joyce8/EMBER2024-capa huggingface dataset:
Function at 0x675290
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x18
mov edx, dword [ebp + 0xc]
push esi
push edi
mov ecx, dword [edx]
mov eax, ecx
mov edi, dword [edx + 4]
sar eax, 0x1f
not eax
mov dword [esp + 0x14], edi
test eax, eax
mov eax, ecx
je 0x6753d5
xor eax, 0x7fffffff
je 0x67549f
test edi, edi
jle 0x67549f
mov eax, dword [ebp + 0x10]
and ecx, 0x7fffffff
mov esi, dword [ebp + 0x20]
add eax, 0xe
shl ecx, 4
xorps xmm0, xmm0
add ecx, eax
mov dword [esp + 0xc], ecx
nop word [eax + eax]
movups xmm4, xmmword [ecx - 0xe]
movzx eax, word [ecx - 8]
mov word [esp + 8], ax
movaps xmm1, xmm4
movzx eax, word [ecx]
punpcklwd xmm1, xmm0
punpckhwd xmm4, xmm0
movaps xmm0, xmm1
psrld xmm0, 0x10
pslld xmm1, 0x10
cvtdq2ps xmm3, xmm0
mov word [esp + 0xa], ax
mov eax, dword [ebp + 0x14]
psrld xmm1, 0x10
mulps xmm3, xmmword [0x78d130]
movaps xmm5, xmmword [eax]
mulps xmm5, xmmword [0x7c1720]
mov eax, dword [ebp + 0x18]
cvtdq2ps xmm0, xmm1
addps xmm3, xmm0
movaps xmm0, xmm4
psrld xmm0, 0x10
pslld xmm4, 0x10
cvtdq2ps xmm1, xmm0
psrld xmm4, 0x10
mulps xmm1, xmmword [0x78d130]
cvtdq2ps xmm0, xmm4
mulps xmm3, xmm5
addps xmm1, xmm0
addps xmm3, xmmword [eax]
mulps xmm1, xmm5
addps xmm1, xmmword [eax]
mov eax, dword [ebp + 0x1c]
movaps xmm0, xmmword [eax]
cmpleps xmm3, xmmword [eax + 0x10]
cmpleps xmm0, xmm1
andps xmm0, xmm3
movmskps eax, xmm0
and eax, 7
cmp al, 7
jne 0x6753bc
mov eax, dword [esi + 8]
and eax, 0x3fffffff
cmp dword [esi + 4], eax
jne 0x6753a9
push 4
push esi
push 0x7d8950
call fcn.00467c00
add esp, 0xc
mov edx, dword [esi + 4]
mov ecx, dword [esi]
mov eax, dword [esp + 8]
mov dword [ecx + edx*4], eax
inc dword [esi + 4]
mov ecx, dword [esp + 0xc]
add ecx, 0x10
xorps xmm0, xmm0
mov dword [esp + 0xc], ecx
sub edi, 1
jne 0x6752f0
pop edi
pop esi
mov esp, ebp
pop ebp
ret
and eax, 0x7ffffffc
mov esi, dword [ebp + 0x18]
add eax, edx
and ecx, 3
mov edx, dword [ebp + 0x14]
mov dword [esp + 0xc], eax
add eax, 8
push dword [ebp + 0x20]
mov dword [esp + 0xc], eax
movzx eax, word [esp + 0x1a]
movd xmm4, eax
movzx eax, di
cvtdq2ps xmm4, xmm4
movd xmm0, eax
mulss xmm4, dword [0x7c1718]
mov eax, dword [ebp + 0x1c]
cvtdq2ps xmm0, xmm0
push eax
push esi
push edx
mulss xmm4, dword [edx + ecx*4]
mulss xmm0, dword [0x7c1718]
addss xmm4, dword [esi + ecx*4]
mulss xmm0, dword [edx + ecx*4]
addss xmm0, dword [esi + ecx*4]
comiss xmm0, dword [eax + ecx*4 + 0x10]
jbe 0x675452
push dword [ebp + 0x10]
push dword [esp + 0x20]
push dword [ebp + 8]
call fcn.00675290
add esp, 0x1c
pop edi
pop esi
mov esp, ebp
pop ebp
ret
movss xmm0, dword [eax + ecx*4]
comiss xmm0, xmm4
jbe 0x675474
push dword [ebp + 0x10]
push dword [esp + 0x1c]
push dword [ebp + 8]
call fcn.00675290
add esp, 0x1c
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
push edi
push dword [esp + 0x20]
push esi
call fcn.00675290
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push edi
push dword [esp + 0x38]
push esi
call fcn.00675290
add esp, 0x38
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x6765f0
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 8
push esi
push edi
mov edi, dword [esp + 0x18]
push dword [0x884adc]
mov esi, dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
shl esi, 4
push esi
push dword [eax + 0x2c]
call fcn.00460640
mov dword [esp + 0x14], eax
xor esi, esi
mov eax, dword [edi + 8]
add esp, 8
cdq
and edx, 3
add eax, edx
sar eax, 2
mov dword [esp + 8], eax
cmp dword [edi + 4], esi
jle 0x676674
mov edx, dword [esp + 0xc]
xor ecx, ecx
add edx, 8
nop dword [eax + eax]
mov eax, dword [edi]
lea edx, [edx + 0x10]
inc esi
mov eax, dword [ecx + eax]
mov dword [edx - 0x18], eax
mov eax, dword [edi]
mov eax, dword [ecx + eax + 4]
mov dword [edx - 0x14], eax
mov eax, dword [edi]
mov edi, dword [esp + 8]
mov eax, dword [ecx + eax + 8]
mov dword [edx - 0x10], eax
lea eax, [edi*4]
mov edi, dword [esp + 0x18]
add ecx, eax
cmp esi, dword [edi + 4]
jl 0x676640
movss xmm0, dword [esp + 0x1c]
mov esi, dword [esp + 0x14]
push ecx
movss dword [esp], xmm0
push 0
push dword [edi + 4]
mov edi, dword [esp + 0x18]
push edi
push esi
call fcn.00678a90
add esp, 0x14
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push dword [eax + 0x2c]
call fcn.00460680
add esp, 8
mov eax, esi
pop edi
pop esi
add esp, 8
ret

Function at 0x678e50
Capabilities:
Get thread local storage value

Disassembly:
push esi
mov esi, ecx
mov dword [esi + 4], 0x1ffff
mov dword [esi], vtable.hkgpConvexHull.0
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push 0x1b0
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 4]
test eax, eax
je 0x678e86
mov ecx, eax
call fcn.00680930
jmp 0x678e88
xor eax, eax
mov dword [esi + 8], eax
mov eax, esi
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
pop esi
ret

Function at 0x678f30
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
push edi
push dword [0x884adc]
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push 0x14
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, 0x14
mov word [eax + 4], cx
mov ecx, eax
call fcn.00678e50
mov esi, eax
mov ebx, dword [esi + 8]
test ebx, ebx
je 0x678f85
mov ecx, ebx
call fcn.00680ad0
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push 0x1b0
push ebx
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
mov dword [esi + 8], 0
mov ecx, dword [edi + 8]
call fcn.00682660
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
mov ecx, dword [edi + 0x10]
test ecx, ecx
je 0x678fb2
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [esi + 0x10], eax
mov eax, esi
pop edi
pop esi
pop ebx
ret
pop edi
mov dword [esi + 0x10], 0
mov eax, esi
pop esi
pop ebx
ret
Function at 0x680c30
Capabilities:
Get thread local storage value

Disassembly:
push esi
mov esi, ecx
call fcn.00678ea0
mov eax, dword [esp + 8]
test al, 1
je 0x680c82
test al, 4
jne 0x680c77
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0x14
cmp ax, cx
je 0x680c5a
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0x14
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4
Function at 0x690090
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 0x1c
push esi
mov esi, ecx
call fcn.00690070
cmp dword [esi + 0x10], 3
jle 0x6901a2
lea ecx, [esp + 0x10]
call fcn.00678df0
push dword [0x884adc]
mov word [esp + 0x1d], 0x101
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push 0x14
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, 0x14
mov word [eax + 4], cx
mov ecx, eax
call fcn.00678e50
mov dword [esi + 0xd4], eax
mov ecx, esi
lea eax, [esp + 4]
mov dword [esp + 4], 0
push eax
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], connect
call fcn.0068d6e0
mov ecx, dword [esi + 0xd4]
lea eax, [esp + 0x10]
push eax
push dword [esp + 0xc]
push dword [esp + 0xc]
call fcn.00679000
mov ecx, dword [esi + 0xd4]
call fcn.0067ad60
cmp eax, 3
je 0x690178
mov ecx, dword [esi + 0xd4]
test ecx, ecx
je 0x69013d
mov eax, dword [ecx]
push 1
call dword [eax]
mov eax, dword [esp + 0xc]
mov dword [esi + 0xd4], 0
mov dword [esp + 8], 0
test eax, eax
js 0x690171
and eax, 0x3fffffff
mov ecx, 0x7d8954
shl eax, 4
push eax
mov eax, dword [0x7d8954]
push dword [esp + 8]
call dword [eax + 0x10]
xor al, al
pop esi
add esp, 0x1c
ret
mov eax, dword [esp + 0xc]
mov dword [esp + 8], 0
test eax, eax
js 0x6901a2
and eax, 0x3fffffff
mov ecx, 0x7d8954
shl eax, 4
push eax
mov eax, dword [0x7d8954]
push dword [esp + 8]
call dword [eax + 0x10]
mov al, 1
pop esi
add esp, 0x1c
ret
Function at 0x69b1f4
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, ecx
mov dword [esi], vtable.hkgpJobQueue::IJob.0
test al, 1
je 0x69b22d
test al, 4
jne 0x69b222
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push 8
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
mov eax, esi
pop esi
ret 4
push 8
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4

Function at 0x69b240
Capabilities:
Get thread local storage value

Disassembly:
push ebx
mov ebx, ecx
push edi
mov edi, dword [ebx + 4]
sub edi, 1
mov ecx, dword [ebx]
js 0x69b29c
push esi
lea esi, [edi + 1]
lea esi, [edi + esi*2]
lea esi, [ecx + esi*4]
nop dword [eax + eax]
mov eax, dword [esi]
mov dword [esi - 4], 0
test eax, eax
js 0x69b286
and eax, 0x3fffffff
mov ecx, 0x7d8954
shl eax, 4
push eax
mov eax, dword [0x7d8954]
push dword [esi - 8]
call dword [eax + 0x10]
mov dword [esi - 8], 0
mov dword [esi], connect
sub esi, 0xc
sub edi, 1
jns 0x69b260
pop esi
mov eax, dword [ebx + 8]
mov dword [ebx + 4], 0
test eax, eax
js 0x69b2c5
and eax, 0x3fffffff
mov ecx, 0x7d8954
lea eax, [eax + eax*2]
shl eax, 2
push eax
mov eax, dword [0x7d8954]
push dword [ebx]
call dword [eax + 0x10]
mov eax, dword [esp + 0xc]
mov dword [ebx], 0
mov dword [ebx + 8], connect
test al, 1
je 0x69b307
test al, 4
jne 0x69b2fc
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push 0x10
push ebx
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, ebx
pop ebx
ret 4
push 0x10
push ebx
call fcn.0045b780
add esp, 8
pop edi
mov eax, ebx
pop ebx
ret 4

Function at 0x69b4f4
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, ecx
mov dword [esi], vtable.hkAabbTreeQueryUtils_struct_hkAabbTreeData::hkAabbTreeAabb__unsigned_int_::Collector.0
test al, 1
je 0x69b52d
test al, 4
jne 0x69b522
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push 0x18
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
mov eax, esi
pop esi
ret 4
push 0x18
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4

Function at 0x69b544
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, ecx
mov dword [esi], vtable.hkgpMesh::IConvexOverlap::IConvexShape.0
test al, 1
je 0x69b57d
test al, 4
jne 0x69b572
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push 0xc
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
mov eax, esi
pop esi
ret 4
push 0xc
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4
Function at 0x69b654
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, ecx
mov dword [esi], vtable.hkAabbTreeQueryUtils_struct_hkAabbTreeData::hkAabbTreeAabb__unsigned_int_::Collector.0
test al, 1
je 0x69b68d
test al, 4
jne 0x69b682
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push 0x60
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
mov eax, esi
pop esi
ret 4
push 0x60
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4

Function at 0x69b6d4
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, ecx
mov dword [esi], vtable.hkGskShape.0
test al, 1
je 0x69b70d
test al, 4
jne 0x69b702
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push 4
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
mov eax, esi
pop esi
ret 4
push 8
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4

Function at 0x69b7b4
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, ecx
mov dword [esi], vtable.hkgpMesh::IConvexOverlap::IConvexShape.0
test al, 1
je 0x69b7ed
test al, 4
jne 0x69b7e2
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push 8
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
mov eax, esi
pop esi
ret 4
push 8
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4

Function at 0x69b804
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, ecx
mov dword [esi], vtable.hkGskShape.0
test al, 1
je 0x69b83d
test al, 4
jne 0x69b832
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push 4
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
mov eax, esi
pop esi
ret 4
push 4
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4

Function at 0x69b850
Capabilities:
Get thread local storage value

Disassembly:
push esi
mov esi, ecx
call fcn.0068d2d0
mov eax, dword [esp + 8]
test al, 1
je 0x69b8a5
test al, 4
jne 0x69b897
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0xf0
cmp ax, cx
je 0x69b87a
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0xf0
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4
Function at 0x6aa3e4
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, ecx
mov dword [esi], vtable.hkProcess.0
test al, 1
je 0x6aa41d
test al, 4
jne 0x6aa412
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push 0x18
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
mov eax, esi
pop esi
ret 4
push 0x18
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4

Function at 0x6aa430
Capabilities:
Get thread local storage value

Disassembly:
sub ecx, 8
jmp method.hkRemoteObjectProcess.virtual_0
push esi
mov esi, ecx
call fcn.006aa140
mov eax, dword [esp + 8]
test al, 1
je 0x6aa482
test al, 4
jne 0x6aa477
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0x2c
cmp ax, cx
je 0x6aa45a
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0x2c
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4

Function at 0x6ab440
Capabilities:
Get thread local storage value

Disassembly:
push ebx
mov ebx, ecx
push esi
mov esi, dword [ebx + 0x18]
mov dword [ebx], vtable.hkProcessFactory.0
test esi, esi
je 0x6ab46f
push esi
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push 0x18
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
mov esi, dword [ebx + 0x10]
sub esi, 1
mov ecx, dword [ebx + 0xc]
js 0x6ab491
lea eax, [esi + esi*2]
push edi
lea edi, [ecx + eax*4]
mov ecx, edi
call fcn.0045d990
sub edi, 0xc
sub esi, 1
jns 0x6ab481
pop edi
mov eax, dword [ebx + 0x14]
mov dword [ebx + 0x10], 0
test eax, eax
js 0x6ab4bb
and eax, 0x3fffffff
mov ecx, 0x7d8954
lea eax, [eax + eax*2]
shl eax, 2
push eax
mov eax, dword [0x7d8954]
push dword [ebx + 0xc]
call dword [eax + 0x10]
mov dword [ebx + 0xc], 0
mov dword [ebx + 0x14], connect
pop esi
mov dword [ebx], vtable.hkBaseObject.0
pop ebx
ret

Function at 0x6ab730
Capabilities:
Get thread local storage value

Disassembly:
push esi
mov esi, ecx
call fcn.006ab440
mov eax, dword [esp + 8]
test al, 1
je 0x6ab782
test al, 4
jne 0x6ab777
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0x1c
cmp ax, cx
je 0x6ab75a
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0x1c
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4
Function at 0x6ab9c4
Capabilities:
Get thread local storage value

Disassembly:
sub ecx, 4
jmp method.hkpAabbTreeCollidableRaycaster.virtual_0
mov eax, dword [esp + 4]
push esi
mov esi, ecx
mov dword [esi + 4], vtable.hkAabbTreeQueryUtils_struct_hkAabbTreeData::hkAabbTreeAabb16__unsigned_short_int_::Collector.0
mov dword [esi], vtable.hkAabbTreeQueryUtils_struct_hkAabbTreeData::hkAabbTreeAabb__unsigned_short_int_::Collector.0
test al, 1
je 0x6aba04
test al, 4
jne 0x6ab9f9
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push 0x20
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
mov eax, esi
pop esi
ret 4
push 0x20
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4

Function at 0x6abd34
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, ecx
mov dword [esi], vtable.hkBaseObject.0
test al, 1
je 0x6abd83
test al, 4
jne 0x6abd78
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0xc
cmp ax, cx
je 0x6abd5b
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0xc
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4

Function at 0x6ac764
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, ecx
mov dword [esi], vtable.hkKdTreeBundleCastCollector.0
test al, 1
je 0x6ac79d
test al, 4
jne 0x6ac792
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push 0x14
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
mov eax, esi
pop esi
ret 4
push 0x14
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4
Function at 0x6ad5e0
Capabilities:
Get thread local storage value

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push ebp
mov ebp, dword [esp + 0xc]
push edi
mov edi, 0x200
cmp word [ebp], di
je 0x6ad6d3
push esi
nop dword [eax + eax]
cmp dword [ebx + 8], 0
je 0x6ad6d2
mov eax, dword [ebx + 4]
lea esi, [ebx + 4]
mov edx, dword [esi + 4]
movzx ecx, byte [ebx + 2]
shl ecx, 6
mov edx, dword [eax + edx*4 - 4]
movzx eax, word [ebx]
sub edx, ecx
add edx, eax
push edx
push ebp
call fcn.006ae8e0
movzx ecx, byte [ebx + 2]
mov eax, 0xffc0
imul ecx, eax
add esp, 8
add word [ebx], cx
jne 0x6ad66e
mov ecx, dword [esi + 4]
mov eax, dword [esi]
mov edi, dword [eax + ecx*4 - 4]
dec dword [esi + 4]
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push 0x200
push edi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
mov edi, 0x200
mov word [ebx], di
mov edx, dword [esi + 8]
test edx, edx
js 0x6ad6c8
mov ecx, dword [esi + 4]
add ecx, 3
mov eax, ecx
shr eax, 0x10
or ecx, eax
mov eax, ecx
shr eax, 8
or ecx, eax
mov eax, ecx
shr eax, 4
or ecx, eax
mov eax, ecx
shr eax, 2
or ecx, eax
mov eax, ecx
shr eax, 1
or eax, ecx
inc eax
cmp eax, 1
jge 0x6ad6ab
push 1
lea eax, [esi + 0xc]
push eax
jmp 0x6ad6b8
and edx, 0x3fffffff
cmp eax, edx
jge 0x6ad6c8
push eax
push 0
push 4
push esi
push 0x7d8954
call fcn.00467c80
add esp, 0x14
cmp word [ebp], di
jne 0x6ad600
pop esi
mov eax, dword [ebx + 8]
test eax, eax
je 0x6ad6ff
push eax
push dword [ebx + 4]
lea ecx, [ebp + 4]
push dword [ebp + 8]
push 0x7d8954
call fcn.006aed50
mov ax, word [ebx]
mov word [ebp], ax
mov dword [ebx + 8], 0
mov word [ebx], di
pop edi
pop ebp
pop ebx
ret
Function at 0x6adee0
Capabilities:
Execute anti-debugging instructions
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x698
push esi
push edi
push dword [0x884c50]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
mov esi, dword [edi + 4]
cmp esi, dword [edi + 0xc]
jae 0x6adf1d
mov dword [esi], str.TtProcessNnEntryNar
rdtsc
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x14]
lea eax, [esi + 0xc]
mov dword [esi + 4], ecx
mov dword [edi + 4], eax
mov edi, dword [ebp + 8]
movzx eax, byte [edi]
mov esi, dword [edi + 0x14]
mov edx, dword [edi + 0x10]
mov dword [esp + 0x1c], eax
add eax, 0xfffffffe
mov dword [esp + 0x14], esi
cmp eax, 0xc
ja case.0x6adf47.3
nop dword [eax]
movzx eax, byte [eax + 0x6ae0e4]
jmp dword [eax*4 + 0x6ae0d4]
lea eax, [esp + 0x13]
push eax
push 4
lea eax, [esp + 0x128]
push eax
lea eax, [esp + 0xac]
push eax
push edx
call fcn.006aeb60
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x27]
push eax
push 4
lea eax, [esp + 0x3fc]
push eax
lea eax, [esp + 0x100]
push eax
push esi
call fcn.006aeb60
mov ecx, dword [esp + 0x44]
mov esi, eax
mov edx, dword [esp + 0x40]
add esp, 0x28
movzx ecx, cl
and ecx, 0xf7
mov dword [esp + 0x14], esi
mov dword [esp + 0x1c], ecx
lea eax, [ecx - 2]
cmp eax, 0xc
jbe 0x6adf40
jmp case.0x6adf47.3
push dword [ebp + 0x14]
mov ecx, dword [edi + 0x20]
push dword [ebp + 0xc]
push esi
mov eax, dword [ecx]
push edx
call dword [eax + 0x18]
jmp case.0x6adf47.3
mov eax, dword [edi + 8]
mov dword [esp + 0x24], esi
mov esi, dword [ebp + 0xc]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x28], 0
mov dword [esp + 0x20], edx
mov dword [esp + 0x2c], esi
mov ecx, dword [edx + 8]
mov eax, dword [eax + 8]
push eax
push ecx
movss xmm4, dword [ecx + 0x5c]
mulss xmm4, dword [esi + 0x58]
movaps xmm2, xmmword [ecx + 0x40]
subps xmm2, xmmword [ecx + 0x50]
movss xmm3, dword [eax + 0x5c]
movaps xmm0, xmm4
mulss xmm3, dword [esi + 0x58]
movaps xmm1, xmmword [eax + 0x50]
subps xmm1, xmmword [eax + 0x40]
shufps xmm0, xmm0, 0
mulps xmm2, xmm0
movaps xmm0, xmm3
shufps xmm0, xmm0, 0
mulps xmm1, xmm0
addps xmm2, xmm1
movaps xmmword [esp + 0x98], xmm2
movss xmm0, dword [ecx + 0x9c]
movss xmm1, dword [eax + 0x9c]
mulss xmm1, xmm3
mulss xmm0, xmm4
mulss xmm1, dword [eax + 0xa0]
mulss xmm0, dword [ecx + 0xa0]
lea ecx, [esp + 0x48]
addss xmm1, xmm0
movss dword [esp + 0xa4], xmm1
call fcn.0046efa0
movzx eax, byte [edi + 1]
push dword [ebp + 0x14]
mov ecx, dword [esi]
push dword [ebp + 0x10]
lea edx, [eax + eax*4]
lea eax, [edi + 0x20]
add edx, edx
push eax
lea eax, [esp + 0x2c]
push eax
mov eax, dword [ecx + edx*8 + 0x16e4]
call eax
add esp, 0x10
push dword [0x884c50]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
mov esi, dword [edi + 4]
cmp esi, dword [edi + 0xc]
jae 0x6ae0cc
mov dword [esi], 0x77f5ec
rdtsc
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 0x18]
lea eax, [esi + 0xc]
mov dword [esi + 4], ecx
mov dword [edi + 4], eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret