp + 8]
lea eax, [esi + 0xc]
mov dword [esi + 4], ecx
mov dword [edi + 4], eax
xor eax, eax
mov dword [esp + 8], eax
cmp dword [ebp + 0xc], eax
jle 0x50066e
mov esi, dword [ebp + 0x10]
nop word [eax + eax]
mov ecx, dword [ebp + 8]
mov dword [esp + 0x3060], 0
mov dword [esp + 0x3064], 0
mov dword [esp + 0x3040], 0x7f7fffee
mov edi, dword [ecx + eax*4]
mov eax, dword [ebp + 0x14]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x20]
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0x18]
mov dword [esp + 0x3090], 0
sub eax, 0
je 0x5005e5
sub eax, 1
je 0x5005dc
sub eax, 1
jne 0x5005f4
mov eax, dword [esi]
add eax, 0x1e80
jmp 0x5005f1
mov eax, dword [esi]
add eax, 0x1d00
jmp 0x5005f1
movsx eax, byte [edi + 0xc]
add eax, 0x73
shl eax, 6
add eax, dword [esi]
mov dword [esi + 0x60], eax
movsx ecx, byte [edi + 0xc]
mov eax, dword [esi]
shl ecx, 6
mov eax, dword [ecx + eax + 0x1cd0]
mov dword [esi + 0x18], eax
lea eax, [esp + 0x10]
push dword [edi + 8]
push eax
push esi
push edi
call fcn.006ad820
lea eax, [esp + 0x30]
add esp, 0x10
cmp dword [esp + 0x10], eax
je 0x500637
mov ecx, dword [edi + 8]
lea edx, [esp + 0x10]
push edx
push esi
push dword [edi + 0x14]
mov eax, dword [ecx]
push dword [edi + 0x10]
call dword [eax + 0x18]
movss xmm0, dword [esp + 0x3040]
ucomiss xmm0, dword [0x77fe14]
lahf
test ah, 0x44
jnp 0x50065c
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x10]
push edi
push eax
call fcn.004fedf0
mov eax, dword [esp + 8]
inc eax
mov dword [esp + 8], eax
cmp eax, dword [ebp + 0xc]
jl 0x500580
push dword [0x884c50]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
mov esi, dword [edi + 4]
cmp esi, dword [edi + 0xc]
jae 0x50069d
mov dword [esi], 0x77f5ec
rdtsc
mov dword [esp + 0xc], eax
mov ecx, dword [esp + 0xc]
lea eax, [esi + 0xc]
mov dword [esi + 4], ecx
mov dword [edi + 4], eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x14
Function at 0x502750
Capabilities:
Get thread local storage value

Disassembly:
push esi
mov esi, ecx
call fcn.004fd830
mov eax, dword [esp + 8]
test al, 1
je 0x5027a2
test al, 4
jne 0x502797
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0x50
cmp ax, cx
je 0x50277a
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0x50
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4
Function at 0x505354
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, ecx
mov dword [esi], vtable.hkpBroadPhaseListener.0
test al, 1
je 0x50538d
test al, 4
jne 0x505382
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push 8
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
mov eax, esi
pop esi
ret 4
push 8
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4

Function at 0x5053a4
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, ecx
mov dword [esi], vtable.hkpBroadPhaseListener.0
test al, 1
je 0x5053dd
test al, 4
jne 0x5053d2
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push 8
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
mov eax, esi
pop esi
ret 4
push 8
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4

Function at 0x505420
Capabilities:
Get thread local storage value

Disassembly:
push esi
mov esi, ecx
call fcn.005029f0
mov eax, dword [esp + 8]
test al, 1
je 0x505475
test al, 4
jne 0x505467
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0x180
cmp ax, cx
je 0x50544a
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0x180
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4

Function at 0x506280
Capabilities:
Get thread local storage value

Disassembly:
push ebx
mov ebx, ecx
push esi
push edi
push ebx
mov dword [ebx], vtable.hkpConstraintInstance.0
call fcn.00532590
mov ecx, dword [ebx + 0x14]
add esp, 4
test ecx, ecx
je 0x5062a0
call fcn.0045c160
mov ecx, dword [ebx + 0x18]
test ecx, ecx
je 0x5062ac
call fcn.0045c160
push ebp
mov ebp, dword [ebx + 0x10]
test ebp, ebp
je 0x5062e6
cmp word [ebp], 0x1a
jb 0x5062e6
nop dword [eax + eax]
push dword [0x884adc]
mov edi, ebp
mov ebp, dword [ebp + 0x14]
movzx esi, word [edi + 0x10]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
push edi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
cmp word [ebp], 0x1a
jae 0x5062c0
mov ecx, dword [ebx + 0xc]
pop ebp
test ecx, ecx
je 0x5062f3
call fcn.0045c160
lea ecx, [ebx + 0x28]
call fcn.0045d990
movzx edi, word [ebx + 0x26]
test edi, 0x8000
jne 0x50632d
push dword [0x884adc]
mov esi, dword [ebx + 0x20]
and edi, 0x3fff
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [eax + 0x2c]
lea eax, [edi*4]
push eax
push esi
mov edx, dword [ecx]
call dword [edx + 8]
pop edi
pop esi
mov dword [ebx], vtable.hkBaseObject.0
pop ebx
ret
Function at 0x506340
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [esp + 0xc]
push ebx
push esi
push edi
mov edi, ecx
test eax, eax
jne 0x506396
lea eax, [esp + 0x18]
push eax
call fcn.005064f0
cmp byte [eax], 0
je 0x5063f5
push dword [edi + 0xc]
call fcn.00533c90
add esp, 4
mov esi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push 0x38
mov ecx, dword [eax + 0x2c]
mov edx, dword [ecx]
call dword [edx + 4]
mov ecx, 0x38
mov word [eax + 4], cx
movzx ecx, byte [edi + 0x1c]
push ecx
push esi
push 0
jmp 0x5063df
cmp eax, 1
jne 0x5063f5
push dword [edi + 0xc]
call fcn.00533b50
mov esi, eax
add esp, 4
test esi, esi
jne 0x5063b6
mov esi, dword [edi + 0xc]
mov ecx, esi
call fcn.0045c0c0
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push 0x38
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, 0x38
mov word [eax + 4], cx
movzx ecx, byte [edi + 0x1c]
push ecx
push esi
push dword [esp + 0x1c]
push dword [esp + 0x1c]
mov ecx, eax
call fcn.005061e0
mov ecx, esi
mov ebx, eax
call fcn.0045c160
jmp 0x50642d
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push 0x38
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, 0x38
mov word [eax + 4], cx
movzx ecx, byte [edi + 0x1c]
push ecx
push dword [edi + 0xc]
mov ecx, eax
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call fcn.005061e0
mov ebx, eax
mov eax, dword [edi + 0x28]
lea ecx, [ebx + 0x28]
and eax, 0xfffffffe
push eax
call fcn.0045d9a0
pop edi
pop esi
mov eax, ebx
pop ebx
ret 0xc
Function at 0x5073d0
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov esi, dword [edi + 0x98]
mov dword [edi], vtable.hkpEntity.0
and esi, 0xfffffffe
je 0x507402
lea eax, [esi + 8]
push eax
call fcn.00507850
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax]
mov dword [edi + 0x98], 0
push edi
call fcn.00534f60
mov esi, dword [edi + 0x214]
add esp, 4
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
test esi, esi
je 0x507435
mov ecx, esi
call fcn.004f6690
push dword [0x884adc]
call ebp
push 0x10
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
mov ecx, dword [edi + 0x210]
test ecx, ecx
je 0x507444
call fcn.0045c160
mov dword [edi + 0x210], 0
movzx ebx, word [edi + 0x20e]
test ebx, 0x8000
jne 0x507482
push dword [0x884adc]
mov esi, dword [edi + 0x208]
and ebx, 0x3fff
call ebp
mov ecx, dword [eax + 0x2c]
lea eax, [ebx*4]
push eax
push esi
mov edx, dword [ecx]
call dword [edx + 8]
movzx ebx, word [edi + 0x206]
test ebx, 0x8000
jne 0x5074b6
push dword [0x884adc]
mov esi, dword [edi + 0x200]
and ebx, 0x3fff
call ebp
mov ecx, dword [eax + 0x2c]
lea eax, [ebx*4]
push eax
push esi
mov edx, dword [ecx]
call dword [edx + 8]
lea ecx, [edi + 0xe0]
call fcn.005071c0
mov eax, dword [edi + 0xc8]
mov dword [edi + 0xc4], 0
test eax, eax
js 0x5074ee
and eax, 0x3fffffff
mov ecx, 0x7d8954
push eax
mov eax, dword [0x7d8954]
push dword [edi + 0xc0]
call dword [eax + 0x10]
mov dword [edi + 0xc0], 0
mov dword [edi + 0xc8], connect
mov eax, dword [edi + 0xbc]
mov dword [edi + 0xb8], 0
test eax, eax
js 0x507532
and eax, 0x3fffffff
mov ecx, 0x7d8954
shl eax, 2
push eax
mov eax, dword [0x7d8954]
push dword [edi + 0xb4]
call dword [eax + 0x10]
mov dword [edi + 0xb4], 0
mov dword [edi + 0xbc], connect
movzx ebx, word [edi + 0xb2]
test ebx, 0x8000
jne 0x507579
push dword [0x884adc]
mov esi, dword [edi + 0xac]
and ebx, 0x3fff
call ebp
mov ecx, dword [eax + 0x2c]
lea eax, [ebx + ebx*2]
shl eax, 4
push eax
push esi
mov edx, dword [ecx]
call dword [edx + 8]
mov ecx, edi
pop edi
pop esi
pop ebp
pop ebx
jmp fcn.004f68c0
Function at 0x507590
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x214], 0
jne 0x5075dd
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push 0x10
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 4]
test eax, eax
je 0x5075d5
mov dword [eax], 0
mov dword [eax + 4], connect
mov dword [eax + 8], 0
mov dword [eax + 0xc], connect
jmp 0x5075d7
xor eax, eax
mov dword [esi + 0x214], eax
mov esi, dword [esi + 0x214]
xor ecx, ecx
add esi, 8
movzx ebx, word [esi + 4]
mov edx, ebx
test edx, edx
jle 0x507603
mov edi, dword [esi]
mov eax, edi
cmp dword [eax], 0
je 0x507636
inc ecx
add eax, 4
cmp ecx, edx
jl 0x5075f6
mov ax, word [esi + 6]
mov ecx, 0x3fff
and ax, cx
cmp bx, ax
jne 0x50761f
push 4
push esi
call fcn.00651190
add esp, 8
movzx edx, word [esi + 4]
mov ecx, dword [esi]
mov eax, dword [esp + 0x10]
pop edi
mov dword [ecx + edx*4], eax
inc word [esi + 4]
pop esi
pop ebx
ret 4
test ecx, ecx
js 0x507603
mov eax, dword [esp + 0x10]
mov dword [edi + ecx*4], eax
pop edi
pop esi
pop ebx
ret 4

Function at 0x507650
Capabilities:
Get thread local storage value

Disassembly:
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x214], 0
jne 0x50769c
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push 0x10
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 4]
test eax, eax
je 0x507694
mov dword [eax], 0
mov dword [eax + 4], connect
mov dword [eax + 8], 0
mov dword [eax + 0xc], connect
jmp 0x507696
xor eax, eax
mov dword [esi + 0x214], eax
mov edx, dword [esi + 0x214]
xor ecx, ecx
movzx esi, word [edx + 0xc]
test esi, esi
jle 0x5076bf
mov eax, dword [edx + 8]
mov edi, dword [esp + 0xc]
cmp dword [eax], edi
je 0x5076c2
inc ecx
add eax, 4
cmp ecx, esi
jl 0x5076b3
or ecx, 0xffffffff
mov eax, dword [edx + 8]
pop edi
pop esi
mov dword [eax + ecx*4], 0
ret 4

Function at 0x5087f0
Capabilities:
Get thread local storage value

Disassembly:
push esi
mov esi, ecx
call fcn.005073d0
mov eax, dword [esp + 8]
test al, 1
je 0x508845
test al, 4
jne 0x508837
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0x220
cmp ax, cx
je 0x50881a
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0x220
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4
Function at 0x508cc0
Capabilities:
Get thread local storage value

Disassembly:
push esi
mov esi, ecx
mov dword [esi], vtable.hkpWorldCinfo.0
mov ecx, dword [esi + 0x6c]
test ecx, ecx
je 0x508cd5
call fcn.0045c160
mov dword [esi + 0x6c], 0
mov ecx, dword [esi + 0x5c]
test ecx, ecx
je 0x508ce8
call fcn.0045c160
mov dword [esi + 0x5c], 0
mov ecx, dword [esi + 0x58]
test ecx, ecx
je 0x508cfb
call fcn.0045c160
mov eax, dword [esp + 8]
mov dword [esi + 0x58], 0
mov dword [esi], vtable.hkBaseObject.0
test al, 1
je 0x508d55
test al, 4
jne 0x508d47
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0xf0
cmp ax, cx
je 0x508d2a
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0xf0
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4