joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43cd28
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
test byte [ebx], 4
je 0x43cf22
test dword [esi], 0x47b
je 0x43cd7a
lea eax, [ebp - 4]
push eax
push esi
mov edx, dword [ebx + 8]
push edx
call fcn.0043c458
add esp, 0xc
test eax, eax
je 0x43cf22
cmp dword [ebp + 0x10], 0
je 0x43cd70
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 4]
inc ecx
mov dword [eax], ecx
mov eax, 1
jmp 0x43cf31
test byte [esi], 4
je 0x43cf22
mov edx, dword [esi + 8]
cmp dword [edx + 0x10], 1
jne 0x43cf22
lea ecx, [ebp - 4]
push ecx
mov eax, dword [esi + 8]
mov edx, dword [eax]
push edx
mov ecx, dword [ebx + 8]
push ecx
call fcn.0043c458
add esp, 0xc
test eax, eax
je 0x43cf22
mov ecx, dword [ebp - 4]
mov eax, dword [ebx + 8]
shl ecx, 4
xor edi, edi
mov edx, dword [eax]
mov eax, dword [esi + 8]
lea ecx, [ecx + ecx*2]
add edx, ecx
add edx, 0x18
mov ebx, edx
mov edx, dword [eax]
add edx, 0x18
test byte [ebx + 1], 4
mov esi, edx
je 0x43cdf6
test byte [esi + 1], 4
je 0x43cdf6
push 1
push esi
push ebx
call fcn.0043f810
add esp, 0xc
test eax, eax
sete al
and eax, 1
mov edi, eax
jmp 0x43cf08
mov ecx, dword [ebx]
test cl, 0xa
je 0x43ce3f
test byte [esi], 0xa
je 0x43ce3f
test cl, 2
je 0x43ce0d
mov eax, dword [ebx + 8]
cdq
jmp 0x43ce13
mov eax, dword [ebx + 8]
mov edx, dword [ebx + 0xc]
push edx
push eax
test byte [esi], 2
je 0x43ce20
mov eax, dword [esi + 8]
cdq
jmp 0x43ce26
mov eax, dword [esi + 8]
mov edx, dword [esi + 0xc]
cmp edx, dword [esp + 4]
jne 0x43ce2f
cmp eax, dword [esp]
sete cl
and ecx, 1
add esp, 8
mov edi, ecx
jmp 0x43cf08
test byte [ebx], 0x1a
je 0x43ce6d
test byte [esi], 0x1a
je 0x43ce6d
push ebx
call fcn.0043df40
pop ecx
fstp qword [ebp - 0xc]
push esi
call fcn.0043df40
fcomp qword [ebp - 0xc]
pop ecx
fnstsw ax
sahf
sete dl
and edx, 1
mov edi, edx
jmp 0x43cf08
test dword [ebx], 0xfffbffff
jne 0x43ce87
test dword [esi], 0xfffbffff
jne 0x43ce87
mov edi, 1
jmp 0x43cf08
push ebx
call fcn.0043eca0
pop ecx
push eax
push esi
call fcn.0043eca0
pop ecx
pop edx
and edx, eax
je 0x43cf08
push ebx
call fcn.00422b70
pop ecx
push esi
call fcn.00422b70
pop ecx
call fcn.00426a14
test eax, eax
jne 0x43cf08
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov ecx, dword [eax]
mov eax, dword [ecx - 4]
push eax
call fcn.0043dee4
pop ecx
mov edi, eax
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
sub dword [eax], 4
mov edx, dword [0x54d750]
push edx
call sub.KERNEL32.DLL_TlsGetValue
mov ecx, dword [eax]
mov eax, dword [ecx]
test dword [eax], 0xb405
je 0x43cf08
mov edx, dword [0x54d750]
push edx
call sub.KERNEL32.DLL_TlsGetValue
mov ecx, dword [eax]
mov eax, dword [ecx]
push eax
call fcn.0043edc0
pop ecx
test edi, edi
je 0x43cf22
cmp dword [ebp + 0x10], 0
je 0x43cf1b
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp - 4]
inc edx
mov dword [ecx], edx
mov eax, 1
jmp 0x43cf31
cmp dword [ebp + 0x10], 0
je 0x43cf2f
mov edx, dword [ebp + 0x10]
xor ecx, ecx
mov dword [edx], ecx
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43d820
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push 0x2000
movzx eax, bx
push eax
call fcn.0043347c
add esp, 8
test eax, eax
je 0x43d882
mov edx, dword [0x54d750]
push edx
call sub.KERNEL32.DLL_TlsGetValue
mov ecx, dword [eax + 0xc]
test esi, esi
movzx eax, bx
mov eax, dword [ecx + eax*4 + 4]
je 0x43d866
push esi
push eax
call fcn.0043efac
add esp, 8
jmp 0x43d87b
test dword [eax], 0xb405
je 0x43d877
push eax
call fcn.0043edc0
pop ecx
jmp 0x43d87b
xor edx, edx
mov dword [eax], edx
mov eax, 1
jmp 0x43d884
xor eax, eax
pop esi
pop ebx
pop ebp
ret

Function at 0x43d888
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push 0x2000
movzx eax, bx
push eax
call fcn.0043347c
add esp, 8
test eax, eax
je 0x43d8ea
mov edx, dword [0x54d750]
push edx
call sub.KERNEL32.DLL_TlsGetValue
mov ecx, dword [eax + 0xc]
test esi, esi
movzx eax, bx
mov eax, dword [ecx + eax*4 + 4]
je 0x43d8ce
push esi
push eax
call fcn.0043f0fc
add esp, 8
jmp 0x43d8e3
test dword [eax], 0xb405
je 0x43d8df
push eax
call fcn.0043edc0
pop ecx
jmp 0x43d8e3
xor edx, edx
mov dword [eax], edx
mov eax, 1
jmp 0x43d8ec
xor eax, eax
pop esi
pop ebx
pop ebp
ret

Function at 0x43e0fc
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x43e11f
push ebx
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
add eax, 0x10
push eax
call fcn.0043ee8c
add esp, 8
mov eax, ebx
pop ebx
pop ebp
ret

Function at 0x43e124
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x43e147
push ebx
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
add eax, 0x10
push eax
call fcn.0043f03c
add esp, 8
mov eax, ebx
pop ebx
pop ebp
ret

Function at 0x43e14c
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x43e176
push ebx
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
add eax, 0x10
push eax
call fcn.0043f03c
add esp, 8
push ebx
call fcn.0043d978
pop ecx
pop ebx
pop ebp
ret

Function at 0x43e364
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x43e380
test dword [ebx], 0xb405
je 0x43e38a
push ebx
call fcn.0043edc0
pop ecx
jmp 0x43e38a
push 0
call fcn.0043d7dc
pop ecx
mov ebx, eax
mov dword [ebx], 0x10
fld qword [ebp + 0xc]
fcomp qword [0x43e3e4]
fnstsw ax
sahf
ja 0x43e3ac
fld qword [ebp + 0xc]
fcomp qword [0x43e3ec]
fnstsw ax
sahf
jae 0x43e3b2
mov dx, 0x14
jmp 0x43e3b6
mov dx, 0xa
mov word [ebx + 0x10], dx
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov cx, word [eax + 0xf4]
mov word [ebx + 0x12], cx
mov eax, dword [ebp + 0xc]
mov dword [ebx + 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebx + 0xc], eax
mov eax, ebx
pop ebx
pop ebp
ret
Function at 0x43e684
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov ebx, dword [ebp + 0x18]
mov esi, dword [ebp + 0x14]
mov edi, dword [ebp + 8]
test ebx, ebx
jge 0x43e6ab
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov ebx, dword [eax + 0xf4]
test ebx, ebx
jne 0x43e70b
fld qword [ebp + 0xc]
call fcn.004afaa8
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
fild qword [ebp - 8]
fcomp qword [ebp + 0xc]
fnstsw ax
sahf
jne 0x43e70b
test esi, esi
jle 0x43e6d1
cmp esi, 0x63
jle 0x43e6f9
fld qword [ebp + 0xc]
fcomp qword [0x43e724]
fnstsw ax
sahf
ja 0x43e6ed
fld qword [ebp + 0xc]
fcomp qword [0x43e72c]
fnstsw ax
sahf
jae 0x43e6f4
mov esi, 0x14
jmp 0x43e6f9
mov esi, 0xa
push esi
push dword [ebp - 4]
push dword [ebp - 8]
push edi
call fcn.0043e630
add esp, 0x10
jmp 0x43e71c
push ebx
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call fcn.0043e734
add esp, 0x14
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x43e734
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0x18]
mov esi, dword [ebp + 0x14]
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x43e758
test dword [ebx], 0xb405
je 0x43e762
push ebx
call fcn.0043edc0
pop ecx
jmp 0x43e762
push 0
call fcn.0043d7dc
pop ecx
mov ebx, eax
test esi, esi
jle 0x43e76b
cmp esi, 0x63
jle 0x43e793
fld qword [ebp + 0xc]
fcomp qword [0x43e7cc]
fnstsw ax
sahf
ja 0x43e787
fld qword [ebp + 0xc]
fcomp qword [0x43e7d4]
fnstsw ax
sahf
jae 0x43e78e
mov esi, 0x14
jmp 0x43e793
mov esi, 0xa
test edi, edi
jge 0x43e7a8
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov edi, dword [eax + 0xf4]
mov dword [ebx], 0x10
mov word [ebx + 0x10], si
mov word [ebx + 0x12], di
mov eax, dword [ebp + 0xc]
mov dword [ebx + 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebx + 0xc], eax
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x43e7dc
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0x14]
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x43e7fc
test dword [ebx], 0xb405
je 0x43e806
push ebx
call fcn.0043edc0
pop ecx
jmp 0x43e806
push 0
call fcn.0043d7dc
pop ecx
mov ebx, eax
mov dword [ebx], 0x10
fld qword [ebp + 0xc]
fcomp qword [0x43e86c]
fnstsw ax
sahf
ja 0x43e828
fld qword [ebp + 0xc]
fcomp qword [0x43e874]
fnstsw ax
sahf
jae 0x43e82e
mov dx, 0x14
jmp 0x43e832
mov dx, 0xa
mov word [ebx + 0x10], dx
cmp esi, 0xff
jne 0x43e856
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov cx, word [eax + 0xf4]
mov word [ebx + 0x12], cx
jmp 0x43e85a
mov word [ebx + 0x12], si
mov eax, dword [ebp + 0xc]
mov dword [ebx + 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebx + 0xc], eax
mov eax, ebx
pop esi
pop ebx
pop ebp
ret
Function at 0x43f810
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
xor ecx, ecx
push ebx
push esi
push edi
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], ecx
mov ecx, dword [edx + 0x10]
mov edi, dword [eax + 0x10]
mov dword [ebp - 4], ecx
cmp dword [ebp + 0x10], 0
mov ebx, dword [eax + 8]
mov esi, dword [edx + 8]
jne 0x43f876
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
cmp dword [eax + 0x11c], 0
je 0x43f876
jmp 0x43f850
dec ebx
cmp esi, ebx
jae 0x43f85b
cmp byte [edi + ebx - 1], 0x20
je 0x43f84f
mov edx, dword [ebp - 4]
lea eax, [edx + esi - 1]
jmp 0x43f866
dec esi
dec eax
cmp ebx, esi
jae 0x43f86f
cmp byte [eax], 0x20
je 0x43f864
mov dword [ebp + 0x10], 1
cmp esi, ebx
jbe 0x43f87e
mov edx, ebx
jmp 0x43f880
mov edx, esi
mov dword [ebp - 8], edx
cmp dword [ebp - 8], 0
je 0x43f905
call fcn.004255a0
test eax, eax
je 0x43f8b4
test byte [eax + 0x24], 8
jne 0x43f8b4
mov ecx, dword [ebp + 0x10]
push ecx
push eax
push esi
mov eax, dword [ebp - 4]
push eax
push ebx
push edi
call fcn.0044f960
add esp, 0x18
mov dword [ebp - 0xc], eax
jmp 0x43f937
mov edx, dword [ebp - 4]
mov cl, byte [edx]
mov al, byte [edi]
cmp cl, al
je 0x43f8d5
mov edx, dword [ebp - 4]
cmp al, byte [edx]
jae 0x43f8cb
or eax, 0xffffffff
jmp 0x43f8d0
mov eax, 1
mov dword [ebp - 0xc], eax
jmp 0x43f8de
inc edi
inc dword [ebp - 4]
dec dword [ebp - 8]
jne 0x43f8b4
cmp dword [ebp - 0xc], 0
jne 0x43f937
cmp esi, ebx
je 0x43f937
cmp dword [ebp + 0x10], 0
jne 0x43f8f2
cmp ebx, esi
jae 0x43f937
cmp esi, ebx
jbe 0x43f8fb
or edx, 0xffffffff
jmp 0x43f900
mov edx, 1
mov dword [ebp - 0xc], edx
jmp 0x43f937
cmp esi, ebx
je 0x43f932
cmp dword [ebp + 0x10], 0
je 0x43f922
cmp esi, ebx
jbe 0x43f918
or eax, 0xffffffff
jmp 0x43f91d
mov eax, 1
mov dword [ebp - 0xc], eax
jmp 0x43f937
test esi, esi
jne 0x43f92a
xor edx, edx
jmp 0x43f92d
or edx, 0xffffffff
mov dword [ebp - 0xc], edx
jmp 0x43f937
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43f944
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
xor ecx, ecx
push ebx
push esi
push edi
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], ecx
mov ecx, dword [edx + 0x10]
mov edi, dword [eax + 0x10]
mov dword [ebp - 4], ecx
cmp dword [ebp + 0x10], 0
mov ebx, dword [eax + 8]
mov esi, dword [edx + 8]
jne 0x43f9aa
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
cmp dword [eax + 0x11c], 0
je 0x43f9aa
jmp 0x43f984
dec ebx
cmp esi, ebx
jae 0x43f98f
cmp byte [edi + ebx - 1], 0x20
je 0x43f983
mov edx, dword [ebp - 4]
lea eax, [edx + esi - 1]
jmp 0x43f99a
dec esi
dec eax
cmp ebx, esi
jae 0x43f9a3
cmp byte [eax], 0x20
je 0x43f998
mov dword [ebp + 0x10], 1
cmp esi, ebx
jbe 0x43f9b2
mov edx, ebx
jmp 0x43f9b4
mov edx, esi
mov dword [ebp - 8], edx
cmp dword [ebp - 8], 0
je 0x43fa6e
call fcn.004255a0
test eax, eax
je 0x43f9ec
test byte [eax + 0x24], 8
jne 0x43f9ec
mov ecx, dword [ebp + 0x10]
push ecx
push eax
push esi
mov eax, dword [ebp - 4]
push eax
push ebx
push edi
call fcn.0044f984
add esp, 0x18
mov dword [ebp - 0xc], eax
jmp 0x43faa0
mov al, byte [edi]
cmp al, 0x61
jb 0x43f9ff
cmp al, 0x7a
ja 0x43f9ff
xor edx, edx
mov dl, byte [edi]
add edx, 0xffffffe0
jmp 0x43fa03
xor edx, edx
mov dl, byte [edi]
mov eax, edx
mov ecx, dword [ebp - 4]
mov dl, byte [ecx]
cmp dl, 0x61
jb 0x43fa20
cmp dl, 0x7a
ja 0x43fa20
mov ecx, dword [ebp - 4]
xor edx, edx
mov dl, byte [ecx]
add edx, 0xffffffe0
jmp 0x43fa27
mov ecx, dword [ebp - 4]
xor edx, edx
mov dl, byte [ecx]
cmp edx, eax
je 0x43fa3e
cmp edx, eax
jle 0x43fa34
or eax, 0xffffffff
jmp 0x43fa39
mov eax, 1
mov dword [ebp - 0xc], eax
jmp 0x43fa47
inc edi
inc dword [ebp - 4]
dec dword [ebp - 8]
jne 0x43f9ec
cmp dword [ebp - 0xc], 0
jne 0x43faa0
cmp esi, ebx
je 0x43faa0
cmp dword [ebp + 0x10], 0
jne 0x43fa5b
cmp ebx, esi
jae 0x43faa0
cmp esi, ebx
jbe 0x43fa64
or edx, 0xffffffff
jmp 0x43fa69
mov edx, 1
mov dword [ebp - 0xc], edx
jmp 0x43faa0
cmp esi, ebx
je 0x43fa9b
cmp dword [ebp + 0x10], 0
je 0x43fa8b
cmp esi, ebx
jbe 0x43fa81
or eax, 0xffffffff
jmp 0x43fa86
mov eax, 1
mov dword [ebp - 0xc], eax
jmp 0x43faa0
test esi, esi
jne 0x43fa93
xor edx, edx
jmp 0x43fa96
or edx, 0xffffffff
mov dword [ebp - 0xc], edx
jmp 0x43faa0
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4413c4
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push ebx
call fcn.00440460
pop ecx
push eax
push ebx
mov eax, dword [ebp + 8]
push eax
mov edx, dword [0x54d750]
push edx
call sub.KERNEL32.DLL_TlsGetValue
add eax, 0x10
push eax
call fcn.00440b58
add esp, 0x10
pop ebx
pop ebp
ret

Function at 0x4418e0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov eax, dword [ebp + 8]
mov ebx, 1
test byte [eax + 1], 4
jne 0x44195f
push eax
push 1
push 0x539488
push 0
push 0x429
push 1
call fcn.004570b8
add esp, 0x18
mov esi, eax
xor ebx, ebx
test esi, esi
je 0x44195f
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
sub dword [eax], 4
mov edx, dword [0x54d750]
push edx
call sub.KERNEL32.DLL_TlsGetValue
mov ecx, dword [eax]
mov eax, dword [ecx]
test dword [eax], 0xb405
je 0x441951
mov edx, dword [0x54d750]
push edx
call sub.KERNEL32.DLL_TlsGetValue
mov ecx, dword [eax]
mov eax, dword [ecx]
push eax
call fcn.0043edc0
pop ecx
push esi
call fcn.00422b70
pop ecx
push esi
call fcn.0043d978
pop ecx
mov eax, ebx
pop esi
pop ebx
pop ebp
ret

Function at 0x4419b0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x441a1a
cmp dword [ebx + 0x1c], 0
je 0x441a1a
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
sub dword [eax], 4
mov edx, dword [0x54d750]
push edx
call sub.KERNEL32.DLL_TlsGetValue
mov ecx, dword [eax]
mov eax, dword [ecx]
test dword [eax], 0xb405
je 0x4419fe
mov edx, dword [0x54d750]
push edx
call sub.KERNEL32.DLL_TlsGetValue
mov ecx, dword [eax]
mov eax, dword [ecx]
push eax
call fcn.0043edc0
pop ecx
mov edx, dword [ebx + 0x1c]
push edx
call fcn.004566f4
pop ecx
mov ecx, dword [ebx + 0x1c]
push ecx
call fcn.00456970
pop ecx
xor eax, eax
mov dword [ebx + 0x1c], eax
pop ebx
pop ebp
ret
mov edx, dword [0x54d750]
push edx
call sub.KERNEL32.DLL_TlsGetValue
mov ecx, dword [eax]
mov eax, dword [ecx - 4]
push eax
push 1
push 0x539488
push 0
push 0x5a9
push 7
call fcn.004570b8
add esp, 0x18
mov ebx, eax
test ebx, ebx
je 0x441a95
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
sub dword [eax], 4
mov edx, dword [0x54d750]
push edx
call sub.KERNEL32.DLL_TlsGetValue
mov ecx, dword [eax]
mov eax, dword [ecx]
test dword [eax], 0xb405
je 0x441a87
mov edx, dword [0x54d750]
push edx
call sub.KERNEL32.DLL_TlsGetValue
mov ecx, dword [eax]
mov eax, dword [ecx]
push eax
call fcn.0043edc0
pop ecx
push ebx
call fcn.00422b70
pop ecx
push ebx
call fcn.0043d978
pop ecx
pop ebx
pop ebp
ret
Function at 0x441c58
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
push ebx
push esi
push edi
mov ebx, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
push esi
call fcn.004418e0
pop ecx
test eax, eax
je 0x441d80
mov dword [ebp - 0x50], 2
test bl, 0x40
je 0x441c8c
call fcn.00441828
jmp 0x441c8e
mov eax, ebx
push eax
call fcn.004255a0
test byte [eax + 0x24], 4
je 0x441ca1
mov edx, 0x800
jmp 0x441ca3
xor edx, edx
pop eax
or eax, edx
mov dword [ebp - 0x4c], eax
lea eax, [ebp - 0x40]
mov dword [ebp - 0x3c], 1
mov word [ebp - 0x1a], 0x3f
mov dword [ebp - 0x38], 1
mov ecx, dword [esi + 8]
mov dword [ebp - 0x40], ecx
push eax
mov edx, dword [esi + 0x10]
push edx
call fcn.00441a98
add esp, 8
mov ebx, eax
mov dword [ebp - 0x44], ebx
cmp ebx, dword [esi + 0x10]
jne 0x441cdf
xor ebx, ebx
test edi, edi
je 0x441cf0
or dword [ebp - 0x3c], 0x20
cmp edi, 0x2c
jne 0x441cf0
or dword [ebp - 0x3c], 0x10
lea eax, [ebp - 0x50]
push eax
call fcn.00441850
pop ecx
test eax, eax
jne 0x441d5f
test byte [ebp - 0x38], 1
je 0x441d5f
mov edx, dword [0x54d750]
push edx
call sub.KERNEL32.DLL_TlsGetValue
sub dword [eax], 4
mov ecx, dword [0x54d750]
push ecx
call sub.KERNEL32.DLL_TlsGetValue
mov eax, dword [eax]
mov edx, dword [eax]
test dword [edx], 0xb405
je 0x441d42
mov ecx, dword [0x54d750]
push ecx
call sub.KERNEL32.DLL_TlsGetValue
mov eax, dword [eax]
mov edx, dword [eax]
push edx
call fcn.0043edc0
pop ecx
lea ecx, [ebp - 0x50]
push ecx
call fcn.00441998
pop ecx
cmp edi, 0x2a
jne 0x441d69
movzx eax, word [ebp - 0x1c]
inc eax
push eax
call fcn.00422db8
pop ecx
jmp 0x441d69
lea edx, [ebp - 0x50]
push edx
call fcn.004419b0
pop ecx
test ebx, ebx
je 0x441d74
push ebx
call fcn.0043b208
pop ecx
lea ecx, [ebp - 0x50]
push ecx
call fcn.004418a4
pop ecx
jmp 0x441d97
cmp edi, 0x2a
jne 0x441d97
call fcn.00425334
test ax, ax
jne 0x441d97
push 1
call fcn.00422d18
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x441da0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push ebx
call fcn.004418e0
pop ecx
test eax, eax
je 0x441e88
mov dword [ebp - 0x50], 2
test esi, 0x40
je 0x441dd6
call fcn.00441828
mov edi, eax
jmp 0x441dd8
mov edi, esi
call fcn.004255a0
test byte [eax + 0x24], 4
je 0x441dea
mov eax, 0x800
jmp 0x441dec
xor eax, eax
or edi, eax
mov dword [ebp - 0x4c], edi
mov dword [ebp - 0x3c], 2
mov word [ebp - 0x1a], 0x3f
mov dword [ebp - 0x38], 1
mov edx, dword [ebx + 0x10]
mov dword [ebp - 0x44], edx
mov ecx, dword [ebx + 8]
mov dword [ebp - 0x40], ecx
lea eax, [ebp - 0x50]
push eax
call fcn.00441850
pop ecx
test eax, eax
jne 0x441e6f
test byte [ebp - 0x38], 1
je 0x441e6f
mov edx, dword [0x54d750]
push edx
call sub.KERNEL32.DLL_TlsGetValue
sub dword [eax], 4
mov ecx, dword [0x54d750]
push ecx
call sub.KERNEL32.DLL_TlsGetValue
mov eax, dword [eax]
mov edx, dword [eax]
test dword [edx], 0xb405
je 0x441e63
mov ecx, dword [0x54d750]
push ecx
call sub.KERNEL32.DLL_TlsGetValue
mov eax, dword [eax]
mov edx, dword [eax]
push edx
call fcn.0043edc0
pop ecx
lea ecx, [ebp - 0x50]
push ecx
call fcn.00441998
pop ecx
jmp 0x441e79
lea eax, [ebp - 0x50]
push eax
call fcn.004419b0
pop ecx
lea edx, [ebp - 0x50]
push edx
call fcn.004418a4
pop ecx
jmp 0x441f0b
call fcn.00425334
test ax, ax
jne 0x441f0b
mov ecx, dword [0x54d750]
push ecx
call sub.KERNEL32.DLL_TlsGetValue
sub dword [eax], 4
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov edx, dword [eax]
mov ecx, dword [edx]
test dword [ecx], 0xb405
je 0x441ece
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov edx, dword [eax]
mov ecx, dword [edx]
push ecx
call fcn.0043edc0
pop ecx
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
sub dword [eax], 4
mov edx, dword [0x54d750]
push edx
call sub.KERNEL32.DLL_TlsGetValue
mov ecx, dword [eax]
mov eax, dword [ecx]
test dword [eax], 0xb405
je 0x441f0b
mov edx, dword [0x54d750]
push edx
call sub.KERNEL32.DLL_TlsGetValue
mov ecx, dword [eax]
mov eax, dword [ecx]
push eax
call fcn.0043edc0
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x441f14
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
push ebx
mov ebx, dword [ebp + 8]
push ebx
call fcn.004418e0
pop ecx
test eax, eax
je 0x441fcc
mov dword [ebp - 0x50], 2
mov dword [ebp - 0x4c], 0x19
mov dword [ebp - 0x3c], 0x41
mov word [ebp - 0x1a], 0x3f
mov dword [ebp - 0x38], 1
mov eax, dword [ebx + 0x10]
mov dword [ebp - 0x44], eax
mov edx, dword [ebx + 8]
mov dword [ebp - 0x40], edx
lea ecx, [ebp - 0x50]
push ecx
call fcn.00441850
pop ecx
test eax, eax
jne 0x441fb8
test byte [ebp - 0x38], 1
je 0x441fb8
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
sub dword [eax], 4
mov edx, dword [0x54d750]
push edx
call sub.KERNEL32.DLL_TlsGetValue
mov ecx, dword [eax]
mov eax, dword [ecx]
test dword [eax], 0xb405
je 0x441fac
mov edx, dword [0x54d750]
push edx
call sub.KERNEL32.DLL_TlsGetValue
mov ecx, dword [eax]
mov eax, dword [ecx]
push eax
call fcn.0043edc0
pop ecx
lea edx, [ebp - 0x50]
push edx
call fcn.00441998
pop ecx
jmp 0x441fc2
lea ecx, [ebp - 0x50]
push ecx
call fcn.004419b0
pop ecx
lea eax, [ebp - 0x50]
push eax
call fcn.004418a4
pop ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44274c
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov ebx, dword [ebp + 8]
push ebx
call fcn.004418e0
pop ecx
test eax, eax
je 0x4427e6
lea eax, [ebp - 4]
push eax
mov edx, dword [ebx + 8]
push edx
mov ecx, dword [ebx + 0x10]
push ecx
call fcn.004422cc
add esp, 0xc
mov ebx, eax
test ebx, ebx
je 0x4427de
push ebx
call fcn.00431944
pop ecx
mov esi, eax
cmp dword [ebp - 4], 0
je 0x442794
push ebx
call fcn.0043b208
pop ecx
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
sub dword [eax], 4
mov edx, dword [0x54d750]
push edx
call sub.KERNEL32.DLL_TlsGetValue
mov ecx, dword [eax]
mov eax, dword [ecx]
test dword [eax], 0xb405
je 0x4427d1
mov edx, dword [0x54d750]
push edx
call sub.KERNEL32.DLL_TlsGetValue
mov ecx, dword [eax]
mov eax, dword [ecx]
push eax
call fcn.0043edc0
pop ecx
mov edx, dword [esi]
push edx
call fcn.004231dc
pop ecx
jmp 0x442855
push 0
call fcn.004419b0
pop ecx
mov ecx, dword [0x54d750]
push ecx
call sub.KERNEL32.DLL_TlsGetValue
mov eax, dword [eax]
mov edx, dword [eax - 4]
test byte [edx + 1], 1
jne 0x442855
call fcn.00425334
test ax, ax
jne 0x442855
mov ecx, dword [0x54d750]
push ecx
call sub.KERNEL32.DLL_TlsGetValue
sub dword [eax], 4
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov edx, dword [eax]
mov ecx, dword [edx]
test dword [ecx], 0xb405
je 0x442843
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov edx, dword [eax]
mov ecx, dword [edx]
push ecx
call fcn.0043edc0
pop ecx
push 0x539489
call fcn.00431944
pop ecx
push eax
call fcn.00423218
pop ecx
pop esi
pop ebx
pop ecx
pop ebp
ret