joyce8/EMBER2024-capa huggingface dataset:
Function at 0x532f50
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 0x10
push ebx
push ebp
mov ebp, dword [esp + 0x20]
mov ecx, ebp
push esi
mov eax, dword [ebp]
call dword [eax + 0x18]
mov ebx, dword [esp + 0x20]
mov esi, dword [ebx + 0x10]
test esi, esi
je 0x53305c
movzx eax, word [esi]
mov edx, dword [esp + 0x28]
push edi
mov edi, dword [ebx + 0x30]
cmp eax, edx
jne 0x532fa0
mov ecx, dword [esi + 0x14]
test edi, edi
je 0x532f92
mov dword [edi + 0xc], ecx
mov ax, word [esi + 0x12]
mov word [edi + 0x10], ax
xor eax, eax
cmp word [ecx], 0x1a
cmovae eax, ecx
mov dword [ebx + 0x10], eax
jmp 0x532fdb
mov ecx, esi
mov esi, dword [esi + 0x14]
movzx eax, word [esi]
cmp eax, 0x1a
jb 0x53305b
movzx eax, ax
cmp eax, edx
je 0x532fcd
mov ecx, esi
mov esi, dword [esi + 0x14]
movzx eax, word [esi]
cmp eax, 0x1a
jae 0x532fb1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov eax, dword [esi + 0x14]
mov dword [ecx + 0x14], eax
mov ax, word [esi + 0x12]
mov word [ecx + 0x12], ax
test edi, edi
je 0x533041
lea eax, [esp + 0x28]
mov byte [esp + 0x28], 0
push eax
lea eax, [esp + 0x14]
xorps xmm0, xmm0
push eax
mov ecx, esi
movups xmmword [esp + 0x18], xmm0
call fcn.005054c0
mov eax, dword [ebx + 0x18]
mov ecx, dword [ebx + 0x14]
mov al, byte [eax + 0xd2]
or al, byte [ecx + 0xd2]
mov cl, byte [esp + 0x28]
and cl, al
movzx eax, cl
and eax, 7
mov byte [esp + 0x28], cl
mov ecx, ebp
movzx edx, word [eax*2 + 0x786e0c]
mov eax, edx
add dword [ebp + 0xc], eax
mov eax, dword [ebx + 0x30]
add word [eax + 0x14], dx
lea eax, [esp + 0x10]
push eax
push dword [edi]
call fcn.00533280
push dword [0x884adc]
movzx edi, word [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret

Function at 0x5339c0
Capabilities:
Execute anti-debugging instructions
Get thread local storage value

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
mov ecx, ebx
push ebp
push esi
push edi
mov eax, dword [ebx]
call dword [eax + 0x18]
push dword [0x884c50]
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
call ebp
mov edi, eax
mov esi, dword [edi + 4]
cmp esi, dword [edi + 0xc]
jae 0x533a00
mov dword [esi], str.TtDsblConstr
rdtsc
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 0x18]
lea eax, [esi + 0xc]
mov dword [esi + 4], ecx
mov dword [edi + 4], eax
mov esi, dword [esp + 0x14]
push 0x1e
push esi
call fcn.00533070
add esp, 8
test eax, eax
jne 0x533a49
push dword [0x884adc]
call ebp
push 0x20
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 4]
test eax, eax
je 0x533a3c
mov ecx, 0x1e
mov word [eax], cx
mov ecx, 0x20
mov word [eax + 0x10], cx
jmp 0x533a3e
xor eax, eax
push eax
push ebx
push esi
call fcn.00532e00
add esp, 0xc
push dword [0x884c50]
call ebp
mov edi, eax
mov esi, dword [edi + 4]
cmp esi, dword [edi + 0xc]
jae 0x533a74
mov dword [esi], 0x77f5ec
rdtsc
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 0x18]
lea eax, [esi + 0xc]
mov dword [esi + 4], ecx
mov dword [edi + 4], eax
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x533a80
Capabilities:
Execute anti-debugging instructions
Get thread local storage value

Disassembly:
sub esp, 8
push ebx
push esi
push edi
mov edi, dword [esp + 0x1c]
mov ecx, edi
mov eax, dword [edi]
call dword [eax + 0x18]
push dword [0x884c50]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov esi, dword [ebx + 4]
cmp esi, dword [ebx + 0xc]
jae 0x533ac0
mov dword [esi], str.TtEnblConstr
rdtsc
mov dword [esp + 0x1c], eax
mov ecx, dword [esp + 0x1c]
lea eax, [esi + 0xc]
mov dword [esi + 4], ecx
mov dword [ebx + 4], eax
push 0x1e
push edi
mov edi, dword [esp + 0x20]
push edi
call fcn.00532f50
mov eax, dword [edi + 0x30]
add esp, 0xc
mov esi, dword [eax + 0x1c]
test esi, esi
je 0x533b14
mov ecx, dword [edi + 0xc]
lea edx, [esp + 0xc]
push edx
mov byte [esp + 0x20], 1
push dword [esp + 0x20]
mov eax, dword [ecx]
call dword [eax + 0x30]
mov ecx, dword [esp + 0x10]
xor eax, eax
test ecx, ecx
jle 0x533b14
nop word [eax + eax]
mov dword [esi + eax*8], 0
mov dword [esi + eax*8 + 4], 0
inc eax
cmp eax, ecx
jl 0x533b00
push dword [0x884c50]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
mov esi, dword [edi + 4]
cmp esi, dword [edi + 0xc]
jae 0x533b43
mov dword [esi], 0x77f5ec
rdtsc
mov dword [esp + 0x1c], eax
mov ecx, dword [esp + 0x1c]
lea eax, [esi + 0xc]
mov dword [esi + 4], ecx
mov dword [edi + 4], eax
pop edi
pop esi
pop ebx
add esp, 8
ret
Function at 0x533b50
Capabilities:
Get thread local storage value

Disassembly:
push esi
mov esi, dword [esp + 8]
mov ecx, esi
push edi
mov eax, dword [esi]
call dword [eax + 0x2c]
sub eax, 2
je 0x533c2d
sub eax, 4
je 0x533bd6
sub eax, 1
je 0x533b75
pop edi
xor eax, eax
pop esi
ret
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push 0x160
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, 0x160
mov word [eax + 4], cx
mov ecx, eax
call fcn.005184e0
mov edi, eax
lea ecx, [esi + 0x10]
push ecx
lea ecx, [edi + 0x10]
call fcn.00534450
mov ecx, dword [esi + 8]
xor esi, esi
mov dword [edi + 8], ecx
mov ecx, dword [edi + esi*4 + 0xf0]
test ecx, ecx
je 0x533bcb
mov eax, dword [ecx]
call dword [eax + 0xc]
mov dword [edi + esi*4 + 0xf0], eax
inc esi
cmp esi, 3
jl 0x533bb4
mov eax, edi
pop edi
pop esi
ret
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push 0xd0
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, 0xd0
mov word [eax + 4], cx
mov ecx, eax
call fcn.00517260
mov edi, eax
lea ecx, [esi + 0x10]
push ecx
lea ecx, [edi + 0x10]
call fcn.00534390
mov ecx, dword [esi + 8]
mov dword [edi + 8], ecx
mov ecx, dword [edi + 0xac]
test ecx, ecx
je 0x533c7f
mov eax, dword [ecx]
call dword [eax + 0xc]
mov dword [edi + 0xac], eax
mov eax, edi
pop edi
pop esi
ret
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push 0x100
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, 0x100
mov word [eax + 4], cx
mov ecx, eax
call fcn.00514e00
mov edi, eax
lea ecx, [esi + 0x10]
push ecx
lea ecx, [edi + 0x10]
call fcn.005342c0
mov ecx, dword [esi + 8]
mov dword [edi + 8], ecx
mov ecx, dword [edi + 0xc0]
test ecx, ecx
je 0x533c7f
mov eax, dword [ecx]
call dword [eax + 0xc]
mov dword [edi + 0xc0], eax
mov eax, edi
pop edi
pop esi
ret
Function at 0x533c90
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
push edi
mov edi, dword [esp + 0x10]
mov ecx, edi
mov eax, dword [edi]
call dword [eax + 0x2c]
cmp eax, 0x13
ja case.0x533ca7.4
jmp dword [eax*4 + 0x533ea8]
push edi
call fcn.00533f00
add esp, 4
pop edi
pop esi
pop ebx
ret
push edi
call fcn.00533f50
add esp, 4
pop edi
pop esi
pop ebx
ret
push edi
call fcn.00533ff0
mov esi, eax
add esp, 4
mov ecx, dword [esi + 0xc0]
test ecx, ecx
je 0x533ce2
call fcn.0045c0c0
pop edi
mov eax, esi
pop esi
pop ebx
ret
push edi
call fcn.00534040
mov edi, dword [edi + 0x18]
add esp, 4
mov ecx, edi
mov ebx, eax
mov edx, dword [edi]
call dword [edx + 0x34]
push edi
mov ecx, ebx
mov esi, eax
call fcn.00516820
mov ecx, esi
call fcn.0045c160
pop edi
pop esi
mov eax, ebx
pop ebx
ret
push edi
call fcn.005340e0
mov esi, eax
add esp, 4
mov ecx, dword [esi + 0xac]
test ecx, ecx
je 0x533ce2
call fcn.0045c0c0
pop edi
mov eax, esi
pop esi
pop ebx
ret
push edi
call fcn.00534180
add esp, 4
mov esi, eax
mov ecx, esi
call fcn.00518de0
test eax, eax
je 0x533d58
mov ecx, esi
call fcn.00518de0
mov ecx, eax
call fcn.0045c0c0
mov ecx, esi
call fcn.00518e00
test eax, eax
je 0x533d71
mov ecx, esi
call fcn.00518e00
mov ecx, eax
call fcn.0045c0c0
mov ecx, esi
call fcn.00518e20
test eax, eax
je 0x533ce2
mov ecx, esi
call fcn.00518e20
mov ecx, eax
call fcn.0045c0c0
pop edi
mov eax, esi
pop esi
pop ebx
ret
push edi
call fcn.00534220
add esp, 4
pop edi
pop esi
pop ebx
ret
push edi
call fcn.00534270
add esp, 4
pop edi
pop esi
pop ebx
ret
push edi
call fcn.00534090
add esp, 4
pop edi
pop esi
pop ebx
ret
push edi
call fcn.00534130
add esp, 4
pop edi
pop esi
pop ebx
ret
push edi
call fcn.00533fa0
add esp, 4
pop edi
pop esi
pop ebx
ret
push edi
call fcn.005341d0
add esp, 4
pop edi
pop esi
pop ebx
ret
push dword [edi + 0x18]
call fcn.00533c90
mov ebx, eax
add esp, 4
test ebx, ebx
je case.0x533ca7.4
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push 0x28
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, 0x28
push ebx
mov word [eax + 4], cx
mov ecx, eax
call fcn.0051a010
mov ecx, ebx
mov esi, eax
call fcn.0045c160
mov ecx, dword [edi + 0x20]
mov eax, esi
mov dword [esi + 0x20], ecx
movzx ecx, byte [edi + 0x24]
mov byte [esi + 0x24], cl
movzx ecx, byte [edi + 0x25]
mov byte [esi + 0x25], cl
mov ecx, dword [edi + 8]
pop edi
mov dword [esi + 8], ecx
pop esi
pop ebx
ret
mov ecx, edi
call fcn.0051d670
push eax
call fcn.00533c90
mov ebx, eax
add esp, 4
test ebx, ebx
je case.0x533ca7.4
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push 0x20
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, 0x20
push ebx
mov word [eax + 4], cx
mov ecx, eax
call fcn.0051d570
mov ecx, ebx
mov esi, eax
call fcn.0045c160
mov ecx, dword [edi + 0x1c]
mov eax, esi
mov dword [esi + 0x1c], ecx
mov ecx, dword [edi + 8]
pop edi
mov dword [esi + 8], ecx
pop esi
pop ebx
ret
pop edi
pop esi
xor eax, eax
pop ebx
ret
Function at 0x533f00
Capabilities:
Get thread local storage value

Disassembly:
push esi
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push 0x60
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, 0x60
mov word [eax + 4], cx
mov ecx, eax
call fcn.00513990
mov ecx, dword [esp + 8]
mov esi, eax
add ecx, 0x10
push 0x50
push ecx
lea ecx, [esi + 0x10]
push ecx
call fcn.0045d810
add esp, 0xc
mov eax, esi
pop esi
ret

Function at 0x533f50
Capabilities:
Get thread local storage value

Disassembly:
push esi
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push 0xd0
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, 0xd0
mov word [eax + 4], cx
mov ecx, eax
call fcn.005144f0
mov ecx, dword [esp + 8]
mov esi, eax
add ecx, 0x10
push 0xb4
push ecx
lea ecx, [esi + 0x10]
push ecx
call fcn.0045d810
add esp, 0xc
mov eax, esi
pop esi
ret

Function at 0x533fa0
Capabilities:
Get thread local storage value

Disassembly:
push esi
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push 0xa0
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, 0xa0
mov word [eax + 4], cx
mov ecx, eax
call fcn.0051aca0
mov ecx, dword [esp + 8]
mov esi, eax
add ecx, 0x10
push 0x84
push ecx
lea ecx, [esi + 0x10]
push ecx
call fcn.0045d810
add esp, 0xc
mov eax, esi
pop esi
ret

Function at 0x533ff0
Capabilities:
Get thread local storage value

Disassembly:
push esi
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push 0x100
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, 0x100
mov word [eax + 4], cx
mov ecx, eax
call fcn.00514e00
mov ecx, dword [esp + 8]
mov esi, eax
add ecx, 0x10
push 0xe4
push ecx
lea ecx, [esi + 0x10]
push ecx
call fcn.0045d810
add esp, 0xc
mov eax, esi
pop esi
ret

Function at 0x534040
Capabilities:
Get thread local storage value

Disassembly:
push esi
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push 0xb0
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, 0xb0
mov word [eax + 4], cx
mov ecx, eax
call fcn.005164f0
mov ecx, dword [esp + 8]
mov esi, eax
add ecx, 0xc
push 0xc
push ecx
lea ecx, [esi + 0xc]
push ecx
call fcn.0045d810
add esp, 0xc
mov eax, esi
pop esi
ret

Function at 0x534090
Capabilities:
Get thread local storage value

Disassembly:
push esi
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push 0xb0
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, 0xb0
mov word [eax + 4], cx
mov ecx, eax
call fcn.00516d50
mov ecx, dword [esp + 8]
mov esi, eax
add ecx, 0x10
push 0x94
push ecx
lea ecx, [esi + 0x10]
push ecx
call fcn.0045d810
add esp, 0xc
mov eax, esi
pop esi
ret
Function at 0x5340e0
Capabilities:
Get thread local storage value

Disassembly:
push esi
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push 0xd0
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, 0xd0
mov word [eax + 4], cx
mov ecx, eax
call fcn.00517260
mov ecx, dword [esp + 8]
mov esi, eax
add ecx, 0x10
push 0xc0
push ecx
lea ecx, [esi + 0x10]
push ecx
call fcn.0045d810
add esp, 0xc
mov eax, esi
pop esi
ret

Function at 0x534130
Capabilities:
Get thread local storage value

Disassembly:
push esi
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push 0x80
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, 0x80
mov word [eax + 4], cx
mov ecx, eax
call fcn.0051dab0
mov ecx, dword [esp + 8]
mov esi, eax
add ecx, 0x10
push 0x70
push ecx
lea ecx, [esi + 0x10]
push ecx
call fcn.0045d810
add esp, 0xc
mov eax, esi
pop esi
ret

Function at 0x534180
Capabilities:
Get thread local storage value

Disassembly:
push esi
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push 0x160
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, 0x160
mov word [eax + 4], cx
mov ecx, eax
call fcn.005184e0
mov ecx, dword [esp + 8]
mov esi, eax
add ecx, 0x10
push 0x148
push ecx
lea ecx, [esi + 0x10]
push ecx
call fcn.0045d810
add esp, 0xc
mov eax, esi
pop esi
ret

Function at 0x5341d0
Capabilities:
Get thread local storage value

Disassembly:
push esi
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push 0xc0
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, 0xc0
mov word [eax + 4], cx
mov ecx, eax
call fcn.0051b310
mov ecx, dword [esp + 8]
mov esi, eax
add ecx, 0x10
push 0xac
push ecx
lea ecx, [esi + 0x10]
push ecx
call fcn.0045d810
add esp, 0xc
mov eax, esi
pop esi
ret

Function at 0x534220
Capabilities:
Get thread local storage value

Disassembly:
push esi
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push 0x50
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, 0x50
mov word [eax + 4], cx
mov ecx, eax
call fcn.00519120
mov ecx, dword [esp + 8]
mov esi, eax
add ecx, 0x10
push 0x38
push ecx
lea ecx, [esi + 0x10]
push ecx
call fcn.0045d810
add esp, 0xc
mov eax, esi
pop esi
ret

Function at 0x534270
Capabilities:
Get thread local storage value

Disassembly:
push esi
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push 0x160
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, 0x160
mov word [eax + 4], cx
mov ecx, eax
call fcn.005191e0
mov ecx, dword [esp + 8]
mov esi, eax
add ecx, 0x10
push 0x124
push ecx
lea ecx, [esi + 0x10]
push ecx
call fcn.0045d810
add esp, 0xc
mov eax, esi
pop esi
ret
Function at 0x534b54
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, ecx
mov dword [esi], vtable.hkpCdPointCollector.0
test al, 1
je 0x534b8d
test al, 4
jne 0x534b82
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push 0x50
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
mov eax, esi
pop esi
ret 4
push 0x50
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4

Function at 0x534bc0
Capabilities:
Execute anti-debugging instructions
Get thread local storage value

Disassembly:
mov eax, dword [esp + 4]
sub esp, 8
push ebp
mov ebp, dword [eax + 0x214]
test ebp, ebp
je 0x534c64
push esi
movzx esi, word [ebp + 0xc]
sub esi, 1
js 0x534c63
push ebx
push edi
mov eax, dword [ebp + 8]
cmp dword [eax + esi*4], 0
je 0x534c5c
push dword [0x884c50]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov edi, dword [ebx + 4]
cmp edi, dword [ebx + 0xc]
jae 0x534c1e
mov dword [edi], str.TtentAddCb
rdtsc
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x10]
lea eax, [edi + 0xc]
mov dword [edi + 4], ecx
mov dword [ebx + 4], eax
mov eax, dword [ebp + 8]
push dword [esp + 0x1c]
mov ecx, dword [eax + esi*4]
mov eax, dword [ecx]
call dword [eax + 4]
push dword [0x884c50]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov edi, dword [ebx + 4]
cmp edi, dword [ebx + 0xc]
jae 0x534c5c
mov dword [edi], 0x77f5ec
rdtsc
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x14]
lea eax, [edi + 0xc]
mov dword [edi + 4], ecx
mov dword [ebx + 4], eax
sub esi, 1
jns 0x534be6
pop edi
pop ebx
pop esi
pop ebp
add esp, 8
ret
Function at 0x534eb0
Capabilities:
Execute anti-debugging instructions
Get thread local storage value

Disassembly:
mov eax, dword [esp + 4]
sub esp, 8
push ebp
mov ebp, dword [eax + 0x214]
test ebp, ebp
je 0x534f54
push esi
movzx esi, word [ebp + 0xc]
sub esi, 1
js 0x534f53
push ebx
push edi
mov eax, dword [ebp + 8]
cmp dword [eax + esi*4], 0
je 0x534f4c
push dword [0x884c50]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov edi, dword [ebx + 4]
cmp edi, dword [ebx + 0xc]
jae 0x534f0e
mov dword [edi], str.TtsetShapeCb
rdtsc
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x10]
lea eax, [edi + 0xc]
mov dword [edi + 4], ecx
mov dword [ebx + 4], eax
mov eax, dword [ebp + 8]
push dword [esp + 0x1c]
mov ecx, dword [eax + esi*4]
mov eax, dword [ecx]
call dword [eax + 0xc]
push dword [0x884c50]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov edi, dword [ebx + 4]
cmp edi, dword [ebx + 0xc]
jae 0x534f4c
mov dword [edi], 0x77f5ec
rdtsc
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x14]
lea eax, [edi + 0xc]
mov dword [edi + 4], ecx
mov dword [ebx + 4], eax
sub esi, 1
jns 0x534ed6
pop edi
pop ebx
pop esi
pop ebp
add esp, 8
ret

Function at 0x534f60
Capabilities:
Execute anti-debugging instructions
Get thread local storage value

Disassembly:
mov eax, dword [esp + 4]
sub esp, 8
push ebp
mov ebp, dword [eax + 0x214]
test ebp, ebp
je 0x535004
push esi
movzx esi, word [ebp + 0xc]
sub esi, 1
js 0x535003
push ebx
push edi
mov eax, dword [ebp + 8]
cmp dword [eax + esi*4], 0
je 0x534ffc
push dword [0x884c50]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov edi, dword [ebx + 4]
cmp edi, dword [ebx + 0xc]
jae 0x534fbe
mov dword [edi], str.TtentDelCb
rdtsc
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x10]
lea eax, [edi + 0xc]
mov dword [edi + 4], ecx
mov dword [ebx + 4], eax
mov eax, dword [ebp + 8]
push dword [esp + 0x1c]
mov ecx, dword [eax + esi*4]
mov eax, dword [ecx]
call dword [eax + 0x14]
push dword [0x884c50]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov edi, dword [ebx + 4]
cmp edi, dword [ebx + 0xc]
jae 0x534ffc
mov dword [edi], 0x77f5ec
rdtsc
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x14]
lea eax, [edi + 0xc]
mov dword [edi + 4], ecx
mov dword [ebx + 4], eax
sub esi, 1
jns 0x534f86
pop edi
pop ebx
pop esi
pop ebp
add esp, 8
ret
Function at 0x535010
Capabilities:
Execute anti-debugging instructions
Get thread local storage value

Disassembly:
mov eax, dword [esp + 4]
sub esp, 8
push ebp
mov ebp, dword [eax + 0x214]
test ebp, ebp
je 0x5350b4
push esi
movzx esi, word [ebp + 0xc]
sub esi, 1
js 0x5350b3
push ebx
push edi
mov eax, dword [ebp + 8]
cmp dword [eax + esi*4], 0
je 0x5350ac
push dword [0x884c50]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov edi, dword [ebx + 4]
cmp edi, dword [ebx + 0xc]
jae 0x53506e
mov dword [edi], str.TtsetMotionTypeCb
rdtsc
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x10]
lea eax, [edi + 0xc]
mov dword [edi + 4], ecx
mov dword [ebx + 4], eax
mov eax, dword [ebp + 8]
push dword [esp + 0x1c]
mov ecx, dword [eax + esi*4]
mov eax, dword [ecx]
call dword [eax + 0x10]
push dword [0x884c50]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov edi, dword [ebx + 4]
cmp edi, dword [ebx + 0xc]
jae 0x5350ac
mov dword [edi], 0x77f5ec
rdtsc
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x14]
lea eax, [edi + 0xc]
mov dword [edi + 4], ecx
mov dword [ebx + 4], eax
sub esi, 1
jns 0x535036
pop edi
pop ebx
pop esi
pop ebp
add esp, 8
ret

Function at 0x5350c0
Capabilities:
Execute anti-debugging instructions
Get thread local storage value

Disassembly:
push ecx
push ebp
mov ebp, dword [esp + 0xc]
add ebp, 0x200
push esi
movzx esi, word [ebp + 4]
sub esi, 1
js 0x53515d
push ebx
push edi
nop dword [eax]
mov eax, dword [ebp]
cmp dword [eax + esi*4], 0
je 0x535156
push dword [0x884c50]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov edi, dword [ebx + 4]
cmp edi, dword [ebx + 0xc]
jae 0x535118
mov dword [edi], str.TtNewCollCb
rdtsc
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 0x18]
lea eax, [edi + 0xc]
mov dword [edi + 4], ecx
mov dword [ebx + 4], eax
mov eax, dword [ebp]
push dword [esp + 0x1c]
mov ecx, dword [eax + esi*4]
mov eax, dword [ecx]
call dword [eax + 4]
push dword [0x884c50]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov edi, dword [ebx + 4]
cmp edi, dword [ebx + 0xc]
jae 0x535156
mov dword [edi], 0x77f5ec
rdtsc
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x10]
lea eax, [edi + 0xc]
mov dword [edi + 4], ecx
mov dword [ebx + 4], eax
sub esi, 1
jns 0x5350e0
pop edi
pop ebx
push ebp
call fcn.005354e0
add esp, 4
pop esi
pop ebp
pop ecx
ret
Function at 0x535170
Capabilities:
Execute anti-debugging instructions
Get thread local storage value

Disassembly:
push ecx
push ebp
mov ebp, dword [esp + 0xc]
add ebp, 0x200
push esi
movzx esi, word [ebp + 4]
sub esi, 1
js 0x53520d
push ebx
push edi
nop dword [eax]
mov eax, dword [ebp]
cmp dword [eax + esi*4], 0
je 0x535206
push dword [0x884c50]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov edi, dword [ebx + 4]
cmp edi, dword [ebx + 0xc]
jae 0x5351c8
mov dword [edi], str.TtFinCollCb
rdtsc
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 0x18]
lea eax, [edi + 0xc]
mov dword [edi + 4], ecx
mov dword [ebx + 4], eax
mov eax, dword [ebp]
push dword [esp + 0x1c]
mov ecx, dword [eax + esi*4]
mov eax, dword [ecx]
call dword [eax + 8]
push dword [0x884c50]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov edi, dword [ebx + 4]
cmp edi, dword [ebx + 0xc]
jae 0x535206
mov dword [edi], 0x77f5ec
rdtsc
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x10]
lea eax, [edi + 0xc]
mov dword [edi + 4], ecx
mov dword [ebx + 4], eax
sub esi, 1
jns 0x535190
pop edi
pop ebx
push ebp
call fcn.005354e0
add esp, 4
pop esi
pop ebp
pop ecx
ret

Function at 0x535220
Capabilities:
Execute anti-debugging instructions
Get thread local storage value

Disassembly:
push ecx
push ebp
mov ebp, dword [esp + 0xc]
add ebp, 0x200
push esi
movzx esi, word [ebp + 4]
sub esi, 1
js 0x5352bc
push ebx
push edi
nop dword [eax]
mov eax, dword [ebp]
cmp dword [eax + esi*4], 0
je 0x5352b5
push dword [0x884c50]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov edi, dword [ebx + 4]
cmp edi, dword [ebx + 0xc]
jae 0x535278
mov dword [edi], str.TtcpCb
rdtsc
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 0x18]
lea eax, [edi + 0xc]
mov dword [edi + 4], ecx
mov dword [ebx + 4], eax
mov eax, dword [ebp]
push dword [esp + 0x1c]
mov ecx, dword [eax + esi*4]
mov eax, dword [ecx]
call dword [eax]
push dword [0x884c50]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov edi, dword [ebx + 4]
cmp edi, dword [ebx + 0xc]
jae 0x5352b5
mov dword [edi], 0x77f5ec
rdtsc
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x10]
lea eax, [edi + 0xc]
mov dword [edi + 4], ecx
mov dword [ebx + 4], eax
sub esi, 1
jns 0x535240
pop edi
pop ebx
push ebp
call fcn.005354e0
add esp, 4
pop esi
pop ebp
pop ecx
ret