joyce8/EMBER2024-capa huggingface dataset:
Function at 0x72944179
Capabilities:
Get common file path
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x150
push esi
push 0xd
call dword [sym.imp.GDI32.dll_GetStockObject]
test eax, eax
je 0x7295d2ef
lea ecx, [ebp - 0x3c]
push ecx
push 0x3c
push eax
call dword [sym.imp.GDI32.dll_GetObjectA]
test eax, eax
je 0x7295d2ef
cmp byte [ebp - 0x25], 0xb2
je 0x7295d2ef
cmp byte [ebp - 0x25], 0xb1
je 0x7295d2ef
push 1
pop eax
pop esi
leave
ret
lea eax, [ebp - 0x150]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x729441bc
lea eax, [ebp - 0x150]
push 0x7296925c
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x150]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
mov dword [0x72a4e8a0], eax
je 0x729441bc
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x72969248
push eax
call esi
test eax, eax
mov dword [0x72a507b8], eax
je 0x729441bc
push 0x72969234
push dword [0x72a4e8a0]
call esi
test eax, eax
mov dword [0x72a507cc], eax
je 0x729441bc
push 0x72969220
push dword [0x72a4e8a0]
call esi
test eax, eax
mov dword [0x72a507ac], eax
je 0x729441bc
push 0x7296920c
push dword [0x72a4e8a0]
call esi
test eax, eax
mov dword [0x72a507d4], eax
je 0x729441bc
push 0x729691f8
push dword [0x72a4e8a0]
call esi
test eax, eax
mov dword [0x72a507a4], eax
je 0x729441bc
push 0x729691e4
push dword [0x72a4e8a0]
call esi
test eax, eax
mov dword [0x72a507bc], eax
je 0x729441bc
push 0x729691d0
push dword [0x72a4e8a0]
call esi
test eax, eax
mov dword [0x72a507b4], eax
je 0x729441bc
push 0x729691c0
push dword [0x72a4e8a0]
call esi
test eax, eax
mov dword [0x72a507c0], eax
je 0x729441bc
push 0x729691ac
push dword [0x72a4e8a0]
call esi
test eax, eax
mov dword [0x72a50798], eax
je 0x729441bc
push 0x7296919c
push dword [0x72a4e8a0]
call esi
test eax, eax
mov dword [0x72a5079c], eax
je 0x729441bc
call dword [0x72a507b8]
test eax, eax
je 0x729441bc
call dword [0x72a507cc]
mov edx, eax
and edx, 0xf
cmp edx, 2
jb 0x729441bc
cmp edx, 2
mov ecx, 0x3f0
jne 0x7295d490
mov esi, eax
and esi, ecx
cmp esi, 0x10
jb 0x729441bc
cmp edx, edx
jne 0x7295d490
mov edx, eax
and edx, ecx
cmp edx, 0x10
jne 0x7295d490
and eax, 0xfc00
cmp eax, 0x1000
jb 0x729441bc
push 1
pop eax
mov dword [0x72a4e898], eax
jmp 0x729441bf

Function at 0x7294426a
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 8]
push 4
push eax
push 0x80000003
push esi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x7295d182
mov ax, si
and esi, 0x3ff
shr ax, 0xa
test ax, ax
je 0x729442bd
cmp ax, 1
jne 0x7295d17b
cmp si, 4
je 0x7295d17b
cmp si, 0x16
je 0x7295d17b
push 2
pop eax
and byte [ebp + eax - 8], 0
inc eax
cmp dword [ebp + 0x10], eax
jb 0x7295d182
lea eax, [ebp - 8]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
xor eax, eax
pop esi
leave
ret 0xc
push 3
jmp 0x729442bf
mov eax, 0x80004005
jmp 0x729442de
Function at 0x72944bde
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
cmp dword [ebx + 0xc], 0
je 0x72944c47
movsx edx, word [ebx + 6]
mov ecx, dword [0x72a4ed84]
add edx, 7
and edx, 0xfffffffc
cmp edx, ecx
mov dword [ebp + 8], edx
ja 0x72944c66
mov eax, dword [0x72a4ed7c]
add dword [0x72a4ed7c], edx
sub ecx, edx
mov esi, dword [ebx + 8]
mov dword [0x72a4ed84], ecx
lea edi, [eax + 4]
movsx ecx, word [ebx + 6]
mov edx, ecx
mov dword [ebp + 8], 0xfffffffd
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
sub dword [ebp + 8], ebx
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 0xc]
lea ecx, [ebx + 3]
jmp 0x72944d55
push 0xd4
push 8
push dword [0x72a4e7cc]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
mov dword [ebx + 0xc], eax
jne 0x72944bf0
jmp 0x7295f614
mov edx, dword [0x72a4ed8c]
test edx, edx
je 0x72944cc9
mov eax, dword [0x72a4ed7c]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
add ecx, eax
mov eax, dword [0x72a4ed80]
sub ecx, eax
test eax, eax
je 0x72944ce4
lea edi, [ecx + edx]
cmp edi, 0x10000
ja 0x72944ce4
push 4
add ecx, edx
push 0x1000
push ecx
push eax
call esi
test eax, eax
je 0x7295f614
mov ecx, dword [0x72a4ed84]
mov eax, dword [0x72a4ed80]
add ecx, dword [0x72a4ed8c]
cmp eax, dword [0x72a4ed7c]
je 0x72944d2b
mov edx, dword [ebp + 8]
jmp 0x72944c07
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edx, dword [ebp - 0x20]
mov ecx, dword [0x72a4ed84]
mov dword [0x72a4ed8c], edx
jmp 0x72944c70
push 4
push 0x2000
push 0x10000
push 0
call esi
mov edi, eax
test edi, edi
je 0x7295f614
push 1
call fcn.72944a8e
mov edx, dword [0x72a4ed8c]
mov eax, edi
xor ecx, ecx
mov dword [0x72a4ed80], eax
mov dword [0x72a4ed7c], edi
mov dword [0x72a4ed84], ecx
mov dword [0x72a4ed88], ecx
jmp 0x72944c93
mov edx, dword [0x72a4ed90]
sub ecx, 4
add dword [0x72a4ed7c], 4
mov dword [eax], edx
mov dword [0x72a4ed90], eax
jmp 0x72944cc1
mov edx, dword [ebp + 8]
add esi, 4
inc ecx
add edx, ecx
cmp edx, 3
jge 0x72944d7d
movzx edx, byte [ecx - 3]
lea edi, [edx + eax + 4]
movzx edx, byte [ecx]
sub edx, 0
je 0x72944d47
dec edx
je 0x7295f626
dec edx
je 0x7295f61b
dec edx
dec edx
jne 0x72944d47
mov edx, dword [esi]
mov dword [edi], edx
jmp 0x72944d47
mov ecx, dword [ebx + 0xc]
mov edx, dword [ebp + 0x10]
lea ecx, [ecx + edx*4]
mov edx, dword [ecx]
mov dword [ecx], eax
mov dword [eax], edx
pop edi
pop esi
pop ebx
leave
ret 0xc
xor eax, eax
jmp 0x72944d8c
mov dx, word [esi]
mov word [edi], dx
jmp 0x72944d47
mov dl, byte [esi]
mov byte [edi], dl
jmp 0x72944d47
Function at 0x729454af
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov al, byte [0x729599f1]
push ebx
push esi
push edi
mov byte [ebp - 0x30c], al
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x30b]
rep stosd dword es:[edi], eax
mov esi, dword [ebp + 8]
xor ebx, ebx
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x30c]
push 0x104
push eax
push ebx
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x729455f7
mov al, byte [0x729599f1]
push 0x40
mov byte [ebp - 0x104], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x104]
push ebx
push eax
push ebx
lea eax, [ebp - 0x30c]
push ebx
push eax
call fcn.729455fe
add esp, 0x14
lea eax, [ebp - 0x30c]
push 0x7295a114
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x414]
push 0x4000
push eax
lea eax, [ebp - 0x30c]
push eax
call fcn.72945791
cmp eax, 0xffffffff
jne 0x7295d49d
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
lea eax, [ebp - 0x104]
push 0x7295a110
push eax
call edi
test eax, eax
je 0x7295d502
lea eax, [ebp - 0x104]
push 0x7295a108
push eax
call edi
test eax, eax
je 0x7295d502
lea eax, [ebp - 0x104]
push 0x7295a0fc
push eax
call edi
test eax, eax
je 0x7295d502
lea eax, [ebp - 0x104]
push 0x7295a0f4
push eax
call edi
test eax, eax
je 0x7295d502
lea eax, [ebp - 0x104]
push 0x7295a0e8
push eax
call edi
test eax, eax
je 0x7295d502
lea eax, [ebp - 0x104]
push 0x7295a0dc
push eax
call edi
test eax, eax
je 0x7295d502
pop edi
pop esi
pop ebx
leave
ret 4
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
lea eax, [ebp - 0x30c]
push eax
push ebx
mov ebx, 0x729692a4
push 0x72969298
push ebx
call edi
mov dword [esi + 4], eax
lea eax, [ebp - 0x30c]
push eax
push 0
push 0x7296928c
push ebx
call edi
mov dword [esi + 8], eax
lea eax, [ebp - 0x30c]
push eax
push 0
push 0x7296927c
push ebx
call edi
mov dword [esi + 0xc], eax
lea eax, [ebp - 0x30c]
push eax
push 0
push 0x72969274
push ebx
call edi
mov dword [esi + 0x10], eax
mov dword [esi], 1
jmp 0x729455f7
push 1
pop eax
mov dword [esi], eax
mov dword [esi + 8], eax
mov dword [esi + 4], eax
jmp 0x729455f7
Function at 0x7294639c
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
cmp dword [0x72a4ee48], 1
push ebx
push esi
push edi
mov ebx, 0x72a4edd0
jne 0x729463b4
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor edi, edi
cmp dword [0x72a4ef9c], 0xffffffff
jne 0x729463e2
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [0x72a4ef9c], eax
je 0x7296039d
call fcn.729464b2
mov esi, eax
cmp esi, edi
jne 0x72960330
cmp dword [0x72a4ee48], edi
je 0x7296035a
push dword [0x72a4ef9c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
cmp esi, edi
jne 0x72946451
cmp dword [0x72a4ee48], edi
je 0x7296036b
push 0xa8
call fcn.72946621
mov esi, eax
cmp esi, edi
je 0x7296039d
push esi
push dword [0x72a4ef9c]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
call fcn.72946665
cmp dword [0x72a4efa0], edi
jne 0x7296037f
cmp dword [0x72a4efa4], edi
jne 0x7296037f
mov dword [0x72a4efa4], esi
cmp dword [esi + 0x1c], edi
jne 0x72946466
call fcn.729466c1
cmp eax, edi
mov dword [esi + 0x1c], eax
je 0x72960394
cmp dword [esi + 0x20], edi
jne 0x7294647b
call fcn.729466f8
cmp eax, edi
mov dword [esi + 0x20], eax
je 0x72960394
mov eax, dword [esp + 0x10]
add eax, 0x8000
cmp eax, dword [esi + 0x70]
jbe 0x7294648c
mov dword [esi + 0x70], eax
call fcn.72a3d000
mov ax, word [esp + 0x14]
or word [esi + 0x30], ax
cmp dword [0x72a4ee48], 1
jne 0x729464aa
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
pop edi
pop esi
pop ebx
ret 8
push dword [0x72a4ef9c]
call dword [sym.imp.KERNEL32.dll_TlsFree]
or dword [0x72a4ef9c], 0xffffffff
cmp dword [0x72a4ee48], 1
jne 0x72960353
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, esi
jmp 0x729464ac
cmp dword [0x72a4efa4], edi
je 0x72946400
jmp 0x729463ee
cmp dword [0x72a4efa4], edi
je 0x7294640c
push 7
pop eax
jmp 0x729464ac
mov dword [0x72a4efa0], 1
mov dword [0x72a4efa4], edi
jmp 0x72946451
push dword [esp + 0x14]
call fcn.7294e2c0
cmp dword [0x72a4ee48], 1
jne 0x72960377
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x72960377

Function at 0x7294670f
Capabilities:
Get thread local storage value

Disassembly:
push esi
mov esi, ecx
push dword [0x72a4ef9c]
and dword [esi + 0x10], 0
and dword [esi + 0x14], 0
mov dword [esi + 4], 0x7295a290
mov dword [esi + 8], 0x7295a2b8
mov dword [esi + 0xc], 0x7295a2a0
mov dword [esi], 0x7295a300
mov dword [esi + 4], 0x7295a2f0
mov dword [esi + 8], 0x7295a2e0
mov dword [esi + 0xc], 0x7295a2c8
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
mov dword [esi + 0x18], eax
call fcn.72946763
mov eax, esi
pop esi
ret
Function at 0x7294918b
Capabilities:
Get thread local storage value

Disassembly:
push dword [0x72a4ef9c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov eax, dword [eax + 0x18]
mov ecx, dword [esp + 4]
mov edx, dword [eax + 0x14]
mov dword [eax + 0x14], ecx
mov dword [ecx], edx
ret 4

Function at 0x72949665
Capabilities:
Get thread local storage value

Disassembly:
call fcn.72949682
push dword [0x72a4ef9c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov eax, dword [eax + 0x18]
mov ecx, dword [eax + 0x14]
mov ecx, dword [ecx]
mov dword [eax + 0x14], ecx
ret

Function at 0x72949696
Capabilities:
Get thread local storage value

Disassembly:
push dword [0x72a4ef9c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov eax, dword [eax + 0x18]
mov eax, dword [eax + 0x14]
ret

Function at 0x7294999c
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push 0x1c
call fcn.72945484
mov ebx, eax
test ebx, ebx
je 0x72960da7
push edi
push esi
mov esi, dword [esp + 0x14]
mov edi, ebx
movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 0x18]
movsd dword es:[edi], dword [esi]
mov ecx, dword [eax]
push eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebx + 0x10], eax
call dword [ecx + 4]
push dword [0x72a4ef9c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
pop esi
pop edi
mov ecx, dword [esp + 8]
mov dword [ebx + 0x14], ecx
mov ecx, dword [eax + 0x48]
mov dword [eax + 0x48], ebx
mov dword [ebx + 0x18], ecx
xor eax, eax
pop ebx
ret 0xc
mov eax, 0x8007000e
jmp 0x729499e7

Function at 0x7294a0fd
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
lea eax, [ebp - 0xc]
push edi
push eax
lea eax, [ebp - 4]
and dword [ebp - 4], 0
push eax
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 8]
call fcn.7294a13f
mov esi, eax
test esi, esi
jl 0x72961910
cmp byte [0x72a4f290], 0
jne 0x72961971
mov eax, dword [ebp - 8]
pop edi
pop esi
leave
ret 4
cmp dword [ebp - 4], 0
push esi
jne 0x7296191c
call fcn.72a0e22c
call fcn.72945426
test eax, eax
je 0x7296196d
push esi
call fcn.72945426
mov edi, eax
or edi, 0x800a0000
push dword [0x72a4ef9c]
mov esi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
call esi
add eax, 0x78
push eax
push edi
call fcn.72a0e15b
push dword [0x72a4ef9c]
call esi
mov ecx, dword [ebp - 4]
push dword [0x72a4ef9c]
mov dword [eax + 0x80], ecx
call esi
add eax, 0x78
push eax
call fcn.72a0e1ae
xor edi, edi
jmp 0x72961933
push dword [ebp - 8]
push dword [ebp + 8]
call fcn.72a0f4e5
jmp 0x7294a136

Function at 0x7294a1dd
Capabilities:
Get thread local storage value

Disassembly:
push dword [0x72a4ef9c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp dword [eax + 0x24], 0
jne 0x72960e5d
push eax
call fcn.7294a203
mov al, byte [eax + 0x28]
shr eax, 2
and eax, 1
ret
xor eax, eax
ret

Function at 0x7294a49d
Capabilities:
Get thread local storage value

Disassembly:
push esi
push edi
push dword [0x72a4ef9c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
mov edi, dword [esp + 0xc]
push edi
call fcn.72a3d437
mov eax, dword [edi + 0x20]
pop edi
mov dword [esi + 0x14], eax
pop esi
ret 4
Function at 0x7294a64a
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x72a4e474]
push ebx
xor ebx, ebx
push esi
cmp eax, 0xffffffff
push edi
je 0x7295d721
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
xor ecx, ecx
cmp dword [eax + 0x30], 2
sete cl
movzx ecx, cl
cmp ecx, ebx
mov dword [ebp - 8], ecx
jne 0x7295d72b
mov esi, dword [ebp + 0xc]
mov edi, dword [sym.imp.USER32.dll_PeekMessageA]
push 1
push ebx
push ebx
lea eax, [ebp - 0x28]
push ebx
push eax
call edi
test eax, eax
je 0x7295d736
cmp dword [ebp - 0x24], 0x12
je 0x7294a6da
mov eax, dword [esi]
lea ecx, [ebp - 0x28]
push ecx
push esi
call dword [eax + 0x14]
test eax, eax
jne 0x7294a6c8
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
mov eax, dword [esi]
push ebx
push esi
call dword [eax + 0x30]
test eax, eax
jne 0x7294a68d
pop edi
pop esi
pop ebx
leave
ret 8
cmp dword [ebp + 8], 0xffffffff
jne 0x7295d7be
jmp 0x7294a6d3
mov dword [ebp - 4], ebx
mov eax, ebx
jmp 0x7294a66d
mov eax, dword [eax + 0x18]
mov dword [ebp - 0xc], eax
jmp 0x7294a684
mov eax, dword [esi]
push 0xffffffffffffffff
push esi
call dword [eax + 0x28]
cmp dword [ebp + 8], 2
je 0x7294a6d3
cmp eax, ebx
jne 0x7294a6c8
mov eax, dword [esi]
push esi
call dword [eax + 0x2c]
push ebx
push ebx
push ebx
lea eax, [ebp - 0x28]
push ebx
push eax
call edi
test eax, eax
jne 0x7294a6c8
cmp dword [ebp - 8], ebx
je 0x7295d7b3
push 0xff
push 0xffffffffffffffff
lea eax, [ebp - 0xc]
push ebx
push eax
push 1
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
cmp eax, ebx
jne 0x7295d7ae
mov ecx, dword [ebp - 4]
mov byte [ebp + 0xc], bl
cmp dword [ecx + 0x34], 3
jne 0x7295d7a3
mov byte [ebp + 0xc], 1
cmp byte [ebp + 0xc], bl
je 0x7294a6c8
jmp 0x7294a6d3
lea eax, [ebp + 0xc]
push eax
call fcn.729b2792
jmp 0x7295d795
cmp eax, 1
jmp 0x7295d798
call dword [sym.imp.USER32.dll_WaitMessage]
jmp 0x7294a6c8
push dword [ebp - 0x20]
call dword [sym.imp.USER32.dll_PostQuitMessage]
jmp 0x7294a6d3

Function at 0x7294aafa
Capabilities:
Get thread local storage value

Disassembly:
mov ecx, dword [0x72a4e474]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp ecx, 0xffffffff
je 0x7295e154
push ecx
call esi
mov ecx, dword [0x72a4e474]
neg eax
sbb eax, eax
neg eax
test al, al
je 0x7295e162
cmp ecx, 0xffffffff
je 0x7295e15b
push ecx
call esi
xor ecx, ecx
cmp dword [eax + 0x30], 2
sete cl
movzx eax, cl
pop esi
ret
xor eax, eax
jmp 0x7294ab1f
xor eax, eax
jmp 0x7294ab33
xor eax, eax
pop esi
ret

Function at 0x7294ab41
Capabilities:
Get thread local storage value

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
test edi, edi
je 0x7296096b
mov esi, dword [esp + 0x10]
test esi, esi
je 0x7296096b
push dword [0x72a4ef9c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [eax + 0x3c]
mov eax, dword [eax + 0x40]
dec eax
mov dword [esi], ecx
mov dword [edi], eax
xor eax, eax
pop edi
pop esi
ret 8
push 5
pop eax
jmp 0x7294ab74
Function at 0x7294ad6b
Capabilities:
Get thread local storage value

Disassembly:
push esi
push edi
push dword [0x72a4ef9c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
push dword [esp + 0xc]
mov eax, dword [esi + 0xa0]
mov edi, eax
or al, 1
shl edi, 0x1f
push esi
mov dword [esi + 0xa0], eax
sar edi, 0x1f
call fcn.7294adba
mov ecx, dword [esi + 0xa0]
xor edx, edx
test edi, edi
setne dl
xor edx, ecx
pop edi
and edx, 1
xor edx, ecx
mov dword [esi + 0xa0], edx
pop esi
ret 4
Function at 0x7294afea
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 0xc]
push ebx
push esi
cmp eax, 0xffffffff
push edi
jne 0x72961299
mov eax, dword [ebp + 8]
xor edi, edi
mov ax, word [eax + 0x2a]
cmp ax, di
je 0x7296128a
movzx eax, ax
dec eax
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], eax
push dword [0x72a4ef9c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], edi
cmp ecx, dword [ebp - 8]
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], ecx
ja 0x7294b07c
lea ecx, [ecx + ecx*2]
shl ecx, 4
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp + 8]
mov eax, ecx
add eax, dword [edx + 0x30]
mov eax, dword [eax]
mov esi, eax
inc esi
neg esi
sbb esi, esi
and esi, eax
cmp esi, edi
je 0x7294b068
mov eax, dword [esi + 0x18]
test byte [eax + 0x28], 2
jne 0x729612a6
inc dword [ebp - 0x14]
add ecx, 0x30
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], ecx
cmp eax, dword [ebp - 8]
jbe 0x7294b044
mov ecx, dword [ebp - 0xc]
cmp dword [ebp - 0x18], edi
jne 0x7294b030
cmp dword [ebp - 0x10], edi
jl 0x729613d3
pop edi
pop esi
pop ebx
leave
ret 8
mov dword [ebp - 0xc], 1
mov dword [ebp - 8], edi
jmp 0x7294b01b
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
xor edi, edi
jmp 0x7294b01b
mov eax, dword [eax + 0x28]
shr eax, 0xf
and eax, 3
cmp al, 2
jl 0x7294b068
cmp dword [0x72a4efa0], edi
jne 0x72961383
mov eax, dword [esi + 0x1c]
mov ebx, dword [eax]
cmp ebx, edi
je 0x7294b08a
mov ecx, ebx
call fcn.72a0b061
mov edi, dword [ebx]
test edi, edi
je 0x729613b6
mov eax, dword [edi + 0x2c]
test ah, 4
jne 0x7296137b
test al, 0x10
jne 0x7296137b
mov ecx, dword [edi + 0x1c]
lea eax, [edi + 0x1c]
push eax
call dword [ecx + 4]
mov eax, dword [ebp - 4]
test byte [eax + 0xa0], 1
je 0x7296135f
push 0
push edi
mov ecx, ebx
call fcn.72a0a827
mov edx, 0x800a9c68
cmp eax, edx
jne 0x7296138f
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 0xa0]
test cl, 1
je 0x7296138f
mov eax, dword [ebp - 4]
and ecx, 0xfffffffe
and dword [ebp - 0x18], 0
mov dword [eax + 0xa0], ecx
cmp word [esi + 0x58], 0
je 0x7296135f
test byte [edi + 0x2c], 8
je 0x7296135f
mov eax, dword [ebp - 4]
test byte [eax + 0x76], 2
jne 0x7296135f
cmp dword [ebp + 0xc], 0xffffffff
jne 0x7296135f
mov dword [ebp - 0x18], 1
mov eax, dword [edi + 0x2c]
and al, 0xf7
or al, 0x10
mov dword [edi + 0x2c], eax
mov eax, dword [esi + 0x18]
test byte [eax + 0x29], 2
jne 0x7296137b
push 0
push edi
call dword [sym.imp.ole32.dll_CoDisconnectObject]
mov edi, dword [edi + 4]
jmp 0x729612d9
mov ecx, esi
call fcn.72a1689b
jmp 0x729612c6
mov ecx, dword [ebp - 4]
test byte [ecx + 0xa0], 1
jne 0x729613a7
or dword [edi + 0x2c], 0x10
push edx
call fcn.72a18c72
jmp 0x7296133c
test eax, eax
jge 0x7296133c
cmp dword [ebp - 0x10], 0
jl 0x7296133c
mov dword [ebp - 0x10], eax
jmp 0x7296133c
mov esi, dword [ebx + 4]
test esi, esi
je 0x729613c9
mov ecx, esi
call fcn.72a0977d
mov esi, dword [esi + 4]
jmp 0x729613b9
mov ecx, dword [ebp - 0x1c]
xor edi, edi
jmp 0x7294b068
push dword [ebp - 0x10]
call fcn.72a18c72
jmp 0x7294b08a
Function at 0x7294b46a
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
xor edi, edi
push dword [0x72a4ef9c]
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, edi
je 0x7294b4c2
mov ebx, dword [eax + 0x18]
cmp ebx, edi
je 0x7294b4c2
cmp word [ebp + 0xc], di
jl 0x7296099f
cmp word [ebp + 0xc], 0x200
jg 0x7296099f
movsx eax, word [ebp + 0xc]
mov dword [ebp - 8], eax
push 1
push dword [ebp - 8]
push dword [ebp + 8]
call fcn.7294b4c9
mov esi, eax
cmp esi, edi
jne 0x729609a6
pop edi
pop esi
pop ebx
leave
ret 0x10
push 0x34
call fcn.72a0e22c
mov eax, dword [esi]
cmp eax, 2
je 0x729609b2
cmp eax, 8
jne 0x729609c7
mov eax, dword [esi + 0x24]
cmp eax, edi
je 0x729609c7
push eax
lea eax, [esi + 0x38]
push eax
push esi
call fcn.72a14fe2
mov dword [ebp - 4], eax
cmp dword [ebp + 0x14], edi
je 0x729609cf
mov dword [ebp - 4], edi
cmp dword [ebp + 0x10], edi
je 0x729609dd
push dword [esi + 4]
call fcn.72a2cc8d
pop ecx
push dword [esi + 4]
call fcn.72a166ee
test eax, eax
je 0x729609f5
cmp dword [ebp - 4], edi
jne 0x729609f5
mov dword [ebp - 4], 0x46
cmp dword [ebp + 0x14], edi
je 0x729609fd
mov dword [ebp - 4], edi
cmp dword [esi + 8], edi
je 0x72960a19
or dword [esi + 4], 0xffffffff
cmp esi, dword [ebx]
jne 0x72960a0c
mov dword [ebx], edi
cmp dword [ebp - 4], edi
je 0x72960a21
push dword [ebp - 4]
call fcn.72a0e22c
push esi
call fcn.7294d14e
jmp 0x72960a06
cmp esi, edi
je 0x7294b4c2
cmp word [ebp + 0xc], di
je 0x7294b4ab
jmp 0x7294b4c2

Function at 0x7294b4c9
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
xor esi, esi
cmp edi, esi
mov dword [ebp - 4], esi
jne 0x72960a38
push dword [0x72a4ef9c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov eax, dword [eax + 0x18]
mov ecx, dword [eax + 8]
movsx eax, word [eax + 0xc]
cmp eax, esi
jg 0x72960a58
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0xc
cmp edi, 0x100
jl 0x7294b4e0
call fcn.7294a1dd
test eax, eax
je 0x7294b4e0
push 5
call fcn.72a0e22c
mov dx, word [ecx]
test dx, dx
je 0x72960a7b
mov ebx, dword [ebp + 8]
cmp ebx, dword [ecx + 4]
je 0x72960a70
cmp edi, 0x100
jl 0x72960a7b
movsx edx, dx
cmp edi, edx
je 0x72960a89
test edi, edi
je 0x72960a89
add ecx, 0xc
inc esi
cmp esi, eax
jge 0x7294b4fe
jmp 0x72960a58
mov eax, dword [ecx + 8]
cmp dword [ebp + 0x10], 0
mov dword [ebp - 4], eax
je 0x7294b4fe
and word [ecx], 0
jmp 0x7294b4fe