joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000959d
Capabilities:
Check if file exists

Disassembly:
push 0x94
mov eax, 0x1006ff8a
call fcn.100521f6
lea ebx, [ebp - 0x64]
xor edi, edi
call fcn.10008f27
mov ebx, 0x10076e30
push ebx
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x80]
push eax
mov dword [ebp - 4], edi
call fcn.1000c54c
add esp, 0xc
push 0x10076e10
push eax
lea eax, [ebp - 0x48]
push eax
mov byte [ebp - 4], 1
call fcn.1000c54c
add esp, 0xc
push edi
push 1
lea esi, [ebp - 0x80]
mov byte [ebp - 4], 3
call fcn.1000457f
push ebx
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x9c]
push eax
call fcn.1000c54c
add esp, 0xc
push 0x10076e34
push eax
lea eax, [ebp - 0x2c]
push eax
mov byte [ebp - 4], 4
call fcn.1000c54c
add esp, 0xc
push edi
push 1
lea esi, [ebp - 0x9c]
mov byte [ebp - 4], 6
call fcn.1000457f
cmp dword [ebp - 0x30], 8
mov eax, dword [ebp - 0x44]
jae 0x1000963c
lea eax, [ebp - 0x44]
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push eax
call ebx
test eax, eax
je 0x100096d1
cmp dword [ebp - 0x30], 8
mov esi, dword [ebp - 0x44]
jae 0x10009659
lea esi, [ebp - 0x44]
call fcn.1000bd7d
mov ecx, esi
mov edi, eax
call fcn.1001c019
call fcn.1000bd7d
mov esi, dword [eax + 0xcc]
push 0
push 0xb
call fcn.1000bd7d
call fcn.1001c22a
xor edi, edi
inc edi
cmp esi, 0xffffffff
je 0x100096d1
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x10009694
lea eax, [ebp - 0x28]
push eax
call ebx
test eax, eax
je 0x100096d1
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x100096a7
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x100096d1
push str.UnionInstall
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100096ca
push esi
call eax
pop ecx
mov edi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor ebx, ebx
push ebx
push 1
lea esi, [ebp - 0x2c]
call fcn.1000457f
push ebx
push 1
lea esi, [ebp - 0x48]
call fcn.1000457f
push ebx
push 1
lea esi, [ebp - 0x64]
call fcn.1000457f
mov eax, edi
call fcn.10052279
ret

Function at 0x100096fc
Capabilities:
Check if file exists

Disassembly:
push 0x5c
mov eax, 0x1006ff3a
call fcn.100521f6
lea ebx, [ebp - 0x48]
call fcn.10008f27
push 0x10076e30
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x64]
xor ebx, ebx
push eax
mov dword [ebp - 4], ebx
call fcn.1000c54c
add esp, 0xc
push 0x10076e10
push eax
lea eax, [ebp - 0x2c]
push eax
mov byte [ebp - 4], 1
call fcn.1000c54c
add esp, 0xc
push ebx
push 1
lea esi, [ebp - 0x64]
mov byte [ebp - 4], 3
call fcn.1000457f
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x1000975b
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1000978d
cmp dword [ebp - 0x14], 8
mov esi, dword [ebp - 0x28]
jae 0x10009772
lea esi, [ebp - 0x28]
call fcn.1000bd7d
mov ecx, esi
mov edi, eax
call fcn.1001c019
push ebx
push 4
call fcn.1000bd7d
call fcn.1001c22a
push ebx
push 1
lea esi, [ebp - 0x2c]
call fcn.1000457f
push ebx
push 1
lea esi, [ebp - 0x48]
call fcn.1000457f
call fcn.10052279
ret
Function at 0x100097a9
Capabilities:
Delete file

Disassembly:
push 0x3c
mov eax, 0x1006c614
call fcn.100521f6
push 0
push 1
push str._moduleAssistant.dll__crashrestoreimport
call fcn.10020509
add esp, 0xc
push 0x10094a30
lea esi, [ebp - 0x2c]
call fcn.100040e3
and dword [ebp - 4], 0
push str.user_data0crash_restore.db
lea esi, [ebp - 0x48]
call fcn.100040e3
lea eax, [ebp - 0x2c]
push eax
mov eax, esi
mov byte [ebp - 4], 1
call fcn.1002770a
pop ecx
push 0
push 1
call fcn.1000457f
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x10009809
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push 1
lea esi, [ebp - 0x2c]
call fcn.1000457f
xor eax, eax
inc eax
call fcn.10052279
ret

Function at 0x10009825
Capabilities:
Delete file

Disassembly:
push 0x3c
mov eax, 0x1006c614
call fcn.100521f6
push 0
push 1
push str._moduleAssistant.dll__homepageimport
call fcn.10020509
add esp, 0xc
push 0x10094a30
lea esi, [ebp - 0x2c]
call fcn.100040e3
and dword [ebp - 4], 0
push str.user_data0ED81EB6C_3DC4_4322_96F1_1B8716C404C4.db
lea esi, [ebp - 0x48]
call fcn.100040e3
lea eax, [ebp - 0x2c]
push eax
mov eax, esi
mov byte [ebp - 4], 1
call fcn.1002770a
pop ecx
push 0
push 1
call fcn.1000457f
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x10009885
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push 1
lea esi, [ebp - 0x2c]
call fcn.1000457f
xor eax, eax
inc eax
call fcn.10052279
ret
Function at 0x10009c8a
Capabilities:
Delete registry key

Disassembly:
push 0x5c
mov eax, 0x1006f66f
call fcn.100521f6
xor edi, edi
xor eax, eax
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], edi
mov word [ebp - 0x28], ax
mov dword [ebp - 4], edi
call fcn.1000bca4
lea eax, [ebp - 0x2c]
push eax
call fcn.100201f2
push str.1.0.0.28
lea eax, [ebp - 0x2c]
call fcn.10004b80
test eax, eax
jne 0x10009d47
push str.SOFTWARETencentQQBrowserExtensions5FD65AEB_B895_446A_915D_72B6D4886A0E
push reloc.gdiplus.dll_Ordinal_1
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
push 0x10094a30
lea esi, [ebp - 0x48]
call fcn.100040e3
push str.Extensions5FD65AEB_B895_446A_915D_72B6D4886A0E
lea esi, [ebp - 0x64]
mov byte [ebp - 4], 1
call fcn.100040e3
lea eax, [ebp - 0x48]
push eax
mov eax, esi
mov byte [ebp - 4], 2
call fcn.1002770a
pop ecx
push edi
push 1
mov byte [ebp - 4], 1
call fcn.1000457f
cmp dword [ebp - 0x30], 8
mov eax, dword [ebp - 0x44]
jae 0x10009d20
lea eax, [ebp - 0x44]
push eax
lea esi, [ebp - 0x64]
call fcn.100040e3
mov eax, esi
mov byte [ebp - 4], 3
call fcn.10027878
push edi
push 1
call fcn.1000457f
push edi
push 1
lea esi, [ebp - 0x48]
call fcn.1000457f
push edi
push 1
lea esi, [ebp - 0x2c]
call fcn.1000457f
xor eax, eax
inc eax
call fcn.10052279
ret
Function at 0x1000a340
Capabilities:
Check if file exists
Delete file

Disassembly:
push 0x9c
mov eax, 0x1006f627
call fcn.100521f6
push 0x10094a30
lea esi, [ebp - 0x48]
call fcn.100040e3
lea eax, [ebp - 0x84]
xor ebx, ebx
push eax
mov dword [ebp - 4], ebx
call fcn.100242be
pop ecx
mov byte [ebp - 4], 1
mov esi, dword [ebp - 0x78]
cmp esi, dword [ebp - 0x74]
jbe 0x1000a37f
call fcn.1004cee2
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x68], esi
mov esi, dword [ebp - 0x74]
cmp dword [ebp - 0x78], esi
jbe 0x1000a398
call fcn.1004cee2
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0x88], esi
lea edi, [ebp - 0x8c]
lea esi, [ebp - 0x6c]
mov dword [ebp - 0x8c], eax
call fcn.10004957
test al, al
je 0x1000a47b
call fcn.1001ce5e
push eax
lea esi, [ebp - 0x64]
call fcn.10004103
lea eax, [ebp - 0x48]
push eax
lea esi, [ebp - 0x2c]
mov byte [ebp - 4], 2
call fcn.10004103
push str.Extensions8Temp
lea esi, [ebp - 0xa8]
mov byte [ebp - 4], 3
call fcn.100040e3
lea eax, [ebp - 0x2c]
push eax
mov eax, esi
mov byte [ebp - 4], 4
call fcn.1002770a
pop ecx
push ebx
push 1
mov byte [ebp - 4], 3
call fcn.1000457f
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x64]
call fcn.1002770a
lea eax, [ebp - 0x2c]
mov dword [esp], str..qrx
push eax
call fcn.10004241
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x1000a436
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1000a454
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x1000a44d
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ebx
push 1
lea esi, [ebp - 0x2c]
call fcn.1000457f
push ebx
push 1
lea esi, [ebp - 0x64]
mov byte [ebp - 4], 1
call fcn.1000457f
lea esi, [ebp - 0x6c]
call fcn.1000bdc7
jmp 0x1000a38b
lea esi, [ebp - 0x84]
call fcn.10004651
push dword [ebp - 0x84]
call fcn.1004dd0c
pop ecx
push ebx
push 1
lea esi, [ebp - 0x48]
call fcn.1000457f
call fcn.10052279
ret
Function at 0x1000a7a5
Capabilities:
Check if file exists
Delete file

Disassembly:
push 0x60
mov eax, 0x1006fc18
call fcn.100521f6
mov eax, dword [ebp + 8]
mov dword [ebp - 0x4c], eax
mov edi, ecx
xor eax, eax
test edi, edi
je 0x1000a7ca
mov ebx, 0x10094a30
cmp eax, ebx
jne 0x1000a7d2
xor eax, eax
call fcn.10052279
ret 0xc
push edi
lea esi, [ebp - 0x48]
call fcn.100040e3
and dword [ebp - 4], 0
push str..qrx
mov eax, esi
push eax
call fcn.10004241
push ebx
lea esi, [ebp - 0x2c]
call fcn.100040e3
push str.Extensions8Temp
lea esi, [ebp - 0x68]
mov byte [ebp - 4], 1
call fcn.100040e3
lea eax, [ebp - 0x2c]
push eax
mov eax, esi
mov byte [ebp - 4], 2
call fcn.1002770a
pop ecx
xor ebx, ebx
push ebx
push 1
mov byte [ebp - 4], 1
call fcn.1000457f
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x48]
call fcn.1002770a
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
pop ecx
jae 0x1000a83d
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1000a863
push ebx
push 1
lea esi, [ebp - 0x2c]
call fcn.1000457f
push ebx
push 1
lea esi, [ebp - 0x48]
call fcn.1000457f
jmp 0x1000a7c8
cmp dword [ebp + 0x10], ebx
jne 0x1000a8a7
push edi
push dword [ebp - 0x4c]
call fcn.1000a4a3
test eax, eax
je 0x1000a8a7
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x1000a881
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor edi, edi
push ebx
push 1
lea esi, [ebp - 0x2c]
call fcn.1000457f
push ebx
push 1
lea esi, [ebp - 0x48]
call fcn.1000457f
mov eax, edi
jmp 0x1000a7ca
mov edi, dword [ebp - 0x4c]
lea esi, [edi + 0x134]
mov eax, dword [esi + 0x10]
sub eax, dword [esi + 0xc]
push 0x1c
cdq
pop ecx
idiv ecx
mov ecx, dword [ebp - 0x28]
add eax, 4
cmp dword [ebp - 0x14], 8
jae 0x1000a8cb
lea ecx, [ebp - 0x28]
cmp eax, 0x2d
jge 0x1000a8de
push dword [ebp + 0xc]
mov ebx, eax
push ecx
push edi
call fcn.1000b54d
xor ebx, ebx
lea eax, [ebp - 0x48]
push eax
mov eax, esi
call fcn.1000bbf5
xor edi, edi
inc edi
jmp 0x1000a88a
Function at 0x1000aa2a
Capabilities:
Delete registry key

Disassembly:
push 0xdc
mov eax, 0x1006f5d1
call fcn.100521f6
mov edi, 0x10094a30
push edi
lea esi, [ebp - 0xb0]
call fcn.100040e3
xor ebx, ebx
push str.ClientUpdateupdate.ini
lea esi, [ebp - 0xe8]
mov dword [ebp - 4], ebx
call fcn.100040e3
lea eax, [ebp - 0xb0]
push eax
mov eax, esi
mov byte [ebp - 4], 1
call fcn.1002770a
pop ecx
push ebx
push 1
mov byte [ebp - 4], bl
call fcn.1000457f
xor eax, eax
push 0x7e
mov word [ebp - 0x94], ax
lea eax, [ebp - 0x92]
push ebx
push eax
call fcn.10051a60
add esp, 0xc
push 0xd4a
push 0x100774c8
lea eax, [ebp - 0x94]
push 0x40
push eax
call fcn.1000c592
mov eax, dword [ebp - 0xac]
add esp, 0x10
cmp dword [ebp - 0x98], 8
jae 0x1000aac8
lea eax, [ebp - 0xac]
push eax
push ebx
push ebx
lea eax, [ebp - 0x94]
push eax
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push edi
lea esi, [ebp - 0xcc]
call fcn.100040e3
push str.Activity
lea esi, [ebp - 0xe8]
mov byte [ebp - 4], 2
call fcn.100040e3
lea eax, [ebp - 0xcc]
push eax
mov eax, esi
mov byte [ebp - 4], 3
call fcn.1002770a
pop ecx
xor edi, edi
push ebx
inc edi
push edi
mov byte [ebp - 4], 2
call fcn.1000457f
cmp dword [ebp - 0xb4], 8
mov eax, dword [ebp - 0xc8]
jae 0x1000ab2e
lea eax, [ebp - 0xc8]
push eax
lea esi, [ebp - 0xe8]
call fcn.100040e3
mov eax, esi
mov byte [ebp - 4], 4
call fcn.10027878
push ebx
push edi
mov byte [ebp - 4], 2
call fcn.1000457f
call fcn.1000bca4
push str.SoftwareTencentQQBrowserActivity
push reloc.gdiplus.dll_Ordinal_1
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
push ebx
push edi
lea esi, [ebp - 0xcc]
call fcn.1000457f
push ebx
push edi
lea esi, [ebp - 0xb0]
call fcn.1000457f
call fcn.10052279
ret

Function at 0x1000ac19
Capabilities:
Terminate process

Disassembly:
push ecx
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
cmp ebp, 0x64
je 0x1000ac2b
cmp ebp, 9
jne 0x1000ac36
push 1
push 0
mov esi, ebx
call fcn.10009079
cmp dword [ebx], 0
jne 0x1000ac60
cmp ebp, 0x64
jne 0x1000ac4b
push 0
xor edi, edi
mov esi, 0x10078ad8
jmp 0x1000ac5a
cmp ebp, 9
jne 0x1000ac60
mov edi, dword [ebx + 0x34]
push 0x30
mov esi, 0x10078a6c
call fcn.10018c95
pop ecx
mov esi, ebx
call fcn.100074e4
call fcn.1000421c
mov dword [eax + 0x74], ebp
mov esi, dword [ebx + 0x34]
xor edi, edi
test esi, esi
je 0x1000acca
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1000acca
push 0
push 0
push 0x465
push esi
call dword [sym.imp.USER32.dll_PostMessageW]
add edi, 0x3e8
push edi
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp edi, 0x4e20
jb 0x1000ac74
cmp ebp, 0x64
je 0x1000acbb
push dword [ebx + 0x58]
call fcn.1000421c
push eax
call fcn.1000c82c
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop edi
pop esi
pop ebp
pop ecx
ret 4
Function at 0x1000ae06
Capabilities:
Check if file exists

Disassembly:
push 0xfc
mov eax, 0x1006ea46
call fcn.100521f6
push 0x10094c38
lea esi, [ebp - 0x64]
mov dword [ebp - 0x98], 0x10076d8c
mov dword [ebp - 0x94], str.Assistant.dll
mov dword [ebp - 0x90], str.dr.dll
mov dword [ebp - 0x8c], str.MouseGesture.dll
mov dword [ebp - 0x88], str.Resource.dll
mov dword [ebp - 0x84], str.QBUtils.dll
mov dword [ebp - 0x80], str.Downloader.dll
mov dword [ebp - 0x7c], str.QQBrowserFrame.dll
mov dword [ebp - 0x78], str.TridentCore.dll
mov dword [ebp - 0x74], str.QQBrowserLiveup.exe
mov dword [ebp - 0x70], str.NetWork.dll
mov dword [ebp - 0x6c], str.QBExtensionFramework.dll
call fcn.100040e3
xor edi, edi
xor ebx, ebx
mov dword [ebp - 4], edi
mov dword [ebp - 0x68], edi
inc ebx
jmp 0x1000ae97
xor edi, edi
lea eax, [ebp - 0x64]
push eax
lea esi, [ebp - 0x2c]
call fcn.10004103
mov eax, dword [ebp - 0x68]
mov byte [ebp - 4], bl
push dword [ebp + eax*4 - 0x98]
lea esi, [ebp - 0xb4]
call fcn.100040e3
lea eax, [ebp - 0x2c]
push eax
mov eax, esi
mov byte [ebp - 4], 2
call fcn.1002770a
pop ecx
push edi
push ebx
mov byte [ebp - 4], bl
call fcn.1000457f
mov eax, dword [ebp - 0x28]
push 8
pop esi
cmp dword [ebp - 0x14], esi
jae 0x1000aee3
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
mov eax, dword [ebp - 0x28]
je 0x1000af82
cmp dword [ebp - 0x14], esi
jae 0x1000aefd
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.1002cf35
xor eax, eax
mov dword [ebp - 0x30], 7
mov dword [ebp - 0x34], edi
mov word [ebp - 0x44], ax
lea eax, [ebp - 0x108]
push eax
lea edi, [ebp - 0x48]
mov byte [ebp - 4], 4
call fcn.1002d003
mov eax, dword [ebp - 0x44]
cmp dword [ebp - 0x30], esi
jae 0x1000af38
lea eax, [ebp - 0x44]
mov edi, 0x10076c88
push edi
push eax
call fcn.1004d3b0
pop ecx
pop ecx
test eax, eax
jne 0x1000afb9
push eax
push ebx
lea esi, [ebp - 0x48]
call fcn.1000457f
lea esi, [ebp - 0xd4]
call fcn.1000bc81
push 0
push ebx
lea esi, [ebp - 0x2c]
mov byte [ebp - 4], 0
call fcn.1000457f
inc dword [ebp - 0x68]
cmp dword [ebp - 0x68], 0xc
jb 0x1000ae95
mov edi, ebx
jmp 0x1000b002
cmp dword [ebp - 0x14], esi
jae 0x1000af8a
lea eax, [ebp - 0x28]
push eax
push ebx
push 0xfa5
xor edx, edx
xor ecx, ecx
call fcn.10021489
add esp, 0xc
push edi
push ebx
lea esi, [ebp - 0x2c]
call fcn.1000457f
push edi
push ebx
lea esi, [ebp - 0x64]
call fcn.1000457f
xor eax, eax
call fcn.10052279
ret
mov ecx, dword [ebp - 0x44]
cmp dword [ebp - 0x30], esi
jae 0x1000afc4
lea ecx, [ebp - 0x44]
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x14], esi
jae 0x1000afcf
lea eax, [ebp - 0x28]
push eax
push 2
push 0xfa5
mov edx, edi
call fcn.10021489
add esp, 0xc
xor edi, edi
push edi
push ebx
lea esi, [ebp - 0x48]
call fcn.1000457f
lea esi, [ebp - 0xd4]
call fcn.1000bc81
push edi
push ebx
lea esi, [ebp - 0x2c]
call fcn.1000457f
push 0
push ebx
lea esi, [ebp - 0x64]
call fcn.1000457f
mov eax, edi
jmp 0x1000afb3
Function at 0x1000b54d
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
lea eax, [eax + ebx*4 + 0x80]
cmp dword [eax], 0
mov dword [ebp - 4], eax
je 0x1000b567
xor eax, eax
jmp 0x1000b5d8
push esi
push edi
mov edi, 0x214
push edi
call fcn.1003202e
push edi
xor edi, edi
mov esi, eax
push edi
push esi
call fcn.10051a60
mov eax, dword [ebp + 8]
add esp, 0x10
cmp ebx, 4
mov dword [esi], ebx
mov dword [esi + 4], eax
jl 0x1000b5b8
cmp dword [ebp + 0xc], edi
je 0x1000b5a9
push dword [ebp + 0xc]
lea eax, [esi + 0xc]
push 0x104
push eax
call fcn.1004d03b
add esp, 0xc
xor eax, eax
mov word [esi + 0x212], ax
mov eax, dword [ebp + 0x10]
mov dword [esi + 8], eax
push edi
push edi
push esi
push 0x1000b5dc
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
xor ecx, ecx
cmp eax, edi
setne cl
pop edi
pop esi
mov eax, ecx
leave
ret 0xc
Function at 0x1000e0a3
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [0x10093ee0]
sub esp, 0x1c
push ebx
push esi
push edi
cmp eax, 2
jne 0x1000e19f
call fcn.1000fb08
push dword [eax]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
test edi, edi
je 0x1000e19f
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], eax
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x14]
push eax
mov eax, edi
call fcn.100105f6
mov ebx, dword [edi + 0x10]
pop ecx
pop ecx
lea esi, [esp + 0x18]
call fcn.1001d36a
mov eax, dword [esp + 0x10]
test eax, eax
je 0x1000e108
cmp eax, dword [esp + 0x18]
je 0x1000e10d
call fcn.1004cee2
mov ebx, dword [esp + 0x14]
cmp ebx, dword [esp + 0x1c]
je 0x1000e19f
lea esi, [esp + 0x10]
call fcn.1001ce5e
push dword [eax]
push 0
call dword [sym.imp.USER32.dll_KillTimer]
mov edx, dword [edi + 0x10]
lea eax, [ebx + 8]
cmp eax, edx
je 0x1000e14f
lea ecx, [eax - 8]
mov esi, dword [eax]
mov dword [ecx], esi
mov esi, dword [eax + 4]
mov dword [ecx + 4], esi
add eax, 8
add ecx, 8
cmp eax, edx
jne 0x1000e13b
add dword [edi + 0x10], 0xfffffff8
lea esi, [esp + 0x20]
call fcn.1001d36a
mov eax, dword [edi + 0x10]
sub eax, dword [edi + 0xc]
test eax, 0xfffffff8
jne 0x1000e19f
mov eax, dword [edi + 0xc]
xor esi, esi
cmp eax, esi
je 0x1000e179
push eax
call fcn.1004dd0c
pop ecx
push dword [edi]
mov dword [edi + 0xc], esi
mov dword [edi + 0x10], esi
mov dword [edi + 0x14], esi
call fcn.1004dd0c
pop ecx
push edi
call fcn.1004dd0c
pop ecx
call fcn.1000fb08
push esi
push dword [eax]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1000e1a8
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push 0x14
mov eax, 0x1006e2fb
call fcn.1005218d
mov ebx, ecx
push ebx
call fcn.1000e0a3
push 0x1000e2a6
push 0xc8
xor edi, edi
push edi
push edi
call dword [sym.imp.USER32.dll_SetTimer]
mov dword [ebp - 0x14], eax
call fcn.1000fb08
push dword [eax]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
mov dword [ebp - 0x10], esi
cmp esi, edi
jne 0x1000e233
push 0x18
call fcn.1003202e
mov esi, eax
pop ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], edi
cmp esi, edi
je 0x1000e21c
push 4
call fcn.1003202e
pop ecx
cmp eax, edi
je 0x1000e20d
mov dword [eax], esi
jmp 0x1000e20f
xor eax, eax
mov dword [esi], eax
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
jmp 0x1000e21e
xor esi, esi
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x10], esi
call fcn.1000fb08
push esi
push dword [eax]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [esi + 0xc]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], ebx
cmp ecx, edi
jne 0x1000e247
xor eax, eax
jmp 0x1000e24f
mov eax, dword [esi + 0x14]
sub eax, ecx
sar eax, 3
mov ebx, dword [esi + 0x10]
mov edx, ebx
sub edx, ecx
sar edx, 3
cmp edx, eax
jae 0x1000e280
xor eax, eax
lea edi, [ebp - 0x14]
stosb byte es:[edi], al
push dword [ebp - 0x14]
lea ecx, [ebp - 0x20]
push dword [ebp - 0x14]
mov eax, ebx
push 1
call fcn.10010784
add esp, 0xc
add ebx, 8
mov dword [esi + 0x10], ebx
jmp 0x1000e2a0
mov edi, esi
lea esi, [ebp - 0x18]
call fcn.1001d36a
push dword [ebp - 0x14]
lea eax, [ebp - 0x20]
push dword [ebp - 0x18]
push eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x10]
call fcn.10010029
call fcn.10052265
ret
Function at 0x1000e565
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1006e2ce
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
mov eax, dword [0x1008f210]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 8]
mov dword [esp + 0xc], eax
call fcn.1000fb1d
push dword [eax]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x1000e5e1
push 0x20
call fcn.1003202e
pop ecx
mov dword [esp + 0x10], eax
and dword [esp + 0x30], esi
test eax, eax
je 0x1000e5cc
push eax
call fcn.1000fb32
mov esi, eax
jmp 0x1000e5ce
xor esi, esi
or dword [esp + 0x30], 0xffffffff
call fcn.1000fb1d
push esi
push dword [eax]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x14]
push eax
call fcn.1000fc65
cmp dword [esp + 0x10], 0
mov ebx, dword [esi + 0x18]
mov eax, dword [esi]
je 0x1000e602
cmp dword [esp + 0x10], eax
je 0x1000e607
call fcn.1004cee2
cmp dword [esp + 0x14], ebx
je 0x1000e611
xor al, al
jmp 0x1000e639
mov eax, dword [esp + 0xc]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
push eax
lea ebx, [esp + 0x1c]
mov eax, esi
mov dword [esp + 0x18], edi
call fcn.1000fbab
push dword [esp + 0xc]
call dword [sym.imp.USER32.dll_SetCapture]
mov al, 1
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000e64b
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [0x10093ee8]
sub esp, 0x18
push esi
push edi
cmp eax, 2
je 0x1000e667
xor al, al
jmp 0x1000e70d
call fcn.1000fb1d
push dword [eax]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
test edi, edi
je 0x1000e660
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 8]
mov dword [esp + 0xc], eax
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x14]
push eax
mov esi, edi
call fcn.1000fc65
cmp dword [esp + 0x10], 0
mov esi, dword [edi + 0x18]
mov eax, dword [edi]
je 0x1000e6a8
cmp dword [esp + 0x10], eax
je 0x1000e6ad
call fcn.1004cee2
cmp dword [esp + 0x14], esi
je 0x1000e660
lea esi, [esp + 0x10]
call fcn.10037af5
cmp dword [eax + 4], ebx
jne 0x1000e660
push dword [esp + 0x14]
lea eax, [esp + 0x1c]
push dword [esp + 0x14]
push eax
push edi
call fcn.100186f7
cmp dword [edi + 0x1c], 0
jne 0x1000e6f6
push edi
call fcn.1000fb83
push edi
call fcn.1004dd0c
pop ecx
call fcn.1000fb1d
push 0
push dword [eax]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
cmp byte [ebp + 8], 0
je 0x1000e701
xor eax, eax
inc eax
jmp 0x1000e70d
call dword [sym.imp.USER32.dll_ReleaseCapture]
neg eax
sbb eax, eax
neg eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4