joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6d6f7c7e
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push esi
push dword [0x6d7a23c4]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp dword [ebp + 8], eax
je 0x6d6f7cb1
lea eax, [ebp - 4]
push eax
push 1
push dword [ebp + 8]
call fcn.6d6fa98c
add esp, 0xc
test eax, eax
jne 0x6d6f7cb1
push 0xd
jmp 0x6d6f7ce5
push dword [ebp + 8]
call fcn.6d6ea920
mov esi, eax
pop ecx
test esi, esi
je 0x6d6f7ce3
mov ecx, esi
call fcn.6d707d48
test eax, eax
je 0x6d6f7ce3
push dword [ebp + 0xc]
lea ecx, [esi + 0x34]
push 0
call fcn.6d6eadca
neg eax
sbb eax, eax
and al, 0xe1
add eax, 0x1f
jmp 0x6d6f7ce6
push 0x1f
pop eax
pop esi
leave
ret 8

Function at 0x6d6f7d13
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
push dword [0x6d7a23c4]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
lea ecx, [ebp - 0x40]
push edi
call fcn.6d6b5a73
mov esi, dword [ebp + 8]
lea eax, [ebp - 4]
and dword [ebp - 4], 0
push eax
push 1
pop ebx
push ebx
push esi
call fcn.6d6fa98c
add esp, 0xc
test eax, eax
jne 0x6d6f7d5d
push 0xd
pop esi
jmp 0x6d6f7e63
cmp dword [esi + 0x138], 0
je 0x6d6f7d6a
push 0x71
jmp 0x6d6f7d57
mov eax, dword [esi + 0x88]
cmp dword [eax + 8], 3
jne 0x6d6f7d7a
push 0x20
jmp 0x6d6f7d57
push edi
lea ecx, [ebp - 0x28]
call fcn.6d64bc19
and dword [ebp + 8], 0
push ebx
push esi
lea ecx, [ebp - 0x108]
call fcn.6d7624bf
cmp dword [ebp - 0x78], 2
je 0x6d6f7df2
xor eax, eax
cmp dword [ebp - 0x6c], eax
je 0x6d6f7daf
push dword [ebp - 0x6c]
mov ecx, dword [edi + 0x90]
call fcn.6d67a638
mov eax, dword [eax]
test byte [eax + 0x11], 1
jne 0x6d6f7e04
lea ecx, [ebp - 0x100]
call fcn.6d6ad93a
mov ecx, dword [ebp + 8]
mov dword [ebp + ecx*4 - 0x18], eax
mov eax, dword [ebp - 0x100]
mov dword [ebp + ecx*4 - 0x10], eax
inc ecx
cmp ecx, ebx
mov dword [ebp + 8], ecx
jg 0x6d6f7dec
lea ecx, [ebp - 0x108]
call fcn.6d7625ad
cmp dword [ebp - 0x78], 2
jne 0x6d6f7d9a
cmp dword [ebp + 8], 2
jge 0x6d6f7e11
mov ecx, dword [ebp - 8]
push ebx
push esi
call fcn.6d6fabe5
test eax, eax
jne 0x6d6f7e04
push 0x1f
jmp 0x6d6f7e06
push 0x20
pop esi
lea ecx, [ebp - 0x28]
call fcn.6d6a63ec
jmp 0x6d6f7e63
xor edi, edi
cmp dword [ebp + edi - 0x18], 0
jne 0x6d6f7e38
push dword [ebp + edi - 0x10]
lea ecx, [ebp - 0x60]
push esi
call fcn.6d76ae97
lea eax, [ebp - 0x60]
push eax
call fcn.6d76a82f
pop ecx
mov dword [ebp - 0x60], sym.jvm.dll_const_VM_Operation::vftable
add edi, 4
cmp edi, 8
jl 0x6d6f7e13
push esi
call fcn.6d6ea920
pop ecx
mov edi, eax
mov ecx, edi
call fcn.6d707dcb
mov dword [esi + 0x138], ebx
lea ecx, [ebp - 0x28]
mov dword [edi + 0x10], ebx
call fcn.6d6a63ec
xor esi, esi
lea ecx, [ebp - 0x40]
call fcn.6d6b5aa6
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x6d6f88dd
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push dword [ebp + 8]
mov ebx, ecx
call fcn.6d6c7aed
test eax, eax
pop ecx
jne 0x6d6f891e
push dword [ebp + 8]
call fcn.6d6c7ab5
mov esi, eax
pop ecx
test esi, esi
jne 0x6d6f8907
push 0x15
jmp 0x6d6f8920
mov eax, dword [esi + 8]
lea ecx, [esi + 8]
call dword [eax + 0x78]
test eax, eax
je 0x6d6f891e
mov esi, dword [esi + 0x98]
test esi, esi
jne 0x6d6f8923
push 0x65
pop eax
jmp 0x6d6f8999
push edi
push dword [0x6d7a23c4]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov eax, dword [eax + 0x8c]
mov dword [ebp - 0x10], eax
mov ecx, dword [eax + 4]
mov dword [ebp - 0xc], ecx
mov ecx, dword [eax + 8]
mov dword [ebp - 8], ecx
mov eax, dword [eax + 0xc]
mov ecx, esi
mov dword [ebp - 4], eax
call fcn.6d7415c5
mov esi, eax
or ecx, 0xffffffff
mov edi, esi
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push eax
push ecx
mov ecx, ebx
call fcn.6d6faade
mov edx, eax
mov eax, dword [ebp + 0xc]
mov edi, esi
or ecx, 0xffffffff
mov dword [eax], edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x10]
call fcn.6d6a63ec
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x6d6f899f
Capabilities:
Get thread local storage value

Disassembly:
push esi
push edi
push dword [0x6d7a23c4]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push dword [esp + 0xc]
mov edi, eax
call fcn.6d6c7aed
test eax, eax
pop ecx
jne 0x6d6f89f7
push dword [esp + 0xc]
call fcn.6d6c7ab5
mov esi, eax
pop ecx
test esi, esi
jne 0x6d6f89d1
push 0x15
jmp 0x6d6f89ea
mov eax, dword [esi + 8]
lea ecx, [esi + 8]
push edi
call dword [eax + 0x158]
cmp dword [edi + 4], 0
je 0x6d6f89ed
and dword [edi + 4], 0
push 0x71
pop eax
jmp 0x6d6f8a04
test byte [esi + 0x54], 0x20
je 0x6d6f89fc
or al, 0x20
jmp 0x6d6f89fc
mov eax, 0x411
mov ecx, dword [esp + 0x10]
mov dword [ecx], eax
xor eax, eax
pop edi
pop esi
ret 8
Function at 0x6d6f8a09
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
push dword [0x6d7a23c4]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push eax
lea ecx, [ebp - 0x20]
mov dword [ebp - 8], eax
call fcn.6d6b5a73
push dword [ebp + 8]
call fcn.6d6c7aed
test eax, eax
pop ecx
je 0x6d6f8a41
mov eax, dword [ebp + 0xc]
xor ebx, ebx
jmp 0x6d6f8a7b
push dword [ebp + 8]
call fcn.6d6c7ab5
mov edi, eax
xor ebx, ebx
cmp edi, ebx
pop ecx
jne 0x6d6f8a57
push 0x15
pop ebx
jmp 0x6d6f8a8c
mov eax, dword [edi + 8]
lea esi, [edi + 8]
mov ecx, esi
call dword [eax + 0x15c]
test al, 0x12
jne 0x6d6f8a6d
push 0x16
jmp 0x6d6f8a54
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x78]
test eax, eax
jne 0x6d6f8a9b
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
push ebx
push ebx
mov dword [eax], ebx
call fcn.6d6faade
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
lea ecx, [ebp - 0x20]
call fcn.6d6b5aa6
mov eax, ebx
jmp 0x6d6f8b86
mov eax, dword [ebp - 8]
push edi
mov ecx, dword [eax + 0x90]
call fcn.6d67a638
mov esi, eax
cmp esi, ebx
mov dword [ebp - 8], esi
jne 0x6d6f8ab7
xor eax, eax
jmp 0x6d6f8ab9
mov eax, dword [esi]
mov eax, dword [eax + 0x74]
mov ecx, dword [ebp - 4]
push ebx
mov edi, dword [eax + 8]
mov eax, edi
shl eax, 2
push eax
call fcn.6d6faade
cmp dword [0x6d7bd694], ebx
mov dword [ebp - 4], eax
mov dword [ebp + 8], ebx
je 0x6d6f8b37
cmp edi, ebx
jle 0x6d6f8b6f
jmp 0x6d6f8aeb
mov esi, dword [ebp - 8]
xor ebx, ebx
cmp esi, ebx
jne 0x6d6f8af3
xor eax, eax
jmp 0x6d6f8af5
mov eax, dword [esi]
mov esi, dword [eax + 0x74]
push 0xc
call fcn.6d645c02
add eax, dword [ebp + 8]
pop ecx
mov ebx, dword [esi + eax*4]
mov eax, dword [ebp - 8]
test eax, eax
je 0x6d6f8b0f
mov eax, dword [eax]
mov esi, dword [eax + 0x78]
push 0xa
call fcn.6d645c02
add eax, dword [ebp + 8]
pop ecx
mov ecx, ebx
mov esi, dword [esi + eax*4]
call fcn.6d7136ae
mov ecx, dword [ebp - 4]
inc dword [ebp + 8]
cmp dword [ebp + 8], edi
mov dword [ecx + esi*4], eax
jl 0x6d6f8ae6
jmp 0x6d6f8b6f
cmp edi, ebx
jle 0x6d6f8b6f
mov ebx, eax
jmp 0x6d6f8b42
mov esi, dword [ebp - 8]
test esi, esi
jne 0x6d6f8b4a
xor eax, eax
jmp 0x6d6f8b4c
mov eax, dword [esi]
mov esi, dword [eax + 0x74]
push 0xc
call fcn.6d645c02
add eax, dword [ebp + 8]
pop ecx
mov ecx, dword [esi + eax*4]
call fcn.6d7136ae
inc dword [ebp + 8]
mov dword [ebx], eax
add ebx, 4
cmp dword [ebp + 8], edi
jl 0x6d6f8b3f
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
mov dword [eax], edi
mov eax, dword [ebp + 0x10]
mov dword [eax], ecx
lea ecx, [ebp - 0x20]
call fcn.6d6b5aa6
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x6d6f8b8d
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
push dword [ebp + 8]
call fcn.6d6c7aed
test eax, eax
pop ecx
je 0x6d6f8bc1
mov ecx, dword [ebp + 0xc]
xor eax, eax
push eax
push eax
mov dword [ecx], eax
mov ecx, dword [ebp - 4]
call fcn.6d6faade
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
jmp 0x6d6f8d3b
push dword [0x6d7a23c4]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
lea ecx, [ebp - 0x28]
push esi
call fcn.6d6b5a73
push dword [ebp + 8]
call fcn.6d6c7ab5
mov ebx, eax
pop ecx
test ebx, ebx
jne 0x6d6f8bec
push 0x15
pop esi
jmp 0x6d6f8c23
mov eax, dword [ebx + 8]
lea edi, [ebx + 8]
mov ecx, edi
call dword [eax + 0x15c]
test al, 0x12
jne 0x6d6f8c02
push 0x16
jmp 0x6d6f8be9
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x78]
test eax, eax
jne 0x6d6f8c32
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
xor esi, esi
push esi
push esi
mov dword [eax], esi
call fcn.6d6faade
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
lea ecx, [ebp - 0x28]
call fcn.6d6b5aa6
mov eax, esi
jmp 0x6d6f8d3d
cmp ebx, dword [0x6d7bf7d8]
jne 0x6d6f8c44
mov eax, dword [0x6d7bd188]
mov dword [ebp + 8], eax
jmp 0x6d6f8c48
or dword [ebp + 8], 0xffffffff
mov ecx, dword [esi + 0x90]
push ebx
call fcn.6d67a638
push 1
lea ecx, [ebp - 0x60]
pop ebx
mov dword [ebp - 8], eax
push ebx
push ebx
push eax
xor edi, edi
call fcn.6d733d41
mov esi, sym.jvm.dll_const_FieldStream::vftable
lea ecx, [ebp - 0x60]
mov dword [ebp - 0x60], esi
call fcn.6d6b68a7
mov dword [ebp - 0x48], eax
sub dword [ebp - 0x48], 7
lea ecx, [ebp - 0x60]
call fcn.6d733da9
test eax, eax
jne 0x6d6f8c9a
lea ecx, [ebp - 0x60]
call fcn.6d6b6a9c
cmp eax, dword [ebp + 8]
je 0x6d6f8c7a
inc edi
jmp 0x6d6f8c7a
mov ecx, dword [ebp - 4]
mov eax, edi
shl eax, 2
push 0
push eax
call fcn.6d6faade
push ebx
push ebx
push dword [ebp - 8]
lea ecx, [ebp - 0x44]
mov dword [ebp - 4], eax
call fcn.6d733d41
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x44], esi
call fcn.6d6b68a7
mov dword [ebp - 0x2c], eax
sub dword [ebp - 0x2c], 7
lea ecx, [ebp - 0x44]
call fcn.6d733da9
test eax, eax
jne 0x6d6f8d26
mov eax, dword [ebp - 4]
lea esi, [eax + edi*4 - 4]
lea ecx, [ebp - 0x44]
call fcn.6d6b6a9c
cmp eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
je 0x6d6f8d16
lea eax, [ebp - 0x10]
lea ecx, [ebp - 0x44]
push eax
call fcn.6d6b68bf
mov eax, dword [eax]
shr eax, 3
and eax, ebx
push eax
push dword [ebp - 0xc]
push dword [ebp - 8]
call fcn.6d6c2f07
add esp, 0xc
mov dword [esi], eax
sub esi, 4
sub dword [ebp - 0x2c], 7
lea ecx, [ebp - 0x44]
call fcn.6d733da9
test eax, eax
je 0x6d6f8cdf
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
mov dword [eax], edi
mov eax, dword [ebp + 0x10]
mov dword [eax], ecx
lea ecx, [ebp - 0x28]
call fcn.6d6b5aa6
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x6d6f8d44
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
push dword [ebp + 8]
call fcn.6d6c7aed
test eax, eax
pop ecx
je 0x6d6f8d78
mov ecx, dword [ebp + 0xc]
xor eax, eax
push eax
push eax
mov dword [ecx], eax
mov ecx, dword [ebp - 4]
call fcn.6d6faade
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
jmp 0x6d6f8ea7
push dword [0x6d7a23c4]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
lea ecx, [ebp - 0x28]
push ebx
mov dword [ebp - 0xc], ebx
call fcn.6d6b5a73
push dword [ebp + 8]
call fcn.6d6c7ab5
mov esi, eax
pop ecx
test esi, esi
jne 0x6d6f8da6
push 0x15
pop esi
jmp 0x6d6f8ddd
mov eax, dword [esi + 8]
lea edi, [esi + 8]
mov ecx, edi
call dword [eax + 0x15c]
test al, 0x12
jne 0x6d6f8dbc
push 0x16
jmp 0x6d6f8da3
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x78]
test eax, eax
jne 0x6d6f8dec
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
xor esi, esi
push esi
push esi
mov dword [eax], esi
call fcn.6d6faade
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
lea ecx, [ebp - 0x28]
call fcn.6d6b5aa6
mov eax, esi
jmp 0x6d6f8ea9
mov esi, dword [esi + 0x7c]
test esi, esi
jne 0x6d6f8df7
xor ebx, ebx
jmp 0x6d6f8e09
mov ecx, dword [ebx + 0x90]
push esi
call fcn.6d67a638
mov ebx, eax
test ebx, ebx
jne 0x6d6f8e0d
xor edi, edi
jmp 0x6d6f8e12
mov eax, dword [ebx]
mov edi, dword [eax + 8]
mov ecx, dword [ebp - 4]
mov eax, edi
shl eax, 2
push 0
push eax
call fcn.6d6faade
and dword [ebp + 8], 0
mov dword [ebp - 0x10], eax
test edi, edi
jle 0x6d6f8e95
mov dword [ebp - 8], eax
mov esi, dword [ebx]
push 0xc
call fcn.6d645c02
add eax, dword [ebp + 8]
pop ecx
mov esi, dword [esi + eax*4]
mov esi, dword [esi + 0x3c]
test esi, esi
jne 0x6d6f8e4b
xor eax, eax
jmp 0x6d6f8e5d
mov eax, dword [ebp - 0xc]
push 4
mov ecx, dword [eax + 0x90]
call fcn.6d645be3
mov dword [eax], esi
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0xa0], 0
je 0x6d6f8e74
push 1
push eax
call fcn.6d6dc05b
pop ecx
jmp 0x6d6f8e80
test eax, eax
je 0x6d6f8e7a
mov eax, dword [eax]
push eax
call fcn.6d6dbff8
inc dword [ebp + 8]
pop ecx
mov ecx, dword [ebp - 8]
add dword [ebp - 8], 4
cmp dword [ebp + 8], edi
mov dword [ecx], eax
jl 0x6d6f8e30
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], edi
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
lea ecx, [ebp - 0x28]
call fcn.6d6b5aa6
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x6d6f8ff4
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push dword [ebp + 8]
mov ebx, ecx
call fcn.6d6c7aed
test eax, eax
pop ecx
jne 0x6d6f9035
push dword [ebp + 8]
call fcn.6d6c7ab5
mov esi, eax
pop ecx
test esi, esi
jne 0x6d6f901e
push 0x15
jmp 0x6d6f9037
mov eax, dword [esi + 8]
lea ecx, [esi + 8]
call dword [eax + 0x78]
test eax, eax
je 0x6d6f9035
mov esi, dword [esi + 0x9c]
test esi, esi
jne 0x6d6f903a
push 0x65
pop eax
jmp 0x6d6f90b0
push edi
push dword [0x6d7a23c4]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov eax, dword [eax + 0x8c]
mov dword [ebp - 0x10], eax
mov ecx, dword [eax + 4]
mov dword [ebp - 0xc], ecx
mov ecx, dword [eax + 8]
mov dword [ebp - 8], ecx
mov eax, dword [eax + 0xc]
mov ecx, esi
mov dword [ebp - 4], eax
call fcn.6d7415c5
mov esi, eax
or ecx, 0xffffffff
mov edi, esi
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push eax
push ecx
mov ecx, ebx
call fcn.6d6faade
mov edx, eax
mov eax, dword [ebp + 0xc]
mov edi, esi
or ecx, 0xffffffff
mov dword [eax], edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x10]
call fcn.6d6a63ec
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x6d6f918c
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
mov esi, ecx
push dword [0x6d7a23c4]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, dword [ebp + 0xc]
mov edi, eax
push ebx
mov ecx, esi
push dword [ebp + 8]
push edi
call fcn.6d6fb2bd
cmp eax, 0xd
jne 0x6d6f91e7
xor eax, eax
mov dword [ebp - 0x2c], sym.jvm.dll_const_VM_GetObjectMonitorUsage::vftable
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x2c]
push eax
mov dword [ebp - 0x14], esi
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], ebx
call fcn.6d76a82f
mov eax, dword [ebp - 4]
pop ecx
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x6d6f920d
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, ecx
push dword [0x6d7a23c4]
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov eax, dword [eax + 0x8c]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov ebx, dword [ebp + 8]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + 8]
mov dword [ebp - 0xc], ecx
mov eax, dword [eax + 0xc]
test esi, esi
mov dword [ebp - 8], eax
jne 0x6d6f925d
cmp dword [edi + 0xa0], 0
je 0x6d6f92b1
push 0x64
pop esi
jmp 0x6d6f937e
mov ecx, dword [ebx + 0x1c]
mov eax, dword [ebx + 4]
mov ecx, dword [ecx]
mov ecx, dword [ecx + eax*4 + 0x1c]
call fcn.6d7415c5
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
mov dword [ebp + 0xc], edi
repne scasb al, byte es:[edi]
not ecx
push eax
push ecx
mov ecx, dword [ebp - 4]
call fcn.6d6faade
mov edx, eax
test edx, edx
mov dword [esi], edx
je 0x6d6f92f3
mov edi, dword [ebp + 0xc]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebp - 4]
mov esi, dword [ebp + 0x10]
test esi, esi
jne 0x6d6f92c2
cmp dword [edi + 0xa0], esi
je 0x6d6f931a
jmp 0x6d6f9255
mov ecx, dword [ebx + 0x1c]
mov eax, dword [ebx + 8]
mov ecx, dword [ecx]
mov ecx, dword [ecx + eax*4 + 0x1c]
call fcn.6d7415c5
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
mov dword [ebp + 0xc], edi
repne scasb al, byte es:[edi]
not ecx
push eax
push ecx
mov ecx, dword [ebp - 4]
call fcn.6d6faade
mov edx, eax
test edx, edx
mov dword [esi], edx
jne 0x6d6f92fa
push 0x6e
jmp 0x6d6f9257
mov edi, dword [ebp + 0xc]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 0x14]
test esi, esi
je 0x6d6f937c
and dword [esi], 0
mov ecx, ebx
call fcn.6d6fa7c5
test eax, eax
je 0x6d6f937c
mov ecx, eax
call fcn.6d7415c5
mov ebx, eax
test ebx, ebx
je 0x6d6f937c
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
push esi
repne scasb al, byte es:[edi]
not ecx
push eax
push ecx
mov ecx, dword [ebp - 4]
call fcn.6d6f68f9
test eax, eax
je 0x6d6f935a
mov esi, eax
jmp 0x6d6f937e
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [ebp + 0x14]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, dword [edx]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor esi, esi
lea ecx, [ebp - 0x14]
call fcn.6d6a63ec
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x6d6f93e8
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [ebp + 8], 0
push edi
mov edi, ecx
mov dword [ebp - 4], edi
jne 0x6d6f9402
push 0x17
pop eax
jmp 0x6d6f955a
push ebx
push esi
push dword [0x6d7a23c4]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov eax, dword [eax + 0x8c]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
or ebx, 0xffffffff
mov ecx, dword [eax + 4]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + 8]
mov dword [ebp - 0xc], ecx
mov eax, dword [eax + 0xc]
test esi, esi
mov dword [ebp - 8], eax
jne 0x6d6f9445
cmp dword [edi + 0xa0], esi
je 0x6d6f9491
push 0x64
pop esi
jmp 0x6d6f954e
mov ecx, dword [ebp + 8]
call fcn.6d68355d
mov ecx, eax
call fcn.6d7415c5
mov dword [ebp + 0xc], eax
mov edi, eax
mov ecx, ebx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push eax
push ecx
mov ecx, dword [ebp - 4]
call fcn.6d6faade
mov edi, dword [ebp + 0xc]
mov edx, eax
mov ecx, ebx
xor eax, eax
mov dword [esi], edx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebp - 4]
mov esi, dword [ebp + 0x10]
test esi, esi
jne 0x6d6f94a2
cmp dword [edi + 0xa0], esi
je 0x6d6f94eb
jmp 0x6d6f943d
mov ecx, dword [ebp + 8]
call fcn.6d68356c
mov ecx, eax
call fcn.6d7415c5
mov dword [ebp + 0xc], eax
mov edi, eax
mov ecx, ebx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push eax
push ecx
mov ecx, dword [ebp - 4]
call fcn.6d6faade
mov edi, dword [ebp + 0xc]
mov edx, eax
mov ecx, ebx
xor eax, eax
mov dword [esi], edx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebp + 0x14]
test edi, edi
je 0x6d6f954c
mov ecx, dword [ebp + 8]
and dword [edi], 0
call fcn.6d6fa6b7
test eax, eax
je 0x6d6f954c
mov ecx, eax
call fcn.6d7415c5
mov esi, eax
test esi, esi
je 0x6d6f954c
push edi
mov edi, esi
mov ecx, ebx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push eax
push ecx
mov ecx, dword [ebp - 4]
call fcn.6d6f68f9
test eax, eax
je 0x6d6f952b
mov esi, eax
jmp 0x6d6f954e
mov edi, esi
mov ecx, ebx
xor eax, eax
mov edx, dword [ebp + 0x14]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, dword [edx]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor esi, esi
lea ecx, [ebp - 0x14]
call fcn.6d6a63ec
mov eax, esi
pop esi
pop ebx
pop edi
leave
ret 0x10
Function at 0x6d6f9aca
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push edi
mov edi, dword [ebp + 8]
test edi, edi
jne 0x6d6f9ae0
push 0x17
pop eax
jmp 0x6d6f9bcf
mov eax, dword [edi + 8]
mov edx, dword [ebp + 0xc]
push ebx
push esi
movzx eax, word [eax + 0x26]
mov dword [edx], eax
cdq
push edx
push eax
call fcn.6d6faade
mov esi, dword [ebp + 0x10]
mov dword [esi], eax
push dword [0x6d7a23c4]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push eax
lea ecx, [ebp - 0x30]
call fcn.6d6b5a73
push edi
lea ecx, [ebp + 8]
call fcn.6d6819e5
push dword [ebp + 8]
lea ecx, [ebp - 0x18]
call fcn.6d64d77b
mov eax, dword [ebp + 8]
test eax, eax
je 0x6d6f9b2d
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
mov ebx, dword [esi]
mov eax, dword [eax + 0x10]
mov dword [ebp + 0xc], eax
lea ecx, [ebp - 0x18]
call fcn.6d686815
mov ecx, eax
test ecx, ecx
jl 0x6d6f9bc3
mov byte [ebx], cl
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
mov eax, dword [eax]
mov eax, dword [eax + 8]
lea esi, [eax + edx + 0x30]
mov edx, dword [ebp - 0x10]
sub eax, esi
lea edx, [eax + edx + 0x30]
cmp edx, 1
jle 0x6d6f9bbc
cmp ecx, 0xb2
jl 0x6d6f9ba7
cmp ecx, 0xb9
jg 0x6d6f9ba7
movzx eax, word [esi + 1]
inc eax
shl eax, 4
add eax, dword [ebp + 0xc]
mov eax, dword [eax]
and eax, 0xffff
mov dword [ebp + 0x10], eax
mov ax, word [ebp + 0x10]
xchg ah, al
cmp ecx, 0xb9
mov word [ebx + 1], ax
jne 0x6d6f9bbc
lea ecx, [edx - 3]
add esi, 3
lea edi, [ebx + 3]
jmp 0x6d6f9bae
lea ecx, [edx - 1]
inc esi
lea edi, [ebx + 1]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
add ebx, edx
jmp 0x6d6f9b38
lea ecx, [ebp - 0x30]
call fcn.6d6b5aa6
pop esi
xor eax, eax
pop ebx
pop edi
leave
ret 0xc

Function at 0x6d6f9c66
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x6d7c1d7c], 0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
jne 0x6d6f9c9e
mov esi, dword [ebp + 8]
push esi
call fcn.6d6f9d03
pop ecx
test esi, esi
je 0x6d6f9c95
mov ecx, esi
call fcn.6d7005bb
push esi
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
pop ecx
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
push dword [0x6d7a23c4]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, dword [ebp + 8]
mov ebx, eax
cmp ebx, dword [esi + 8]
je 0x6d6f9cc2
mov eax, dword [ebx]
push dword [esi + 8]
mov ecx, ebx
call dword [eax + 0x38]
test eax, eax
je 0x6d6f9ce3
mov edi, dword [esi + 0x18]
and dword [ebp + 8], 0
test edi, edi
jl 0x6d6f9ce3
push 0
push ebx
mov ecx, esi
call fcn.6d71a48b
test eax, eax
jne 0x6d6f9cfe
inc dword [ebp + 8]
cmp dword [ebp + 8], edi
jle 0x6d6f9ccd
cmp dword [esi + 8], 0
je 0x6d6f9c83
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xa0]
neg eax
sbb eax, eax
and eax, 0x3e
add eax, 0x33
jmp 0x6d6f9c97
push 0x71
pop eax
jmp 0x6d6f9c97