joyce8/EMBER2024-capa huggingface dataset:
Function at 0x70a0d0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x774f23
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x69bc80]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
xor ebx, ebx
or eax, 0xffffffff
mov dword [esi + 4], eax
mov dword [esi + 8], ebx
mov byte [esi + 0xc], bl
mov dword [esi + 0x18], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], eax
mov byte [esi + 0x1c], bl
xor eax, eax
mov dword [esi], 0x6a4b80
mov byte [esi + 0x20], 0x20
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
push 0x18
mov dword [esp + 0x24], ebx
mov dword [esi + 0x34], eax
call fcn.007562f4
mov edi, eax
add esp, 4
mov dword [esp + 0x14], edi
mov byte [esp + 0x20], 1
cmp edi, ebx
je 0x70a19f
push 1
mov dword [edi], 0x69d7b0
mov dword [edi + 4], ebx
mov dword [edi + 0xc], ebx
mov dword [edi + 8], ebx
mov byte [edi + 0x10], 1
mov dword [edi + 0x14], ebx
call fcn.00755936
add esp, 4
cmp dword [edi + 0x14], 1
mov dword [edi + 4], eax
mov dword [edi + 0xc], 1
mov dword [edi + 8], 1
jne 0x70a187
mov byte [eax], bl
mov dword [esi + 0x38], edi
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret
mov dword [esi + 0x38], ebx
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret

Function at 0x70a1c0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x774f23
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x69bc80]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
xor ebx, ebx
or eax, 0xffffffff
mov dword [esi + 4], eax
mov dword [esi + 8], ebx
mov byte [esi + 0xc], bl
mov dword [esi + 0x18], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], eax
mov byte [esi + 0x1c], bl
xor eax, eax
mov dword [esi], 0x6a4bac
mov byte [esi + 0x20], 0x21
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
push 0x18
mov dword [esp + 0x24], ebx
mov dword [esi + 0x34], eax
call fcn.007562f4
mov edi, eax
add esp, 4
mov dword [esp + 0x14], edi
mov byte [esp + 0x20], 1
cmp edi, ebx
je 0x70a28f
push 1
mov dword [edi], 0x69d7b0
mov dword [edi + 4], ebx
mov dword [edi + 0xc], ebx
mov dword [edi + 8], ebx
mov byte [edi + 0x10], 1
mov dword [edi + 0x14], ebx
call fcn.00755936
add esp, 4
cmp dword [edi + 0x14], 1
mov dword [edi + 4], eax
mov dword [edi + 0xc], 1
mov dword [edi + 8], 1
jne 0x70a277
mov byte [eax], bl
mov dword [esi + 0x38], edi
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret
mov dword [esi + 0x38], ebx
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret
Function at 0x70a2b0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x774f23
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x69bc80]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
xor ebx, ebx
or eax, 0xffffffff
mov dword [esi + 4], eax
mov dword [esi + 8], ebx
mov byte [esi + 0xc], bl
mov dword [esi + 0x18], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], eax
mov byte [esi + 0x1c], bl
xor eax, eax
mov dword [esi], 0x6a4c04
mov byte [esi + 0x20], 0x22
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
push 0x18
mov dword [esp + 0x24], ebx
mov dword [esi + 0x34], eax
call fcn.007562f4
mov edi, eax
add esp, 4
mov dword [esp + 0x14], edi
mov byte [esp + 0x20], 1
cmp edi, ebx
je 0x70a37f
push 1
mov dword [edi], 0x69d7b0
mov dword [edi + 4], ebx
mov dword [edi + 0xc], ebx
mov dword [edi + 8], ebx
mov byte [edi + 0x10], 1
mov dword [edi + 0x14], ebx
call fcn.00755936
add esp, 4
cmp dword [edi + 0x14], 1
mov dword [edi + 4], eax
mov dword [edi + 0xc], 1
mov dword [edi + 8], 1
jne 0x70a367
mov byte [eax], bl
mov dword [esi + 0x38], edi
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret
mov dword [esi + 0x38], ebx
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret
Function at 0x70a3a0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x774f5e
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x69bc80]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
xor ebx, ebx
or eax, 0xffffffff
mov dword [esi + 4], eax
mov dword [esi + 8], ebx
mov byte [esi + 0xc], bl
mov dword [esi + 0x18], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], eax
mov byte [esi + 0x1c], bl
xor eax, eax
mov dword [esi], 0x6a4ce0
mov byte [esi + 0x20], 0x35
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
push 0x18
mov dword [esp + 0x28], ebx
mov dword [esi + 0x3c], eax
call fcn.007562f4
mov edi, eax
add esp, 4
mov dword [esp + 0x18], edi
mov byte [esp + 0x24], 1
lea ebp, [ebx + 1]
cmp edi, ebx
je 0x70a459
push ebp
mov dword [edi], 0x69d7b0
mov dword [edi + 4], ebx
mov dword [edi + 0xc], ebx
mov dword [edi + 8], ebx
mov byte [edi + 0x10], 1
mov dword [edi + 0x14], ebx
call fcn.00755936
add esp, 4
mov dword [edi + 4], eax
mov dword [edi + 0xc], ebp
mov dword [edi + 8], ebp
cmp dword [edi + 0x14], ebp
jne 0x70a45b
mov byte [eax], bl
jmp 0x70a45b
xor edi, edi
push 0x18
mov byte [esp + 0x28], bl
mov dword [esi + 0x40], edi
call fcn.007562f4
mov edi, eax
add esp, 4
mov dword [esp + 0x18], edi
mov byte [esp + 0x24], 2
cmp edi, ebx
je 0x70a4af
push ebp
mov dword [edi], 0x69d7b0
mov dword [edi + 4], ebx
mov dword [edi + 0xc], ebx
mov dword [edi + 8], ebx
mov byte [edi + 0x10], 1
mov dword [edi + 0x14], ebx
call fcn.00755936
add esp, 4
mov dword [edi + 4], eax
mov dword [edi + 0xc], ebp
mov dword [edi + 8], ebp
cmp dword [edi + 0x14], ebp
jne 0x70a4aa
mov byte [eax], bl
mov dword [esi + 0x44], edi
jmp 0x70a4b2
mov dword [esi + 0x44], ebx
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x70a6c0
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x774f96
mov eax, dword fs:[0]
push eax
sub esp, 0x3a8
mov eax, dword [0x69bc80]
xor eax, esp
mov dword [esp + 0x3a0], eax
push ebx
push esi
push edi
mov eax, dword [0x69bc80]
xor eax, esp
push eax
lea eax, [esp + 0x3b8]
mov dword fs:[0], eax
mov ebx, dword [ebp + 0xc]
or eax, 0xffffffff
xor edi, edi
push 0x2c4
mov dword [esp + 0x44], eax
mov dword [esp + 0x54], eax
lea eax, [esp + 0x64]
push edi
push eax
mov dword [esp + 0x24], ecx
mov dword [esp + 0x50], edi
mov byte [esp + 0x54], 0
mov dword [esp + 0x60], edi
mov dword [esp + 0x58], edi
mov byte [esp + 0x64], 0
mov dword [esp + 0x48], 0x6a49c8
mov byte [esp + 0x68], 0x64
call fcn.00755e40
add esp, 0xc
mov dword [esp + 0x324], edi
mov dword [esp + 0x3c0], edi
call fcn.00712330
mov ecx, eax
call fcn.00712870
mov ecx, 0x7cad88
mov dword [ebx + 0x1d0], eax
call fcn.006ec710
cmp al, 1
jne 0x70a77e
mov dword [ebx + 0x1d0], edi
xor eax, eax
lea esi, [ebx + 0x270]
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
lea ecx, [esp + 0x14]
mov dword [esi + 0x14], eax
push ecx
lea edx, [esp + 0x330]
mov dword [esi + 0x18], eax
push edx
mov dword [esi + 0x1c], eax
mov dword [esp + 0x1c], 0x80
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
je 0x70a81c
mov eax, dword [esp + 0x14]
dec eax
push eax
lea ecx, [esp + 0x330]
push ecx
lea ecx, [esp + 0x24]
call fcn.006b9830
push 0x20
push esi
lea ecx, [esp + 0x24]
mov byte [esp + 0x3c8], 1
call fcn.006eb3f0
cmp dword [esp + 0x38], 0x10
mov byte [esp + 0x3c0], 0
mov dword [esp + 0x1c], 0x6a0f10
jb 0x70a80b
mov edx, dword [esp + 0x24]
push edx
call fcn.00755e35
add esp, 4
mov dword [esp + 0x38], 0xf
mov dword [esp + 0x34], edi
mov byte [esp + 0x24], 0
mov eax, dword [ebp + 8]
and eax, 3
or eax, 0x10000000
mov byte [ebx + 0x28f], 0
mov dword [esp + 0x60], eax
mov ecx, 0xb0
mov esi, ebx
lea edi, [esp + 0x64]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x18]
call fcn.007037e0
movzx cx, al
lea eax, [ebx + 0x134]
movzx esi, cx
mov byte [ebx + 0x1b3], 0
lea edi, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x70a860
sub eax, edi
mov edx, 0x80
sub edx, eax
push edx
lea eax, [ebx + eax + 0x134]
push 0
push eax
call fcn.00755e40
add esp, 0xc
push 1
movzx ecx, si
push 8
mov dword [esp + 0x240], ecx
mov ecx, dword [esp + 0x20]
push 0x2c8
lea edx, [esp + 0x48]
push edx
add ecx, 0x28
call fcn.00725370
mov dword [esp + 0x3c0], 0xffffffff
mov dword [esp + 0x3c], 0x6a49c8
lea ecx, [esp + 0x3c]
test al, al
jne 0x70a8cb
call fcn.007242f0
xor eax, eax
jmp 0x70a8d9
mov esi, dword [esp + 0x324]
call fcn.007242f0
mov eax, esi
mov ecx, dword [esp + 0x3b8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x3a0]
xor ecx, esp
call fcn.007562ca
mov esp, ebp
pop ebp
ret 8
Function at 0x70a900
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
sub esp, 8
push ebx
mov bl, byte [esp + 0x18]
push ebp
xor ebp, ebp
movzx eax, bl
neg eax
sbb eax, eax
push esi
mov esi, dword [esp + 0x1c]
and eax, 0x210
add eax, 0xb0
push edi
mov edi, ecx
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], ebp
je 0x70a94e
push eax
push esi
call fcn.00724c70
test al, al
jne 0x70a94e
push 0x71
mov ecx, edi
call fcn.00703780
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret 0xc
cmp esi, ebp
jne 0x70a967
push 0x69
mov ecx, edi
call fcn.00703780
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret 0xc
test bl, bl
jne 0x70a971
mov dword [esp + 0x10], esi
jmp 0x70a975
mov dword [esp + 0x14], esi
cmp dword [esi + 4], ebp
jne 0x70a989
cmp dword [esi + 8], 0x186a0
jne 0x70a989
or dword [esi], 0x10000
mov ebx, dword [esp + 0x1c]
mov dword [esp + 0x20], ebp
cmp byte [esp + 0x24], 0
mov ecx, edi
jne 0x70a9a7
mov ebp, dword [esp + 0x10]
push ebp
push ebx
call fcn.00706760
jmp 0x70a9b2
mov ebp, dword [esp + 0x14]
push ebp
push ebx
call fcn.0070a6c0
mov ebp, dword [ebp + 0x10]
mov esi, eax
push esi
mov ecx, edi
call fcn.007068c0
test al, al
jne 0x70a9d3
mov ecx, dword [esp + 0x20]
inc ecx
cmp ecx, 5
mov dword [esp + 0x20], ecx
jl 0x70a991
jmp 0x70a9d9
and esi, 0xffff
test al, al
jne 0x70aa1f
mov eax, dword [0x7cad84]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x70aa0d
push 4
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
je 0x70aa0d
mov ecx, dword [0x7cad84]
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop edi
mov dword [esi], 0x7f
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret 0xc
test esi, esi
je 0x70aa54
test ebp, ebp
je 0x70aa54
push esi
mov ecx, edi
call fcn.007081b0
test eax, eax
je 0x70aa37
cmp eax, ebp
jae 0x70aa54
push esi
mov ecx, edi
call fcn.007069d0
push 0x7d
mov ecx, edi
call fcn.00703780
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret 0xc
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc
Function at 0x70b730
Capabilities:
Get thread local storage value

Disassembly:
push 0xffffffffffffffff
push 0x775091
mov eax, dword fs:[0]
push eax
sub esp, 0x454
mov eax, dword [0x69bc80]
xor eax, esp
mov dword [esp + 0x450], eax
push ebx
push ebp
push esi
mov eax, dword [0x69bc80]
xor eax, esp
push eax
lea eax, [esp + 0x464]
mov dword fs:[0], eax
mov esi, ecx
mov ebp, dword [esp + 0x47c]
mov eax, dword [esp + 0x478]
mov dword [esp + 0x14], eax
test ebp, ebp
je 0x70b79d
push ebp
push eax
call fcn.00724c70
test al, al
jne 0x70b79d
push 0x71
mov ecx, esi
call fcn.00703780
xor eax, eax
jmp 0x70b969
xor eax, eax
mov dword [esp + 0x5c], 7
mov dword [esp + 0x58], 0
mov word [esp + 0x48], ax
mov dword [esp + 0x40], 0x6a0f08
mov ecx, dword [0x7cad84]
push ecx
mov dword [esp + 0x470], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x70b7d6
mov eax, dword [eax]
add eax, 0x2710
push eax
call fcn.00702c90
add esp, 4
push eax
lea ecx, [esp + 0x44]
call fcn.006ec550
mov ebx, dword [esp + 0x474]
cmp bl, 0x10
jne 0x70b887
lea ecx, [esp + 0x10]
call fcn.00729d40
lea edx, [esp + 0x40]
push edx
lea ecx, [esp + 0x20]
mov byte [esp + 0x470], 1
call fcn.006ec4f0
push ecx
mov eax, esp
mov dword [eax], 1
mov dword [esp + 0x40], esp
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x20]
push ecx
lea ecx, [esp + 0x1c]
mov byte [esp + 0x478], 2
call fcn.00729dc0
cmp dword [esp + 0x38], 0x10
mov dword [esp + 0x1c], 0x6a0f10
jb 0x70b861
mov edx, dword [esp + 0x24]
push edx
call fcn.00755e35
add esp, 4
lea ecx, [esp + 0x10]
mov dword [esp + 0x38], 0xf
mov dword [esp + 0x34], 0
mov byte [esp + 0x24], 0
mov byte [esp + 0x46c], 0
call fcn.00729de0
and ebx, 0xf00
mov byte [esp + 0x45f], 0
cmp ebx, 0x100
je 0x70b905
push 1
cmp ebx, 0x200
je 0x70b8ca
push 0x3ff
lea eax, [esp + 0x68]
push eax
lea ecx, [esp + 0x4c]
call fcn.006eba30
lea eax, [esp + 0x60]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x70b8c1
jmp 0x70b927
push 0x200
lea ecx, [esp + 0x68]
push ecx
lea ecx, [esp + 0x4c]
call fcn.006eb580
xor edx, edx
lea eax, [esp + 0x60]
mov word [esp + 0x45e], dx
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x70b8f0
sub eax, edx
sar eax, 1
lea esi, [eax + eax + 2]
jmp 0x70b92c
push 0x3ff
lea eax, [esp + 0x64]
push eax
lea ecx, [esp + 0x48]
call fcn.006eb410
lea eax, [esp + 0x60]
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x70b920
sub eax, edx
lea esi, [eax + 1]
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x70b94b
mov eax, ebp
cmp ebp, esi
jb 0x70b93c
mov eax, esi
push eax
lea edx, [esp + 0x64]
push edx
push ecx
call fcn.00756630
add esp, 0xc
cmp dword [esp + 0x5c], 8
mov dword [esp + 0x40], 0x6a0f08
jb 0x70b967
mov eax, dword [esp + 0x48]
push eax
call fcn.00755e35
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x464]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x450]
xor ecx, esp
call fcn.007562ca
add esp, 0x460
ret 0xc
Function at 0x70bad0
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 0x94
mov eax, dword [0x69bc80]
xor eax, esp
mov dword [esp + 0x90], eax
push ebx
mov ebx, dword [esp + 0xa0]
push ebp
push esi
push edi
mov edi, dword [esp + 0xa8]
push 0x90
xor ebp, ebp
lea eax, [esp + 0x14]
push ebp
push eax
mov esi, ecx
call fcn.00755e40
add esp, 0xc
push 0x90
lea ecx, [esp + 0x14]
push ecx
push 1
push edi
mov ecx, esi
call fcn.0070b240
cmp eax, 0x90
je 0x70bb58
mov edx, dword [0x7cad84]
push edx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x70bb58
cmp dword [eax], 0x73
jne 0x70bb58
mov eax, dword [esp + 0xb0]
push ebp
push ebp
push eax
push ebx
push 0x101
push edi
mov ecx, esi
call fcn.007079e0
jmp 0x70bb5a
mov eax, ebp
mov ecx, dword [esp + 0xa0]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.007562ca
add esp, 0x94
ret 0xc

Function at 0x70bb80
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
sub esp, 0xa4
mov eax, dword [0x69bc80]
xor eax, esp
mov dword [esp + 0xa0], eax
push ebx
push ebp
mov ebp, dword [esp + 0xb4]
push esi
xor eax, eax
push edi
mov edi, dword [esp + 0xb8]
push 0x10
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
lea eax, [esp + 0x14]
push eax
push 0x20
push edi
mov esi, ecx
xor ebx, ebx
call fcn.0070b240
cmp eax, 0x10
jne 0x70bc38
cmp word [esp + 0x10], bx
je 0x70bc38
push 0x90
lea ecx, [esp + 0x24]
push ebx
push ecx
call fcn.00755e40
add esp, 0xc
push 0x90
lea edx, [esp + 0x24]
push edx
push 1
push edi
mov ecx, esi
call fcn.0070b240
cmp eax, 0x90
je 0x70bc34
mov eax, dword [0x7cad84]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x70bc34
cmp dword [eax], 0x73
jne 0x70bc34
mov ecx, dword [esp + 0xc0]
push ebx
push ebx
push ecx
push ebp
push 0x102
push edi
mov ecx, esi
call fcn.007079e0
mov ebx, eax
mov eax, ebx
jmp 0x70bc70
mov edx, dword [0x7cad84]
push edx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x70bc68
push 4
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
je 0x70bc68
mov eax, dword [0x7cad84]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [esi], 0x10e
xor eax, eax
mov ecx, dword [esp + 0xb0]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.007562ca
add esp, 0xa4
ret 0xc
Function at 0x70f910
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov eax, 0x52fc
call fcn.00757180
mov eax, dword [0x69bc80]
xor eax, esp
mov dword [esp + 0x52f8], eax
push ebx
mov ebx, dword [esp + 0x530c]
push esi
mov esi, dword [esp + 0x5308]
push edi
push 0x2c0
lea eax, [esp + 0x18]
push 0
push eax
call fcn.00755e40
lea ecx, [esp + 0x20]
push ecx
push 0
mov dword [esp + 0x28], 0x80000
call fcn.006f0200
mov edi, eax
add esp, 0x14
test edi, edi
je 0x70fa20
push 0x5030
lea edx, [esp + 0x2d8]
push 0
push edx
call fcn.00755e40
mov ecx, dword [esp + 0x531c]
push 0x5030
lea eax, [esp + 0x2e4]
push eax
push ecx
push esi
push 0x1e
push edi
call fcn.006efd90
add esp, 0x24
cmp eax, 0x5030
jne 0x70fa17
mov eax, dword [esp + 0x2d4]
dec eax
cmp eax, 5
ja case.0x70f9b4.3
jmp dword [eax*4 + 0x70fa44]
mov dx, word [esp + 0x31c]
mov eax, dword [esp + 0x320]
lea ecx, [esp + 0xc]
push ecx
mov ecx, ebx
mov word [esp + 0x14], dx
mov dword [esp + 0x10], eax
call fcn.0070f2c0
jmp 0x70fa17
mov edx, dword [0x7cad84]
push edx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x70fa11
push 4
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
je 0x70fa11
mov eax, dword [0x7cad84]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [esi], 0xdc
push edi
call fcn.006f0320
add esp, 4
mov eax, dword [ebx + 0x10]
sub eax, dword [ebx + 0xc]
mov ecx, dword [esp + 0x5304]
pop edi
pop esi
pop ebx
xor ecx, esp
sar eax, 3
call fcn.007562ca
add esp, 0x52fc
ret 0xc
Function at 0x710b10
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
lea ebp, [esp - 0x94]
sub esp, 0x94
push 0xffffffffffffffff
push 0x7757c0
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x69bc80]
xor eax, ebp
mov dword [ebp + 0x90], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, dword [ebp + 0x9c]
mov ebx, dword [ebp + 0xa0]
xor eax, eax
push 0x10
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x28]
push eax
push 0x20
mov esi, ecx
push edi
mov dword [ebp - 0x18], esi
call fcn.0070b240
cmp eax, 0x10
jne 0x710c12
cmp word [ebp - 0x28], 0
je 0x710c12
push 0x90
lea ecx, [ebp]
push 0
push ecx
mov dword [ebp - 4], 0
call fcn.00755e40
add esp, 0xc
push 0x90
lea edx, [ebp]
push edx
push 1
push edi
mov ecx, esi
call fcn.0070b240
cmp eax, 0x90
je 0x710bfa
mov eax, dword [0x7cad84]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x710bfa
cmp dword [eax], 0x73
jne 0x710bfa
mov ecx, dword [ebp + 0xa4]
push 0
push 0
push ecx
push ebx
push 0x15
push edi
mov ecx, esi
call fcn.0070ff00
test eax, eax
je 0x710bfa
mov dword [ebp - 0x14], 1
mov eax, dword [ebp - 0x14]
jmp 0x710c4a
mov edx, dword [0x7cad84]
push edx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x710c42
push 4
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
je 0x710c42
mov eax, dword [0x7cad84]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [esi], 0x10e
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x90]
xor ecx, ebp
call fcn.007562ca
add ebp, 0x94
mov esp, ebp
pop ebp
ret 0xc
Function at 0x711610
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ecx
mov eax, dword [0x7cad84]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_TlsGetValue]
push ebp
push esi
push edi
push eax
mov edi, ecx
call ebx
mov ebp, dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
jne 0x71164b
push 4
push 0x40
call ebp
mov esi, eax
test esi, esi
je 0x71164b
mov ecx, dword [0x7cad84]
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push 4
lea edx, [esp + 0x1c]
push edx
mov dword [esi], 0
call fcn.00724c70
test al, al
jne 0x711699
mov eax, dword [0x7cad84]
push eax
call ebx
mov esi, eax
test esi, esi
jne 0x711689
push 4
push 0x40
call ebp
mov esi, eax
test esi, esi
je 0x711689
mov ecx, dword [0x7cad84]
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [esi], 0x72
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret 0x20
cmp dword [esp + 0x18], 0xffff
jbe 0x7116c7
mov edx, dword [0x7cad84]
push edx
call ebx
mov esi, eax
test esi, esi
jne 0x711689
push 4
push 0x40
call ebp
mov esi, eax
test esi, esi
je 0x711689
mov eax, dword [0x7cad84]
push esi
push eax
jmp 0x711683
mov eax, dword [esp + 0x24]
add eax, eax
add eax, eax
je 0x711718
mov ecx, dword [esp + 0x20]
push eax
push ecx
call fcn.00724c70
test al, al
jne 0x711718
mov edx, dword [0x7cad84]
push edx
call ebx
mov esi, eax
test esi, esi
jne 0x711708
push 4
push 0x40
call ebp
mov esi, eax
test esi, esi
je 0x711708
mov eax, dword [0x7cad84]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop edi
mov dword [esi], 0x71
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret 0x20
mov ebp, dword [esp + 0x28]
mov ebx, dword [esp + 0x30]
test ebp, ebp
jne 0x711784
test ebx, ebx
je 0x711788
mov edx, dword [esp + 0x18]
mov esi, dword [esp + 0x34]
push 4
lea ecx, [esp + 0x14]
push ecx
push 0x10
push edx
mov ecx, edi
mov dword [esi], 0
mov dword [esp + 0x20], 0
call fcn.0070b240
cmp eax, 4
jne 0x71168f
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x2c]
push esi
push ebx
and eax, 8
push ecx
push ebp
cmp al, 8
jne 0x71179b
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
push edx
push eax
mov ecx, edi
call fcn.00710850
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x20
test ebx, ebx
je 0x711728
push 0x69
mov ecx, edi
call fcn.00703780
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret 0x20
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x2c]
push edx
mov edx, dword [esp + 0x2c]
push eax
push ecx
push edx
mov ecx, edi
call fcn.00710d50
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x20