joyce8/EMBER2024-capa huggingface dataset:
Function at 0x660db1da
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
cmp esi, edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 4], edi
jl 0x660db1fa
cmp esi, 0x3fffffff
jbe 0x660db201
push 5
call fcn.66024fdc
push dword [ebp + 0xc]
call fcn.6602d92c
push dword [0x6610ee98]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov eax, dword [eax + 0x18]
push 0xffffffffffffffef
pop ecx
mov eax, dword [eax]
mov dword [ebp + 0xc], ecx
mov dword [ebp - 0x10], eax
lea eax, [esi + esi]
cmp eax, ecx
ja 0x660db22d
mov dword [ebp + 0xc], eax
push dword [ebp + 0xc]
push edi
call dword [sym.imp.OLEAUT32.dll_DllRegisterServer]
cmp eax, edi
mov dword [ebp - 8], eax
jne 0x660db24a
call fcn.6602da9b
push 0xe
call fcn.66024fdc
mov ebx, dword [ebp - 8]
lea edi, [esi - 1]
test esi, esi
je 0x660db2a8
mov esi, 0xff
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x10]
call fcn.6602d661
cmp eax, 0xffffffff
je 0x660db2dd
mov ecx, dword [ebp + 0xc]
cmp dword [ebp - 0xc], ecx
ja 0x660db2ec
cmp eax, esi
jle 0x660db2d8
mov ecx, eax
mov byte [ebp + 0xb], al
sar ecx, 8
mov byte [ebp + 0xa], cl
xor ecx, ecx
cmp eax, esi
setg cl
push 1
inc ecx
push ebx
lea eax, [ebp + 0xa]
push ecx
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
add dword [ebp - 0xc], 2
inc ebx
inc ebx
mov eax, edi
dec edi
test eax, eax
jne 0x660db259
call fcn.6602da9b
cmp dword [ebp - 4], 0
je 0x660db2f5
cmp dword [ebp - 4], 0x3e
jne 0x660db2c1
mov eax, dword [ebp - 0x10]
cmp dword [eax], 0x20
je 0x660db2f5
push dword [ebp - 8]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
cmp dword [ebp - 4], 0
je 0x660db312
push dword [ebp - 4]
call fcn.66024fdc
mov byte [ebp + 0xa], al
jmp 0x660db281
cmp dword [ebp - 4], 0
jne 0x660db2a8
mov dword [ebp - 4], 0x3e
jmp 0x660db2a8
mov dword [ebp - 4], 0xe
jmp 0x660db2a8
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 0xc]
je 0x660db312
push eax
lea eax, [ebp - 8]
push dword [ebp - 8]
push eax
call fcn.660de5df
test eax, eax
jne 0x660db312
push 0xe
jmp 0x660db2d3
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x660dbc49
Capabilities:
Get thread local storage value

Disassembly:
push esi
push dword [0x6610ee98]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, dword [eax + 0x18]
movsx eax, word [esp + 8]
push eax
call fcn.660259e8
test byte [eax], 0x25
mov dword [esi], eax
je 0x660dbc72
push 0x36
call fcn.66024fdc
mov dword [esi + 4], 2
pop esi
ret 4

Function at 0x660dbcde
Capabilities:
Get thread local storage value

Disassembly:
push dword [0x6610ee98]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov eax, dword [eax + 0x18]
push 2
push dword [esp + 8]
push dword [eax + 4]
push dword [eax]
call fcn.66025add
call fcn.660dbd49
ret 4

Function at 0x660dbffc
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
push edi
push dword [0x6610ee98]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
and word [ebp - 0x20], 0
lea edi, [eax + 0x50]
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 0xc]
call fcn.66024e0e
mov esi, eax
mov ax, word [esi]
cmp ax, 0xa
jne 0x660dc067
cmp dword [esi + 8], 0x80020004
jne 0x660dc067
or ecx, 0xffffffff
test cx, cx
je 0x660dc06b
call fcn.660dc936
mov ecx, edi
mov dword [ebp - 8], eax
mov word [ebp - 0x10], 8
call sym.MSVBVM60.DLL___vbaFreeVar
mov eax, dword [ebp + 8]
lea esi, [ebp - 0x10]
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
leave
ret 8
xor ecx, ecx
jmp 0x660dc03b
cmp ax, 8
je 0x660dc09b
movzx ecx, ax
test ecx, ecx
jl 0x660dc082
cmp ecx, 0xe
jle 0x660dc097
cmp ecx, 0x11
je 0x660dc097
test ah, 0x20
jne 0x660dc097
cmp ax, 0x24
je 0x660dc097
push 0x1ca
call fcn.66024fdc
push 0xd
jmp 0x660dc092
push dword [esi + 8]
call fcn.660dc93e
jmp 0x660dc045

Function at 0x660dc0a5
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
push dword [0x6610ee98]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
and word [ebp - 0x10], 0
lea edi, [eax + 0x50]
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
call fcn.66024e0e
mov esi, eax
mov ax, word [esi]
cmp ax, 0xa
jne 0x660dc0ff
cmp dword [esi + 8], 0x80020004
jne 0x660dc0ff
or ecx, 0xffffffff
test cx, cx
je 0x660dc103
call fcn.660dc936
mov ecx, edi
mov esi, eax
call sym.MSVBVM60.DLL___vbaFreeVar
mov eax, esi
pop edi
pop esi
leave
ret 4
xor ecx, ecx
jmp 0x660dc0e4
cmp ax, 8
je 0x660dc133
movzx ecx, ax
test ecx, ecx
jl 0x660dc11a
cmp ecx, 0xe
jle 0x660dc12f
cmp ecx, 0x11
je 0x660dc12f
test ah, 0x20
jne 0x660dc12f
cmp ax, 0x24
je 0x660dc12f
push 0x1ca
call fcn.66024fdc
push 0xd
jmp 0x660dc12a
push dword [esi + 8]
call fcn.660dc93e
jmp 0x660dc0ee
Function at 0x660dc4a1
Capabilities:
Timestomp file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
push edi
xor eax, eax
mov edi, pe_nt_image_headers32
push eax
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileA]
push edi
push 3
push eax
push 3
push SysReAllocStringLen
mov dword [ebp - 4], eax
push dword [ebp + 8]
call esi
cmp eax, 0xffffffff
mov dword [ebp + 8], eax
je 0x660dc4f5
push 0
push edi
push 3
push 0
push 3
push 0x40000000
push dword [ebp + 0xc]
call esi
mov edi, eax
cmp edi, 0xffffffff
jne 0x660dc500
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.660dbb07
pop edi
pop esi
leave
ret 8
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1c]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
je 0x660dc530
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
test eax, eax
jne 0x660dc538
call fcn.660dbb07
mov dword [ebp - 4], eax
push dword [ebp + 8]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push edi
call esi
mov eax, dword [ebp - 4]
jmp 0x660dc4fa

Function at 0x660dc66b
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push esi
mov esi, dword [ebp + 8]
test esi, esi
push edi
je 0x660dc697
cmp word [esi], 0
je 0x660dc697
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 0x104
jbe 0x660dc69e
push 0x35
call fcn.66024fdc
push 1
lea eax, [ebp - 0x108]
push esi
push eax
call fcn.660dc899
mov esi, dword [ebp + 0xc]
mov eax, esi
or al, 0x27
cmp eax, 0x27
je 0x660dc6c0
push 5
call fcn.66024fdc
test esi, esi
jne 0x660dc6c9
mov esi, pe_nt_image_headers32
lea eax, [ebp - 0x108]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
jne 0x660dc711
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 5
je 0x660dc70d
call esi
cmp eax, 0x35
je 0x660dc70d
call esi
cmp eax, 0x57
je 0x660dc70d
call esi
cmp eax, 0x13
je 0x660dc70d
push 0x35
pop eax
movzx eax, ax
test eax, eax
je 0x660dc711
push eax
call fcn.66024fdc
push 0x4b
jmp 0x660dc6ff
pop edi
pop esi
leave
ret 8

Function at 0x660dc79a
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [ebp + 8]
test eax, eax
je 0x660dc81c
cmp word [eax], 0
je 0x660dc81c
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.66024e4e
test eax, eax
jne 0x660dc818
lea eax, [ebp - 0x108]
push 0x6605524a
push eax
call fcn.660e1d67
pop ecx
test eax, eax
pop ecx
je 0x660dc7dd
push 0x34
pop eax
jmp 0x660dc818
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ecx, dword [ebp + 0xc]
cmp eax, 0xffffffff
mov dword [ecx], eax
jne 0x660dc816
call dword [sym.imp.KERNEL32.dll_GetLastError]
dec eax
dec eax
je 0x660dc81c
dec eax
je 0x660dc812
dec eax
dec eax
je 0x660dc80e
sub eax, 0x30
je 0x660dc81c
push 5
jmp 0x660dc7da
push 0x4b
jmp 0x660dc7da
push 0x4c
jmp 0x660dc7da
xor eax, eax
leave
ret 8
push 0x35
jmp 0x660dc7da
Function at 0x660dcaef
Capabilities:
Get thread local storage value

Disassembly:
push dword [0x6610ee98]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov eax, dword [eax + 0x18]
mov eax, dword [eax + 0x10]
test eax, eax
je 0x660dcb15
mov ecx, dword [eax + 0xc]
mov edx, dword [esp + 4]
cmp edx, dword [ecx + 8]
je 0x660dcb15
mov eax, dword [eax]
jmp 0x660dcb01
ret 4

Function at 0x660dcb18
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
push edi
mov edi, dword [esp + 0x10]
push dword [0x6610ee98]
mov esi, dword [edi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [esi + 4]
mov ecx, dword [ecx + 0x14]
mov edx, dword [ecx + 8]
mov ecx, dword [eax + 0x18]
mov ecx, dword [ecx + 0x10]
test ecx, ecx
je 0x660dcb4c
mov ebx, dword [ecx + 0xc]
cmp edx, dword [ebx + 8]
je 0x660dcb4c
mov ecx, dword [ecx]
jmp 0x660dcb3c
mov edx, dword [ecx + 0xc]
mov ebx, dword [esp + 0x18]
mov edx, dword [edx + 0xc]
mov dword [ebx], edx
movzx edx, word [esi + 2]
mov esi, dword [esp + 0x1c]
lea edx, [edx + edx*4]
lea ecx, [ecx + edx*4]
mov edx, dword [ecx + 0x18]
mov dword [esi], edx
mov edx, dword [edi]
mov edx, dword [edx + 0x18]
test byte [edx + 0x28], 2
jne 0x660dcb7f
mov edx, dword [esp + 0x14]
mov ecx, dword [ecx + 0x24]
mov dword [edx], ecx
pop edi
pop esi
pop ebx
ret 0x10

Function at 0x660dd65c
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
push edi
call fcn.660137fa
mov esi, eax
lea ecx, [esi + 0x4c]
mov eax, dword [ecx]
test eax, eax
je 0x660dd68d
cmp dword [eax], 0
jne 0x660dd688
mov edx, dword [eax + 0xc]
inc word [esi + 0x44]
mov dword [ecx], edx
mov edx, dword [esi + 0x48]
mov dword [eax + 0xc], edx
mov dword [esi + 0x48], eax
jmp 0x660dd669
lea ecx, [eax + 0xc]
jmp 0x660dd669
mov ax, word [esi + 0x44]
cmp ax, word [esi + 0x46]
jae 0x660dd727
call fcn.660dd72b
mov edi, eax
test edi, edi
je 0x660dd6f2
push dword [0x6610ee98]
mov ebx, dword [edi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov eax, dword [eax + 0x18]
mov dword [eax + 0x18], ebx
lea eax, [edi + 4]
movzx ebx, word [eax]
mov ecx, dword [esi + 0x50]
mov ax, word [eax]
add word [esi + 0x44], ax
mov dword [esi + 0x50], edi
mov dword [ecx], edi
mov edi, dword [edi + 8]
test ebx, ebx
jbe 0x660dd68d
mov eax, ebx
shl eax, 4
add eax, edi
and dword [eax - 0x10], 0
mov ecx, dword [esi + 0x48]
sub eax, 0x10
dec ebx
mov dword [esi + 0x48], eax
mov dword [eax + 0xc], ecx
je 0x660dd68d
jmp 0x660dd6dd
mov eax, dword [esi + 0x50]
movzx ebx, word [eax + 4]
shl ebx, 1
mov eax, ebx
shl eax, 4
add eax, 0xc
push eax
call fcn.6600fd50
mov edi, eax
test edi, edi
jne 0x660dd719
push 0x8007000e
call fcn.660dd7bf
lea eax, [edi + 4]
lea ecx, [edi + 0xc]
mov dword [edi + 8], ecx
mov word [eax], bx
jmp 0x660dd6c0
pop edi
pop esi
pop ebx
ret
Function at 0x660de779
Capabilities:
Get thread local storage value

Disassembly:
push ecx
push dword [0x6610ee98]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov eax, dword [eax + 0x70]
lea ecx, [esp + 3]
sub eax, 0x8000
cmp ecx, eax
sbb eax, eax
and eax, 0x800a001c
pop ecx
ret
Function at 0x660e300e
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
xor eax, eax
cmp dword [0x6610f348], eax
je 0x660e305f
cmp dword [ebp + 8], eax
jne 0x660e3027
push 3
pop eax
jmp 0x660e3062
push eax
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push eax
call dword [0x66110ce4]
test eax, eax
je 0x660e3046
push dword [ebp + 8]
call dword [0x66110cd8]
test eax, eax
jne 0x660e304a
push 2
jmp 0x660e3024
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call dword [0x66110cfc]
test eax, eax
jne 0x660e3066
or eax, 0xffffffff
leave
ret 4
mov eax, dword [ebp - 4]
test al, 1
je 0x660e3080
test al, 2
je 0x660e307c
and al, 8
neg al
sbb eax, eax
add eax, 6
jmp 0x660e3062
push 4
jmp 0x660e3024
and al, 8
neg al
sbb eax, eax
add eax, 8
jmp 0x660e3062

Function at 0x660e308b
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
xor eax, eax
cmp dword [0x6610f348], eax
je 0x660e30da
cmp dword [ebp + 8], eax
je 0x660e30da
push eax
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push eax
call dword [0x66110ce4]
test eax, eax
je 0x660e30be
push dword [ebp + 8]
call dword [0x66110cd8]
test eax, eax
jne 0x660e30c5
push 8
pop eax
leave
ret 4
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call dword [0x66110cfc]
test eax, eax
jne 0x660e30df
or eax, 0xffffffff
jmp 0x660e30c1
mov eax, dword [ebp - 4]
test al, 1
je 0x660e30f1
and al, 8
neg al
sbb eax, eax
add eax, 0xa
jmp 0x660e30c1
and al, 8
neg al
sbb eax, eax
add eax, 8
jmp 0x660e30c1

Function at 0x660e30fc
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
xor eax, eax
cmp dword [0x6610f348], eax
je 0x660e314b
cmp dword [ebp + 8], eax
je 0x660e314b
push eax
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push eax
call dword [0x66110ce4]
test eax, eax
je 0x660e312f
push dword [ebp + 8]
call dword [0x66110cd8]
test eax, eax
jne 0x660e3136
push 2
pop eax
leave
ret 4
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call dword [0x66110cfc]
test eax, eax
jne 0x660e3150
or eax, 0xffffffff
jmp 0x660e3132
mov eax, dword [ebp - 4]
and al, 1
neg al
sbb eax, eax
inc eax
inc eax
jmp 0x660e3132

Function at 0x660e3329
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
push dword [0x6610ee98]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
and word [ebp - 0x10], 0
lea edi, [eax + 0x50]
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
call fcn.66024e0e
cmp word [eax], 0xa
jne 0x660e3380
mov esi, dword [eax + 8]
push esi
call fcn.6602467a
cmp eax, 0x1b8
jne 0x660e336f
cmp esi, 0x800a01b8
jne 0x660e3371
mov esi, eax
test esi, 0xffff8000
je 0x660e3388
push 6
call fcn.66024fdc
push eax
call fcn.660e318b
mov esi, eax
mov ecx, edi
call sym.MSVBVM60.DLL___vbaFreeVar
mov ax, si
pop edi
pop esi
leave
ret 4
Function at 0x660e3398
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
push dword [0x6610ee98]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
and word [ebp - 0x10], 0
lea edi, [eax + 0x50]
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
call fcn.66024e0e
cmp word [eax], 0xa
jne 0x660e33ef
mov esi, dword [eax + 8]
push esi
call fcn.6602467a
cmp eax, 0x1b8
jne 0x660e33de
cmp esi, 0x800a01b8
jne 0x660e33e0
mov esi, eax
mov ecx, edi
call sym.MSVBVM60.DLL___vbaFreeVar
mov eax, esi
pop edi
pop esi
leave
ret 4
push eax
call fcn.660243e5
jmp 0x660e33de

Function at 0x660e33f7
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push edi
push dword [0x6610ee98]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
and word [ebp - 0x10], 0
lea edi, [eax + 0x50]
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
call fcn.66024e0e
cmp word [eax], 0xa
jne 0x660e3459
push esi
mov esi, dword [eax + 8]
push esi
call fcn.6602467a
cmp eax, 0x1b8
jne 0x660e3440
cmp esi, 0x800a01b8
mov dword [ebp + 8], esi
jne 0x660e3443
mov dword [ebp + 8], eax
fild dword [ebp + 8]
pop esi
fstp dword [ebp + 8]
mov ecx, edi
call sym.MSVBVM60.DLL___vbaFreeVar
fld dword [ebp + 8]
pop edi
leave
ret 4
push eax
call fcn.660e31dc
fstp dword [ebp + 8]
jmp 0x660e344a

Function at 0x660e3464
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push edi
push dword [0x6610ee98]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
and word [ebp - 0x18], 0
lea edi, [eax + 0x50]
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 8]
call fcn.66024e0e
cmp word [eax], 0xa
jne 0x660e34c6
push esi
mov esi, dword [eax + 8]
push esi
call fcn.6602467a
cmp eax, 0x1b8
jne 0x660e34ad
cmp esi, 0x800a01b8
mov dword [ebp + 8], esi
jne 0x660e34b0
mov dword [ebp + 8], eax
fild dword [ebp + 8]
pop esi
fstp qword [ebp - 8]
mov ecx, edi
call sym.MSVBVM60.DLL___vbaFreeVar
fld qword [ebp - 8]
pop edi
leave
ret 4
push eax
call fcn.660e322a
fstp qword [ebp - 8]
jmp 0x660e34b7

Function at 0x660e34fd
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
push dword [0x6610ee98]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
and word [ebp - 0x10], 0
lea ebx, [eax + 0x50]
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
call fcn.66024e0e
cmp word [eax], 0xa
jne 0x660e3562
mov esi, dword [eax + 8]
push esi
call fcn.6602467a
cmp eax, 0x1b8
jne 0x660e3544
cmp esi, 0x800a01b8
jne 0x660e3546
mov esi, eax
push esi
call fcn.660e34d1
mov ecx, ebx
mov esi, eax
mov edi, edx
call sym.MSVBVM60.DLL___vbaFreeVar
mov edx, edi
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4
push eax
call fcn.660e3278
jmp 0x660e354c
Function at 0x660e371d
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
push ebx
push dword [0x6610ee98]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
add eax, 0x50
and word [ebp - 0x18], 0
mov dword [ebp - 8], eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 8]
call fcn.66024e0e
mov ebx, eax
cmp word [ebx], 0xa
jne 0x660e383b
push edi
push esi
lea eax, [ebp - 0x7c]
push 0x64
push eax
push 0x6601a430
push 0x8dab
call fcn.660de31a
mov edi, 0x6604fda8
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x7c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ebx, dword [ebx + 8]
push ebx
call fcn.6602467a
cmp eax, 0x1b8
jne 0x660e37b2
cmp ebx, 0x800a01b8
jne 0x660e37b4
mov ebx, eax
lea eax, [ebp - 4]
push eax
call fcn.66010656
push eax
push ebx
call fcn.660e4558
test eax, eax
je 0x660e37ce
push eax
call fcn.66024fdc
lea eax, [ebp - 0x144]
push 0x64
push eax
lea edi, [ebp - 0x7c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
lea eax, [ebp - 0x7c]
push ecx
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push dword [ebp - 4]
lea eax, [ebp - 0x144]
push eax
call fcn.660ed80c
pop ecx
pop ecx
push dword [ebp - 4]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
lea eax, [ebp - 0x144]
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
test esi, esi
jne 0x660e3826
push 0xe
call fcn.66024fdc
mov dword [ebp - 4], esi
pop esi
pop edi
mov ecx, dword [ebp - 8]
call sym.MSVBVM60.DLL___vbaFreeVar
mov eax, dword [ebp - 4]
pop ebx
leave
ret 4
push ebx
call sym.MSVBVM60.DLL___vbaStrVarCopy
mov dword [ebp - 4], eax
jmp 0x660e382b
Function at 0x660e3846
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
push dword [0x6610ee98]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
lea edi, [eax + 0x50]
mov eax, dword [ebp + 8]
mov esi, 0xffffbfff
mov cx, word [eax]
movzx edx, cx
and edx, esi
cmp edx, 9
jne 0x660e388e
mov eax, dword [eax + 8]
test ch, 0x40
je 0x660e387d
mov eax, dword [eax]
push edi
xor ecx, ecx
push 3
push ecx
push ecx
push ecx
push ecx
push eax
call fcn.660ddd03
mov eax, edi
mov bx, word [eax]
movzx ecx, bx
and ecx, esi
cmp ecx, 2
jl 0x660e38af
cmp ecx, 7
jle 0x660e38c8
cmp ecx, 0xb
je 0x660e38c8
cmp ecx, 0xe
je 0x660e38c8
cmp ecx, 0x11
je 0x660e38c8
lea ecx, [ebp - 0x24]
push ecx
lea ecx, [ebp - 0x24]
push ecx
push 5
push eax
push edi
call fcn.66028048
push eax
call fcn.6601d35f
mov eax, edi
lea ecx, [ebp - 0x24]
push ecx
lea ecx, [ebp - 0x24]
push ecx
push 8
push eax
push edi
call fcn.66028048
push eax
call fcn.6601d35f
mov eax, dword [edi + 8]
mov dword [ebp - 4], eax
cmp word [eax], 0x2d
je 0x660e390a
cmp bx, 7
je 0x660e390a
cmp bx, 0xb
je 0x660e390a
lea eax, [ebp - 4]
push eax
call fcn.660e458e
test eax, eax
je 0x660e390a
push eax
call fcn.66024fdc
push 0
call fcn.660d9000
movsx ax, byte [eax + 0xe]
push eax
push dword [ebp - 4]
call fcn.660e3930
mov dword [ebp - 4], eax
and word [edi], 0
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x660e3b5d
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push esi
push edi
push dword [0x6610ee98]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
lea edi, [eax + 0x50]
lea eax, [ebp - 0x20]
push eax
xor esi, esi
push dword [ebp + 0xc]
mov word [ebp - 0x20], si
call fcn.66024e0e
mov ecx, eax
mov word [ebp - 0x10], 2
mov dx, word [ecx]
movzx eax, dx
cmp eax, 0x11
ja case.0x660e3b9d.44
jmp dword [eax*4 + 0x660e3cc5]
mov word [ebp - 0x10], 1
mov ecx, edi
call sym.MSVBVM60.DLL___vbaFreeVar
mov eax, dword [ebp + 8]
lea esi, [ebp - 0x10]
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
leave
ret 8
xor al, al
cmp al, byte [ecx + 8]
sbb eax, eax
neg eax
mov word [ebp - 8], ax
jmp 0x660e3baa
mov cx, word [ecx + 8]
cmp cx, si
jl 0x660e3c7d
xor eax, eax
cmp cx, si
setg al
jmp 0x660e3bcc
mov ecx, dword [ecx + 8]
cmp ecx, esi
jl 0x660e3c7d
xor eax, eax
cmp ecx, esi
jmp 0x660e3be4
fld dword [ecx + 8]
fcomp qword [0x66030258]
fnstsw ax
sahf
jb 0x660e3c7d
fld dword [ecx + 8]
fcomp qword [0x66030258]
fnstsw ax
sahf
jbe case.0x660e3b9d.32
mov word [ebp - 8], 1
jmp 0x660e3baa
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x40]
push eax
push 5
lea eax, [ebp - 0x10]
push ecx
push eax
call fcn.66028048
push eax
call fcn.6601d35f
fld qword [ebp - 8]
fcomp qword [0x66030258]
mov word [ebp - 0x10], 2
fnstsw ax
sahf
jb 0x660e3c7d
fld qword [ebp - 8]
fcomp qword [0x66030258]
fnstsw ax
sahf
ja 0x660e3c16
mov word [ebp - 8], si
jmp 0x660e3baa
fld qword [ecx + 8]
fcomp qword [0x66030258]
fnstsw ax
sahf
jb 0x660e3c7d
fld qword [ecx + 8]
jmp 0x660e3c4f
mov eax, dword [ecx + 0xc]
cmp eax, esi
jge 0x660e3c87
or word [ebp - 8], 0xffff
jmp 0x660e3baa
jne 0x660e3c16
cmp dword [ecx + 8], esi
jne 0x660e3c16
jmp case.0x660e3b9d.32
mov eax, dword [ecx + 4]
or eax, dword [ecx + 8]
or eax, dword [ecx + 0xc]
je case.0x660e3b9d.32
mov al, byte [ecx + 3]
and al, 0x80
neg al
sbb eax, eax
and al, 0xfe
inc eax
jmp 0x660e3bcc
test dh, 0x20
jne case.0x660e3b9d.41
cmp dx, 0x24
je case.0x660e3b9d.41
push 0x1ca
call fcn.66024fdc
push 0xd
jmp 0x660e3cbc

Function at 0x660e3dba
Capabilities:
Get thread local storage value

Disassembly:
push esi
push edi
push dword [0x6610ee98]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
lea esi, [eax + 0x50]
push dword [esp + 0x10]
push esi
call sym.MSVBVM60.DLL___vbaVarDateVar
mov eax, dword [esp + 0xc]
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
ret 8