Many reverse engineers start the debugging phase from the entry point of the malware, which usually makes sense. However, some malicious code can start before the entry point. Some malware families use Thread Local Storage (TLS) to execute code that initializes every thread (which runs before the thread's actual code starts). This gives the malware the ability to escape the debugging and do some preliminary checks, and maybe run most of the malicious code this way while having benign code at the entry point.
In a data directory block of the PE header, there is an entry for TLS. It is commonly stored in the .tls section, and the structure of it looks like this:
The AddressOfCallBacks points to a null-terminated array (the last element is zero) of callback functions, which are to be called after each other, each time a thread is created. Any malware can set its malicious code to start inside the AddressOfCallBacks array and ensure that this code...