joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4afb80
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp dword [eax + 0x7c], 0
je 0x4afbe6
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
movzx eax, word [eax + 0x80]
test eax, eax
jne 0x4afbe6
push 0x7d87d8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
dec dword [0x7d87f0]
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [eax + 0x7c], 0
push 0x7d87f8
call fcn.0048dab0
pop ecx
push 0x7d87d8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0x7d87c0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp dword [eax + 0x1654], 0
je 0x4afc16
push 0x7d87c0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.0048d580
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [eax + 0x1658], 1
push 0x7d87c0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebp + 8]
push eax
call fcn.004ae4c0
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
push 0
push eax
call fcn.004be070
add esp, 8
push 0x7d87c0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [eax + 0x1658], 0
push 0x7d87c0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp dword [eax + 0x7c], 0
jne 0x4afcf6
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
movzx eax, word [eax + 0x80]
test eax, eax
jne 0x4afcf6
push 0x7d87d8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
jmp 0x4afcc9
push 0xffffffffffffffff
push 0x7d87d8
push 0x7d87f8
call fcn.0048db80
add esp, 0xc
mov eax, dword [0x7d87f4]
test eax, eax
jne 0x4afcb5
inc dword [0x7d87f0]
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [eax + 0x7c], 1
push 0x7d87d8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop ebp
ret
Function at 0x4b02d0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp dword [eax + 0x7c], 0
je 0x4b0339
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
movzx eax, word [eax + 0x80]
test eax, eax
jne 0x4b0339
push 0x7d87d8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
dec dword [0x7d87f0]
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [eax + 0x7c], 0
push 0x7d87f8
call fcn.0048dab0
pop ecx
push 0x7d87d8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0x7d87c0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp dword [eax + 0x1654], 0
je 0x4b0369
push 0x7d87c0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.0048d580
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [eax + 0x1658], 1
push 0x7d87c0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
movzx eax, word [ebp + 0x10]
push eax
call fcn.004ae690
pop ecx
mov esi, eax
cmp dword [ebp + 0xc], 0
jge 0x4b03b1
movzx eax, si
test eax, eax
jne 0x4b03b1
or ebx, 0xffffffff
push 0x19
call fcn.004be030
pop ecx
jmp 0x4b03e7
mov eax, dword [ebp + 8]
push eax
call fcn.004ae4c0
pop ecx
movzx edx, si
push edx
push 0
mov edx, dword [ebp + 0xc]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ebx, eax
push 0
cmp ebx, 0xffffffff
je 0x4b03dc
mov edi, 1
jmp 0x4b03de
xor edi, edi
push edi
call fcn.004be070
add esp, 8
cmp ebx, 0xffffffff
jne 0x4b0405
mov eax, dword [ebp + 8]
push eax
call fcn.004ae4c0
pop ecx
push 1
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ebx, eax
push 0x7d87c0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [eax + 0x1658], 0
push 0x7d87c0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp dword [eax + 0x7c], 0
jne 0x4b04a8
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
movzx eax, word [eax + 0x80]
test eax, eax
jne 0x4b04a8
push 0x7d87d8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
jmp 0x4b047b
push 0xffffffffffffffff
push 0x7d87d8
push 0x7d87f8
call fcn.0048db80
add esp, 0xc
mov eax, dword [0x7d87f4]
test eax, eax
jne 0x4b0467
inc dword [0x7d87f0]
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [eax + 0x7c], 1
push 0x7d87d8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4b08f0
Capabilities:
Delete file
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, dword [ebp + 8]
push eax
call fcn.004a9b80
pop ecx
push eax
call fcn.004b1c10
pop ecx
mov dword [ebp + 8], eax
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp dword [eax + 0x7c], 0
je 0x4b096b
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
movzx eax, word [eax + 0x80]
test eax, eax
jne 0x4b096b
push 0x7d87d8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
dec dword [0x7d87f0]
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [eax + 0x7c], 0
push 0x7d87f8
call fcn.0048dab0
pop ecx
push 0x7d87d8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0x7d87c0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp dword [eax + 0x1654], 0
je 0x4b099b
push 0x7d87c0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.0048d580
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [eax + 0x1658], 1
push 0x7d87c0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ebx, eax
push 0
push ebx
call fcn.004be070
add esp, 8
push 0x7d87c0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [eax + 0x1658], 0
push 0x7d87c0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp dword [eax + 0x7c], 0
jne 0x4b0a76
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
movzx eax, word [eax + 0x80]
test eax, eax
jne 0x4b0a76
push 0x7d87d8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
jmp 0x4b0a49
push 0xffffffffffffffff
push 0x7d87d8
push 0x7d87f8
call fcn.0048db80
add esp, 0xc
mov eax, dword [0x7d87f4]
test eax, eax
jne 0x4b0a35
inc dword [0x7d87f0]
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [eax + 0x7c], 1
push 0x7d87d8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebp + 8]
push eax
call fcn.0049b640
pop ecx
mov eax, ebx
pop ebx
pop ebp
ret
Function at 0x4b0a90
Capabilities:
Get thread local storage value
Move file

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, dword [ebp + 8]
push eax
call fcn.004a9b80
pop ecx
push eax
call fcn.004b1c10
pop ecx
mov dword [ebp + 8], eax
mov eax, dword [ebp + 0xc]
push eax
call fcn.004a9b80
pop ecx
push eax
call fcn.004b1c10
pop ecx
mov dword [ebp + 0xc], eax
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp dword [eax + 0x7c], 0
je 0x4b0b1f
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
movzx eax, word [eax + 0x80]
test eax, eax
jne 0x4b0b1f
push 0x7d87d8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
dec dword [0x7d87f0]
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [eax + 0x7c], 0
push 0x7d87f8
call fcn.0048dab0
pop ecx
push 0x7d87d8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0x7d87c0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp dword [eax + 0x1654], 0
je 0x4b0b4f
push 0x7d87c0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.0048d580
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [eax + 0x1658], 1
push 0x7d87c0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
mov ebx, eax
push 0
push ebx
call fcn.004be070
add esp, 8
push 0x7d87c0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [eax + 0x1658], 0
push 0x7d87c0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp dword [eax + 0x7c], 0
jne 0x4b0c2e
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
movzx eax, word [eax + 0x80]
test eax, eax
jne 0x4b0c2e
push 0x7d87d8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
jmp 0x4b0c01
push 0xffffffffffffffff
push 0x7d87d8
push 0x7d87f8
call fcn.0048db80
add esp, 0xc
mov eax, dword [0x7d87f4]
test eax, eax
jne 0x4b0bed
inc dword [0x7d87f0]
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [eax + 0x7c], 1
push 0x7d87d8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebp + 8]
push eax
call fcn.0049b640
pop ecx
mov eax, dword [ebp + 0xc]
push eax
call fcn.0049b640
pop ecx
mov eax, ebx
pop ebx
pop ebp
ret
Function at 0x4b0df0
Capabilities:
Get thread local storage value
Set current directory

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, dword [ebp + 8]
push eax
call fcn.004a9b80
pop ecx
push eax
call fcn.004b1c10
pop ecx
mov dword [ebp + 8], eax
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp dword [eax + 0x7c], 0
je 0x4b0e6b
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
movzx eax, word [eax + 0x80]
test eax, eax
jne 0x4b0e6b
push 0x7d87d8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
dec dword [0x7d87f0]
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [eax + 0x7c], 0
push 0x7d87f8
call fcn.0048dab0
pop ecx
push 0x7d87d8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0x7d87c0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp dword [eax + 0x1654], 0
je 0x4b0e9b
push 0x7d87c0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.0048d580
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [eax + 0x1658], 1
push 0x7d87c0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov ebx, eax
push 0
push ebx
call fcn.004be070
add esp, 8
push 0x7d87c0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [eax + 0x1658], 0
push 0x7d87c0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp dword [eax + 0x7c], 0
jne 0x4b0f76
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
movzx eax, word [eax + 0x80]
test eax, eax
jne 0x4b0f76
push 0x7d87d8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
jmp 0x4b0f49
push 0xffffffffffffffff
push 0x7d87d8
push 0x7d87f8
call fcn.0048db80
add esp, 0xc
mov eax, dword [0x7d87f4]
test eax, eax
jne 0x4b0f35
inc dword [0x7d87f0]
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [eax + 0x7c], 1
push 0x7d87d8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebp + 8]
push eax
call fcn.0049b640
pop ecx
mov eax, ebx
pop ebx
pop ebp
ret
Function at 0x4b13a0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
push esi
push edi
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp dword [eax + 0x7c], 0
je 0x4b140c
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
movzx eax, word [eax + 0x80]
test eax, eax
jne 0x4b140c
push 0x7d87d8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
dec dword [0x7d87f0]
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [eax + 0x7c], 0
push 0x7d87f8
call fcn.0048dab0
pop ecx
push 0x7d87d8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0x7d87c0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp dword [eax + 0x1654], 0
je 0x4b143c
push 0x7d87c0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.0048d580
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [eax + 0x1658], 1
push 0x7d87c0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.00534f80
mov edi, eax
cmp edi, 0x41
jae 0x4b1472
mov dword [ebp - 4], 1
jmp 0x4b1479
mov dword [ebp - 4], 0x41
mov eax, dword [ebp - 4]
sub edi, eax
movzx eax, byte [ebp + 8]
inc eax
push eax
call fcn.00534fd0
pop ecx
call fcn.00534f80
mov esi, eax
cmp esi, 0x41
jae 0x4b149f
mov dword [ebp - 4], 1
jmp 0x4b14a6
mov dword [ebp - 4], 0x41
mov eax, dword [ebp - 4]
sub esi, eax
movzx eax, byte [ebp + 8]
cmp eax, esi
jne 0x4b14c0
xor bx, bx
push 0
call fcn.004be030
pop ecx
jmp 0x4b14dc
lea eax, [edi + 1]
push eax
call fcn.00534fd0
pop ecx
or eax, 0xffffffff
mov ebx, eax
or eax, 0xffffffff
movzx eax, ax
push eax
call fcn.004be030
pop ecx
push 0x7d87c0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [eax + 0x1658], 0
push 0x7d87c0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp dword [eax + 0x7c], 0
je 0x4b156b
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
movzx eax, word [eax + 0x80]
test eax, eax
jne 0x4b156b
push 0x7d87d8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
dec dword [0x7d87f0]
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [eax + 0x7c], 0
push 0x7d87f8
call fcn.0048dab0
pop ecx
push 0x7d87d8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
movzx eax, bx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4b1a50
Capabilities:
Get common file path
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
push esi
mov eax, dword [ebp + 0xc]
mov byte [eax], 0
push 0x7d87c0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp dword [eax + 0x1654], 0
je 0x4b1a8e
push 0x7d87c0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.0048d580
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [eax + 0x1658], 1
push 0x7d87c0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov ebx, eax
push 0
test ebx, ebx
je 0x4b1acc
mov esi, 1
jmp 0x4b1ace
xor esi, esi
push esi
call fcn.004be070
add esp, 8
push 0x7d87c0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [eax + 0x1658], 0
push 0x7d87c0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp dword [eax + 0x7c], 0
jne 0x4b1b7a
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
movzx eax, word [eax + 0x80]
test eax, eax
jne 0x4b1b7a
push 0x7d87d8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
jmp 0x4b1b4d
push 0xffffffffffffffff
push 0x7d87d8
push 0x7d87f8
call fcn.0048db80
add esp, 0xc
mov eax, dword [0x7d87f4]
test eax, eax
jne 0x4b1b39
inc dword [0x7d87f0]
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [eax + 0x7c], 1
push 0x7d87d8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.004bdff0
movzx eax, ax
test eax, eax
je 0x4b1b93
call fcn.004bdff0
movzx eax, ax
jmp 0x4b1c07
mov ebx, dword [ebp + 0xc]
movzx eax, byte [ebx + 1]
cmp eax, 0x3a
jne 0x4b1ba2
lea ebx, [ebx + 2]
mov eax, dword [ebp + 0xc]
mov edx, ebx
cmp eax, edx
je 0x4b1bbc
mov eax, dword [ebp + 0x10]
push eax
push ebx
mov eax, dword [ebp + 0xc]
push eax
call fcn.00532af0
add esp, 0xc
mov eax, dword [ebp + 0xc]
mov edx, eax
or eax, 0xffffffff
inc eax
cmp byte [edx + eax], 0
jne 0x4b1bc4
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx + eax - 1]
push eax
push 0x69f95e
call fcn.00532890
add esp, 8
test eax, eax
je 0x4b1bf4
mov eax, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
mov byte [edx + eax], 0
jmp 0x4b1c05
push 0x69f95c
mov eax, dword [ebp + 0xc]
push eax
call fcn.00532090
add esp, 8
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4b5190
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
push esi
push edi
mov eax, dword [0x7c09a0]
mov eax, dword [eax + 8]
push eax
call fcn.0046b2e0
pop ecx
call fcn.004a9060
push eax
call fcn.0046a8b0
pop ecx
push 0
call fcn.00469190
pop ecx
mov eax, 0x80020009
cmp dword [0x7ce040], eax
jne 0x4b51fe
mov eax, dword [0x7cdfd4]
push eax
call fcn.004b3250
pop ecx
mov edi, eax
or eax, 0xffffffff
inc eax
cmp byte [edi + eax], 0
jne 0x4b51da
inc eax
push eax
call fcn.00533970
pop ecx
mov ebx, eax
push edi
push ebx
call fcn.00531ba0
add esp, 8
push edi
call fcn.0049b640
pop ecx
jmp 0x4b5205
call fcn.004b4ab0
mov ebx, eax
push 0xffffffffffffffff
call fcn.0049d1e0
pop ecx
mov dword [ebp - 4], eax
mov edx, dword [0x7d8230]
push edx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov eax, dword [eax + 0x30]
mov eax, dword [eax]
mov eax, dword [eax + 0x14]
mov eax, dword [eax]
push eax
push ebx
mov eax, dword [0x7ce040]
push eax
push 0x3e9
mov eax, dword [ebp - 4]
push eax
call fcn.00492bd0
add esp, 0x14
mov esi, eax
mov eax, 0x80020009
cmp dword [0x7ce040], eax
jne 0x4b5256
push ebx
call fcn.00533210
pop ecx
mov eax, esi
test eax, eax
je 0x4b526a
push esi
call fcn.004a4500
pop ecx
push eax
call fcn.0049f7d0
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4b69e0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
call fcn.004b69a0
movzx eax, ax
push eax
mov eax, dword [ebp - 4]
lea eax, [eax + 0x10]
push eax
call fcn.004a0410
add esp, 8
mov esp, ebp
pop ebp
ret

Function at 0x4b6a20
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.004b69a0
mov edi, eax
mov si, 1
mov dword [ebp - 0x20], 0
movzx eax, di
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.004a2750
add esp, 8
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, dword [eax]
jmp 0x4b6a76
movzx eax, si
lea edx, [eax + 1]
mov esi, edx
push eax
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebx]
push eax
call fcn.004b68f0
add esp, 0xc
lea ebx, [ebx + 4]
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edx, ebx
mov eax, dword [eax + 4]
cmp edx, eax
jbe 0x4b6a5b
lea eax, [ebp - 0x20]
push eax
call fcn.004a4540
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4b6aa0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, dword [eax + 0x30]
xor si, si
jmp 0x4b6af9
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edx, ebx
mov ecx, dword [ebx]
mov ecx, dword [ecx + 8]
mov eax, dword [eax]
lea eax, [eax + ecx*4]
sub edx, eax
mov eax, edx
cdq
and edx, 3
add eax, edx
sar eax, 2
lea eax, [eax - 2]
mov esi, eax
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edx, dword [ebx]
mov edx, dword [edx + 8]
mov eax, dword [eax]
lea ebx, [eax + edx*4]
mov eax, dword [ebp + 8]
lea edx, [eax - 1]
mov dword [ebp + 8], edx
test eax, eax
jle 0x4b6b1a
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edx, ebx
mov eax, dword [eax]
cmp edx, eax
jne 0x4b6ab9
movzx eax, si
pop esi
pop ebx
pop ebp
ret

Function at 0x4b6b30
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
push 1
call fcn.0049dbf0
pop ecx
inc eax
push eax
call fcn.004b6aa0
pop ecx
push eax
mov eax, dword [ebp - 4]
lea eax, [eax + 0x10]
push eax
call fcn.004a0470
add esp, 8
mov esp, ebp
pop ebp
ret

Function at 0x4b6b70
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
push edi
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 0x28], eax
mov edx, dword [0x7d8230]
push edx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edx, dword [ebp - 0x28]
mov edx, dword [edx + 0x30]
mov edx, dword [edx]
mov edx, dword [edx + 8]
mov eax, dword [eax]
lea eax, [eax + edx*4]
mov dword [ebp - 0x24], eax
push 1
call fcn.004b6aa0
pop ecx
mov edi, eax
mov si, 1
mov dword [ebp - 0x20], 0
movzx eax, di
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.004a2750
add esp, 8
mov ebx, dword [ebp - 0x24]
jmp 0x4b6bed
movzx eax, si
lea edx, [eax + 1]
mov esi, edx
push eax
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebx]
push eax
call fcn.004b68f0
add esp, 0xc
lea ebx, [ebx + 4]
mov eax, dword [0x7d8230]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edx, ebx
mov eax, dword [eax + 0x30]
cmp edx, eax
jb 0x4b6bd2
lea eax, [ebp - 0x20]
push eax
call fcn.004a4540
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret