joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100a4820
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
mov edi, edi
push esi
mov esi, dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
push 0xfffffffffffffffe
push 0xfffffffffffffffe
push 0x101e316c
mov dword [ebx], 0
call esi
cmp eax, 0xfffffffe
jne 0x100a48ad
push edi
push 0
push 1
push 0x101e8a94
call esi
cmp eax, 1
jne 0x100a486a
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push 1
call edi
push 0
push 1
push 0x101e8a94
call esi
cmp eax, 1
je 0x100a4856
push 0xfffffffffffffffe
push 0xfffffffffffffffe
push 0x101e316c
call esi
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov esi, eax
cmp esi, 0xfffffffe
jne 0x100a4897
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov esi, eax
cmp esi, 0xffffffff
je 0x100a4897
push esi
push 0x101e316c
call edi
push 0
push 0x101e8a94
call edi
pop edi
cmp esi, 0xffffffff
jne 0x100a48ad
mov eax, 0x8007000e
pop esi
ret
mov eax, dword [0x101e316c]
test eax, eax
jl 0x100a48d1
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x100a48d1
inc dword [eax + 0x12c]
mov dword [ebx], 1
xor eax, eax
pop esi
ret
push 0x130
call sub.msvcrt.dll_malloc
mov esi, eax
add esp, 4
test esi, esi
je 0x100a48a6
push 0x130
push 0
push esi
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [esi + 0x12c], 1
mov dword [ebx], 1
mov eax, dword [0x101e316c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
xor eax, eax
pop esi
ret

Function at 0x100a4a80
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x104
mov eax, dword [0x101e0048]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x101e8a90], 0
jne 0x100a4af5
cmp dword [0x101e8ac0], 0
push esi
mov esi, 0x101e8ac0
je 0x100a4aed
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
jmp 0x100a4ac0
mov ecx, dword [esi]
push pe_nt_image_headers32
lea eax, [ebp - 0x104]
push eax
push ecx
call edi
dec eax
cmp eax, 0xfe
ja 0x100a4ae4
lea ecx, [ebp - 0x104]
call fcn.100a4a10
add esi, 0x10
cmp dword [esi], 0
jne 0x100a4ac0
pop edi
mov byte [0x101e8a90], 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101dc51a
mov esp, ebp
pop ebp
ret
Function at 0x100a9db0
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x101e316c]
test eax, eax
jge 0x100a9dbd
xor eax, eax
jmp 0x100a9dc4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
xor ecx, ecx
lea edx, [eax + 0x24]
lea esp, [esp]
cmp dword [ecx*4 + 0x10053234], edi
jne 0x100a9dde
cmp dword [edx], 0
jne 0x100a9df3
inc ecx
add edx, 8
cmp ecx, 0xf
jb 0x100a9dd0
mov ecx, dword [eax + 0x20]
push 0x10
push edi
call fcn.101d8457
ret
mov edx, dword [eax + ecx*8 + 0x24]
test edx, edx
je 0x100a9e15
push esi
mov esi, dword [edx]
mov dword [eax + ecx*8 + 0x24], esi
test esi, esi
pop esi
jne 0x100a9e0f
mov dword [eax + ecx*8 + 0x28], 0
mov dword [edx], 0xfefefefe
cmp ecx, 0xf
jb 0x100a9e26
mov ecx, dword [eax + 0x20]
push 0x10
push edi
call fcn.101d8457
ret
mov eax, edx
ret

Function at 0x100aaa70
Capabilities:
Get thread local storage value

Disassembly:
test esi, esi
je 0x100aaac4
mov eax, dword [0x101e316c]
push ebx
push edi
test eax, eax
jge 0x100aaa83
xor ebx, ebx
jmp 0x100aaa8c
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov edi, dword [esi + 4]
mov eax, dword [edi*4 + 0x10053234]
push eax
push 0xfe
push esi
call sub.msvcrt.dll_memset
lea ecx, [ebx + edi*8 + 0x28]
mov dword [esi], 0
mov eax, dword [ecx]
add esp, 0xc
test eax, eax
je 0x100aaabc
pop edi
mov dword [eax], esi
mov dword [ecx], esi
pop ebx
ret
mov dword [ebx + edi*8 + 0x24], esi
pop edi
mov dword [ecx], esi
pop ebx
ret
Function at 0x100b36a0
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
push ebx
push esi
push edi
mov edi, ecx
lea ecx, [esp + 0xc]
mov esi, eax
call fcn.101dad02
xor eax, eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
cmp edi, eax
je 0x100b36e4
mov ecx, dword [ebp + 0x10]
cmp ecx, eax
jne 0x100b36ee
mov esi, 0x8876086c
jmp 0x100b3818
test esi, 0xfffffffc
jne 0x100b36e4
cmp dword [ebp + 8], 0x80000000
ja 0x100b36e4
push 0x10084308
mov dword [ecx], eax
call sub.msvcrt.dll_getenv
add esp, 4
test eax, eax
setne al
mov ecx, esi
shr esi, 1
and ecx, 1
and esi, 1
lea ebx, [esp + 0x14]
mov byte [0x101e8a91], al
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], esi
call fcn.100aab00
cmp dword [esp + 0x24], 0
je 0x100b3758
push 0x10084334
mov ecx, ebx
call fcn.100aae20
add esp, 4
push 0x1008433c
mov ecx, ebx
call fcn.100aae20
add esp, 4
mov edx, dword [ebp + 8]
push 0
push 0
push edx
push edi
lea ecx, [esp + 0x1c]
call fcn.101dad11
test eax, eax
jne 0x100b378c
mov eax, dword [ebp + 0xc]
push eax
push 0
push edi
call fcn.101db128
push eax
push edi
lea ecx, [esp + 0x1c]
push ecx
lea eax, [esp + 0x28]
call fcn.100b31d0
jmp 0x100b379c
mov edx, dword [ebp + 0xc]
push edi
push 1
push edx
lea eax, [esp + 0x20]
call fcn.100ae690
cmp dword [esp + 0x24], 0
je 0x100b37b4
push 0x10084358
lea ecx, [esp + 0x18]
call fcn.100aae20
add esp, 4
mov eax, dword [esp + 0x14]
mov edi, dword [ebp + 0x10]
inc eax
push edi
push eax
call fcn.101d836f
mov esi, eax
test esi, esi
jl 0x100b37fb
mov eax, dword [edi]
test eax, eax
jne 0x100b37d6
mov esi, 0x8007000e
jmp 0x100b37fb
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc]
push eax
call edx
mov ecx, dword [esp + 0x1c]
mov edi, eax
mov eax, dword [esp + 0x14]
push eax
push ecx
push edi
call sub.msvcrt.dll_memcpy
mov edx, dword [esp + 0x20]
add esp, 0xc
mov byte [edi + edx], 0
mov eax, dword [esp + 0x20]
test eax, eax
je 0x100b3818
push eax
push 4
call sub.msvcrt.dll_setlocale
mov eax, dword [esp + 0x28]
push eax
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
add esp, 0xc
mov ecx, dword [esp + 0x1c]
push ecx
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100bf990
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
cmp eax, 0x48530500
ja 0x100bfa5e
je 0x100bfbf4
cmp eax, 0x46580201
ja 0x100bf9fa
cmp eax, 0x46580200
jae 0x100bfa95
cmp eax, 0x43530500
ja 0x100bf9e4
je 0x100bfbf4
cmp eax, 0x43530400
jb 0x100bf9d9
cmp eax, 0x43530401
jbe 0x100bfbf4
pop esi
mov eax, 0x80070057
pop ebx
pop ebp
ret 4
cmp eax, 0x44530500
je 0x100bfbf4
pop esi
mov eax, 0x80070057
pop ebx
pop ebp
ret 4
cmp eax, 0x47530401
ja 0x100bfa48
cmp eax, 0x47530400
jae 0x100bfbf4
cmp eax, 0x46580400
jb 0x100bf9d9
cmp eax, 0x46580401
ja 0x100bf9d9
push 0x10390
call fcn.10119140
mov esi, eax
xor ebx, ebx
cmp esi, ebx
je 0x100bfc4c
call fcn.100c0500
mov dword [esi], 0x10089240
mov dword [esi + 0x10388], ebx
mov eax, esi
jmp 0x100bfc4e
cmp eax, 0x47530500
je 0x100bfbf4
pop esi
mov eax, 0x80070057
pop ebx
pop ebp
ret 4
cmp eax, 0xfffe0500
ja 0x100bfb4a
je 0x100bfbf4
cmp eax, 0xfffe02ff
ja 0x100bfb07
je 0x100bfad9
cmp eax, 0xfffe0102
ja 0x100bfac3
cmp eax, 0xfffe0101
jae 0x100bfad9
cmp eax, 0x54580100
jne 0x100bf9d9
push 0x10390
call fcn.10119140
mov esi, eax
xor ebx, ebx
cmp esi, ebx
je 0x100bfc4c
call fcn.100c0500
mov dword [esi], 0x10089168
mov dword [esi + 0x10388], ebx
mov eax, esi
jmp 0x100bfc4e
cmp eax, 0xfffe0200
jb 0x100bf9d9
cmp eax, 0xfffe0203
ja 0x100bf9d9
push 0x10388
call fcn.10119140
mov esi, eax
xor ebx, ebx
cmp esi, ebx
je 0x100bfc4c
call fcn.100c0500
mov dword [esi], 0x10087f40
mov byte [esi + 0x102e5], bl
mov eax, esi
jmp 0x100bfc4e
cmp eax, 0xfffe03ff
ja 0x100bfb35
je 0x100bfbac
cmp eax, 0xfffe0300
jb 0x100bf9d9
cmp eax, 0xfffe0301
jbe 0x100bfbac
pop esi
mov eax, 0x80070057
pop ebx
pop ebp
ret 4
cmp eax, 0xfffe0400
jb 0x100bf9d9
cmp eax, 0xfffe0401
jmp 0x100bf9d3
cmp eax, 0xffff03ff
ja 0x100bfbd7
je 0x100bfbac
cmp eax, 0xffff02ff
ja 0x100bfb96
je 0x100bfb76
cmp eax, 0xffff0200
jb 0x100bf9d9
cmp eax, 0xffff0205
ja 0x100bf9d9
push 0x103c0
call fcn.10119140
xor ebx, ebx
cmp eax, ebx
je 0x100bfc4c
mov esi, eax
call fcn.100de4c0
jmp 0x100bfc4e
cmp eax, 0xffff0300
jb 0x100bf9d9
cmp eax, 0xffff0301
ja 0x100bf9d9
push 0x10388
call fcn.10119140
mov esi, eax
xor ebx, ebx
cmp esi, ebx
je 0x100bfc4c
call fcn.100c0500
mov dword [esi], 0x10088488
mov byte [esi + 0x102e5], bl
mov eax, esi
jmp 0x100bfc4e
cmp eax, 0xffff0400
jb 0x100bf9d9
cmp eax, 0xffff0401
jbe 0x100bfbf4
cmp eax, 0xffff0500
jne 0x100bf9d9
mov eax, dword [0x101e316c]
xor ebx, ebx
cmp eax, ebx
jge 0x100bfc03
xor eax, eax
jmp 0x100bfc0a
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov eax, dword [eax]
push 0x103a0
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
cmp esi, ebx
je 0x100bfc4c
call fcn.100c0500
mov dword [esi], 0x10088f78
mov byte [esi + 0x102e5], bl
mov dword [esi + 0x1038c], ebx
mov dword [esi + 0x10390], ebx
mov dword [esi + 0x10394], ebx
mov dword [esi + 0x10388], ebx
mov eax, esi
jmp 0x100bfc4e
xor eax, eax
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
neg eax
sbb eax, eax
and eax, 0x7ff8fff2
pop esi
add eax, 0x8007000e
pop ebx
pop ebp
ret 4
Function at 0x100d61e0
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov ecx, dword [edi + 0x102a4]
push ebx
push esi
mov esi, ecx
test ecx, ecx
jne 0x100d61f9
mov esi, 0x400
mov edx, dword [edi + 0x102a0]
add edx, eax
cmp edx, esi
jbe 0x100d6216
mov edx, dword [edi + 0x102a0]
add eax, edx
lea ecx, [ecx]
add esi, esi
cmp eax, esi
ja 0x100d6210
cmp esi, ecx
je 0x100d6287
call fcn.1016a960
mov ebx, eax
test ebx, ebx
jne 0x100d6230
pop esi
mov eax, 0x8007000e
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 0x102a0]
mov ecx, dword [edi + 0x1029c]
add eax, eax
add eax, eax
push eax
push ecx
push ebx
call sub.msvcrt.dll_memcpy
mov ecx, dword [edi + 0x1029c]
add esp, 0xc
mov dword [ebp - 4], ecx
test ecx, ecx
je 0x100d627b
mov eax, dword [0x101e316c]
test eax, eax
jge 0x100d6265
xor eax, eax
jmp 0x100d626f
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [ebp - 4]
mov edx, dword [eax]
push ecx
push 0
push edx
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 0x1029c], ebx
mov dword [edi + 0x102a4], esi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100da4b0
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebx
xor ebx, ebx
mov dword [esi + 8], ebx
cmp byte [esi + 0xc], bl
je 0x100da4e7
push edi
mov edi, dword [esi]
cmp edi, ebx
je 0x100da4e3
mov eax, dword [0x101e316c]
cmp eax, ebx
jge 0x100da4d1
xor eax, eax
jmp 0x100da4d8
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov eax, dword [eax]
push edi
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov byte [esi + 0xc], bl
pop edi
mov dword [esi + 4], ebx
mov dword [esi], ebx
pop ebx
ret

Function at 0x100da6b0
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
cmp byte [esi + 0xd], 0
jne 0x100da6c5
mov eax, 0x8000ffff
mov esp, ebp
pop ebp
ret
push ebx
push edi
test ecx, ecx
jbe 0x100da6f4
lea eax, [ebp - 4]
push eax
mov eax, esi
call fcn.100f8dc0
test eax, eax
jne 0x100da77f
mov ebx, dword [ebp - 4]
cmp ebx, 0x3fffffff
jbe 0x100da714
pop edi
mov eax, 0x80070216
pop ebx
mov esp, ebp
pop ebp
ret
xor ebx, ebx
xor edi, edi
cmp byte [esi + 0xc], 0
je 0x100da76c
mov ecx, dword [esi]
mov dword [ebp - 4], ecx
test ecx, ecx
je 0x100da76c
mov eax, dword [0x101e316c]
test eax, eax
jge 0x100da756
xor eax, eax
jmp 0x100da760
test ebx, ebx
jbe 0x100da6f6
lea ecx, [ebx*4]
push ecx
call fcn.10119140
mov edi, eax
test edi, edi
jne 0x100da736
pop edi
mov eax, 0x8007000e
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 8]
mov ecx, ebx
cmp ebx, eax
jbe 0x100da741
mov ecx, eax
xor eax, eax
test ecx, ecx
jbe 0x100da6f8
mov edx, dword [esi]
mov edx, dword [edx + eax*4]
mov dword [edi + eax*4], edx
inc eax
cmp eax, ecx
jb 0x100da747
jmp 0x100da6f8
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [ebp - 4]
mov eax, dword [eax]
push ecx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [esi], edi
mov dword [esi + 4], ebx
cmp dword [esi + 8], ebx
jbe 0x100da779
mov dword [esi + 8], ebx
mov byte [esi + 0xc], 1
xor eax, eax
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100da790
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
cmp byte [esi + 0xd], 0
jne 0x100da7a5
mov eax, 0x8000ffff
mov esp, ebp
pop ebp
ret
push ebx
push edi
test ecx, ecx
jbe 0x100da7d0
lea eax, [ebp - 4]
push eax
mov eax, esi
call fcn.100f8dc0
test eax, eax
jne 0x100da823
mov ebx, dword [ebp - 4]
cmp ebx, 0x1fffffff
jbe 0x100da829
pop edi
mov eax, 0x80070216
pop ebx
mov esp, ebp
pop ebp
ret
xor ebx, ebx
xor edi, edi
cmp byte [esi + 0xc], 0
je 0x100da810
mov eax, dword [esi]
mov dword [ebp - 4], eax
test eax, eax
je 0x100da810
mov eax, dword [0x101e316c]
test eax, eax
jl 0x100da7fd
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x100da7fd
mov eax, dword [eax]
test eax, eax
jne 0x100da803
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, dword [ebp - 4]
push edx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [esi], edi
mov dword [esi + 4], ebx
cmp dword [esi + 8], ebx
jbe 0x100da81d
mov dword [esi + 8], ebx
mov byte [esi + 0xc], 1
xor eax, eax
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
test ebx, ebx
jbe 0x100da7d2
lea ecx, [ebx*8]
push ecx
call fcn.100dae90
mov edi, eax
test edi, edi
jne 0x100da84b
pop edi
mov eax, 0x8007000e
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 8]
mov edx, ebx
cmp ebx, eax
jbe 0x100da856
mov edx, eax
xor eax, eax
test edx, edx
jbe 0x100da7d4
mov ecx, dword [esi]
mov ebx, dword [ecx + eax*8]
mov dword [edi + eax*8], ebx
mov ecx, dword [ecx + eax*8 + 4]
mov dword [edi + eax*8 + 4], ecx
inc eax
cmp eax, edx
jb 0x100da860
mov ebx, dword [ebp - 4]
jmp 0x100da7d4

Function at 0x100da890
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp ecx, eax
jae 0x100da8f8
push ebx
push esi
mov esi, dword [ebp + 8]
mov edx, ecx
shl edx, 4
sub eax, ecx
push edi
lea esi, [edx + esi + 0xc]
mov dword [ebp + 8], eax
xor ebx, ebx
nop
lea eax, [esi - 0xc]
test eax, eax
je 0x100da8ec
mov dword [esi - 4], ebx
cmp byte [esi], bl
je 0x100da8e6
mov edi, dword [esi - 0xc]
cmp edi, ebx
je 0x100da8e4
mov eax, dword [0x101e316c]
cmp eax, ebx
jge 0x100da8d2
xor eax, eax
jmp 0x100da8d9
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [eax]
push edi
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov byte [esi], bl
mov dword [esi - 0xc], ebx
mov dword [esi - 8], ebx
add esi, 0x10
sub dword [ebp + 8], 1
jne 0x100da8b0
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x100da910
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp ecx, eax
jae 0x100da986
push ebx
push esi
mov esi, dword [ebp + 8]
lea edx, [ecx + ecx*2]
shl edx, 4
sub eax, ecx
push edi
lea esi, [edx + esi + 0x2c]
mov dword [ebp + 8], eax
xor ebx, ebx
lea eax, [esi - 0x2c]
test eax, eax
je 0x100da97a
mov ecx, dword [esi - 0xc]
mov eax, dword [esi - 4]
push ecx
xor ecx, ecx
call fcn.100da990
mov dword [esi - 4], ebx
cmp byte [esi], bl
je 0x100da974
mov edi, dword [esi - 0xc]
cmp edi, ebx
je 0x100da972
mov eax, dword [0x101e316c]
cmp eax, ebx
jge 0x100da960
xor eax, eax
jmp 0x100da967
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edx, dword [eax]
push edi
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov byte [esi], bl
mov dword [esi - 0xc], ebx
mov dword [esi - 8], ebx
add esi, 0x30
sub dword [ebp + 8], 1
jne 0x100da930
pop edi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x100da990
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp ecx, eax
jae 0x100da9f8
push ebx
push esi
mov esi, dword [ebp + 8]
sub eax, ecx
lea edx, [ecx + ecx*4]
push edi
lea esi, [esi + edx*4 + 0x10]
mov dword [ebp + 8], eax
xor ebx, ebx
lea ecx, [ecx]
lea eax, [esi - 0x10]
test eax, eax
je 0x100da9ec
mov dword [esi - 4], ebx
cmp byte [esi], bl
je 0x100da9e6
mov edi, dword [esi - 0xc]
cmp edi, ebx
je 0x100da9e4
mov eax, dword [0x101e316c]
cmp eax, ebx
jge 0x100da9d2
xor eax, eax
jmp 0x100da9d9
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [eax]
push edi
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov byte [esi], bl
mov dword [esi - 0xc], ebx
mov dword [esi - 8], ebx
add esi, 0x14
sub dword [ebp + 8], 1
jne 0x100da9b0
pop edi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x100daa10
Capabilities:
Get thread local storage value

Disassembly:
cmp esi, 0xaaaaaaa
jbe 0x100daa1b
xor eax, eax
ret
mov eax, dword [0x101e316c]
test eax, eax
jge 0x100daa28
xor eax, eax
jmp 0x100daa2f
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edx, dword [eax]
lea ecx, [esi + esi*2]
add ecx, ecx
add ecx, ecx
add ecx, ecx
push ecx
push 0
push edx
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
ret

Function at 0x100dae50
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x101e316c]
test eax, eax
jge 0x100dae5d
xor eax, eax
jmp 0x100dae64
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edx, dword [eax]
lea ecx, [esi + esi*2]
add ecx, ecx
add ecx, ecx
add ecx, ecx
push ecx
push 0
push edx
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
ret
Function at 0x100daed0
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push esi
mov esi, dword [edi + 4]
test esi, esi
je 0x100daf41
mov eax, dword [esi + 0xc]
cmp eax, dword [ebx + 0xc]
jb 0x100daf0f
mov eax, dword [0x101e316c]
test eax, eax
jge 0x100daefa
xor eax, eax
mov ecx, dword [eax]
push ebx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop esi
ret
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [eax]
push ebx
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop esi
ret
test esi, esi
je 0x100daf41
mov eax, dword [0x101e316c]
test eax, eax
jge 0x100daf2e
xor eax, eax
mov edx, dword [eax]
push esi
push eax
push edx
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 4], ebx
pop esi
ret
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edx, dword [eax]
push esi
push 0
push edx
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 4], ebx
pop esi
ret
Function at 0x100e1750
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, eax
mov eax, dword [esi + 0x8040]
push edi
mov dword [ebp - 4], eax
xor edi, edi
lea ebx, [ebp - 0x14]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
mov eax, dword [esi + 0x8040]
push 0x11
push edi
push edx
push eax
push ebx
push esi
call fcn.10169c20
test eax, eax
jl 0x100e18c5
inc edi
add ebx, 4
cmp edi, 4
jb 0x100e176b
mov eax, dword [ebp - 4]
inc dword [eax + 0x10]
mov eax, dword [0x101e316c]
xor ebx, ebx
cmp eax, ebx
jge 0x100e17a9
xor eax, eax
jmp 0x100e17b0
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp dword [eax + 0x18], ebx
je 0x100e17d6
mov ecx, dword [eax + 0x18]
cmp ecx, ebx
jne 0x100e17c0
xor eax, eax
jmp 0x100e17e2
mov edx, dword [ecx]
mov dword [eax + 0x18], edx
cmp edx, ebx
jne 0x100e17cc
mov dword [eax + 0x1c], ebx
mov dword [ecx], 0xfefefefe
mov eax, ecx
jmp 0x100e17e2
mov ecx, dword [eax + 0x14]
push 0x10
push 0x44
call fcn.101d8457
cmp eax, ebx
je 0x100e181d
or ecx, 0xffffffff
xor edx, edx
mov dword [eax + 0x10], ecx
mov dword [eax + 0x20], ecx
mov dword [eax], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0x3c], ebx
mov dword [eax + 4], ebx
mov word [eax + 0x40], dx
mov dword [eax + 0xc], ebx
mov word [eax + 0x42], dx
mov dword [eax + 0x14], ebx
mov dword [eax + 0x18], ebx
mov dword [eax + 0x1c], ebx
mov dword [eax + 0x24], ebx
mov dword [eax + 0x34], ebx
mov dword [eax + 0x38], ebx
mov ecx, eax
jmp 0x100e181f
xor ecx, ecx
mov eax, dword [ebp + 8]
mov dword [eax], ecx
cmp ecx, ebx
jne 0x100e1836
mov eax, 0x8007000e
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov edi, dword [ebp + 0xc]
push ebx
mov eax, edi
and eax, 0xfffff
push ecx
or eax, 0x10000000
mov edx, edi
mov ecx, edi
call fcn.10172020
cmp eax, ebx
mov dword [ebp - 4], eax
jge 0x100e1876
mov ecx, dword [ebp + 8]
mov esi, dword [ecx]
cmp esi, ebx
je 0x100e18c5
call fcn.10171ee0
call fcn.101751f0
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [esi + 0x10294]
mov edx, dword [ebp + 8]
mov ecx, dword [edx]
mov edx, dword [eax + 0x34]
mov dword [ecx + 0x34], edx
mov eax, dword [eax + 0x38]
mov dword [ecx + 0x38], eax
xor eax, eax
cmp edi, ebx
jbe 0x100e18c3
mov edi, dword [ecx + 4]
mov edx, dword [ebp + eax*4 - 0x14]
mov dword [edi + eax*4], edx
mov edi, dword [esi + 0x10294]
mov edi, dword [edi + 0xc]
mov edi, dword [edi + eax*4]
mov ebx, dword [ecx + 0xc]
mov dword [ebx + eax*4], edi
mov edi, dword [esi + 0x10294]
mov edi, dword [edi + 0xc]
mov dword [edi + eax*4], edx
inc eax
cmp eax, dword [ebp + 0xc]
jb 0x100e1893
xor ebx, ebx
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x100e5b00
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, ecx
xor eax, eax
mov dword [ebx], 0x10088f78
mov dword [ebp - 4], eax
cmp dword [ebx + 0x10394], eax
jbe 0x100e5b80
push esi
push edi
mov edi, edi
mov ecx, dword [ebx + 0x10388]
mov esi, dword [ecx + eax*4]
test esi, esi
je 0x100e5b6f
call fcn.10171ee0
mov eax, dword [0x101e316c]
test eax, eax
jl 0x100e5b6f
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
test edi, edi
je 0x100e5b6f
push 0x44
push 0xfe
push esi
call sub.msvcrt.dll_memset
mov dword [esi], 0
mov eax, dword [edi + 0x1c]
add esp, 0xc
test eax, eax
je 0x100e5b69
mov dword [eax], esi
jmp 0x100e5b6c
mov dword [edi + 0x18], esi
mov dword [edi + 0x1c], esi
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp eax, dword [ebx + 0x10394]
jb 0x100e5b20
pop edi
pop esi
mov edx, dword [ebx + 0x10388]
push edx
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
mov eax, dword [ebx + 0x1038c]
push eax
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
mov ecx, dword [ebx + 0x10390]
push ecx
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
add esp, 0xc
mov ecx, ebx
call fcn.100c06b0
pop ebx
mov esp, ebp
pop ebp
ret