joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5fbfdf
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
and dword [ebp - 4], 0
push edi
push dword [0x728f98]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x5fc002
mov edi, dword [eax + 0x16c]
jmp 0x5fc004
xor edi, edi
test edi, edi
jne 0x5fc018
push 0x80040014
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x5fc0b0
and dword [ebp - 0x10], 0
push edi
push 0
push 1
lea ecx, [ebp - 0x10]
call fcn.0063ab78
test eax, eax
jne 0x5fc03a
push 0x80070057
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x5fc0a8
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x5fc050
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x14]
shr eax, 2
test al, 1
jne 0x5fc052
xor esi, esi
test esi, esi
jne 0x5fc05d
push 0x80070057
jmp 0x5fc08c
cmp edi, dword [esi + 8]
je 0x5fc069
push 0x8004001e
jmp 0x5fc08c
cmp dword [edi + 0x10], 0
je 0x5fc094
mov ecx, esi
call fcn.005f8d40
test eax, eax
je 0x5fc094
mov ecx, esi
call fcn.005f8d40
test byte [eax + 0x54], 0x20
je 0x5fc094
push 0x8004001f
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x5fc0a7
push dword [ebp + 0xc]
lea ecx, [esi + 0xc]
push esi
call fcn.005f9423
mov dword [ebp - 4], 1
pop esi
lea ecx, [ebp - 0x10]
call fcn.0063ab31
mov eax, dword [ebp - 4]
pop edi
leave
ret 8
Function at 0x615953
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
call fcn.005f8825
test eax, eax
jne 0x615969
mov eax, 0x80004005
jmp 0x615a61
push esi
push edi
mov edi, 0x72dd18
push edi
call dword [0x71ed60]
mov esi, eax
test esi, esi
jne 0x6159b6
push 0x40
mov eax, 0x1000
push eax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
je 0x615a53
push ebx
lea ebx, [esi + 0xfc0]
push esi
push edi
call dword [0x71ed64]
add esi, 0x24
cmp esi, ebx
jb 0x61599e
test esi, esi
pop ebx
je 0x615a53
mov eax, 0x615844
sub eax, esi
push 0xd
sub eax, 0xd
push esi
mov dword [esi], 0x42444c7
mov dword [esi + 4], esi
mov byte [esi + 8], 0xe9
mov dword [esi + 9], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x10], eax
mov eax, dword [ebp + 0x10]
mov dword [esi + 0x14], eax
mov byte [esi + 0x20], 0
mov byte [esi + 0x21], 1
mov byte [esi + 0x22], 0
cmp dword [0x72dd20], 0
jne 0x615a33
push 0x4e5ef8
call dword [sym.imp.USER32.dll_RegisterWindowMessageW]
test eax, eax
mov dword [0x72dd20], eax
jne 0x615a33
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
test eax, eax
jg 0x615a25
call edi
jmp 0x615a35
call edi
and eax, 0xffff
or eax, 0x80070000
jmp 0x615a35
xor eax, eax
test eax, eax
jl 0x615a5f
mov eax, dword [ebp + 8]
push esi
push 0xfffffffffffffffc
push eax
mov dword [esi + 0x18], eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
test eax, eax
jne 0x615a5a
push esi
call fcn.006157c7
mov eax, 0x8007000e
jmp 0x615a5f
mov dword [esi + 0x1c], eax
xor eax, eax
pop edi
pop esi
xor ecx, ecx
test eax, eax
setge cl
mov eax, ecx
pop ebp
ret 0xc

Function at 0x6389b8
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, dword [edi + 0x194]
push edi
push dword [0x728f98]
shl esi, 0x1f
sar esi, 0x1f
call ebx
mov eax, dword [edi + 0x16c]
test eax, eax
je 0x6389ee
push dword [eax + 0xc]
call fcn.005ee42b
test esi, esi
jne 0x6389ff
call fcn.006389a4
push edi
mov ecx, eax
call fcn.00646941
push edi
call fcn.0063897d
push 0
call fcn.005ee42b
push 0
push dword [0x728f98]
call ebx
pop edi
test esi, esi
pop esi
pop ebx
jne 0x638a2a
dec dword [0x72dd74]
jne 0x638a2a
call fcn.00638950
pop ebp
ret 4
Function at 0x638a52
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
mov esi, dword [ebp + 0x10]
xor ebx, ebx
mov dword [ebp - 4], 0x8004000a
mov dword [esi], ebx
call fcn.005f93ce
test eax, eax
je 0x638a92
push dword [0x728f98]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
inc dword [eax + 0x190]
mov eax, dword [eax + 0x16c]
mov dword [esi], eax
xor eax, eax
jmp 0x638c4b
cmp dword [ebp + 0xc], ebx
jne 0x638ab1
call fcn.006388e3
cmp eax, ebx
jne 0x638aaa
mov eax, 0x8007000e
jmp 0x638c4b
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 4]
cmp eax, ebx
push edi
je 0x638ac1
cmp eax, 2
jne 0x638ad6
xor esi, esi
cmp eax, 2
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 8], ebx
jne 0x638ae2
cmp dword [ecx + 0x10], ebx
je 0x638ae2
mov dword [ebp - 4], 0x80070057
jmp 0x638c0f
xor edx, edx
dec eax
inc edx
cmp edx, eax
mov eax, dword [ecx + 0xc]
sbb edi, edi
neg edi
sub eax, ebx
je 0x638afb
dec eax
jne 0x638b14
push 2
pop ebx
jmp 0x638b14
push 0x1000
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, dword [ebp + 8]
mov ebx, eax
neg ebx
sbb ebx, ebx
and ebx, 0xfffffffe
inc ebx
inc ebx
mov ecx, dword [ecx + 0x10]
test ecx, ecx
je 0x638ba3
push ecx
call fcn.005f93ee
mov esi, eax
test esi, esi
jne 0x638b37
mov dword [ebp - 4], 0x80070057
jmp 0x638bed
and dword [ebp - 0x10], 0
mov ecx, esi
call fcn.00638882
cmp dword [esi + 0x18], 2
jne 0x638b58
mov dword [ebp - 4], 0x80070057
mov dword [ebp - 0x10], 1
jmp 0x638b70
xor ecx, ecx
lea eax, [esi + 4]
inc ecx
lock xadd dword [eax], ecx
lea eax, [ebp - 0x18]
push eax
push ebx
push edi
push dword [esi + 0xc]
call fcn.005ee5f1
dec dword [esi + 8]
mov ecx, esi
call fcn.005f938b
cmp dword [ebp - 0x10], 0
jne 0x638bed
lea eax, [ebp - 8]
push eax
push dword [ebp + 0xc]
call fcn.00646bd5
test eax, eax
mov dword [ebp - 4], eax
jl 0x638bed
cmp dword [ebp + 0xc], 0
je 0x638bbd
mov eax, dword [ebp - 8]
mov dword [0x72dd6c], eax
jmp 0x638bd3
lea eax, [ebp - 0xc]
push eax
push ebx
push edi
push 0
call fcn.005ee5f1
test eax, eax
jge 0x638b80
mov dword [ebp - 4], 0x8007000e
jmp 0x638bed
mov edi, dword [ebp - 8]
call fcn.006389a4
push edi
mov ecx, eax
call fcn.00646924
inc dword [0x72dd74]
test esi, esi
jne 0x638c2a
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0xc]
push dword [ebp + 8]
call fcn.0063ac16
test eax, eax
mov dword [ebp - 4], eax
jge 0x638c25
cmp dword [ebp - 8], 0
je 0x638bff
push dword [ebp - 8]
call fcn.006389b8
and dword [ebp - 8], 0
cmp dword [ebp - 0xc], 0
je 0x638c0d
push dword [ebp - 0xc]
call fcn.005ee6c9
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
jne 0x638c20
call fcn.006388e3
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebp - 4]
jmp 0x638c4a
mov esi, dword [ebp - 0x14]
jmp 0x638c31
mov ecx, esi
call fcn.0063ab1a
cmp dword [ebp + 0xc], 0
jne 0x638c43
call fcn.006388e3
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebp + 0x10]
mov dword [eax], esi
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x639679
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
mov esi, ecx
je 0x6396e3
mov eax, dword [edi]
push 0
mov ecx, edi
call dword [eax]
mov eax, dword [esi + 0x1000]
mov dword [esi + eax*4], edi
inc dword [esi + 0x1000]
cmp dword [esi + 0x1000], 0x400
jl 0x6396e3
push dword [0x71e8c0]
mov edi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
call edi
test eax, eax
je 0x6396d9
push dword [0x71e8c0]
call edi
mov edx, dword [eax]
push 0x50
lea ecx, [esi + 0x800]
push ecx
push 0x200
mov ecx, eax
call dword [edx + 0x14]
add dword [esi + 0x1000], 0xfffffe00
pop edi
pop esi
pop ebp
ret 4

Function at 0x63a033
Capabilities:
Get thread local storage value

Disassembly:
push esi
push edi
mov edi, ecx
lea esi, [edi + 0x1000]
mov eax, dword [esi]
test eax, eax
jg 0x63a069
push dword [0x71e8c0]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edx, dword [eax]
push 0x50
push 0x200
push edi
push esi
mov ecx, eax
call dword [edx + 0xc]
mov eax, dword [esi]
test eax, eax
jne 0x63a069
xor edi, edi
jmp 0x63a087
dec eax
push 0x50
mov dword [esi], eax
mov edi, dword [edi + eax*4]
push 0
push edi
call fcn.0066e181
add esp, 0xc
test edi, edi
je 0x63a087
mov ecx, edi
call fcn.00639f37
mov eax, edi
pop edi
pop esi
ret

Function at 0x63a287
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push edi
mov edi, ecx
mov eax, dword [edi]
test eax, eax
je 0x63a29b
mov ebx, dword [eax - 8]
jmp 0x63a29d
xor ebx, ebx
mov ecx, dword [ebp + 8]
test ecx, ecx
jl 0x63a358
cmp ecx, ebx
jge 0x63a358
dec ebx
test ebx, ebx
push esi
mov dword [ebp + 8], ebx
jle 0x63a328
cmp ecx, ebx
jge 0x63a2d5
mov edx, ebx
sub edx, ecx
lea eax, [eax + ecx*8]
shl edx, 3
push edx
lea ecx, [eax + 8]
push ecx
push eax
call fcn.0066ef09
add esp, 0xc
push dword [0x71e8c0]
mov esi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
call esi
test eax, eax
je 0x63a321
push dword [0x71e8c0]
call esi
mov esi, dword [edi]
push 0
push 0xffffffffffffffff
push 0
mov dword [ebp - 4], eax
mov eax, dword [eax]
push 8
push ebx
sub esi, 8
mov dword [ebp - 8], eax
call fcn.005bc615
mov ecx, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
push esi
call dword [eax + 8]
test eax, eax
mov ebx, dword [ebp + 8]
je 0x63a321
add eax, 8
mov dword [edi], eax
mov eax, dword [edi]
mov dword [eax - 8], ebx
jmp 0x63a352
push dword [0x71e8c0]
mov esi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
call esi
test eax, eax
je 0x63a34f
push dword [0x71e8c0]
call esi
mov ecx, dword [edi]
mov edx, dword [eax]
sub ecx, 8
push ecx
mov ecx, eax
call dword [edx + 0x10]
and dword [edi], 0
xor eax, eax
inc eax
pop esi
jmp 0x63a35a
xor eax, eax
pop edi
pop ebx
leave
ret 4
Function at 0x63aac3
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
push 2
mov dword [edi], 0x4ef0f4
lea esi, [edi + 0x20]
pop ebx
mov eax, dword [esi]
test eax, eax
je 0x63aae3
push eax
call fcn.0063aa30
and dword [esi], 0
add esi, 4
dec ebx
jne 0x63aad4
mov eax, dword [edi + 0xc]
test eax, eax
je 0x63aaf6
push eax
call fcn.005ee6c9
push dword [0x728f98]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
and dword [eax + 0x16c], 0
mov ecx, edi
pop edi
pop esi
pop ebx
jmp fcn.00646cb1

Function at 0x63bc30
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push dword [0x71e8c0]
mov edi, ecx
call esi
test eax, eax
je 0x63bc8b
push dword [0x71e8c0]
call esi
mov esi, eax
mov eax, dword [edi]
xor ecx, ecx
cmp eax, ecx
je 0x63bc64
add eax, 0xfffffff8
mov dword [ebp - 4], eax
jmp 0x63bc67
mov dword [ebp - 4], ecx
push ebx
mov ebx, dword [esi]
push ecx
push 0xffffffffffffffff
push ecx
push 8
push dword [ebp + 8]
call fcn.005bc615
push eax
push dword [ebp - 4]
mov ecx, esi
call dword [ebx + 8]
test eax, eax
pop ebx
je 0x63bc96
add eax, 8
mov dword [edi], eax
mov eax, dword [edi]
mov ecx, dword [ebp + 8]
mov dword [eax - 8], ecx
xor eax, eax
inc eax
pop edi
pop esi
leave
ret 8

Function at 0x63bd4d
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.0063a287
Function at 0x63cc5e
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov ebx, dword [ebp + 0x10]
and dword [ebx], 0
test byte [ecx + 0x38], 0x80
jne 0x63cc79
push 2
pop eax
jmp 0x63cde5
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [esi + 8]
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 4]
sub eax, 0
je 0x63cd5c
dec eax
jne 0x63cd9c
mov eax, dword [edi + 4]
push 8
mov dword [ebp + 0x10], eax
call sub.gdiplus.dll_GdipAlloc
test eax, eax
je 0x63ccb4
mov ecx, eax
call fcn.0063cba0
mov edi, eax
jmp 0x63ccb6
xor edi, edi
test edi, edi
je 0x63cd9c
mov ecx, dword [ebp + 0x10]
push edi
call fcn.0063cb5d
mov eax, dword [ebp + 0xc]
mov dword [ebx], edi
mov esi, dword [esi]
mov ecx, dword [eax]
mov edx, dword [esi]
cmp ecx, edx
mov dword [ebp - 0x14], ecx
jg 0x63ccdc
mov dword [ebp - 0x14], edx
mov ecx, dword [eax + 8]
mov edx, dword [esi + 8]
cmp ecx, edx
mov dword [ebp - 0xc], ecx
jl 0x63ccec
mov dword [ebp - 0xc], edx
mov ecx, dword [ebp - 0xc]
cmp dword [ebp - 0x14], ecx
jge 0x63cd1c
mov ecx, dword [eax + 4]
mov edx, dword [esi + 4]
cmp ecx, edx
mov dword [ebp - 0x10], ecx
jg 0x63cd04
mov dword [ebp - 0x10], edx
mov eax, dword [eax + 0xc]
mov esi, dword [esi + 0xc]
cmp eax, esi
mov dword [ebp - 8], eax
jl 0x63cd14
mov dword [ebp - 8], esi
mov eax, dword [ebp - 8]
cmp dword [ebp - 0x10], eax
jl 0x63cd2a
xor eax, eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.0063c646
mov ecx, dword [ebp + 0x10]
push 1
lea eax, [ebp - 0x24]
push eax
call fcn.0063cafe
mov ecx, dword [ebp + 0x10]
call fcn.0063cb7c
neg eax
sbb eax, eax
and eax, 0xfffffffe
add eax, 3
jmp 0x63cde3
mov eax, dword [edi + 4]
push dword [0x728f98]
mov ebx, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
call ebx
mov edi, eax
add edi, 0xc
mov ecx, edi
call fcn.00647e2d
test eax, eax
mov dword [ebp + 8], eax
je 0x63cd9c
push eax
push dword [ebp - 4]
call dword [sym.imp.GDI32.dll_GetClipRgn]
cmp eax, 0xffffffff
jne 0x63cda0
push dword [ebp + 8]
mov ecx, edi
call fcn.00647e7c
xor eax, eax
jmp 0x63cde3
test eax, eax
jne 0x63cdb2
push dword [ebp + 8]
mov ecx, edi
call fcn.00647e7c
xor eax, eax
jmp 0x63cdb5
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
push dword [0x728f98]
call ebx
push dword [esi + 0x20]
mov edi, dword [eax + 8]
push dword [esi + 0x1c]
mov ecx, dword [esi + 0x10]
push dword [ebp + 0xc]
push edi
call fcn.006482cf
push 1
push edi
push dword [ebp - 4]
call dword [sym.imp.GDI32.dll_ExtSelectClipRgn]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x63cdea
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
test byte [ecx + 0x38], 0x80
je 0x63ce54
mov eax, dword [ebp + 8]
push esi
mov esi, dword [eax + 8]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
sub eax, 0
je 0x63ce28
dec eax
jne 0x63ce53
mov ecx, dword [esi + 4]
push 0
push dword [ebp + 0xc]
call fcn.0063cb3b
cmp dword [ebp + 0xc], 0
je 0x63ce53
mov ecx, dword [ebp + 0xc]
push 1
call fcn.0063c805
jmp 0x63ce53
push 5
push dword [ebp + 0xc]
push dword [esi + 4]
call dword [sym.imp.GDI32.dll_ExtSelectClipRgn]
cmp dword [ebp + 0xc], 0
je 0x63ce53
push dword [0x728f98]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push dword [ebp + 0xc]
lea ecx, [eax + 0xc]
call fcn.00647e7c
pop esi
pop ebp
ret 8
Function at 0x63f5d4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
call fcn.005f8b27
test eax, eax
je 0x63f697
mov esi, dword [eax + 0x20]
test esi, esi
je 0x63f697
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x63f697
cmp dword [esi + 0x4c], 0
je 0x63f614
push dword [ebp + 0xc]
push ebx
call fcn.0063f54e
jmp 0x63f699
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 1
call edi
test ax, ax
jl 0x63f635
push 4
call edi
test ax, ax
jl 0x63f635
push 2
call edi
test ax, ax
jge 0x63f697
mov eax, dword [ebp + 0xc]
test eax, eax
mov dword [esi + 0x4c], ebx
je 0x63f64a
mov ecx, dword [eax]
mov dword [esi + 0x50], ecx
mov eax, dword [eax + 4]
mov dword [esi + 0x54], eax
mov ecx, ebx
call fcn.005f8d40
mov edi, eax
mov ecx, edi
call fcn.0063f0ec
and dword [ebp - 0xc], 0
mov ecx, edi
call fcn.005f8d40
mov esi, dword [eax + 0x50]
call fcn.005f8b27
push eax
push esi
push 1
lea ecx, [ebp - 0xc]
call fcn.0063ab78
test eax, eax
je 0x63f68a
push 0
lea eax, [ebp + 8]
push eax
mov ecx, edi
call fcn.0063f4b1
lea ecx, [ebp - 0xc]
call fcn.0063ab31
xor eax, eax
inc eax
jmp 0x63f699
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x63fe45
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov eax, dword [esi + 0x1c]
push edi
or edi, 0xffffffff
test eax, eax
je 0x63fe81
add eax, 0xfffffff8
je 0x63fe81
mov ecx, dword [eax + 8]
test ecx, ecx
je 0x63fe67
add ecx, 0xfffffff8
jmp 0x63fe69
xor ecx, ecx
mov eax, dword [eax + 0x28]
cmp eax, edi
jae 0x63fe76
test eax, eax
mov edi, eax
je 0x63fe7c
test ecx, ecx
mov eax, ecx
jne 0x63fe5b
cmp edi, 0xa
jbe 0x63fec4
push dword [0x728f98]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [esi + 0x20]
lea edx, [ecx - 8]
neg ecx
sbb ecx, ecx
and ecx, edx
je 0x63fec4
mov edx, dword [ecx + 8]
test edx, edx
je 0x63fea7
add edx, 0xfffffff8
jmp 0x63fea9
xor edx, edx
cmp dword [ecx + 0x10], eax
jne 0x63febe
mov ecx, dword [ecx + 0x40]
sub ecx, dword [ebp + 8]
jns 0x63feb8
xor ecx, ecx
cmp ecx, edi
jae 0x63febe
mov edi, ecx
test edx, edx
mov ecx, edx
jne 0x63fe9b
mov eax, edi
pop edi
pop esi
pop ebp
ret 4
Function at 0x6406ee
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push edi
mov edi, ecx
mov eax, dword [edi]
test eax, eax
je 0x640702
mov ebx, dword [eax - 4]
jmp 0x640704
xor ebx, ebx
mov ecx, dword [ebp + 8]
test ecx, ecx
jl 0x6407bf
cmp ecx, ebx
jge 0x6407bf
dec ebx
test ebx, ebx
push esi
mov dword [ebp + 8], ebx
jle 0x64078f
cmp ecx, ebx
jge 0x64073c
mov edx, ebx
sub edx, ecx
lea eax, [eax + ecx*4]
shl edx, 2
push edx
lea ecx, [eax + 4]
push ecx
push eax
call fcn.0066ef09
add esp, 0xc
push dword [0x71e8c0]
mov esi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
call esi
test eax, eax
je 0x640788
push dword [0x71e8c0]
call esi
mov esi, dword [edi]
push 0
push 0xffffffffffffffff
push 0
mov dword [ebp - 4], eax
mov eax, dword [eax]
push 4
push ebx
sub esi, 4
mov dword [ebp - 8], eax
call fcn.005ad160
mov ecx, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
push esi
call dword [eax + 8]
test eax, eax
mov ebx, dword [ebp + 8]
je 0x640788
add eax, 4
mov dword [edi], eax
mov eax, dword [edi]
mov dword [eax - 4], ebx
jmp 0x6407b9
push dword [0x71e8c0]
mov esi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
call esi
test eax, eax
je 0x6407b6
push dword [0x71e8c0]
call esi
mov ecx, dword [edi]
mov edx, dword [eax]
sub ecx, 4
push ecx
mov ecx, eax
call dword [edx + 0x10]
and dword [edi], 0
xor eax, eax
inc eax
pop esi
jmp 0x6407c1
xor eax, eax
pop edi
pop ebx
leave
ret 4

Function at 0x6407f7
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push dword [0x71e8c0]
mov edi, ecx
call esi
test eax, eax
je 0x640852
push dword [0x71e8c0]
call esi
mov esi, eax
mov eax, dword [edi]
xor ecx, ecx
cmp eax, ecx
je 0x64082b
add eax, 0xfffffffc
mov dword [ebp - 4], eax
jmp 0x64082e
mov dword [ebp - 4], ecx
push ebx
mov ebx, dword [esi]
push ecx
push 0xffffffffffffffff
push ecx
push 4
push dword [ebp + 8]
call fcn.005ad160
push eax
push dword [ebp - 4]
mov ecx, esi
call dword [ebx + 8]
test eax, eax
pop ebx
je 0x64085d
add eax, 4
mov dword [edi], eax
mov eax, dword [edi]
mov ecx, dword [ebp + 8]
mov dword [eax - 4], ecx
xor eax, eax
inc eax
pop edi
pop esi
leave
ret 8

Function at 0x646ad0
Capabilities:
Get thread local storage value

Disassembly:
push esi
mov esi, ecx
lea ecx, [esi + 0x40]
call fcn.00646a31
lea ecx, [esi + 0x20]
call fcn.00646a31
mov ecx, esi
pop esi
jmp fcn.00646a31
push esi
mov esi, ecx
mov ecx, dword [esi + 0x16c]
or dword [esi + 0x194], 2
test ecx, ecx
je 0x646b01
push esi
push 0x6469e1
call fcn.0063a4df
test eax, eax
je 0x646afa
mov ecx, esi
call fcn.00646997
and dword [esi + 0x16c], 0
mov eax, dword [esi + 8]
test eax, eax
je 0x646b0f
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
push 1
lea ecx, [esi + 0x170]
call fcn.00646e0b
lea ecx, [esi + 0x168]
call fcn.0064998f
lea ecx, [esi + 0x6c]
call fcn.00647ac3
lea ecx, [esi + 0xc]
pop esi
jmp 0x646ab5
Function at 0x646bd5
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
push dword [0x728f98]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
xor edi, edi
cmp eax, edi
je 0x646bf8
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
xor eax, eax
jmp 0x646c8c
push ebx
push esi
mov dword [ebp - 4], 0x80070057
call fcn.00646baa
mov esi, eax
cmp esi, edi
jne 0x646c18
mov dword [ebp - 4], 0x8007000e
jmp 0x646ca7
push edi
push edi
push edi
push edi
call dword [sym.imp.GDI32.dll_CreateRectRgn]
cmp eax, edi
mov dword [esi + 8], eax
jne 0x646c32
mov dword [ebp - 4], 0x8007000e
jmp 0x646c93
lea eax, [esi + 0x194]
mov ecx, dword [eax]
xor ecx, dword [ebp + 8]
mov ebx, 0x729734
and ecx, 1
xor dword [eax], ecx
lea edi, [esi + 0x18c]
mov ecx, dword [ebx]
mov eax, dword [ecx]
push esi
call dword [eax]
test eax, eax
mov dword [edi], eax
je 0x646c91
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 4]
test eax, eax
mov dword [ebp - 4], eax
jl 0x646c91
add ebx, 4
add edi, 4
cmp ebx, 0x729738
jl 0x646c4d
push esi
push dword [0x728f98]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
xor eax, eax
pop esi
pop ebx
pop edi
leave
ret 8
xor edi, edi
mov eax, dword [esi + 8]
cmp eax, edi
je 0x646ca1
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
push esi
call fcn.0063897d
mov eax, dword [ebp + 0xc]
mov dword [eax], edi
mov eax, dword [ebp - 4]
jmp 0x646c8a

Function at 0x646d64
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
cmp edi, dword [esi + 0x18]
jle 0x646dad
push dword [0x71e8c0]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push 1
push 0xffffffffffffffff
push 0
push edi
push 1
mov ebx, eax
call fcn.005ad160
push eax
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 4]
test eax, eax
jne 0x646da0
xor eax, eax
jmp 0x646e04
mov ecx, dword [esi + 0xc]
mov dword [eax], ecx
mov dword [esi + 0xc], eax
add eax, 4
jmp 0x646e04
cmp dword [esi + 8], 0
je 0x646db8
cmp edi, dword [esi + 0x10]
jle 0x646df8
push dword [0x71e8c0]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, dword [eax]
push 1
push 0xffffffffffffffff
push 0
push dword [esi + 0x14]
mov dword [ebp + 8], eax
push 1
call fcn.005ad160
mov ecx, dword [ebp + 8]
push eax
call dword [ebx + 4]
test eax, eax
je 0x646d9c
mov ecx, dword [esi + 8]
mov dword [eax], ecx
mov ecx, dword [esi + 0x14]
mov dword [esi + 8], eax
add eax, 4
mov dword [esi + 0x10], ecx
mov dword [esi + 4], eax
mov eax, dword [esi + 4]
sub dword [esi + 0x10], edi
lea ecx, [eax + edi]
mov dword [esi + 4], ecx
pop edi
pop esi
pop ebx
pop ebp
ret 4