joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10012cad
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.10012df9

Function at 0x10013483
Capabilities:
Allocate thread local storage

Disassembly:
push 8
mov eax, 0x1008d2b7
call fcn.1008ace0
push 0x72
push 0
push 0x100a7d80
call fcn.1008cf50
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x100a7828], eax
cmp eax, 0xffffffff
je 0x100134f8
mov eax, dword [0x100a8400]
lea edx, [ebp - 0x10]
and dword [0x100a8400], 0
xor cl, cl
mov byte [ebp - 0x14], 6
push dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
call fcn.100135f1
mov ecx, dword [0x100a8400]
mov eax, dword [ebp - 0x10]
mov dword [0x100a8400], eax
and dword [ebp - 4], 0
test ecx, ecx
je 0x100134eb
call fcn.10013fd3
mov byte [0x100a81d4], 1
call fcn.1008aca0
ret
call fcn.1001402c
int3

Function at 0x10013ad4
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push dword [0x100a7828]
mov edi, ecx
mov dword [ebp - 8], edi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test edi, edi
je 0x10013b03
test eax, eax
jne 0x10013afa
mov bl, 1
jmp 0x10013b12
mov edi, eax
xor bl, bl
mov dword [ebp - 8], edi
jmp 0x10013b12
mov edi, eax
mov dword [ebp - 8], eax
xor bl, bl
test edi, edi
je 0x10013b95
xor eax, eax
lea esi, [edi + 0x10]
and dword [ebp - 0xc], eax
xor edx, edx
mov edi, dword [ebp - 0xc]
xor ecx, ecx
mov dword [ebp - 4], esi
push ebx
mov ebx, edi
lock cmpxchg8b qword [esi]
mov edi, ebx
pop ebx
test edx, edx
jl 0x10013b95
jg 0x10013b38
test eax, eax
je 0x10013b95
mov eax, dword [ebp - 4]
mov esi, dword [esi]
mov dword [ebp - 0x10], esi
mov edx, dword [eax + 4]
mov eax, esi
sub eax, 1
mov dword [ebp - 0x14], edx
mov dword [ebp - 0xc], eax
mov ecx, edx
mov edi, dword [ebp - 0xc]
mov eax, esi
mov esi, dword [ebp - 4]
sbb ecx, 0
push ebx
mov ebx, edi
lock cmpxchg8b qword [esi]
mov edi, ebx
pop ebx
cmp eax, dword [ebp - 0x10]
jne 0x10013b38
cmp edx, dword [ebp - 0x14]
jne 0x10013b38
mov eax, edi
mov edi, dword [ebp - 8]
or eax, ecx
jne 0x10013b95
test bl, bl
je 0x10013b83
mov ecx, edi
call fcn.10013c9e
mov ecx, edi
call fcn.100139e0
test bl, bl
je 0x10013b95
xor ecx, ecx
call fcn.10013c9e
pop edi
pop esi
pop ebx
leave
ret

Function at 0x10014953
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, 0x811c9dc5
xor ecx, ecx
movzx eax, byte [ecx + edx]
xor eax, esi
imul esi, eax, 0x1000193
inc ecx
cmp ecx, 4
jb 0x1001495f
mov eax, esi
pop esi
leave
ret 4
Function at 0x1001502d
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1008d40a
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x100a77f0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov dword [ebp - 0x18], esi
mov ebx, ecx
xor ecx, ecx
xor dl, dl
mov edi, ebx
mov dword [ebp - 0x14], ecx
mov byte [ebp - 0xd], dl
cmp byte [0x100a81d4], cl
je 0x100151f7
test ebx, ebx
je 0x10015096
cmp byte [ebx + 0x33], cl
je 0x10015096
push dword [0x100a7828]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, ebx
je 0x100151f3
mov ecx, dword [ebp - 0x14]
mov dl, cl
test edi, edi
je 0x100150e2
test dl, dl
jne 0x100150b5
mov ecx, dword [edi + 0x38]
mov dword [ebp - 0x14], ecx
test ecx, ecx
je 0x100150b5
call fcn.100136cc
mov ecx, dword [ebp - 0x14]
mov dl, 1
mov byte [ebp - 0xd], dl
mov eax, dword [edi + 0x2c]
sub eax, 0
je 0x100151bc
sub eax, 1
je 0x100150cf
sub eax, 1
je 0x10015152
test dl, dl
je 0x100150e2
call fcn.100136e1
xor ecx, ecx
xor dl, dl
mov dword [ebp - 0x14], ecx
mov byte [ebp - 0xd], dl
test ebx, ebx
jne 0x10015096
push dword [0x100a7828]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [ebp - 0x14]
mov edi, eax
mov dl, byte [ebp - 0xd]
test edi, edi
jne 0x1001509a
call fcn.10013c05
mov ecx, dword [ebp - 0x14]
mov edi, eax
mov dl, byte [ebp - 0xd]
test edi, edi
jne 0x1001509a
mov eax, dword [0x100a7d68]
mov esi, 0x87b10101
mov dword [ebp - 0x1c], esi
test eax, eax
je 0x100151a8
mov eax, dword [eax]
lea ecx, [ebp - 0x1c]
push dword [ebp - 0x18]
push ecx
mov esi, dword [eax + 0x18]
mov ecx, esi
call dword [0x100a9324]
mov ecx, dword [0x100a7d68]
call esi
mov esi, dword [ebp - 0x1c]
test esi, esi
js 0x100151a8
mov ecx, dword [ebp - 0x14]
mov dl, byte [ebp - 0xd]
jmp 0x10015096
mov esi, dword [edi + 0x3c]
test esi, esi
je 0x1001515e
mov esi, dword [esi + 0x50]
jmp 0x10015160
xor esi, esi
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentThreadId]
cmp esi, eax
je 0x1001517e
push 0
push 0x7530
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObjectEx]
mov ebx, dword [0x100a7d68]
test ebx, ebx
je 0x1001519c
mov eax, dword [ebx]
push dword [ebp - 0x18]
mov esi, dword [eax + 0x1c]
mov ecx, esi
call dword [0x100a9324]
mov ecx, ebx
call esi
mov esi, 0x87b10103
mov ecx, edi
call fcn.10015217
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret 4
test ebx, ebx
je 0x100151c4
cmp edi, ebx
jne 0x100151fe
test ecx, ecx
je 0x100151f3
push dword [0x100a7828]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0x1001520c
push dword [0x100a7828]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, edi
je 0x100151ef
mov ecx, edi
call fcn.10013c9e
lock inc dword [edi + 4]
xor eax, eax
jmp 0x100151aa
mov edx, esi
call fcn.10014e1a
mov edx, dword [ebp - 0x18]
mov ecx, 0x87b10102
push ecx
call fcn.10014eea
call fcn.1001402c
int3
Function at 0x10015cd7
Capabilities:
Get thread local storage value

Disassembly:
push edi
mov edi, ecx
call fcn.10013c05
mov dword [edi], eax
test eax, eax
jne 0x10015d17
push esi
push dword [0x100a7828]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
je 0x10015d03
lea eax, [esi + 0x10]
push eax
call fcn.1008588c
jmp 0x10015d0c
mov cl, 1
call fcn.10013a47
mov esi, eax
push esi
mov dword [edi], esi
call fcn.10015c90
pop esi
pop edi
ret
add eax, 0x10
push eax
call fcn.1008588c
pop edi
ret

Function at 0x10018c08
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
mov eax, dword [0x100a77f0]
xor eax, esp
mov dword [esp + 0x20], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, ecx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov dword [ebx + 4], eax
test esi, esi
je 0x10018c35
lea edi, [ebx + 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x10018c43
lea edi, [ebx + 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor esi, esi
push esi
push esi
push 1
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [ebx + 0x2c], eax
test eax, eax
je 0x10018cf0
push esi
push esi
push 1
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [ebx + 0x30], eax
test eax, eax
jne 0x10018c7d
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
test eax, eax
jle 0x10018d02
jmp 0x10018cfa
push esi
push esi
push ebx
push 0x10018e00
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, eax
mov dword [ebx + 0x28], ecx
test ecx, ecx
je 0x10018c6d
mov eax, dword [ebx + 0x2c]
push 0xffffffffffffffff
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push esi
push eax
push 2
mov dword [esp + 0x24], ecx
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
test eax, eax
jne 0x10018d0c
test byte [0x100a7c80], 4
je 0x10018cd0
lea eax, [esp + 0x18]
mov edx, 0x1000b358
push eax
push 1
push ecx
call fcn.10016327
push dword [ebx + 0x2c]
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov ecx, dword [esp + 0x2c]
pop edi
mov dword [ebx + 0x2c], esi
pop esi
pop ebx
xor ecx, esp
call fcn.10087b70
mov esp, ebp
pop ebp
ret 0xc
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
test eax, eax
jle 0x10018d02
movzx eax, ax
or eax, 0x80070000
push esi
xor edx, edx
mov ecx, eax
call fcn.10014eea
call fcn.1001402c
int3
Function at 0x1001d62f
Capabilities:
Get thread local storage value

Disassembly:
push 0x18
mov eax, 0x1008dfbc
call fcn.1008ad60
mov esi, ecx
mov dword [ebp - 0x1c], esi
cmp byte [esi + 0x58], 0
je 0x1001d7a2
cmp dword [esi + 0x60], edx
jne 0x1001d7a2
mov ecx, dword [ebp + 0x24]
mov al, cl
not al
and al, 1
mov byte [ebp - 0x11], al
jne 0x1001d671
cmp byte [esi + 0x59], 0
jne 0x1001d671
and ecx, 0xfffffffe
mov byte [ebp - 0x11], 1
mov dword [ebp + 0x24], ecx
xor edi, edi
mov ebx, edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x20], ebx
cmp dword [ebp + 0xc], edi
jle 0x1001d726
mov esi, edi
push edi
push ecx
mov eax, esp
push 0x40
pop ecx
mov dword [eax], 0xbbd
call fcn.1001db5e
mov ecx, eax
mov dword [ebp - 0x18], ecx
mov dword [ecx + 0x30], edi
mov dword [ecx + 8], edi
mov dword [ecx + 0xc], edi
mov dword [ecx + 0x10], edi
mov dword [ecx + 0x14], edi
mov dword [ecx + 0x18], edi
mov dword [ecx + 0x1c], edi
mov dword [ecx + 0x24], edi
mov dword [ecx + 0x34], edi
mov dword [ecx + 0x38], edi
test esi, esi
je 0x1001d6c4
mov dword [esi + 0x30], ecx
jmp 0x1001d6c9
mov ebx, ecx
mov dword [ebp - 0x20], ebx
cmp byte [ebp - 0x11], 0
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0x24]
mov dword [ecx], edi
mov dword [ecx + 0x28], eax
mov eax, dword [edx + 4]
mov dword [ecx + 0x38], eax
jne 0x1001d6e7
mov eax, dword [edx]
mov dword [ecx + 0x34], eax
jmp 0x1001d70c
mov esi, dword [edx + 4]
mov ecx, esi
call fcn.1001d3b6
mov ecx, dword [ebp - 0x18]
push esi
mov dword [ecx + 0x34], eax
mov ecx, dword [ebp + 8]
push dword [ecx]
push eax
call fcn.1008a460
mov ecx, dword [ebp - 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
add edx, 8
dec eax
mov dword [ebp + 8], edx
mov dword [ebp + 0xc], eax
mov esi, ecx
test eax, eax
jg 0x1001d686
mov esi, dword [ebp - 0x1c]
cmp byte [ebp - 0x11], 0
mov eax, dword [ebp + 0x1c]
mov ecx, dword [ebp + 0x14]
mov dword [ebx + 0x10], eax
mov eax, dword [ebp + 0x10]
mov dword [ebx + 0x18], eax
mov eax, dword [ebp + 0x18]
mov dword [ebx + 0x20], eax
mov eax, dword [ebp + 0x20]
mov dword [ebx + 0x1c], ecx
mov dword [ebx + 0x24], eax
jne 0x1001d76a
push dword [0x100a7828]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov eax, dword [eax + 0xc]
test eax, eax
je 0x1001d7b6
lock inc dword [eax + 4]
mov dword [ebx + 8], eax
mov eax, dword [eax + 0x60]
mov dword [ebx + 0xc], eax
mov eax, dword [esi + 0x60]
mov dword [ebx + 0x14], eax
lea eax, [esi + 0x48]
push ebx
push eax
call dword [sym.imp.api_ms_win_core_interlocked_l1_1_0.dll_InterlockedPushEntrySList]
test eax, eax
jne 0x1001d792
mov eax, dword [ebp - 0x1c]
mov esi, dword [esi + 0x50]
mov ecx, esi
push dword [eax + 0x54]
call dword [0x100a9324]
call esi
mov ecx, dword [ebp + 0x28]
test ecx, ecx
je 0x1001d79e
mov eax, dword [ebp + 0x24]
mov dword [ecx], eax
mov al, 1
jmp 0x1001d7ae
mov eax, dword [ebp + 0x28]
test eax, eax
je 0x1001d7ac
and dword [eax], 0
xor al, al
call fcn.1008aca0
ret 0x24
call fcn.10085532
mov esi, dword [ebp - 0x20]
xor edi, edi
cmp dword [esi + 8], edi
je 0x1001d7d3
mov ecx, dword [esi + 8]
call fcn.10013fd3
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov ecx, esi
call fcn.1001ce12
push edi
push edi
call fcn.10089d02
int3
Function at 0x10025765
Capabilities:
Get thread local storage value

Disassembly:
push 0xc
mov eax, 0x1008ebd6
call fcn.1008ace0
mov edi, ecx
mov esi, dword [edi + 0x70]
and dword [edi + 0x70], 0
test esi, esi
je 0x100257ae
push dword [0x100a7828]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
push esi
mov byte [ebx + 0x33], 1
mov ecx, dword [esi]
mov esi, dword [ecx + 8]
mov ecx, esi
call dword [0x100a9324]
call esi
cmp dword [edi + 0x70], 0
jne 0x1002588c
mov byte [ebx + 0x33], 0
mov ebx, dword [edi + 0x1c]
mov dword [ebp - 0x14], ebx
test ebx, ebx
je 0x100257bb
inc dword [ebx + 8]
and dword [ebp - 4], 0
mov esi, dword [ebx + 0x20]
test esi, esi
je 0x10025809
inc dword [esi + 8]
mov dword [ebp - 0x18], esi
push dword [ebx + 0xa0]
lea ecx, [ebp - 0x10]
call fcn.100140aa
push ecx
mov ecx, esi
mov byte [ebp - 4], 2
call fcn.1001a13f
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x100257f2
call fcn.10085d15
mov ecx, esi
call fcn.10085d3d
mov ecx, dword [ebx + 0x20]
and dword [ebx + 0x20], 0
test ecx, ecx
je 0x10025809
call fcn.10085d3d
test ebx, ebx
je 0x10025814
mov ecx, ebx
call fcn.10085d3d
mov esi, dword [edi + 0x20]
mov dword [ebp - 0x18], esi
test esi, esi
je 0x10025821
inc dword [esi + 8]
mov ecx, esi
mov dword [ebp - 4], 3
call fcn.1001aa85
test esi, esi
je 0x1002583a
mov ecx, esi
call fcn.10085d3d
push dword [0x100a7828]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, eax
call fcn.10013b9a
mov ecx, dword [edi + 0x68]
xor ebx, ebx
mov dword [edi + 0x68], ebx
test ecx, ecx
je 0x1002585e
call fcn.10085d3d
mov eax, dword [edi + 0x20]
mov word [eax + 0x2c], bx
mov dword [edi + 0x50], ebx
mov ecx, dword [edi + 0x54]
mov dword [edi + 0x54], ebx
test ecx, ecx
je 0x10025877
call fcn.10085d3d
mov ecx, dword [edi + 0x58]
mov dword [edi + 0x58], ebx
test ecx, ecx
je 0x10025886
call fcn.10085d3d
call fcn.1008aca0
ret
call fcn.1001402c
int3
Function at 0x100365e9
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100909ed
mov eax, dword fs:[0]
push eax
sub esp, 0x30
push esi
push edi
mov eax, dword [0x100a77f0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [ebp + 8]
push dword [0x100a7828]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x18], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push 0x10005044
mov ecx, esi
mov edi, eax
call fcn.10085f9d
push 0xc
mov edx, eax
mov dword [ebp - 0x1c], eax
mov ecx, edi
call fcn.1001532f
mov ecx, edi
mov esi, eax
call fcn.100152a7
lea eax, [ebp - 0x24]
mov ecx, edi
mov dword [ebp - 0x3c], eax
lea edx, [ebp - 0x3c]
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x20]
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x28], eax
call fcn.1003939d
mov edx, esi
mov ecx, edi
call fcn.10015310
mov esi, dword [ebp - 0x10]
mov edi, dword [ebp + 0xc]
cmp esi, edi
je 0x100366a1
push 0xa
pop ecx
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + 0x10]
cmp eax, ecx
je 0x100366b5
mov edx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ecx], edx
mov dword [ecx + 4], eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp + 0x14]
cmp eax, ecx
je 0x100366c9
mov edx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ecx], edx
mov dword [ecx + 4], eax
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
leave
ret 0x10
Function at 0x100367ae
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x34
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [esp + 0x18], eax
mov ebx, ecx
mov eax, dword [ebp + 0xc]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x10], eax
mov esi, edx
push edi
lea eax, [ebp + 0x10]
push eax
call fcn.10038fc2
push dword [0x100a7828]
and dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push 0x10005044
mov ecx, esi
mov edi, eax
call fcn.10085f9d
push 0xe
mov edx, eax
mov dword [esp + 0x1c], eax
mov ecx, edi
call fcn.1001532f
mov ecx, edi
mov esi, eax
call fcn.100152a7
lea eax, [esp + 0x10]
mov ecx, edi
mov dword [esp + 0x28], eax
lea edx, [esp + 0x28]
lea eax, [esp + 0x18]
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x30], eax
lea eax, [esp + 0x14]
mov dword [esp + 0x34], eax
lea eax, [esp + 0x20]
mov dword [esp + 0x38], eax
lea eax, [esp + 0xc]
mov dword [esp + 0x3c], eax
call fcn.100394b5
mov edx, esi
mov ecx, edi
call fcn.10015310
mov ecx, dword [esp + 0x10]
test ecx, ecx
jns 0x1003686c
mov edx, esi
call fcn.1001355e
mov ecx, dword [esp + 0x10]
call fcn.10085571
mov esi, dword [esp + 0x14]
mov edi, dword [ebp + 0xc]
cmp esi, edi
je 0x1003687c
push 0xa
pop ecx
rep movsd dword es:[edi], dword [esi]
and dword [ebx], 0
lea eax, [esp + 0xc]
cmp eax, ebx
je 0x1003688d
mov eax, dword [esp + 0xc]
mov dword [ebx], eax
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x1003691a
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
and dword [esp + 0xc], 0
lea eax, [ebp + 8]
and dword [esp + 0x10], 0
push ebx
push esi
push edi
push dword [0x100a7828]
mov esi, edx
mov dword [esp + 0x18], eax
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push 0x10005044
mov ecx, esi
mov edi, eax
call fcn.10085f9d
push 0x10
mov edx, eax
mov dword [esp + 0x14], eax
mov ecx, edi
call fcn.1001532f
mov ecx, edi
mov esi, eax
call fcn.100152a7
lea eax, [esp + 0xc]
mov ecx, edi
mov dword [esp + 0x20], eax
lea edx, [esp + 0x20]
lea eax, [esp + 0x10]
mov dword [esp + 0x24], eax
lea eax, [esp + 0x14]
mov dword [esp + 0x28], eax
lea eax, [esp + 0x18]
mov dword [esp + 0x2c], eax
call fcn.10039585
mov edx, esi
mov ecx, edi
call fcn.10015310
mov ecx, dword [esp + 0xc]
test ecx, ecx
jns 0x100369b9
mov edx, esi
call fcn.1001355e
mov ecx, dword [esp + 0xc]
call fcn.10085571
and dword [ebx], 0
lea eax, [esp + 0x18]
and dword [ebx + 4], 0
cmp eax, ebx
je 0x100369d5
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov dword [ebx], eax
mov dword [ebx + 4], ecx
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10036a6e
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10090a34
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
push edi
mov eax, dword [0x100a77f0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [ebp + 8]
push dword [0x100a7828]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push 0x10005044
mov ecx, esi
mov edi, eax
call fcn.10085f9d
push 0x12
mov edx, eax
mov dword [ebp - 0x14], eax
mov ecx, edi
call fcn.1001532f
mov ecx, edi
mov esi, eax
call fcn.100152a7
lea eax, [ebp - 0x1c]
mov ecx, edi
mov dword [ebp - 0x2c], eax
lea edx, [ebp - 0x2c]
lea eax, [ebp - 0x14]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x20], eax
call fcn.10039652
mov edx, esi
mov ecx, edi
call fcn.10015310
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 0xc]
cmp eax, ecx
je 0x10036b13
mov edx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ecx], edx
mov dword [ecx + 4], eax
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
leave
ret 8

Function at 0x10036d30
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x4c
mov eax, dword [0x100a77f0]
xor eax, esp
mov dword [esp + 0x48], eax
push ebx
push esi
push edi
push 0xa
mov ebx, ecx
lea eax, [ebp + 8]
pop ecx
push dword [0x100a7828]
mov dword [esp + 0x18], eax
lea edi, [esp + 0x2c]
xor eax, eax
mov esi, edx
rep stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push 0x10005044
mov ecx, esi
mov edi, eax
call fcn.10085f9d
push 0x16
mov edx, eax
mov dword [esp + 0x14], eax
mov ecx, edi
call fcn.1001532f
mov ecx, edi
mov esi, eax
call fcn.100152a7
lea eax, [esp + 0xc]
mov ecx, edi
mov dword [esp + 0x18], eax
lea edx, [esp + 0x18]
lea eax, [esp + 0x10]
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x14]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x28]
mov dword [esp + 0x24], eax
call fcn.10039836
mov edx, esi
mov ecx, edi
call fcn.10015310
mov ecx, dword [esp + 0xc]
test ecx, ecx
jns 0x10036ddb
mov edx, esi
call fcn.1001355e
mov ecx, dword [esp + 0xc]
call fcn.10085571
push 0xa
pop ecx
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
mov ecx, ebx
call fcn.1001febd
lea eax, [esp + 0x28]
cmp eax, ebx
je 0x10036dfc
push 0xa
pop ecx
mov esi, eax
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x54]
mov eax, ebx
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10087b70
mov esp, ebp
pop ebp
ret 4
Function at 0x10036eb3
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
mov eax, dword [ebp + 8]
and dword [esp + 0xc], 0
and dword [esp + 0x10], 0
push ebx
push esi
push edi
push dword [0x100a7828]
mov esi, edx
mov dword [esp + 0x18], eax
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push 0x10005044
mov ecx, esi
mov edi, eax
call fcn.10085f9d
push 0x18
mov edx, eax
mov dword [esp + 0x14], eax
mov ecx, edi
call fcn.1001532f
mov ecx, edi
mov esi, eax
call fcn.100152a7
lea eax, [esp + 0xc]
mov ecx, edi
mov dword [esp + 0x20], eax
lea edx, [esp + 0x20]
lea eax, [esp + 0x10]
mov dword [esp + 0x24], eax
lea eax, [esp + 0x14]
mov dword [esp + 0x28], eax
lea eax, [esp + 0x18]
mov dword [esp + 0x2c], eax
call fcn.10039901
mov edx, esi
mov ecx, edi
call fcn.10015310
mov ecx, dword [esp + 0xc]
test ecx, ecx
jns 0x10036f52
mov edx, esi
call fcn.1001355e
mov ecx, dword [esp + 0xc]
call fcn.10085571
and dword [ebx], 0
lea eax, [esp + 0x18]
and dword [ebx + 4], 0
cmp eax, ebx
je 0x10036f6e
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov dword [ebx], eax
mov dword [ebx + 4], ecx
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x1003939d
Capabilities:
Access peb ldr_data

Disassembly:
push 0xc
push 0x1009c938
call fcn.10088090
mov edi, edx
mov dword [ebp - 0x1c], ecx
and dword [ebp - 4], 0
mov eax, dword [edi + 4]
mov ecx, dword [eax]
mov eax, dword [ecx]
mov esi, dword [eax + 0x30]
mov eax, dword [edi + 0x14]
push dword [eax]
mov eax, dword [edi + 0x10]
push dword [eax]
mov eax, dword [edi + 0xc]
push dword [eax]
mov eax, dword [edi + 8]
push dword [eax]
push ecx
mov ecx, esi
call dword [0x100a9324]
call esi
mov ecx, dword [edi]
mov dword [ecx], eax
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1003a007
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x28
push esi
mov esi, edx
lea eax, [ebp + 8]
mov dword [esp + 0x10], eax
push edi
mov edi, ecx
test esi, esi
jne 0x1003a02b
and dword [esp + 0x18], edx
and dword [esp + 0x1c], edx
jmp 0x1003a03e
mov ecx, esi
call fcn.100870eb
mov dword [esp + 0x18], 0x10039db0
mov dword [esp + 0x1c], esi
push dword [0x100a7828]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push 0x10005080
mov ecx, edi
mov esi, eax
call fcn.10085f9d
push 8
mov edx, eax
mov dword [esp + 0x14], eax
mov ecx, esi
call fcn.1001532f
mov ecx, esi
mov edi, eax
call fcn.100152a7
lea eax, [esp + 0xc]
mov ecx, esi
mov dword [esp + 0x20], eax
lea edx, [esp + 0x20]
lea eax, [esp + 0x10]
mov dword [esp + 0x24], eax
lea eax, [esp + 0x14]
mov dword [esp + 0x28], eax
lea eax, [esp + 0x18]
mov dword [esp + 0x2c], eax
call fcn.1003b319
mov edx, edi
mov ecx, esi
call fcn.10015310
mov ecx, dword [esp + 0xc]
test ecx, ecx
jns 0x1003a0bc
mov edx, edi
call fcn.1001355e
mov ecx, dword [esp + 0xc]
call fcn.10085571
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4