joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5911ce0a
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push dword [0x591d4f7c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x5911ce4b
mov eax, dword [eax + 0x1194]
test eax, eax
je 0x59171c51
mov eax, dword [eax + 0x44]
push 2
push 1
push dword [ebp + 0x14]
mov ecx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.5911cc70
pop ebp
ret 0x10
xor eax, eax
jmp 0x5911ce25
pop ebp
jmp dword [sym.imp.USER32.dll_GetMessageW]

Function at 0x5911d818
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x591d4f78]
jne 0x591a3d46
repz ret

Function at 0x59120426
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x591d4f78]
jne 0x591a3d46
repz ret

Function at 0x591204a2
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
mov ebx, 0x80070057
je 0x59120527
mov esi, dword [edi + 8]
test esi, esi
je 0x59120527
cmp dword [edi + 4], 0x8000
jl 0x59120527
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x14]
mov dword [ebp + 8], eax
shr eax, 1
test al, 1
je 0x59120527
push dword [0x591d4f7c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x59162d49
mov ecx, dword [eax + 0x1194]
test ecx, ecx
mov eax, dword [esi + 0x10]
je 0x59120527
test eax, eax
je 0x59120527
test byte [ecx + 0x34], 4
jne 0x59120527
test byte [eax + 0x34], 4
jne 0x59120527
cmp ecx, eax
jne 0x59162d33
test byte [ebp + 0xc], 1
lea ecx, [esi + 0x14]
jne 0x59124ad2
push 0
push edi
push esi
call fcn.591203d3
mov ebx, eax
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 8
mov eax, dword [ebp + 8]
shr eax, 2
test al, 1
je 0x5912051c
push 0
push edi
push esi
call fcn.59124114
jmp 0x59120525
push dword [ebp + 0xc]
mov eax, dword [eax + 0x44]
mov ecx, dword [ecx + 0x44]
push esi
push edi
push eax
call fcn.59163e1c
jmp 0x59120525
xor ecx, ecx
jmp 0x591204f0

Function at 0x59120bdc
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x59120c32
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x59120c36
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
add eax, esi
and ecx, 0xf
jbe 0x59120c23
cmp esi, eax
jae 0x59120c36
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x59120c15
cmp esi, eax
jae 0x59120c36
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop ebp
ret 0xc
xor eax, eax
jmp 0x59120c31

Function at 0x591233fe
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x591d4f78]
jne 0x591a3d46
repz ret

Function at 0x5912383c
Capabilities:
Get thread local storage value

Disassembly:
push dword [sym.MSNCore.dll_unsigned_long_int_DirectUI::g_dwElSlot]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x5916a467
mov eax, dword [eax + 0xc]
ret
ret
Function at 0x591283ce
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push dword [sym.MSNCore.dll_unsigned_long_int_DirectUI::g_dwElSlot]
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x59128462
cmp byte [ebp + 0xc], 0
push ebx
push edi
mov edi, dword [eax + 0xc]
je 0x59129e2c
test dword [ebp + 8], 0x10000
je 0x5912844a
mov ecx, esi
call fcn.591269a8
test al, al
jne 0x591332a2
lea eax, [ebp + 0xc]
push eax
mov ecx, esi
call fcn.59126f88
mov edi, eax
lea eax, [ebp - 4]
push eax
mov ecx, esi
call fcn.59127d52
push 0xb
push dword [eax + 4]
push dword [eax]
push dword [edi + 4]
push dword [edi]
push dword [esi + 4]
call sym.MSNCore.dll_SetGadgetRect
mov ecx, dword [ebp + 0xc]
call fcn.5911cf70
mov ecx, dword [ebp - 4]
call fcn.5911cf70
test dword [ebp + 8], 0x20000
je 0x59128460
mov esi, dword [esi + 4]
test esi, esi
je 0x59128460
push esi
call sym.MSNCore.dll_InvalidateGadget
pop edi
pop ebx
pop esi
leave
ret 8
test edi, edi
je 0x59128460
test byte [ebp + 8], 5
je 0x59129ebe
mov dword [ebp + 0xc], esi
jmp 0x59129e61
mov ecx, dword [ebp + 0xc]
mov ebx, ecx
call fcn.5911d218
mov ecx, ebx
mov dword [ebp + 0xc], eax
call fcn.59127d0c
cmp dword [ebp + 0xc], 0
je 0x59129e80
cmp eax, 0xfffffffe
jne 0x59129e61
test byte [ebp + 8], 1
je 0x59129e9b
or byte [esi + 0x30], 4
mov ecx, dword [edi + 0x14]
push ebx
call fcn.59129e43
test eax, eax
je 0x59129fa2
test byte [ebp + 8], 4
je 0x59129ebe
mov eax, dword [esi + 0x34]
and eax, 0xfffffffd
or eax, 1
mov dword [esi + 0x34], eax
mov ecx, dword [edi + 0x10]
push ebx
call fcn.59129e43
test eax, eax
je 0x59129fb2
test byte [ebp + 8], 0xa
je 0x59128460
mov ebx, esi
xor esi, esi
mov ecx, ebx
mov dword [ebp + 0xc], ebx
call fcn.5911d218
mov ebx, eax
test ebx, ebx
je 0x59129ee4
test esi, esi
je 0x5912a284
mov ecx, dword [ebp + 0xc]
call fcn.59127d0c
test ebx, ebx
je 0x59129ef5
cmp eax, 0xfffffffe
jne 0x59129ecc
test esi, esi
je 0x59128460
test byte [ebp + 8], 2
jne 0x5912fd7a
test byte [ebp + 8], 8
je 0x59128460
mov eax, dword [esi + 0x34]
push dword [ebp + 0xc]
and eax, 0xfffffffd
or eax, 1
mov dword [esi + 0x34], eax
mov ecx, dword [edi + 0x10]
call fcn.59129e43
test eax, eax
jne 0x59128460
mov ecx, dword [edi + 0x10]
push 1
push dword [ebp + 0xc]
call fcn.59129f47
jmp 0x59128460
mov ecx, dword [edi + 0x14]
push 1
push ebx
call fcn.59129f47
jmp 0x59129e9b
mov ecx, dword [edi + 0x10]
push 1
push ebx
call fcn.59129f47
jmp 0x59129ebe
mov esi, ebx
jmp 0x59129ee4
or byte [esi + 0x30], 4
push dword [ebp + 0xc]
mov ecx, dword [edi + 0x14]
call fcn.59129e43
test eax, eax
jne 0x59129f07
jmp 0x5916a668
mov ecx, esi
call fcn.5912fb0c
mov ebx, eax
mov edi, 0xf000
test edi, ebx
je 0x5912840e
call fcn.5912fb2a
test al, al
je 0x5912840e
push edi
push ebx
mov ecx, esi
call sym.MSNCore.dll_public:_void___thiscall_DirectUI::Element::InvokeAnimation_int__unsigned_int_
jmp 0x5912844a
mov ecx, dword [edi + 0x14]
push 1
push dword [ebp + 0xc]
call fcn.59129f47
jmp 0x59129f07
Function at 0x59129026
Capabilities:
Get thread local storage value

Disassembly:
push 0x10
mov eax, 0x591c2a18
call fcn.5911c518
mov eax, dword [ebp + 8]
mov esi, dword [eax]
test esi, esi
je 0x5912906a
mov ecx, dword [esi + 0xc]
mov eax, dword [ecx]
call dword [eax + 0x18]
test eax, eax
jne 0x59129171
mov esi, dword [esi]
jmp 0x59129037
call fcn.5911c54b
ret 4
mov ecx, dword [esi + 0xc]
mov eax, dword [ecx]
push 1
call dword [eax + 0x1c]
mov eax, dword [esi + 0x20]
mov ecx, dword [ebp + 8]
push esi
mov dword [ebp - 0x14], eax
call fcn.59129241
mov eax, dword [esi + 0x1c]
test eax, eax
mov edi, dword [esi + 0x10]
mov ebx, dword [esi + 0xc]
je 0x5912919d
push esi
call eax
mov dword [esi + 0x18], eax
mov eax, dword [esi + 0x14]
mov ecx, dword [esi + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ecx]
push 0
call dword [eax + 0x1c]
and dword [ebp - 0x1c], 0
and dword [ebp - 4], 0
lea eax, [ebp - 0x1c]
push eax
push 0x591320e3
mov ecx, ebx
call fcn.59120482
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.5911de0b
mov eax, edi
shr eax, 0x1f
test al, 1
je 0x591291ee
push dword [0x591d52c4]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edx, dword [eax]
push esi
mov ecx, eax
call dword [edx + 0x10]
cmp dword [ebp - 0x10], 0
jne 0x59170311
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x59129032
jmp 0x59129035
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_SetEvent]
jmp 0x591291f8

Function at 0x591290cb
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, dword [edi]
push dword [0x591d52c4]
mov dword [ebp - 4], ecx
add esi, 0x24
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edx, dword [eax]
push 1
push esi
mov ecx, eax
call dword [edx + 4]
mov esi, eax
test esi, esi
je 0x5917031f
push dword [edi]
lea eax, [esi + 0x24]
push edi
push eax
call sub.MSVCR80.dll_memcpy
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
and dword [esi + 8], 0
add esp, 0xc
push edi
push eax
mov dword [esi + 0xc], eax
call fcn.5912046a
mov ecx, dword [ebp - 4]
and dword [esi + 0x14], 0
and dword [esi + 0x18], 0
or edi, 0x80000000
push esi
mov dword [esi + 0x1c], eax
mov dword [esi + 0x10], edi
call fcn.591290aa
xor eax, eax
pop edi
pop esi
leave
ret 0xc
mov eax, 0x8007000e
jmp 0x59129140

Function at 0x5912f1eb
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push edi
push dword [0x591d52c4]
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edx, dword [esi]
test edx, edx
jne 0x5912fac4
xor ecx, ecx
mov edi, dword [ebp + 8]
mov edx, dword [eax]
push ebx
lea ebx, [edi*8 + 8]
push ebx
push ecx
mov ecx, eax
call dword [edx + 8]
test eax, eax
pop ebx
je 0x5912f235
add eax, 8
push edi
mov ecx, esi
mov dword [esi], eax
call fcn.5912cfea
xor eax, eax
inc eax
pop edi
pop esi
pop ebp
ret 8
lea ecx, [edx - 8]
jmp 0x5912f20c
Function at 0x5912f5ca
Capabilities:
Inspect section memory permissions

Disassembly:
or dword [esi + 0x14], 0x40000000
push dword [edi + 0xc]
call dword [0x5912e428]
jmp 0x5912f6f2
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp dword [esi + 8], 0
je 0x59173430
push ebx
push edi
push 0x74
pop ebx
push ebx
lea edi, [esi + 0x10]
push 0
push edi
call sub.MSVCR80.dll_memset
mov ecx, dword [esi + 8]
or dword [esi + 0x14], 0x20000000
add esp, 0xc
lea eax, [ebp - 4]
push eax
mov dword [edi], ebx
call fcn.59128333
push eax
push 0x20
lea eax, [esi + 0x2a]
push eax
call fcn.59126a01
mov ecx, dword [ebp - 4]
call fcn.5911cf70
push dword [esi + 0xc]
or dword [esi + 0x14], 0x80000000
mov byte [esi + 0x29], 0
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
push 0x5a
push edi
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov ecx, dword [esi + 8]
mov ebx, eax
call fcn.59128351
push ebx
push 0x48
neg eax
push eax
call dword [sym.imp.KERNEL32.dll_MulDiv]
imul eax, eax, 0x14
push edi
push dword [esi + 0xc]
mov dword [esi + 0x1c], eax
call dword [sym.imp.USER32.dll_ReleaseDC]
mov ecx, dword [esi + 8]
xor ebx, ebx
inc ebx
or dword [esi + 0x14], ebx
call fcn.5912836f
cmp eax, 0x258
jge 0x59134a5f
mov ecx, dword [esi + 8]
or dword [esi + 0x14], 0xe
call fcn.5912838d
test bl, al
jne 0x5917343a
test al, 4
jne 0x59173443
test al, 2
jne 0x5913e183
or dword [esi + 0x14], 0x10000000
and dword [esi + 0x20], 0
mov eax, dword [sym.MSNCore.dll_struct_DirectUI::PropertyInfo__DirectUI::Element::ForegroundProp]
mov ecx, dword [esi + 8]
push 2
push dword [eax]
call dword [fcn.5911cf20]
mov edi, eax
movzx eax, word [edi + 4]
cmp ax, bx
je 0x5912e413
cmp ax, 9
jne 0x5912f6f5
or dword [esi + 0x14], 0x40000000
lea eax, [edi + 0xc]
test eax, eax
je 0x5912f6e5
test byte [eax], 0x10
jne 0x5913326b
mov eax, dword [edi + 0x10]
and eax, 0xffffff
or eax, 0x2000000
mov dword [esi + 0x24], eax
mov ecx, edi
call fcn.5911cf70
or dword [esi + 0x14], 0xc000000
or dword [esi + 0x18], 0x4000000
pop edi
mov byte [esi + 0x28], bl
xor eax, eax
pop ebx
pop esi
leave
ret
mov ecx, dword [esi + 8]
push 0xb4
call fcn.5912377f
push eax
push dword [edi + 0x10]
call dword [0x59133288]
jmp 0x5912f6e8
or dword [esi + 0x18], ebx
jmp 0x5912f678
or dword [esi + 0x18], 4
jmp 0x5912f69c
mov eax, 0x80004003
jmp 0x5912f711
or dword [esi + 0x18], 2
jmp 0x5912f68c
or dword [esi + 0x18], 8
jmp 0x5912f694

Function at 0x5912f8a6
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push edi
push dword [0x591d52c4]
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edx, dword [esi]
test edx, edx
jne 0x59170263
xor ecx, ecx
mov edi, dword [ebp + 8]
mov edx, dword [eax]
push ebx
lea ebx, [edi*4 + 4]
push ebx
push ecx
mov ecx, eax
call dword [edx + 8]
test eax, eax
pop ebx
je 0x5912f8f0
add eax, 4
push edi
mov ecx, esi
mov dword [esi], eax
call fcn.5912f83c
xor eax, eax
inc eax
pop edi
pop esi
pop ebp
ret 8
lea ecx, [edx - 4]
jmp 0x5912f8c7
Function at 0x591304fb
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push edi
push dword [0x591d52c4]
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edx, dword [esi]
test edx, edx
jne 0x59133994
xor ecx, ecx
mov edi, dword [ebp + 8]
mov edx, dword [eax]
push ebx
lea ebx, [edi + 1]
shl ebx, 4
push ebx
push ecx
mov ecx, eax
call dword [edx + 8]
test eax, eax
pop ebx
je 0x59130544
add eax, 0x10
push edi
mov ecx, esi
mov dword [esi], eax
call fcn.5912faa7
xor eax, eax
inc eax
pop edi
pop esi
pop ebp
ret 8
lea ecx, [edx - 0x10]
jmp 0x5913051c

Function at 0x59130920
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
mov esi, ecx
je 0x59167388
push dword [0x591d52c4]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edx, dword [eax]
mov ecx, edi
shl ecx, 2
push ecx
push dword [esi]
mov ecx, eax
call dword [edx + 8]
test eax, eax
je 0x5913095b
mov dword [esi + 8], edi
mov dword [esi], eax
xor eax, eax
inc eax
pop edi
pop esi
pop ebp
ret 4
call fcn.5911c9d4
jmp 0x59130958

Function at 0x59130ed2
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebx
push esi
mov ebx, ecx
lea esi, [ebx + 0x1000]
mov eax, dword [esi]
test eax, eax
push edi
mov edi, 0x80
jle 0x5915a251
dec eax
push edi
mov dword [esi], eax
mov ebx, dword [ebx + eax*4]
push 0
push ebx
call sub.MSVCR80.dll_memset
add esp, 0xc
pop edi
pop esi
mov eax, ebx
pop ebx
ret
push dword [0x591d52c4]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edx, dword [eax]
push edi
push 0x200
push ebx
push esi
mov ecx, eax
call dword [edx + 0xc]
mov eax, dword [esi]
test eax, eax
jne 0x59130eee
jmp 0x591719f2
xor ebx, ebx
jmp 0x59130f00
Function at 0x591316f8
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], edi
call fcn.591209d1
mov eax, dword [ebp + 0x14]
cmp eax, edi
je 0x5913171b
mov dword [eax], edi
mov eax, dword [ebp + 0x18]
cmp eax, edi
jne 0x59131aff
mov dword [ebp - 4], 1
add esi, 4
mov eax, dword [esi]
test eax, eax
je 0x59131751
mov ecx, dword [ebp - 4]
test dword [ebp + 0x10], ecx
je 0x59131751
push dword [ebp + 0xc]
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
jne 0x59131767
shl dword [ebp - 4], 1
inc edi
add esi, 0x10
cmp edi, 4
jl 0x59131730
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret 0x14
mov eax, dword [esi]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x59131751
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
mov dword [ebp - 8], eax
je 0x5913179e
mov esi, dword [ebp + 0x14]
test esi, esi
je 0x5913179e
mov eax, dword [ebp - 0xc]
shl edi, 4
mov edi, dword [edi + eax + 4]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [esi], eax
mov eax, dword [ebp + 0x18]
test eax, eax
je 0x5913175d
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
jmp 0x5913175d
mov dword [eax], edi
jmp 0x59131726

Function at 0x59131c4a
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov eax, dword [esi]
test eax, eax
push edi
je 0x59131fa1
mov edi, dword [eax - 8]
dec edi
test edi, edi
jg 0x59131c90
push dword [0x591d52c4]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [esi]
mov edx, dword [eax]
sub ecx, 8
push ecx
mov ecx, eax
call dword [edx + 0x10]
and dword [esi], 0
xor eax, eax
pop edi
inc eax
pop esi
pop ebp
ret 4
mov ecx, dword [ebp + 8]
cmp ecx, edi
jl 0x59131f83
push ebx
push dword [0x591d52c4]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edx, dword [esi]
mov ebx, dword [eax]
lea ecx, [edi*8 + 8]
push ecx
sub edx, 8
push edx
mov ecx, eax
call dword [ebx + 8]
test eax, eax
pop ebx
je 0x59131cc7
add eax, 8
mov dword [esi], eax
push edi
mov ecx, esi
call fcn.5912cfea
jmp 0x59131c87
mov edx, edi
sub edx, ecx
lea eax, [eax + ecx*8]
shl edx, 3
push edx
lea ecx, [eax + 8]
push ecx
push eax
call dword [sym.imp.MSVCR80.dll_memmove]
add esp, 0xc
jmp 0x59131c9b
xor edi, edi
jmp 0x59131c66
Function at 0x59132143
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov eax, dword [esi]
test eax, eax
push edi
je 0x591339f8
mov edi, dword [eax - 0x10]
dec edi
test edi, edi
jg 0x5913399c
push dword [0x591d52c4]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [esi]
mov edx, dword [eax]
sub ecx, 0x10
push ecx
mov ecx, eax
call dword [edx + 0x10]
and dword [esi], 0
xor eax, eax
pop edi
inc eax
pop esi
pop ebp
ret 4
cmp dword [ebp + 8], edi
jge 0x591339c0
mov ecx, dword [ebp + 8]
shl ecx, 4
add eax, ecx
mov ecx, edi
sub ecx, dword [ebp + 8]
shl ecx, 4
push ecx
lea ecx, [eax + 0x10]
push ecx
push eax
call dword [sym.imp.MSVCR80.dll_memmove]
add esp, 0xc
push ebx
push dword [0x591d52c4]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edx, dword [esi]
mov ebx, dword [eax]
lea ecx, [edi + 1]
shl ecx, 4
push ecx
sub edx, 0x10
push edx
mov ecx, eax
call dword [ebx + 8]
test eax, eax
pop ebx
je 0x591339eb
add eax, 0x10
mov dword [esi], eax
push edi
mov ecx, esi
call fcn.5912faa7
jmp 0x5913217e
xor edi, edi
jmp 0x59132159

Function at 0x59134a92
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp sym.MSNCore.dll_public_virtual:_void___thiscall_DirectUI::Element::OnPropertyChanged_struct_DirectUI::PropertyInfo___int__class_DirectUI::Value___class_DirectUI::Value__

Function at 0x591379ef
Capabilities:
Get thread local storage value

Disassembly:
push dword [0x591d4f7c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
add eax, 0x1070
ret

Function at 0x59137a43
Capabilities:
Get thread local storage value

Disassembly:
push dword [0x591d4f7c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
add eax, 0x1010
ret
Function at 0x59137a7a
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
mov ebx, dword [ebp + 0x10]
and dword [ebx], 0
test byte [ecx + 0x3c], 0x80
jne 0x591396da
push 2
pop eax
pop ebx
leave
ret 0xc
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [esi + 8]
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 4]
sub eax, 0
jne 0x5917053a
mov eax, dword [edi + 4]
mov dword [ebp + 8], eax
call fcn.59137a43
mov ecx, eax
mov dword [ebp + 0x10], ecx
call fcn.5913900c
mov edi, eax
test edi, edi
je 0x5913975e
push edi
push dword [ebp + 8]
call dword [sym.imp.GDI32.dll_GetClipRgn]
cmp eax, 0xffffffff
je 0x59170605
test eax, eax
je 0x59170613
mov dword [ebx], edi
push dword [0x591d4f7c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push dword [esi + 0x1c]
mov edi, dword [eax + 8]
push dword [esi + 0x18]
mov ecx, dword [esi + 0x10]
push dword [ebp + 0xc]
push edi
call fcn.59139668
push 1
push edi
push dword [ebp + 8]
call dword [sym.imp.GDI32.dll_ExtSelectClipRgn]
pop edi
pop esi
jmp 0x59137a96
xor eax, eax
jmp 0x59139757
dec eax
jne 0x5913975e
mov eax, dword [edi + 4]
push 8
mov dword [ebp + 0x10], eax
call sub.gdiplus.dll_GdipAlloc
test eax, eax
je 0x5917055d
mov ecx, eax
call fcn.5918f9b8
mov edi, eax
jmp 0x5917055f
xor edi, edi
test edi, edi
je 0x5913975e
mov ecx, dword [ebp + 0x10]
push edi
call fcn.5918f971
mov ecx, dword [ebp + 0xc]
mov dword [ebx], edi
mov eax, dword [esi]
mov edx, dword [ecx]
mov esi, dword [eax]
cmp edx, esi
mov dword [ebp - 0x10], edx
jg 0x59170585
mov dword [ebp - 0x10], esi
mov edx, dword [ecx + 8]
mov esi, dword [eax + 8]
cmp edx, esi
mov dword [ebp - 8], edx
jl 0x59170595
mov dword [ebp - 8], esi
mov edx, dword [ebp - 8]
cmp dword [ebp - 0x10], edx
jge 0x591705c5
mov edx, dword [ecx + 4]
mov esi, dword [eax + 4]
cmp edx, esi
mov dword [ebp - 0xc], edx
jg 0x591705ad
mov dword [ebp - 0xc], esi
mov ecx, dword [ecx + 0xc]
mov eax, dword [eax + 0xc]
cmp ecx, eax
mov dword [ebp - 4], ecx
jl 0x591705bd
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp dword [ebp - 0xc], eax
jl 0x591705d3
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.5918f603
mov ecx, dword [ebp + 0x10]
push 1
lea eax, [ebp - 0x20]
push eax
call fcn.5918f90e
mov ecx, dword [ebp + 0x10]
call fcn.5918f992
neg eax
sbb eax, eax
and eax, 0xfffffffe
add eax, 3
jmp 0x59139757
mov ecx, dword [ebp + 0x10]
push edi
call fcn.59137a55
jmp 0x5913975e
mov ecx, dword [ebp + 0x10]
push edi
call fcn.59137a55
xor edi, edi
jmp 0x59139728
Function at 0x5913be1c
Capabilities:
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x104
mov eax, dword [0x591d4f78]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push edi
push 0
push esi
call sub.MSVCR80.dll_memset
add esp, 0xc
mov dword [esi], edi
call dword [sym.imp.USER32.dll_GetMessageTime]
and dword [esi + 0x18], 0
mov dword [esi + 0x1c], eax
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
test eax, eax
je 0x5913bec4
mov eax, 0x80
test byte [ebp - 0x103], al
jne 0x5915172a
test byte [ebp - 0x102], al
jne 0x5917877b
test byte [ebp - 0x100], al
jne 0x59178783
test byte [ebp - 0x64], al
jne 0x5917878f
test byte [ebp - 0x63], al
jne 0x59178798
test byte [ebp - 0x62], al
jne 0x5913dd21
test byte [ebp - 0x61], al
jne 0x591787a1
test byte [ebp - 0x60], al
jne 0x591787aa
test byte [ebp - 0x5f], al
jne 0x591787b3
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.5911c55f
leave
ret 8
or dword [esi + 0x18], 1
jmp 0x5913bea9
or dword [esi + 0x18], 0x40
jmp 0x5913be76
or dword [esi + 0x18], eax
jmp 0x5913be82
or dword [esi + 0x18], 0x100
jmp 0x5913be8e
or dword [esi + 0x18], 4
jmp 0x5913be97
or dword [esi + 0x18], 8
jmp 0x5913bea0
or dword [esi + 0x18], 2
jmp 0x5913beb2
or dword [esi + 0x18], 0x10
jmp 0x5913bebb
or dword [esi + 0x18], 0x20
jmp 0x5913bec4

Function at 0x5913bed4
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ecx + 4]
mov eax, dword [eax + 0x1194]
mov dword [eax + 0x30], 1
add ecx, 8
pop ebp
jmp fcn.591290cb