joyce8/EMBER2024-capa huggingface dataset:
Function at 0x421850
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44edb5
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x463040]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
mov eax, dword [edi + 4]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x1c], edi
test al, 1
jne 0x4218bb
push dword [0x46b9c8]
and eax, 0xfffffffc
mov esi, dword [eax + 8]
lea eax, [esi + 0x14]
neg esi
sbb esi, esi
and esi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4218bb
nop dword [eax]
cmp dword [eax], esi
je 0x4218dd
mov eax, dword [eax + 8]
test eax, eax
jne 0x4218b0
push dword [0x46b9c8]
lea eax, [edi + 1]
mov dword [ebp - 0x28], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x42195b
mov ecx, dword [eax + 4]
jmp 0x42195d
cmp dword [eax + 4], 0
je 0x4218bb
mov esi, dword [ebx]
mov dword [ebx], 0
mov dword [ebp - 4], 0
mov byte [ebp - 4], 2
test esi, esi
je 0x42190b
mov ecx, esi
xor esi, esi
push 1
push ecx
mov dword [ebp - 0x18], esi
mov eax, dword [ecx]
call eax
add esp, 8
mov dword [ebp - 4], 3
test esi, esi
je 0x421a22
mov eax, dword [esi]
push 0
push esi
call eax
add esp, 8
jmp 0x421a22
xor ecx, ecx
push ecx
push dword [ebp - 0x18]
mov edx, 0x28
call fcn.0041a400
mov esi, eax
add esp, 8
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0x422140
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x1c], 0
mov eax, dword [ebx]
mov dword [esi + 0x20], eax
mov dword [ebx], 0
mov eax, dword [edi + 4]
and eax, 0xfffffffc
mov edi, dword [eax + 8]
lock inc dword [edi + 0x18]
push esi
push 0
push 0
mov dword [esi + 0x1c], 1
push dword [edi + 0x14]
call dword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
test eax, eax
jne 0x421a0c
lea ebx, [edi + 0x38]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [esi + 0x14], 0
mov eax, dword [edi + 0x58]
test eax, eax
je 0x4219f5
mov dword [eax + 0x14], esi
jmp 0x4219f8
mov dword [edi + 0x54], esi
mov dword [edi + 0x58], esi
lea eax, [edi + 0x34]
mov ecx, 1
xchg dword [eax], ecx
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 0
call fcn.00421c60
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0043435c
mov esp, ebp
pop ebp
ret 4
Function at 0x421c60
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44da40
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x463040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi + 8]
test eax, eax
je 0x421cac
mov dword [ebp - 4], 0
mov eax, dword [eax + 0x20]
test eax, eax
je 0x421ca5
push 0
push eax
mov eax, dword [eax]
call eax
add esp, 8
mov dword [edi + 8], 0
mov esi, dword [edi + 4]
test esi, esi
je 0x421cef
push dword [0x46b9c8]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x421cdf
mov edx, dword [eax + 4]
test edx, edx
je 0x421cdf
xor eax, eax
nop dword [eax]
cmp dword [edx + eax*4], 0
lea ecx, [edx + eax*4]
je 0x421d00
inc eax
cmp eax, 2
jl 0x421cd0
push esi
call fcn.0043ca92
add esp, 4
mov dword [edi + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov al, byte [esi + 0x28]
mov byte [esi], al
mov dword [ecx], esi
jmp 0x421ce8
Function at 0x422a70
Capabilities:
Get thread local storage value

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44ef8b
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x30
push esi
push edi
mov eax, dword [0x463040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x20], esi
mov eax, dword [ebx + 0x10]
push dword [0x46b9c8]
mov dword [ebp - 0x3c], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x422acb
mov ecx, dword [eax + 4]
jmp 0x422acd
xor ecx, ecx
push ecx
push dword [ebp - 0x20]
mov edx, 0xb4
call fcn.0041a400
add esp, 8
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], 0
mov edi, dword [ebx + 8]
mov dword [ebp - 4], 0
mov ecx, dword [esi + 0x14]
xor esi, esi
mov dword [ebp - 0x1c], ecx
xor ecx, ecx
mov edx, dword [edi + 4]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x14], ecx
test edx, edx
je 0x422b20
mov esi, dword [edi]
mov ecx, edx
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x2c], edx
lock inc dword [edx + 8]
mov dword [eax + 0x14], 0
lea edx, [ecx + 8]
mov dword [eax + 0x18], 0x4232f0
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
mov dword [eax + 0x10], 0
mov dword [eax + 0x1c], 0
mov dword [eax + 0x20], 0
mov dword [eax + 0x24], 0x463bbc
mov dword [eax + 0x28], 0
mov dword [eax + 0x2c], 0
mov dword [ebp - 0x18], edx
test ecx, ecx
je 0x422b88
mov dword [eax + 0x28], esi
mov dword [eax + 0x2c], ecx
lock inc dword [edx]
jmp 0x422b8b
mov dword [ebp - 0x18], edx
mov esi, dword [ebx + 0xc]
lea edi, [eax + 0x30]
mov byte [ebp - 4], 2
lea ecx, [edi + 0x20]
mov dword [ebp - 0x28], edi
movups xmm0, xmmword [esi]
lea eax, [esi + 0x20]
push eax
movups xmmword [edi], xmm0
movups xmm0, xmmword [esi + 0x10]
movups xmmword [edi + 0x10], xmm0
call fcn.00403ef0
lea eax, [esi + 0x38]
mov byte [ebp - 4], 3
lea ecx, [edi + 0x38]
push eax
call fcn.00403ef0
mov esi, dword [ebp - 0x38]
mov eax, dword [ebp - 0x1c]
push dword [ebx + 0x14]
mov dword [esi + 0x80], eax
lea ecx, [esi + 0x94]
mov eax, dword [ebx + 0x10]
sub esp, 8
movups xmm0, xmmword [eax]
movups xmmword [esi + 0x84], xmm0
call fcn.00423920
mov ecx, dword [ebp - 0x14]
mov dword [esi + 0xb0], 0
mov byte [ebp - 4], 0
test ecx, ecx
je 0x422c12
mov edx, dword [ebp - 0x18]
or eax, 0xffffffff
lock xadd dword [edx], eax
jne 0x422c12
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0x20]
push esi
mov dword [ebp - 0x34], esi
lea ecx, [ecx + 0x14]
call fcn.00412160
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0x10
Function at 0x423200
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44da40
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x463040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [edi + 8]
test esi, esi
je 0x423281
mov eax, dword [esi + 0xb0]
test eax, eax
je 0x42323e
push eax
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
lea ecx, [esi + 0x94]
mov dword [ebp - 4], 0
cmp dword [ecx + 0x10], 0
je 0x42325c
mov eax, dword [ecx + 0xc]
push ecx
mov eax, dword [eax]
call eax
add esp, 4
lea ecx, [esi + 0x30]
call fcn.00417cb0
mov ecx, dword [esi + 0x2c]
test ecx, ecx
je 0x42327a
or eax, 0xffffffff
lock xadd dword [ecx + 8], eax
jne 0x42327a
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [edi + 8], 0
mov esi, dword [edi + 4]
test esi, esi
je 0x4232c0
push dword [0x46b9c8]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4232b0
mov edx, dword [eax + 4]
test edx, edx
je 0x4232b0
xor eax, eax
cmp dword [edx + eax*4], 0
lea ecx, [edx + eax*4]
je 0x4232d1
inc eax
cmp eax, 2
jl 0x4232a1
push esi
call fcn.0043ca92
add esp, 4
mov dword [edi + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov al, byte [esi + 0xb4]
mov byte [esi], al
mov dword [ecx], esi
jmp 0x4232b9
Function at 0x4251f0
Capabilities:
Get thread local storage value

Disassembly:
push esi
push edi
mov edi, ecx
mov esi, dword [edi + 8]
test esi, esi
je 0x42522c
mov esi, dword [esi + 0x20]
test esi, esi
je 0x425225
push ebx
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [esi + 4], eax
jne 0x425224
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lock xadd dword [esi + 8], ebx
dec ebx
jne 0x425224
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
pop ebx
mov dword [edi + 8], 0
mov esi, dword [edi + 4]
test esi, esi
je 0x42526f
push dword [0x46b9c8]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x42525f
mov edx, dword [eax + 4]
test edx, edx
je 0x42525f
mov eax, 4
nop
cmp dword [edx + eax*4], 0
lea ecx, [edx + eax*4]
je 0x425272
inc eax
cmp eax, 6
jl 0x425250
push esi
call fcn.0043ca92
add esp, 4
mov dword [edi + 4], 0
pop edi
pop esi
ret
mov al, byte [esi + 0x2c]
mov byte [esi], al
mov dword [ecx], esi
mov dword [edi + 4], 0
pop edi
pop esi
ret

Function at 0x425290
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44f360
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x463040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [edi + 8]
test esi, esi
je 0x425308
lea ecx, [esi + 0x68]
mov dword [ebp - 4], 0
cmp dword [ecx + 0x10], 0
je 0x4252d9
mov eax, dword [ecx + 0xc]
push ecx
mov eax, dword [eax]
call eax
add esp, 4
mov esi, dword [esi + 0x48]
test esi, esi
je 0x425301
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [esi + 4], eax
jne 0x425301
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lock xadd dword [esi + 8], ebx
dec ebx
jne 0x425301
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov dword [edi + 8], 0
mov esi, dword [edi + 4]
test esi, esi
je 0x42534f
push dword [0x46b9c8]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x42533f
mov edx, dword [eax + 4]
test edx, edx
je 0x42533f
xor eax, eax
nop dword [eax + eax]
cmp dword [edx + eax*4], 0
lea ecx, [edx + eax*4]
je 0x425361
inc eax
cmp eax, 2
jl 0x425330
push esi
call fcn.0043ca92
add esp, 4
mov dword [edi + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov al, byte [esi + 0x84]
mov byte [esi], al
mov dword [ecx], esi
jmp 0x425348
Function at 0x425830
Capabilities:
Get thread local storage value

Disassembly:
push esi
push edi
mov edi, ecx
mov esi, dword [edi + 8]
test esi, esi
je 0x42586c
mov esi, dword [esi + 0x10]
test esi, esi
je 0x425865
push ebx
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [esi + 4], eax
jne 0x425864
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lock xadd dword [esi + 8], ebx
dec ebx
jne 0x425864
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
pop ebx
mov dword [edi + 8], 0
mov esi, dword [edi + 4]
test esi, esi
je 0x4258af
push dword [0x46b9c8]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x42589f
mov edx, dword [eax + 4]
test edx, edx
je 0x42589f
mov eax, 4
nop
cmp dword [edx + eax*4], 0
lea ecx, [edx + eax*4]
je 0x4258b2
inc eax
cmp eax, 6
jl 0x425890
push esi
call fcn.0043ca92
add esp, 4
mov dword [edi + 4], 0
pop edi
pop esi
ret
mov al, byte [esi + 0x3c]
mov byte [esi], al
mov dword [ecx], esi
mov dword [edi + 4], 0
pop edi
pop esi
ret
Function at 0x426570
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44f560
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x463040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [edi + 8]
test esi, esi
je 0x4265da
lea ecx, [esi + 0x3c]
mov dword [ebp - 4], 0
cmp dword [ecx + 0x10], 0
je 0x4265b8
mov eax, dword [ecx + 0xc]
push ecx
mov eax, dword [eax]
call eax
add esp, 4
lea ecx, [esi + 0x18]
mov dword [ebp - 4], 1
cmp dword [ecx + 0x10], 0
je 0x4265d3
mov eax, dword [ecx + 0xc]
push ecx
mov eax, dword [eax]
call eax
add esp, 4
mov dword [edi + 8], 0
mov esi, dword [edi + 4]
test esi, esi
je 0x42661f
push dword [0x46b9c8]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x42660f
mov edx, dword [eax + 4]
test edx, edx
je 0x42660f
mov eax, 4
nop dword [eax]
cmp dword [edx + eax*4], 0
lea ecx, [edx + eax*4]
je 0x426630
inc eax
cmp eax, 6
jl 0x426600
push esi
call fcn.0043ca92
add esp, 4
mov dword [edi + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov al, byte [esi + 0x5c]
mov byte [esi], al
mov dword [ecx], esi
jmp 0x426618

Function at 0x428a10
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44f560
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x463040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [edi + 8]
test esi, esi
je 0x428a92
lea ecx, [esi + 0x80]
mov dword [ebp - 4], 0
cmp dword [ecx + 0x10], 0
je 0x428a5b
mov eax, dword [ecx + 0xc]
push ecx
mov eax, dword [eax]
call eax
add esp, 4
lea ecx, [esi + 0x48]
mov dword [ebp - 4], 0xffffffff
cmp byte [ecx + 0x1c], 0
je 0x428a83
mov dword [ebp - 4], 1
cmp dword [ecx + 0x10], 0
je 0x428a83
mov eax, dword [ecx + 0xc]
push ecx
mov eax, dword [eax]
call eax
add esp, 4
lea ecx, [esi + 8]
call fcn.00421a70
mov dword [edi + 8], 0
mov esi, dword [edi + 4]
test esi, esi
je 0x428ad4
push dword [0x46b9c8]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x428ac4
mov edx, dword [eax + 4]
test edx, edx
je 0x428ac4
mov eax, 4
cmp dword [edx + eax*4], 0
lea ecx, [edx + eax*4]
je 0x428ae5
inc eax
cmp eax, 6
jl 0x428ab5
push esi
call fcn.0043ca92
add esp, 4
mov dword [edi + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov al, byte [esi + 0xa0]
mov byte [esi], al
mov dword [ecx], esi
jmp 0x428acd
Function at 0x429080
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44da40
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x463040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ecx, dword [edi + 8]
test ecx, ecx
je 0x4290cf
add ecx, 0x18
mov dword [ebp - 4], 0
cmp dword [ecx + 0x10], 0
je 0x4290c8
mov eax, dword [ecx + 0xc]
push ecx
mov eax, dword [eax]
call eax
add esp, 4
mov dword [edi + 8], 0
mov esi, dword [edi + 4]
test esi, esi
je 0x429111
push dword [0x46b9c8]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x429101
mov edx, dword [eax + 4]
test edx, edx
je 0x429101
mov eax, 4
cmp dword [edx + eax*4], 0
lea ecx, [edx + eax*4]
je 0x429122
inc eax
cmp eax, 6
jl 0x4290f2
push esi
call fcn.0043ca92
add esp, 4
mov dword [edi + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov al, byte [esi + 0x40]
mov byte [esi], al
mov dword [ecx], esi
jmp 0x42910a
Function at 0x42b5b0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44da40
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x463040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [edi + 8]
test esi, esi
je 0x42b60d
cmp byte [esi + 0x64], 0
lea edx, [esi + 0x48]
je 0x42b5fe
mov dword [ebp - 4], 0
cmp dword [edx + 0x10], 0
je 0x42b5fe
mov eax, dword [edx + 0xc]
push edx
mov eax, dword [eax]
call eax
add esp, 4
lea ecx, [esi + 8]
call fcn.00421a70
mov dword [edi + 8], 0
mov esi, dword [edi + 4]
test esi, esi
je 0x42b64f
push dword [0x46b9c8]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x42b63f
mov edx, dword [eax + 4]
test edx, edx
je 0x42b63f
mov eax, 4
cmp dword [edx + eax*4], 0
lea ecx, [edx + eax*4]
je 0x42b660
inc eax
cmp eax, 6
jl 0x42b630
push esi
call fcn.0043ca92
add esp, 4
mov dword [edi + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov al, byte [esi + 0x84]
mov byte [esi], al
mov dword [ecx], esi
jmp 0x42b648

Function at 0x42b680
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44f980
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x463040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [edi + 8]
test esi, esi
je 0x42b73e
lea ebx, [esi + 0xa4]
lea ecx, [ebx + 0x1c]
mov dword [ebp - 4], 0
cmp dword [ecx + 0x10], 0
je 0x42b6d3
mov eax, dword [ecx + 0xc]
push ecx
mov eax, dword [eax]
call eax
add esp, 4
mov dword [ebp - 4], 1
cmp dword [ebx + 0x10], 0
je 0x42b6eb
mov eax, dword [ebx + 0xc]
push ebx
mov eax, dword [eax]
call eax
add esp, 4
lea ecx, [esi + 0x7c]
mov dword [ebp - 4], 2
cmp dword [ecx + 0x10], 0
je 0x42b706
mov eax, dword [ecx + 0xc]
push ecx
mov eax, dword [eax]
call eax
add esp, 4
lea ecx, [esi + 0x4c]
mov dword [ebp - 4], 3
cmp dword [ecx + 0x10], 0
je 0x42b721
mov eax, dword [ecx + 0xc]
push ecx
mov eax, dword [eax]
call eax
add esp, 4
mov ecx, dword [esi + 0x28]
test ecx, ecx
je 0x42b737
or eax, 0xffffffff
lock xadd dword [ecx + 8], eax
jne 0x42b737
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [edi + 8], 0
mov esi, dword [edi + 4]
test esi, esi
je 0x42b77f
push dword [0x46b9c8]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x42b76f
mov edx, dword [eax + 4]
test edx, edx
je 0x42b76f
xor eax, eax
nop
cmp dword [edx + eax*4], 0
lea ecx, [edx + eax*4]
je 0x42b791
inc eax
cmp eax, 2
jl 0x42b760
push esi
call fcn.0043ca92
add esp, 4
mov dword [edi + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov al, byte [esi + 0xdc]
mov byte [esi], al
mov dword [ecx], esi
jmp 0x42b778
Function at 0x42cc60
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44da40
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x463040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi + 8]
test eax, eax
je 0x42ccbc
lea esi, [eax + 4]
lea edx, [esi + 0xb8]
mov dword [ebp - 4], 0
cmp dword [edx + 0x10], 0
je 0x42ccae
mov eax, dword [edx + 0xc]
push edx
mov eax, dword [eax]
call eax
add esp, 4
mov ecx, esi
call fcn.00425760
mov dword [edi + 8], 0
mov esi, dword [edi + 4]
test esi, esi
je 0x42ccff
push dword [0x46b9c8]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x42ccef
mov edx, dword [eax + 4]
test edx, edx
je 0x42ccef
mov eax, 4
nop
cmp dword [edx + eax*4], 0
lea ecx, [edx + eax*4]
je 0x42cd10
inc eax
cmp eax, 6
jl 0x42cce0
push esi
call fcn.0043ca92
add esp, 4
mov dword [edi + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov al, byte [esi + 0xdc]
mov byte [esi], al
mov dword [ecx], esi
jmp 0x42ccf8

Function at 0x42cd30
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44fa60
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x463040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [edi + 8]
test esi, esi
je 0x42cdb5
lea ecx, [esi + 0x7c]
mov dword [ebp - 4], 0
cmp dword [ecx + 0x10], 0
je 0x42cd78
mov eax, dword [ecx + 0xc]
push ecx
mov eax, dword [eax]
call eax
add esp, 4
lea ecx, [esi + 0x4c]
mov dword [ebp - 4], 1
cmp dword [ecx + 0x10], 0
je 0x42cd93
mov eax, dword [ecx + 0xc]
push ecx
mov eax, dword [eax]
call eax
add esp, 4
add esi, 0x1c
mov dword [ebp - 4], 2
cmp dword [esi + 0x10], 0
je 0x42cdae
mov eax, dword [esi + 0xc]
push esi
mov eax, dword [eax]
call eax
add esp, 4
mov dword [edi + 8], 0
mov esi, dword [edi + 4]
test esi, esi
je 0x42cdff
push dword [0x46b9c8]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x42cdef
mov edx, dword [eax + 4]
test edx, edx
je 0x42cdef
mov eax, 4
nop dword [eax + eax]
cmp dword [edx + eax*4], 0
lea ecx, [edx + eax*4]
je 0x42ce10
inc eax
cmp eax, 6
jl 0x42cde0
push esi
call fcn.0043ca92
add esp, 4
mov dword [edi + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov al, byte [esi + 0x9c]
mov byte [esi], al
mov dword [ecx], esi
jmp 0x42cdf8
Function at 0x42d4f0
Capabilities:
Get thread local storage value

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44fafb
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x190
mov eax, dword [0x463040]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea edi, [esi + 0xb8]
push esi
lea ecx, [ebp - 0xe8]
mov dword [ebp - 0x30], edi
call fcn.00428980
movq xmm0, qword [esi + 0xac]
mov eax, dword [esi + 0xb4]
movq qword [ebp - 0x3c], xmm0
mov dword [ebp - 0x34], eax
mov dword [ebp - 4], 0
cmp dword [edi + 0x10], 0
je 0x42d696
mov ecx, dword [edi + 0x14]
mov eax, dword [ecx + 0xc]
test eax, eax
je 0x42d590
lea ecx, [ebp - 0xe8]
push ecx
push 0x432f90
push edi
call eax
add esp, 0xc
jmp 0x42d66d
mov eax, dword [ecx + 8]
lea ecx, [ebp - 0x1a0]
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0xe8]
push eax
call fcn.00428980
movq xmm0, qword [ebp - 0x3c]
mov eax, dword [ebp - 0x34]
movq qword [ebp - 0xf4], xmm0
mov dword [ebp - 0xec], eax
mov byte [ebp - 4], 1
lea eax, [ebp - 0x21]
push dword [0x46b9c8]
mov dword [ebp - 0x20], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x42d5dd
mov ecx, dword [eax + 4]
jmp 0x42d5df
xor ecx, ecx
push ecx
push dword [ebp - 0x2c]
mov edx, 0xc0
call fcn.00425650
mov edi, eax
mov dword [ebp - 0x18], 0
add esp, 8
lea eax, [ebp - 0x1a0]
lea ecx, [edi + 4]
push eax
call fcn.00428980
movq xmm0, qword [ebp - 0xf4]
lea ecx, [ebp - 0x20]
movq qword [edi + 0xb0], xmm0
mov eax, dword [ebp - 0xec]
mov dword [edi + 0xb8], eax
mov dword [edi], 0x433900
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x1c], 0
call fcn.00431a10
lea ecx, [ebp - 0x1a0]
call fcn.00425760
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 2
push eax
push dword [ebp - 0x30]
call dword [ebp - 0x2c]
add esp, 8
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x42d66d
push 0
push eax
mov eax, dword [eax]
call eax
add esp, 8
lea ecx, [ebp - 0xe8]
call fcn.00425760
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0043435c
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
lea ecx, [ebp - 0x20]
call fcn.0040cf40
mov byte [ebp - 4], 4
call fcn.0041a510
int3
Function at 0x430330
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44fd10
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x463040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [edi + 8]
test esi, esi
je 0x4303bc
lea ebx, [esi + 0xd8]
lea ecx, [ebx + 0x1c]
mov dword [ebp - 4], 0
cmp dword [ecx + 0x10], 0
je 0x43037f
mov eax, dword [ecx + 0xc]
push ecx
mov eax, dword [eax]
call eax
add esp, 4
mov dword [ebp - 4], 1
cmp dword [ebx + 0x10], 0
je 0x430397
mov eax, dword [ebx + 0xc]
push ebx
mov eax, dword [eax]
call eax
add esp, 4
lea ecx, [esi + 0x2c]
call fcn.00425760
mov ecx, dword [esi + 0x24]
test ecx, ecx
je 0x4303b5
or eax, 0xffffffff
lock xadd dword [ecx + 8], eax
jne 0x4303b5
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [edi + 8], 0
mov esi, dword [edi + 4]
test esi, esi
je 0x4303ff
push dword [0x46b9c8]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4303ef
mov edx, dword [eax + 4]
test edx, edx
je 0x4303ef
xor eax, eax
nop dword [eax]
cmp dword [edx + eax*4], 0
lea ecx, [edx + eax*4]
je 0x430411
inc eax
cmp eax, 2
jl 0x4303e0
push esi
call fcn.0043ca92
add esp, 4
mov dword [edi + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov al, byte [esi + 0x110]
mov byte [esi], al
mov dword [ecx], esi
jmp 0x4303f8