joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100102a0
Capabilities:
Encode data using xor

Disassembly:
push str.g_begin
call fcn.1000bbb0
add esp, 4
jmp fcn.10010020

Function at 0x100102c0
Capabilities:
Terminate thread

Disassembly:
call fcn.10049420
call fcn.101b77c0
mov ecx, eax
jmp fcn.101b8b80

Function at 0x100106d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x100106fb
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.10012a90
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x14], eax
test eax, eax
je 0x1001071d
mov eax, dword [ebx + 0x30]
mov eax, dword [eax]
jmp 0x1001071f
xor eax, eax
cdq
mov dword [esp + 0xc], eax
mov ecx, edx
mov dword [esp + 0x10], ecx
test edi, edi
jl 0x100107a3
jg 0x10010734
test esi, esi
je 0x100107a3
test ecx, ecx
jl 0x1001077d
jg 0x1001073e
test eax, eax
je 0x1001077d
cmp edi, ecx
jg 0x10010752
jl 0x10010748
cmp esi, eax
jae 0x10010752
mov eax, esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x1c]
call fcn.101ec960
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [ebx + 0x30]
add edx, ecx
sub esi, ecx
sbb edi, dword [esp + 0x10]
sub dword [eax], ecx
mov eax, dword [ebx + 0x20]
add dword [eax], ecx
jmp 0x10010780
mov edx, dword [ebp + 8]
test edi, edi
jl 0x100107a3
jg 0x1001078a
test esi, esi
je 0x100107a3
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x100107a3
push eax
push esi
push 1
push edx
call fcn.101f7dce
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100107c0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x38], 0
je 0x100107eb
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.10012320
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [edi + 0x1c]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x14], eax
test eax, eax
je 0x1001080d
mov eax, dword [edi + 0x2c]
mov eax, dword [eax]
jmp 0x1001080f
xor eax, eax
cdq
mov dword [esp + 0xc], eax
mov ecx, edx
mov dword [esp + 0x10], ecx
test ebx, ebx
jl 0x100108ae
jg 0x1001082c
test esi, esi
je 0x100108ae
test ecx, ecx
jl 0x10010879
jg 0x10010836
test eax, eax
je 0x10010879
cmp ebx, ecx
jg 0x1001084a
jl 0x10010840
cmp esi, eax
jae 0x1001084a
mov eax, esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], ebx
push eax
push dword [esp + 0x18]
push dword [ebp + 8]
call fcn.101ec960
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [edi + 0x2c]
add edx, ecx
sub esi, ecx
mov dword [esp + 0xc], edx
sbb ebx, dword [esp + 0x10]
sub dword [eax], ecx
mov eax, dword [edi + 0x1c]
add dword [eax], ecx
jmp 0x10010880
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], eax
test ebx, ebx
jl 0x100108ae
jg 0x1001088a
test esi, esi
je 0x100108ae
cmp dword [edi + 0x4c], 0
je 0x100108ae
mov ecx, edi
call fcn.10010f90
push dword [edi + 0x4c]
push esi
push 1
push dword [esp + 0x18]
call fcn.101f9043
add esp, 0x10
sub esi, eax
sbb ebx, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
pop edi
pop esi
sbb edx, ebx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10010c10
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x1029912c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x10010c40
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101d506b
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x10010c7c
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x10010c7c
lea ecx, [edi - 1]
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101d506b
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x10010d61
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x10010ca4
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x10010cd7
push dword [esi + 0x4c]
movsx eax, bl
push eax
call fcn.101f7fda
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101d506b
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x28], bl
mov edx, dword [ecx]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x27]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x1c]
test eax, eax
js 0x10010d61
cmp eax, 1
jle 0x10010d34
cmp eax, 3
jne 0x10010d61
push dword [esi + 0x4c]
push dword [ebp - 0x28]
call fcn.1000f240
add esp, 8
or ecx, 0xffffffff
test al, al
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101d506b
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x10010d51
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.101f7dce
add esp, 0x10
cmp edi, eax
jne 0x10010d61
lea eax, [ebp - 0x28]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
jne 0x10010c67
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.101d506b
mov esp, ebp
pop ebp
ret 4
Function at 0x10010fc0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x1029912c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x38], 0
je 0x10011061
cmp byte [esi + 0x3d], 0
je 0x10011061
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x10011017
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
mov edx, dword [ecx]
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x10011029
sub eax, 1
je 0x1001102d
sub eax, 2
je 0x10011061
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101d506b
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x1001104a
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.101f7dce
add esp, 0x10
cmp edi, eax
jne 0x10011017
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101d506b
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
xor ecx, ebp
pop esi
call fcn.101d506b
mov esp, ebp
pop ebp
ret

Function at 0x10011760
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10225620
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x1029912c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.101d507c
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.101d1ca2
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x34], esi
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100193f0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10226e6d
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x1029912c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edi, dword [ebp + 8]
push dword [0x102ad738]
mov esi, dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x1001943b
cmp dword [eax], esi
je 0x1001943b
mov eax, dword [eax + 8]
test eax, eax
jne 0x10019430
lea eax, [edi + 8]
mov dword [ebp - 0x18], edi
push eax
push 0x58
call fcn.10023580
mov esi, eax
mov dword [ebp - 0x10], 0
add esp, 8
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 1
lea ecx, [esi + 0x20]
push edi
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0x1001ee90
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x1c], 0
call fcn.1001ef50
mov edi, dword [ebx + 8]
lock inc dword [edi + 0x18]
push esi
push 0
push 0
mov dword [esi + 0x1c], 1
push dword [edi + 0x14]
call dword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
test eax, eax
jne 0x100194f3
lea ebx, [edi + 0x38]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [esi + 0x14], 0
mov eax, dword [edi + 0x58]
test eax, eax
je 0x100194dc
mov dword [eax + 0x14], esi
jmp 0x100194df
mov dword [edi + 0x54], esi
mov dword [edi + 0x58], esi
lea eax, [edi + 0x34]
mov ecx, 1
xchg dword [eax], ecx
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
call fcn.1001ee00
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1001fd30
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10227a08
mov eax, dword fs:[0]
push eax
sub esp, 0x70
push ebx
push esi
push edi
mov eax, dword [0x1029912c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [ebx + 0x10]
mov eax, dword [eax + 0xc]
test eax, eax
je 0x1001fd86
push dword [ebp + 8]
push 0x100200d0
push ebx
call eax
add esp, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x6c]
mov eax, dword [esi]
mov dword [ebp - 0x7c], eax
mov eax, dword [esi + 4]
mov dword [ebp - 0x78], eax
mov eax, dword [esi + 8]
mov dword [ebp - 0x74], eax
lea eax, [esi + 0x10]
push eax
call fcn.10017a20
mov eax, dword [esi + 0x50]
mov dword [ebp - 0x2c], eax
mov eax, dword [esi + 0x54]
mov dword [ebp - 0x28], eax
mov dword [ebp - 4], 0
lea eax, [ebp + 0xb]
push dword [0x102ad720]
mov dword [ebp - 0x24], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x1001fdf8
mov eax, dword [eax + 4]
test eax, eax
je 0x1001fdf8
mov edi, dword [eax + 8]
test edi, edi
je 0x1001fdf8
mov dword [eax + 8], 0
mov al, byte [edi]
cmp al, 0x1a
jb 0x1001fdef
mov byte [edi + 0x68], al
jmp 0x1001fe08
push edi
call fcn.100df630
add esp, 4
push 0x69
call fcn.101d507c
mov edi, eax
add esp, 4
mov byte [edi + 0x68], 0x1a
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], 0
mov byte [ebp - 4], 1
lea esi, [edi + 8]
mov eax, dword [ebp - 0x7c]
lea ecx, [esi + 8]
mov dword [esi], eax
mov eax, dword [ebp - 0x78]
mov dword [esi + 4], eax
mov eax, dword [ebp - 0x74]
mov dword [ecx], eax
lea eax, [ebp - 0x6c]
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x18], ecx
add ecx, 8
push eax
call fcn.10017a20
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x24]
mov dword [esi + 0x50], eax
mov eax, dword [ebp - 0x28]
mov dword [esi + 0x54], eax
mov dword [edi], 0x100203b0
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x20], 0
call fcn.10020000
mov dword [ebp - 4], 2
mov esi, dword [ebp - 0x30]
test esi, esi
je 0x1001fe91
or edi, 0xffffffff
mov eax, edi
lock xadd dword [esi + 4], eax
jne 0x1001fe91
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lock xadd dword [esi + 8], edi
dec edi
jne 0x1001fe91
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
lea ecx, [ebp - 0x6c]
call fcn.100151d0
mov dword [ebp - 4], 3
lea ecx, [ebp - 0x14]
mov eax, dword [ebx + 0x10]
push ecx
push ebx
mov eax, dword [eax + 8]
call eax
add esp, 8
mov dword [ebp - 4], 4
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x1001fec8
push 0
push eax
mov eax, dword [eax]
call eax
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10020000
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x102259a0
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x1029912c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi + 8]
test eax, eax
je 0x10020073
lea esi, [eax + 0x18]
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov esi, dword [esi + 0x3c]
test esi, esi
je 0x10020064
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [esi + 4], eax
jne 0x10020064
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lock xadd dword [esi + 8], ebx
dec ebx
jne 0x10020064
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov ecx, dword [ebp - 0x10]
call fcn.100151d0
mov dword [edi + 8], 0
mov esi, dword [edi + 4]
test esi, esi
je 0x100200b1
push dword [0x102ad720]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x100200a1
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x100200a1
cmp dword [ecx + 8], 0
jne 0x100200a1
mov al, byte [esi + 0x68]
mov byte [esi], al
mov dword [ecx + 8], esi
jmp 0x100200aa
push esi
call fcn.100df630
add esp, 4
mov dword [edi + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10020a40
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10227c52
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x1029912c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x20], ebx
mov eax, dword [ebp + 8]
push dword [0x102ad738]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x34], eax
mov esi, dword [eax]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x10020a9b
nop dword [eax + eax]
cmp dword [eax], esi
je 0x10020ab2
mov eax, dword [eax + 8]
test eax, eax
jne 0x10020a90
mov esi, dword [edi]
mov dword [ebp - 0x30], edi
cmp byte [esi + 0x400], 0
jne 0x10020ace
mov byte [esi + 0x400], 1
jmp 0x10020add
cmp dword [eax + 4], 0
je 0x10020a9b
push edi
push edi
mov dword [ebp - 4], 0
call fcn.10021a10
add esp, 8
jmp 0x10020c07
push 0x88
call fcn.101d507c
add esp, 4
mov esi, eax
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], 0
mov dword [ebp - 4], 1
mov ebx, dword [ebx + 0x14]
mov byte [ebp - 4], 2
lea ecx, [esi + 0x20]
push edi
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], fcn.10021140
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x1c], 0
call fcn.10021500
mov dword [esi + 0x78], ebx
mov dword [esi + 0x80], 0
test ebx, ebx
je 0x10020b4d
mov eax, dword [ebx + 8]
lock inc dword [eax + 0x18]
mov byte [ebp - 4], 1
mov edi, dword [ebp - 0x34]
mov ebx, dword [ebp - 0x20]
mov ecx, ebx
push esi
push edi
call fcn.10022bf0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x2c], 0
test al, al
je 0x10020bff
mov eax, dword [edi]
xorps xmm0, xmm0
push dword [0x102ad738]
movq qword [ebp - 0x1c], xmm0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x1c], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x1c]
push eax
push dword [0x102ad738]
mov dword [ebp - 0x18], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [ebx + 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [edi]
mov dword [ebp - 0x20], eax
push 0x102a8ad8
push 0x1003c720
push 0x102a8ae0
mov byte [ebp - 4], 6
call fcn.101d1ed1
add esp, 0xc
test eax, eax
je 0x10020c25
push 0
lea eax, [ebp - 0x38]
push eax
push esi
push dword [ebx + 0x18]
call fcn.10021140
add esp, 0x10
lea ecx, [ebp - 0x24]
call fcn.10022b80
push dword [ebp - 0x14]
push dword [0x102ad738]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
lea ecx, [ebp - 0x30]
call fcn.100213b0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.101d506b
mov esp, ebp
pop ebp
ret 8
call fcn.101f7e31
int3
Function at 0x10020c30
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10227ca2
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x1029912c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [ebp + 8]
push dword [0x102ad738]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
mov esi, dword [eax]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x10020c87
cmp dword [eax], esi
je 0x10020d76
mov eax, dword [eax + 8]
test eax, eax
jne 0x10020c78
lea eax, [edi + 0x30]
mov dword [ebp - 0x30], edi
push eax
push 0x80
call fcn.10023580
mov esi, eax
mov dword [ebp - 0x28], 0
add esp, 8
mov dword [ebp - 0x2c], esi
mov dword [ebp - 4], 2
lea ecx, [esi + 0x20]
push edi
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], fcn.10021040
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x1c], 0
call fcn.10021450
mov byte [ebp - 4], 1
mov ecx, ebx
mov edi, dword [ebp - 0x20]
push esi
push edi
call fcn.10022bf0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x2c], 0
test al, al
je 0x10020dbc
mov eax, dword [edi]
xorps xmm0, xmm0
push dword [0x102ad738]
movq qword [ebp - 0x1c], xmm0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x1c], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x1c]
push eax
push dword [0x102ad738]
mov dword [ebp - 0x18], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [ebx + 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [edi]
mov dword [ebp - 0x20], eax
push 0x102a8ad8
push 0x1003c720
push 0x102a8ae0
mov byte [ebp - 4], 5
call fcn.101d1ed1
add esp, 0xc
test eax, eax
je 0x10020de2
jmp 0x10020d93
cmp dword [eax + 4], 0
je 0x10020c87
push edi
push edi
mov dword [ebp - 4], 0
call fcn.10021aa0
add esp, 8
jmp 0x10020dc4
push 0
lea eax, [ebp - 0x38]
push eax
push esi
push dword [ebx + 0x18]
call fcn.10021040
add esp, 0x10
lea ecx, [ebp - 0x24]
call fcn.10022b80
push dword [ebp - 0x14]
push dword [0x102ad738]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
lea ecx, [ebp - 0x30]
call fcn.100212f0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.101d506b
mov esp, ebp
pop ebp
ret 8
call fcn.101f7e31
int3
Function at 0x100215a0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10227e42
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x1029912c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp + 8]
push dword [0x102ad738]
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x3c], eax
mov esi, dword [eax]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x100215ff
nop dword [eax]
cmp dword [eax], esi
je 0x1002172c
mov eax, dword [eax + 8]
test eax, eax
jne 0x100215f0
push ebx
push 0x80
mov dword [ebp - 0x38], ebx
call fcn.10023580
mov edi, eax
mov dword [ebp - 0x30], 0
add esp, 8
mov dword [ebp - 0x34], edi
mov eax, dword [ebp - 0x20]
mov dword [ebp - 4], 1
mov eax, dword [eax + 0x14]
mov dword [ebp - 0x2c], eax
mov byte [ebp - 4], 2
lea esi, [edi + 0x20]
mov dword [edi + 0x14], 0
lea ecx, [esi + 8]
mov dword [edi + 0x18], fcn.100217b0
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x1c], 0
mov dword [ebp - 0x24], esi
mov eax, dword [ebx]
mov dword [esi], eax
lea eax, [ebx + 8]
push eax
call fcn.10017a20
mov eax, dword [ebx + 0x48]
mov dword [esi + 0x48], eax
mov eax, dword [ebx + 0x4c]
mov dword [esi + 0x4c], eax
mov eax, dword [ebp - 0x2c]
mov dword [edi + 0x70], eax
mov dword [edi + 0x78], 0
test eax, eax
je 0x100216a1
mov eax, dword [eax + 8]
lock inc dword [eax + 0x18]
mov ebx, dword [ebp - 0x20]
mov ecx, ebx
mov byte [ebp - 4], 1
mov esi, dword [ebp - 0x3c]
push edi
push esi
call fcn.10022bf0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x34], 0
test al, al
je 0x10021772
mov eax, dword [esi]
xorps xmm0, xmm0
push dword [0x102ad738]
movq qword [ebp - 0x1c], xmm0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x1c], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x1c]
push eax
push dword [0x102ad738]
mov dword [ebp - 0x18], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [ebx + 0x18]
mov dword [ebp - 0x28], eax
mov eax, dword [esi]
mov dword [ebp - 0x24], eax
push 0x102a8ad8
push 0x1003c720
push 0x102a8ae0
mov byte [ebp - 4], 6
call fcn.101d1ed1
add esp, 0xc
test eax, eax
je 0x10021798
jmp 0x10021749
cmp dword [eax + 4], 0
je 0x100215ff
push ebx
push ebx
mov dword [ebp - 4], 0
call fcn.1001f640
add esp, 8
jmp 0x1002177a
push 0
lea eax, [ebp - 0x40]
push eax
push edi
push dword [ebx + 0x18]
call fcn.100217b0
add esp, 0x10
lea ecx, [ebp - 0x28]
call fcn.10022b80
push dword [ebp - 0x14]
push dword [0x102ad738]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
lea ecx, [ebp - 0x38]
call fcn.10021940
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.101d506b
mov esp, ebp
pop ebp
ret 8
call fcn.101f7e31
int3