joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42f2b4
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
push 1
call fcn.004336f4
pop ecx
mov dword [esp], eax
push 0xffffffffffffffff
push 2
call fcn.0043347c
add esp, 8
mov ebp, eax
push 0xffffffffffffffff
push 3
call fcn.0043347c
add esp, 8
mov ebx, eax
test ebx, ebx
je 0x42f2ee
test dword [ebx], 0xfffbffff
jne 0x42f2ee
xor ebx, ebx
push 0xffffffffffffffff
push 4
call fcn.0043347c
add esp, 8
mov esi, eax
test esi, esi
je 0x42f30a
test dword [esi], 0xfffbffff
jne 0x42f30a
xor esi, esi
push 0xffffffffffffffff
push 5
call fcn.0043347c
add esp, 8
mov edi, eax
test edi, edi
je 0x42f326
test dword [edi], 0xfffbffff
jne 0x42f326
xor edi, edi
cmp dword [esp], 0
je 0x42f399
test ebp, ebp
je 0x42f336
test byte [ebp], 0x1a
je 0x42f399
test ebx, ebx
je 0x42f340
test byte [ebx + 1], 0x80
je 0x42f399
test esi, esi
je 0x42f34a
test byte [esi + 1], 1
je 0x42f399
test edi, edi
je 0x42f353
test byte [edi], 0x80
je 0x42f399
push edi
call fcn.0043dee4
pop ecx
push eax
push esi
call fcn.0043e0e0
pop ecx
push eax
push ebx
push ebp
call fcn.0043df78
pop ecx
push eax
mov eax, dword [esp + 0x10]
push eax
call fcn.0042ebac
add esp, 0x14
mov ebx, eax
movzx edx, bx
push edx
mov ecx, dword [0x54d750]
push ecx
call sub.KERNEL32.DLL_TlsGetValue
add eax, 0x10
push eax
call fcn.0043e3f4
add esp, 8
jmp 0x42f3ae
push 0xffffffffffffffff
push 1
push 0
push 0xbb8
push 1
call fcn.00456f18
add esp, 0x14
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x430ab0
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov edx, dword [eax + 0xc]
mov ecx, dword [edx]
push ecx
call fcn.0043e0e0
pop ecx
mov edx, dword [eax]
cmp byte [edx], 0x5f
jne 0x430ae4
push 0xfffffffffffffffe
inc edx
push edx
push 0
push 0x3ed
push 0x10
call fcn.00457184
add esp, 0x14
ret
push 0xfffffffffffffffe
mov eax, dword [eax]
push eax
push 0
push 0x3ec
push 0xd
call fcn.00457184
add esp, 0x14
ret
Function at 0x432064
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
cmp dword [ebp + 0x18], 0
mov ebx, dword [ebp + 8]
je 0x432091
mov eax, dword [ebp + 0x18]
push eax
push ebx
mov edx, dword [ebp + 0x18]
push edx
call fcn.0043b120
pop ecx
push eax
call fcn.004ab480
add esp, 0xc
mov dword [ebp - 4], eax
jmp 0x432094
mov dword [ebp - 4], ebx
cmp word [ebp + 0xc], 0
je 0x432186
movzx eax, word [ebp + 0xc]
inc eax
mov bx, 1
mov edx, eax
shl edx, 3
lea edx, [edx + edx*2]
push edx
call fcn.0043b120
pop ecx
mov esi, eax
xor eax, eax
mov dword [esi], eax
mov edx, dword [ebp + 0x10]
mov eax, dword [0x54d750]
movzx edi, word [edx]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov edx, dword [eax + 0xc]
mov ecx, dword [edx]
mov ax, word [ecx + 0x10]
push eax
mov edx, dword [0x54d750]
push edx
call sub.KERNEL32.DLL_TlsGetValue
mov ecx, dword [eax + 0xc]
mov eax, dword [ecx]
pop edx
cmp dx, word [eax + 0x12]
jbe 0x432138
mov ecx, dword [0x54d750]
push ecx
call sub.KERNEL32.DLL_TlsGetValue
mov eax, dword [eax + 0xc]
mov edx, dword [eax]
movzx ecx, word [edx + 0x12]
cmp edi, ecx
jle 0x432138
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov edx, dword [eax + 0xc]
mov ecx, dword [edx]
movzx eax, word [ecx + 0x10]
push eax
mov edx, dword [0x54d750]
push edx
call sub.KERNEL32.DLL_TlsGetValue
mov ecx, dword [eax + 0xc]
mov eax, dword [ecx]
pop ecx
movzx edx, word [eax + 0x12]
sub ecx, edx
jmp 0x43213a
xor ecx, ecx
add edi, ecx
push edi
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov edx, dword [eax + 0xc]
pop eax
mov eax, dword [edx + eax*4 + 4]
add dword [ebp + 0x10], 2
push eax
call fcn.004437d8
movzx edx, bx
pop ecx
push esi
lea ecx, [edx + edx*2]
lea edi, [esi + ecx*8]
mov esi, eax
mov ecx, 6
rep movsd dword es:[edi], dword [esi]
pop esi
mov eax, dword [eax + 8]
push eax
call fcn.0043b238
pop ecx
inc ebx
cmp bx, word [ebp + 0xc]
jbe 0x4320bd
jmp 0x4321bb
mov edx, dword [0x54d750]
push edx
call sub.KERNEL32.DLL_TlsGetValue
mov ecx, dword [eax + 0xc]
mov eax, dword [ecx + 4]
test byte [eax + 1], 0x10
je 0x4321b9
mov eax, dword [eax + 8]
mov dx, word [eax + 0x14]
mov word [ebp + 0xc], dx
mov esi, dword [eax + 0xc]
test esi, esi
je 0x4321bb
push esi
call fcn.0043b238
pop ecx
jmp 0x4321bb
xor esi, esi
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov edx, dword [eax + 0xc]
mov edi, dword [edx]
push 0x53927c
push 0x18
call fcn.0043b69c
add esp, 8
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [ebx], eax
cmp dword [ebp + 0x18], 0
setne dl
and edx, 1
mov word [ebx + 0x16], dx
mov ecx, dword [edi + 0xc]
cmp word [ecx + 0xc], 0
je 0x432202
push edi
call fcn.0042c514
pop ecx
jmp 0x432205
mov eax, dword [edi + 8]
mov dword [ebx + 8], eax
mov edx, dword [ebp + 0x14]
mov dword [ebx + 4], edx
mov ecx, dword [0x54d750]
push ecx
call sub.KERNEL32.DLL_TlsGetValue
mov eax, dword [eax + 0x8c]
mov dword [ebx + 0x10], eax
mov eax, ebx
mov dx, word [ebp + 0xc]
mov word [ebx + 0x14], dx
mov dword [ebx + 0xc], esi
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x432238
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, dword [ebp + 0xc]
push ebx
mov eax, dword [ebp + 8]
push eax
push ebx
call fcn.0043b120
pop ecx
push eax
call fcn.004ab480
add esp, 0xc
mov edi, eax
push 0x53927c
push 0x18
call fcn.0043b69c
add esp, 8
mov ebx, eax
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov edx, dword [eax + 0xc]
mov esi, dword [edx]
mov dword [ebx], edi
mov word [ebx + 0x16], 1
mov eax, dword [esi + 0xc]
cmp word [eax + 0xc], 0
je 0x432294
push esi
call fcn.0042c514
pop ecx
jmp 0x432297
mov eax, dword [esi + 8]
mov dword [ebx + 8], eax
xor edx, edx
mov dword [ebx + 4], edx
mov ecx, dword [0x54d750]
push ecx
call sub.KERNEL32.DLL_TlsGetValue
mov eax, dword [eax + 0x8c]
xor edx, edx
mov dword [ebx + 0x10], eax
mov eax, ebx
mov word [ebx + 0x14], 0
mov dword [ebx + 0xc], edx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x43250c
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov esi, eax
mov eax, dword [ebx]
test eax, eax
je 0x432540
cmp eax, dword [esi + 0x84]
jg 0x432540
mov edx, dword [esi + 0x88]
cmp dword [edx + eax*8], 0
jne 0x432611
test eax, eax
jne 0x43256d
push 0x539288
call fcn.004499f4
pop ecx
cmp dword [ebx], 0
jne 0x432562
inc dword [0x5392a4]
mov ecx, dword [0x5392a4]
mov dword [ebx], ecx
push 0x539288
call fcn.00449a14
pop ecx
mov edi, dword [ebx]
cmp edi, dword [esi + 0x84]
jle 0x4325be
inc edi
shl edi, 3
push edi
mov eax, dword [esi + 0x88]
push eax
call fcn.0043b178
add esp, 8
mov dword [esi + 0x88], eax
mov edx, dword [ebx]
mov eax, dword [esi + 0x84]
sub edx, eax
shl edx, 3
push edx
push 0
shl eax, 3
add eax, dword [esi + 0x88]
add eax, 8
push eax
call fcn.004ab4f0
add esp, 0xc
mov edx, dword [ebx]
mov dword [esi + 0x84], edx
mov ecx, dword [esi + 0x88]
mov eax, dword [ebx]
mov dword [ecx + eax*8], ebx
mov edx, dword [ebx + 4]
push edx
call fcn.0043b120
pop ecx
mov ecx, dword [esi + 0x88]
mov edx, dword [ebx]
mov dword [ecx + edx*8 + 4], eax
mov eax, dword [ebx + 4]
push eax
push 0
mov ecx, dword [esi + 0x88]
mov eax, dword [ebx]
mov edx, dword [ecx + eax*8 + 4]
push edx
call fcn.004ab4f0
add esp, 0xc
cmp dword [ebx + 8], 0
je 0x432611
mov ecx, dword [esi + 0x88]
mov eax, dword [ebx]
mov edx, dword [ecx + eax*8 + 4]
push edx
call dword [ebx + 8]
pop ecx
mov ecx, dword [esi + 0x88]
mov eax, dword [ebx]
mov eax, dword [ecx + eax*8 + 4]
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x43265c
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, dword [ebp + 8]
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov esi, eax
mov eax, dword [ebx]
test eax, eax
je 0x4326d3
cmp eax, dword [esi + 0x84]
jg 0x4326d3
mov edx, dword [esi + 0x88]
cmp dword [edx + eax*8 + 4], 0
je 0x4326d3
cmp dword [ebx + 0xc], 0
je 0x4326a1
mov ecx, dword [esi + 0x88]
mov eax, dword [ecx + eax*8 + 4]
push eax
call dword [ebx + 0xc]
pop ecx
mov edx, dword [esi + 0x88]
mov ecx, dword [ebx]
mov eax, dword [edx + ecx*8 + 4]
push eax
call fcn.0043b208
pop ecx
mov edx, dword [esi + 0x88]
mov ecx, dword [ebx]
xor eax, eax
mov dword [edx + ecx*8 + 4], eax
mov edx, dword [esi + 0x88]
mov ecx, dword [ebx]
xor eax, eax
mov dword [edx + ecx*8], eax
xor edx, edx
mov dword [ebx], edx
pop esi
pop ebx
pop ebp
ret

Function at 0x4327b8
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov ebx, eax
mov eax, dword [ebp + 8]
movzx esi, word [eax + 4]
cmp esi, dword [ebx + 0x1c8]
jle 0x43281b
mov eax, esi
shl eax, 3
push eax
mov edx, dword [ebx + 0x1c4]
push edx
call fcn.0043b178
mov edi, eax
mov edx, esi
mov dword [ebx + 0x1c4], edi
add esp, 8
mov eax, dword [ebx + 0x1c8]
sub edx, eax
shl edx, 3
shl eax, 3
push edx
add eax, edi
push 0
push eax
call fcn.004ab4f0
add esp, 0xc
mov dword [ebx + 0x1c8], esi
mov eax, esi
shl eax, 3
add eax, dword [ebx + 0x1c4]
add eax, 0xfffffff8
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x43296c
Capabilities:
Get thread local storage value

Disassembly:
push ebx
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov ebx, eax
sub dword [ebx], 4
mov eax, dword [ebx]
cmp eax, dword [ebx + 0xc]
ja 0x432997
push 0
push 0
push 0
push 0x233b
call fcn.00457320
add esp, 0x10
mov edx, dword [ebx]
mov eax, dword [edx]
test dword [eax], 0xb405
je 0x4329aa
push eax
call fcn.0043edc0
pop ecx
pop ebx
ret

Function at 0x432a84
Capabilities:
Get thread local storage value

Disassembly:
push ebx
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov ebx, eax
add dword [ebx], 4
mov eax, dword [ebx]
cmp eax, dword [ebx + 4]
jne 0x432aa1
call fcn.00432adc
mov edx, dword [ebx]
mov eax, dword [edx - 4]
pop ebx
ret
Function at 0x432adc
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov ebx, eax
mov ebp, dword [ebx + 0xc]
mov edi, dword [ebx + 8]
sub ebp, edi
test ebp, ebp
jns 0x432afd
add ebp, 3
sar ebp, 2
mov eax, dword [ebx]
sub eax, edi
test eax, eax
jns 0x432b0b
add eax, 3
sar eax, 2
mov dword [esp], eax
mov esi, dword [ebx + 4]
sub esi, edi
test esi, esi
jns 0x432b1d
add esi, 3
sar esi, 2
mov eax, dword [ebx + 0x28]
add eax, 0x14
shl eax, 2
push eax
push edi
call fcn.0043b178
add esp, 8
mov dword [ebx + 8], eax
shl ebp, 2
mov edx, dword [esp]
shl edx, 2
add edx, dword [ebx + 8]
mov dword [ebx], edx
add ebp, dword [ebx + 8]
mov dword [ebx + 0xc], ebp
add dword [ebx + 0x28], 0x14
mov ecx, dword [ebx + 0x28]
shl ecx, 2
add ecx, dword [ebx + 8]
mov dword [ebx + 4], ecx
push 0x18
call fcn.0043b120
mov edi, eax
mov eax, dword [ebx + 8]
pop ecx
xor ecx, ecx
mov dword [eax + esi*4], edi
mov edx, dword [ebx + 8]
mov dword [edi], ecx
inc esi
cmp esi, dword [ebx + 0x28]
jl 0x432b5a
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x432b80
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov ebx, eax
mov esi, dword [ebp + 8]
shl esi, 2
add esi, dword [ebx + 8]
jmp 0x432bb3
sub dword [ebx], 4
mov eax, dword [ebx]
mov eax, dword [eax]
test dword [eax], 0xb405
je 0x432bb3
push eax
call fcn.0043edc0
pop ecx
cmp esi, dword [ebx]
jb 0x432b9d
pop esi
pop ebx
pop ebp
ret

Function at 0x432bbc
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov esi, eax
movzx eax, word [ebp + 0xc]
shl eax, 2
mov edx, dword [esi]
sub edx, eax
add edx, 0xfffffff8
mov dword [ebp - 4], edx
mov ecx, dword [ebp - 4]
mov edi, dword [ecx]
test byte [edi + 1], 1
jne 0x432c05
push 0
push str.hb_vmDo__
push 0
push 0x2337
call fcn.00457320
add esp, 0x10
mov eax, dword [esi + 0xc]
sub eax, dword [esi + 8]
test eax, eax
jns 0x432c12
add eax, 3
sar eax, 2
mov dword [ebx], eax
mov edx, dword [esi + 0x8c]
mov dword [ebx + 8], edx
call fcn.00443964
mov dword [ebx + 4], eax
xor ecx, ecx
mov word [ebx + 0x10], cx
mov word [ebx + 0xe], cx
mov word [ebx + 0xc], cx
mov word [ebx + 0x12], 0
mov dword [edi + 0xc], ebx
mov ax, word [ebp + 0xc]
mov word [edi + 0x10], ax
mov dx, word [ebp + 0xc]
mov word [edi + 0x12], dx
mov eax, dword [ebp - 4]
mov dword [esi + 0xc], eax
mov eax, edi
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x432c60
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov ebx, eax
mov eax, dword [ebx]
cmp eax, dword [ebx + 0xc]
ja 0x432c8f
push 0
push 0
push 0
push 0x233b
call fcn.00457320
add esp, 0x10
sub dword [ebx], 4
mov edx, dword [ebx]
mov eax, dword [edx]
test dword [eax], 0xb405
je 0x432ca5
push eax
call fcn.0043edc0
pop ecx
mov edx, dword [ebx]
cmp edx, dword [ebx + 0xc]
ja 0x432c8f
mov ecx, dword [esi]
shl ecx, 2
add ecx, dword [ebx + 8]
mov dword [ebx + 0xc], ecx
mov eax, dword [esi + 8]
mov dword [ebx + 0x8c], eax
mov edx, dword [esi + 4]
push edx
call fcn.004439a0
pop ecx
pop esi
pop ebx
pop ebp
ret

Function at 0x432cd0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, dword [ebp + 8]
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov esi, eax
test ebx, ebx
jge 0x432cfc
push 0
push 0
push 0
push 0x233b
call fcn.00457320
add esp, 0x10
mov eax, dword [esi + 8]
mov eax, dword [eax + ebx*4]
pop esi
pop ebx
pop ebp
ret

Function at 0x432d08
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, dword [ebp + 8]
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov esi, eax
test ebx, ebx
jl 0x432d34
push 0
push 0
push 0
push 0x233b
call fcn.00457320
add esp, 0x10
mov eax, dword [esi]
mov eax, dword [eax + ebx*4]
pop esi
pop ebx
pop ebp
ret

Function at 0x432d40
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, dword [ebp + 8]
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov esi, eax
test ebx, ebx
jge 0x432d6c
push 0
push 0
push 0
push 0x233b
call fcn.00457320
add esp, 0x10
mov eax, dword [esi + 0xc]
mov eax, dword [eax + ebx*4 + 4]
pop esi
pop ebx
pop ebp
ret

Function at 0x432dfc
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov edx, dword [eax + 0xc]
mov eax, dword [edx]
ret

Function at 0x432e10
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov edx, dword [eax + 0xc]
mov eax, dword [edx + 4]
ret

Function at 0x432e24
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
add eax, 0x10
ret

Function at 0x432f30
Capabilities:
Get thread local storage value

Disassembly:
cmp dword [0x5392a8], 0
je 0x432f5a
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
test eax, eax
je 0x432f5a
mov edx, dword [0x54d750]
push edx
call sub.KERNEL32.DLL_TlsGetValue
add eax, 0x1d0
ret
mov eax, 0x54d85c
ret

Function at 0x432fac
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
add eax, 0x4c
ret
Function at 0x43310c
Capabilities:
Get thread local storage value

Disassembly:
push ebx
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov ecx, eax
mov edx, dword [ecx + 0xc]
mov eax, dword [edx]
jmp 0x43312e
xor ebx, ebx
mov dword [edx + 4], ebx
mov eax, dword [edx]
mov edx, dword [ecx + 8]
mov eax, dword [edx + eax*4]
mov edx, dword [eax + 0xc]
cmp dword [edx + 4], 0
jne 0x433121
pop ebx
ret

Function at 0x43313c
Capabilities:
Get thread local storage value

Disassembly:
push ebx
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov edx, eax
mov eax, dword [edx + 0xc]
sub eax, dword [edx + 8]
test eax, eax
jns 0x433157
add eax, 3
sar eax, 2
xor ecx, ecx
test eax, eax
jle 0x433170
mov ebx, dword [edx + 8]
mov eax, dword [ebx + eax*4]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
inc ecx
test eax, eax
jg 0x433160
mov eax, ecx
pop ebx
ret

Function at 0x433174
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov edx, eax
mov eax, dword [edx + 0xc]
sub eax, dword [edx + 8]
test eax, eax
jns 0x433195
add eax, 3
sar eax, 2
jmp 0x4331a5
mov ecx, dword [edx + 8]
mov eax, dword [ecx + eax*4]
mov ecx, dword [eax + 0xc]
mov eax, dword [ecx]
mov ecx, ebx
add ebx, 0xffffffff
test ecx, ecx
jle 0x4331b2
test eax, eax
jg 0x43319a
test ebx, ebx
jge 0x4331c5
test eax, eax
jg 0x4331c8
mov edx, dword [edx + 8]
mov edx, dword [edx]
test byte [edx + 1], 1
jne 0x4331c8
or eax, 0xffffffff
pop ebx
pop ebp
ret

Function at 0x433428
Capabilities:
Get thread local storage value

Disassembly:
cmp dword [0x5392a8], 0
je 0x433452
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
test eax, eax
je 0x433452
mov edx, dword [0x54d750]
push edx
call sub.KERNEL32.DLL_TlsGetValue
add eax, 0x1e4
ret
mov eax, 0x54d870
ret

Function at 0x43347c
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
cmp ebx, 0xffffffff
jl 0x4334ef
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov edx, dword [eax + 0xc]
mov ecx, dword [edx]
movzx eax, word [ecx + 0x10]
cmp ebx, eax
jg 0x4334ef
cmp ebx, 0xffffffff
jne 0x4334ba
mov edx, dword [0x54d750]
push edx
call sub.KERNEL32.DLL_TlsGetValue
add eax, 0x10
jmp 0x4334cd
mov ecx, dword [0x54d750]
push ecx
call sub.KERNEL32.DLL_TlsGetValue
mov eax, dword [eax + 0xc]
mov eax, dword [eax + ebx*4 + 4]
test byte [eax + 1], 0x20
je 0x4334e2
push eax
call fcn.0043f598
pop ecx
cmp esi, 0x2000
je 0x4334f1
mov ecx, dword [eax]
mov edx, esi
and ecx, edx
jne 0x4334f1
cmp edx, 0xffffffff
je 0x4334f1
xor eax, eax
pop esi
pop ebx
pop ebp
ret
Function at 0x433520
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x433542
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov edx, dword [eax + 0xc]
mov ecx, dword [edx]
movzx eax, word [ecx + 0x10]
jmp 0x4335af
cmp ebx, 0xffffffff
jl 0x4335ad
mov edx, dword [0x54d750]
push edx
call sub.KERNEL32.DLL_TlsGetValue
mov ecx, dword [eax + 0xc]
mov eax, dword [ecx]
movzx edx, word [eax + 0x10]
cmp ebx, edx
jg 0x4335ad
cmp ebx, 0xffffffff
jne 0x433578
mov ecx, dword [0x54d750]
push ecx
call sub.KERNEL32.DLL_TlsGetValue
mov esi, eax
add esi, 0x10
jmp 0x43358a
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov edx, dword [eax + 0xc]
mov esi, dword [edx + ebx*4 + 4]
mov ebx, dword [esi]
and ebx, 0xfffbffff
test bh, 0x20
je 0x4335a7
push esi
call fcn.0043f598
pop ecx
mov eax, dword [eax]
and eax, 0xfffbffff
or ebx, eax
mov eax, ebx
jmp 0x4335af
xor eax, eax
pop esi
pop ebx
pop ebp
ret

Function at 0x4335f4
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
cmp ebx, 0xffffffff
jne 0x433610
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
add eax, 0x10
jmp 0x433647
test ebx, ebx
jl 0x433642
mov edx, dword [0x54d750]
push edx
call sub.KERNEL32.DLL_TlsGetValue
mov ecx, dword [eax + 0xc]
mov eax, dword [ecx]
movzx edx, word [eax + 0x10]
cmp ebx, edx
jg 0x433642
mov ecx, dword [0x54d750]
push ecx
call sub.KERNEL32.DLL_TlsGetValue
mov eax, dword [eax + 0xc]
mov eax, dword [eax + ebx*4 + 4]
jmp 0x433647
xor eax, eax
pop ebx
pop ebp
ret
test byte [eax + 1], 0x20
je 0x433654
push eax
call fcn.0043f598
pop ecx
test byte [eax + 1], 0x80
je 0x433664
mov edx, dword [eax + 8]
cmp word [edx + 0xc], 0
je 0x433668
xor ecx, ecx
jmp 0x43366d
mov ecx, 1
mov eax, ecx
pop ebx
pop ebp
ret

Function at 0x433674
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
cmp ebx, 0xffffffff
jne 0x433690
mov eax, dword [0x54d750]
push eax
call sub.KERNEL32.DLL_TlsGetValue
add eax, 0x10
jmp 0x4336c7
test ebx, ebx
jl 0x4336c2
mov edx, dword [0x54d750]
push edx
call sub.KERNEL32.DLL_TlsGetValue
mov ecx, dword [eax + 0xc]
mov eax, dword [ecx]
movzx edx, word [eax + 0x10]
cmp ebx, edx
jg 0x4336c2
mov ecx, dword [0x54d750]
push ecx
call sub.KERNEL32.DLL_TlsGetValue
mov eax, dword [eax + 0xc]
mov eax, dword [eax + ebx*4 + 4]
jmp 0x4336c7
xor eax, eax
pop ebx
pop ebp
ret
test byte [eax + 1], 0x20
je 0x4336d4
push eax
call fcn.0043f598
pop ecx
test byte [eax + 1], 0x80
je 0x4336e4
mov edx, dword [eax + 8]
cmp word [edx + 0xc], 0
jne 0x4336e8
xor ecx, ecx
jmp 0x4336ed
mov ecx, 1
mov eax, ecx
pop ebx
pop ebp
ret