TLS Callback refers to the Address of Callbacks, which are functions that are often saved in the TLS section that is called into action whenever a process or thread is started or closed. Given that the Windows loader must first establish a thread before the process can begin, Even before the application reaches its entry point, the code contained in TLS Callback is executed. These routines and Callbacks are utilized by malware in order to store their harmful code or Anti-Debug techniques. Because they start breaking at EntryPoint, yet the malicious code has already been run, it makes it difficult for malware analysts to debug the code without becoming confused.