joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40110c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x435030]
jne 0x401116
repz ret
jmp fcn.00401b61

Function at 0x409235
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00404c95
and dword [ebp - 4], 0
cmp dword [0x437794], 0
mov ebx, eax
jne 0x4092e6
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x409397
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x409397
push eax
call fcn.00404c23
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x437794], eax
call esi
push eax
call fcn.00404c23
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x437798], eax
call esi
push eax
call fcn.00404c23
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x43779c], eax
call esi
push eax
call fcn.00404c23
pop ecx
mov dword [0x4377a4], eax
test eax, eax
je 0x4092e6
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00404c23
pop ecx
mov dword [0x4377a0], eax
mov eax, dword [0x4377a0]
cmp eax, ebx
je 0x40933e
cmp dword [0x4377a4], ebx
je 0x40933e
push eax
call fcn.00404c9e
push dword [0x4377a4]
mov esi, eax
call fcn.00404c9e
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40933e
test edi, edi
je 0x40933e
call esi
test eax, eax
je 0x409335
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x409335
test byte [ebp - 0xc], 1
jne 0x40933e
or dword [ebp + 0x10], 0x200000
jmp 0x409377
mov eax, dword [0x437798]
cmp eax, ebx
je 0x409377
push eax
call fcn.00404c9e
pop ecx
test eax, eax
je 0x409377
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x409377
mov eax, dword [0x43779c]
cmp eax, ebx
je 0x409377
push eax
call fcn.00404c9e
pop ecx
test eax, eax
je 0x409377
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x437794]
call fcn.00404c9e
pop ecx
test eax, eax
je 0x409397
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x409399
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40b0a0
Capabilities:
Set console window title

Disassembly:
sub esp, 0x428
mov eax, dword [0x435030]
xor eax, esp
mov dword [esp + 0x424], eax
mov eax, dword [0x2c1501c]
push ebx
mov ebx, dword [0x2c14e68]
push esi
mov esi, dword [0x435f60]
push edi
mov edi, eax
cmp eax, 0x930
jne 0x40b0e1
push str.pecoloniwifuforewuxito
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
mov eax, dword [0x2c1501c]
mov dword [0x4378f4], esi
cmp eax, 0x114e
jne 0x40b10b
push 0
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
lea eax, [esp + 0x14]
push eax
push str.famufinisiban
call dword [sym.imp.KERNEL32.dll_BuildCommDCBA]
mov eax, dword [0x2c1501c]
cmp eax, 0x2f
jne 0x40b12d
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x10]
push edx
push 0
lea eax, [esp + 0x3c]
push eax
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_ReadEventLogA]
call fcn.0040aff0
mov ecx, dword [esp + 0x430]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0040110c
add esp, 0x428
ret
Function at 0x10057360
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
mov edi, edi
push esi
mov esi, dword [sym.imp.kernel32.dll_InterlockedCompareExchange]
push 0xfffffffffffffffe
push 0xfffffffffffffffe
push 0x101b4344
mov dword [ebx], 0
call esi
cmp eax, 0xfffffffe
jne 0x100573ed
push edi
push 0
push 1
push 0x101bab94
call esi
cmp eax, 1
jne 0x100573aa
mov edi, dword [sym.imp.kernel32.dll_Sleep]
push 1
call edi
push 0
push 1
push 0x101bab94
call esi
cmp eax, 1
je 0x10057396
push 0xfffffffffffffffe
push 0xfffffffffffffffe
push 0x101b4344
call esi
mov edi, dword [sym.imp.kernel32.dll_InterlockedExchange]
mov esi, eax
cmp esi, 0xfffffffe
jne 0x100573d7
call dword [sym.imp.kernel32.dll_TlsAlloc]
mov esi, eax
cmp esi, 0xffffffff
je 0x100573d7
push esi
push 0x101b4344
call edi
push 0
push 0x101bab94
call edi
pop edi
cmp esi, 0xffffffff
jne 0x100573ed
mov eax, 0x8007000e
pop esi
ret
mov eax, dword [0x101b4344]
test eax, eax
jl 0x10057411
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x10057411
inc dword [eax + 0x12c]
mov dword [ebx], 1
xor eax, eax
pop esi
ret
push 0x130
call sub.msvcrt.dll_malloc
mov esi, eax
add esp, 4
test esi, esi
je 0x100573e6
push 0x130
push 0
push esi
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [esi + 0x12c], 1
mov dword [ebx], 1
mov eax, dword [0x101b4344]
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
xor eax, eax
pop esi
ret

Function at 0x1005c8c0
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x101b4344]
test eax, eax
jge 0x1005c8cd
xor eax, eax
jmp 0x1005c8d4
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
xor ecx, ecx
lea edx, [eax + 0x24]
lea esp, [esp]
cmp dword [ecx*4 + 0x10020564], edi
jne 0x1005c8ee
cmp dword [edx], 0
jne 0x1005c903
inc ecx
add edx, 8
cmp ecx, 0xf
jb 0x1005c8e0
mov ecx, dword [eax + 0x20]
push 0x10
push edi
call fcn.100bb9d0
ret
mov edx, dword [eax + ecx*8 + 0x24]
test edx, edx
je 0x1005c925
push esi
mov esi, dword [edx]
mov dword [eax + ecx*8 + 0x24], esi
test esi, esi
pop esi
jne 0x1005c91f
mov dword [eax + ecx*8 + 0x28], 0
mov dword [edx], 0xfefefefe
cmp ecx, 0xf
jb 0x1005c936
mov ecx, dword [eax + 0x20]
push 0x10
push edi
call fcn.100bb9d0
ret
mov eax, edx
ret

Function at 0x1005d560
Capabilities:
Get thread local storage value

Disassembly:
test esi, esi
je 0x1005d5b4
mov eax, dword [0x101b4344]
push ebx
push edi
test eax, eax
jge 0x1005d573
xor ebx, ebx
jmp 0x1005d57c
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov ebx, eax
mov edi, dword [esi + 4]
mov eax, dword [edi*4 + 0x10020564]
push eax
push 0xfe
push esi
call sub.msvcrt.dll_memset
lea ecx, [ebx + edi*8 + 0x28]
mov dword [esi], 0
mov eax, dword [ecx]
add esp, 0xc
test eax, eax
je 0x1005d5ac
pop edi
mov dword [eax], esi
mov dword [ecx], esi
pop ebx
ret
mov dword [ebx + edi*8 + 0x24], esi
pop edi
mov dword [ecx], esi
pop ebx
ret
Function at 0x1007a6d0
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebx
xor ebx, ebx
push edi
mov dword [esi + 0x48], ebx
cmp byte [esi + 0x4c], bl
je 0x1007a707
mov edi, dword [esi + 0x40]
cmp edi, ebx
je 0x1007a704
mov eax, dword [0x101b4344]
cmp eax, ebx
jge 0x1007a6f2
xor eax, eax
jmp 0x1007a6f9
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov eax, dword [eax]
push edi
push ebx
push eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov byte [esi + 0x4c], bl
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x38], ebx
cmp byte [esi + 0x3c], bl
je 0x1007a73e
mov edi, dword [esi + 0x30]
cmp edi, ebx
je 0x1007a73b
mov eax, dword [0x101b4344]
cmp eax, ebx
jge 0x1007a729
xor eax, eax
jmp 0x1007a730
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov ecx, dword [eax]
push edi
push ebx
push ecx
call dword [sym.imp.kernel32.dll_HeapFree]
mov byte [esi + 0x3c], bl
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov edx, dword [esi + 0x20]
mov eax, dword [esi + 0x28]
push edx
xor ecx, ecx
call fcn.100bb9d0
mov dword [esi + 0x28], ebx
cmp byte [esi + 0x2c], bl
je 0x1007a783
mov edi, dword [esi + 0x20]
cmp edi, ebx
je 0x1007a780
mov eax, dword [0x101b4344]
cmp eax, ebx
jge 0x1007a76e
xor eax, eax
jmp 0x1007a775
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov eax, dword [eax]
push edi
push ebx
push eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov byte [esi + 0x2c], bl
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov ecx, dword [esi + 0x10]
mov eax, dword [esi + 0x18]
push ecx
xor ecx, ecx
call fcn.100bb9d0
mov dword [esi + 0x18], ebx
cmp byte [esi + 0x1c], bl
je 0x1007a7c8
mov edi, dword [esi + 0x10]
cmp edi, ebx
je 0x1007a7c5
mov eax, dword [0x101b4344]
cmp eax, ebx
jge 0x1007a7b3
xor eax, eax
jmp 0x1007a7ba
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov edx, dword [eax]
push edi
push ebx
push edx
call dword [sym.imp.kernel32.dll_HeapFree]
mov byte [esi + 0x1c], bl
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov eax, dword [esi]
push eax
mov eax, dword [esi + 8]
xor ecx, ecx
call fcn.100bb9d0
mov dword [esi + 8], ebx
cmp byte [esi + 0xc], bl
je 0x1007a80b
mov edi, dword [esi]
cmp edi, ebx
je 0x1007a808
mov eax, dword [0x101b4344]
cmp eax, ebx
jge 0x1007a7f6
xor eax, eax
jmp 0x1007a7fd
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov ecx, dword [eax]
push edi
push ebx
push ecx
call dword [sym.imp.kernel32.dll_HeapFree]
mov byte [esi + 0xc], bl
pop edi
mov dword [esi + 4], ebx
mov dword [esi], ebx
pop ebx
ret
Function at 0x1007a820
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebx
mov ebx, dword [sym.imp.kernel32.dll_HeapFree]
push esi
push edi
mov edi, ecx
mov esi, dword [edi + 0x12654]
mov dword [edi], 0x10035af8
test esi, esi
je 0x1007a859
mov eax, dword [0x101b4344]
test eax, eax
jge 0x1007a84a
xor eax, eax
jmp 0x1007a851
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov eax, dword [eax]
push esi
push 0
push eax
call ebx
mov esi, dword [edi + 0x1266c]
test esi, esi
je 0x1007a87f
mov eax, dword [0x101b4344]
test eax, eax
jge 0x1007a870
xor eax, eax
jmp 0x1007a877
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov ecx, dword [eax]
push esi
push 0
push ecx
call ebx
mov eax, dword [edi + 0x126e0]
test eax, eax
je 0x1007a89b
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
mov dword [edi + 0x126e0], 0
lea esi, [edi + 0x126e4]
call fcn.1007a6d0
mov ecx, edi
pop edi
pop esi
pop ebx
jmp fcn.10120c90

Function at 0x10093170
Capabilities:
Get thread local storage value

Disassembly:
cmp esi, 0xaaaaaaa
jbe 0x1009317b
xor eax, eax
ret
mov eax, dword [0x101b4344]
test eax, eax
jge 0x10093188
xor eax, eax
jmp 0x1009318f
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov edx, dword [eax]
lea ecx, [esi + esi*2]
add ecx, ecx
add ecx, ecx
add ecx, ecx
push ecx
push 0
push edx
call dword [sym.imp.kernel32.dll_HeapAlloc]
ret

Function at 0x10093600
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push esi
mov esi, dword [edi + 4]
test esi, esi
je 0x10093671
mov eax, dword [esi + 0xc]
cmp eax, dword [ebx + 0xc]
jb 0x1009363f
mov eax, dword [0x101b4344]
test eax, eax
jge 0x1009362a
xor eax, eax
mov ecx, dword [eax]
push ebx
push eax
push ecx
call dword [sym.imp.kernel32.dll_HeapFree]
pop esi
ret
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov ecx, dword [eax]
push ebx
push 0
push ecx
call dword [sym.imp.kernel32.dll_HeapFree]
pop esi
ret
test esi, esi
je 0x10093671
mov eax, dword [0x101b4344]
test eax, eax
jge 0x1009365e
xor eax, eax
mov edx, dword [eax]
push esi
push eax
push edx
call dword [sym.imp.kernel32.dll_HeapFree]
mov dword [edi + 4], ebx
pop esi
ret
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov edx, dword [eax]
push esi
push 0
push edx
call dword [sym.imp.kernel32.dll_HeapFree]
mov dword [edi + 4], ebx
pop esi
ret

Function at 0x10094010
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebx
xor ebx, ebx
mov dword [esi + 8], ebx
cmp byte [esi + 0xc], bl
je 0x10094047
push edi
mov edi, dword [esi]
cmp edi, ebx
je 0x10094043
mov eax, dword [0x101b4344]
cmp eax, ebx
jge 0x10094031
xor eax, eax
jmp 0x10094038
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov eax, dword [eax]
push edi
push ebx
push eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov byte [esi + 0xc], bl
pop edi
mov dword [esi + 4], ebx
mov dword [esi], ebx
pop ebx
ret
Function at 0x1009e310
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebx
push esi
mov esi, ecx
mov dword [esi], 0x10036fb0
mov eax, dword [esi + 0x12740]
push eax
mov eax, dword [esi + 0x12748]
xor ecx, ecx
call fcn.100bb9d0
xor ebx, ebx
mov dword [esi + 0x12748], ebx
cmp byte [esi + 0x1274c], bl
je 0x1009e371
push edi
mov edi, dword [esi + 0x12740]
cmp edi, ebx
je 0x1009e36a
mov eax, dword [0x101b4344]
cmp eax, ebx
jge 0x1009e358
xor eax, eax
jmp 0x1009e35f
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov ecx, dword [eax]
push edi
push ebx
push ecx
call dword [sym.imp.kernel32.dll_HeapFree]
mov byte [esi + 0x1274c], bl
pop edi
mov dword [esi + 0x12740], ebx
mov dword [esi + 0x12744], ebx
mov ecx, esi
pop esi
pop ebx
jmp fcn.1007a820

Function at 0x100bb460
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x1c]
push edi
xor edi, edi
cmp esi, edi
je 0x100bb48f
mov eax, dword [0x101b4344]
cmp eax, edi
jge 0x100bb47d
xor eax, eax
jmp 0x100bb484
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov eax, dword [eax]
push esi
push edi
push eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov esi, dword [ebx + 0x20]
mov dword [ebx + 0x1c], edi
cmp esi, edi
je 0x100bb4b8
mov eax, dword [0x101b4344]
cmp eax, edi
jge 0x100bb4a6
xor eax, eax
jmp 0x100bb4ad
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov ecx, dword [eax]
push esi
push edi
push ecx
call dword [sym.imp.kernel32.dll_HeapFree]
mov esi, dword [ebx + 0x24]
mov dword [ebx + 0x20], edi
cmp esi, edi
je 0x100bb4e1
mov eax, dword [0x101b4344]
cmp eax, edi
jge 0x100bb4cf
xor eax, eax
jmp 0x100bb4d6
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov edx, dword [eax]
push esi
push edi
push edx
call dword [sym.imp.kernel32.dll_HeapFree]
mov esi, dword [ebx + 0x2c]
mov dword [ebx + 0x24], edi
cmp esi, edi
je 0x100bb50a
mov eax, dword [0x101b4344]
cmp eax, edi
jge 0x100bb4f8
xor eax, eax
jmp 0x100bb4ff
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov eax, dword [eax]
push esi
push edi
push eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov dword [ebx + 0x2c], edi
lea edi, [ebx + 0x1ac]
call fcn.100c4f40
push 0xd4
push 0
add ebx, 0x1bc
push ebx
call sub.msvcrt.dll_memset
add esp, 0xc
pop edi
pop esi
pop ebx
ret
Function at 0x100bb540
Capabilities:
Get thread local storage value

Disassembly:
mov ecx, dword [ebx + 8]
push esi
xor esi, esi
push edi
cmp ecx, esi
je 0x100bb553
mov eax, dword [ecx]
mov edx, dword [eax]
push 1
call edx
mov edi, dword [ebx + 0x1a8]
mov dword [ebx + 8], esi
cmp edi, esi
je 0x100bb578
call fcn.100d2010
lea esi, [edi + 0x24]
call fcn.100d37e0
push edi
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
add esp, 4
xor esi, esi
mov dword [ebx + 0x1a8], esi
cmp byte [ebx + 0x1a4], 0
mov dword [ebx + 0x1a0], esi
je 0x100bb5bd
mov edi, dword [ebx + 0x198]
cmp edi, esi
je 0x100bb5b6
mov eax, dword [0x101b4344]
cmp eax, esi
jge 0x100bb5a4
xor eax, eax
jmp 0x100bb5ab
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov eax, dword [eax]
push edi
push esi
push eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov byte [ebx + 0x1a4], 0
pop edi
mov dword [ebx + 0x198], esi
mov dword [ebx + 0x19c], esi
mov eax, ebx
pop esi
jmp fcn.100bb460

Function at 0x100bb9d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x100bb9df
pop dword [ebp - 0x38]
mov eax, 0x100bb9df
sub dword [ebp - 0x38], eax
push 0x40
push 0x1000
push 0x6d741
push 0
mov eax, 0x12a061ca
add eax, 0xfd5faec6
add eax, dword [ebp - 0x38]
call dword [eax]
mov ecx, 0x28bdf163
add ecx, 0xd7425993
mov edx, eax
mov esi, 0x101c7a00
add esi, dword [ebp - 0x38]
mov ebx, 0x95c97291
mov dword [ebp - 0x10], 0xfd0804be
mov edi, dword [esi]
xor dword [ebp - 0x34], 0x56a825a
add edi, ebx
xor dword [ebp - 0x34], edi
mov dword [edx], edi
sub dword [ebp - 0x2c], 0xc5d676f1
add edx, 4
add esi, 0x5cfe42a4
sub esi, 0x5cfe42a0
loop 0x100bba2d
add eax, 0x11eab
mov ebx, eax
add eax, 0x60482951
add eax, 0x9fb7d6b4
mov ecx, 0x6d4d9c46
sub ecx, 0x5d4d9c46
add ecx, dword [ebp - 0x38]
call ebx
leave
ret

Function at 0x100d1c00
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebx
push esi
mov esi, eax
xor ebx, ebx
cmp dword [esi + 4], ebx
jbe 0x100d1c2c
push edi
xor edi, edi
mov eax, dword [esi + 0xc]
mov ecx, dword [eax + edi + 0x10]
test ecx, ecx
je 0x100d1c22
push 1
call fcn.100bb9d0
inc ebx
add edi, 0x18
cmp ebx, dword [esi + 4]
jb 0x100d1c10
pop edi
mov esi, dword [esi + 0xc]
test esi, esi
je 0x100d1c5f
mov eax, dword [0x101b4344]
test eax, eax
jge 0x100d1c4c
xor eax, eax
mov ecx, dword [eax]
push esi
push eax
push ecx
call dword [sym.imp.kernel32.dll_HeapFree]
pop esi
pop ebx
ret
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov ecx, dword [eax]
push esi
push 0
push ecx
call dword [sym.imp.kernel32.dll_HeapFree]
pop esi
pop ebx
ret
Function at 0x100d2200
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ecx
push esi
push edi
mov edi, ecx
mov esi, edx
test eax, eax
jne 0x100d225f
lea ecx, [ecx]
cmp dword [eax*4 + 0x10021340], edi
jae 0x100d2221
inc eax
cmp eax, 0x1c
jb 0x100d2210
jmp 0x100d2228
mov edi, dword [eax*4 + 0x10021340]
mov eax, dword [0x101b4344]
test eax, eax
jge 0x100d2235
xor eax, eax
jmp 0x100d223c
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov edx, dword [eax]
lea ecx, [edi*4]
push ecx
push 0
push edx
call dword [sym.imp.kernel32.dll_HeapAlloc]
test eax, eax
jne 0x100d225c
mov eax, 0x8007000e
pop edi
pop esi
pop ecx
ret
mov dword [esi + 0x34], eax
mov ecx, eax
neg ecx
sbb ecx, ecx
and ecx, edi
push ecx
mov ecx, eax
add esi, 0x24
mov eax, edi
call fcn.100bb9d0
pop edi
pop esi
pop ecx
ret
Function at 0x10120c90
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebx
push esi
mov ebx, ecx
mov esi, dword [ebx + 0xa4e0]
push edi
xor edi, edi
mov dword [ebx], 0x1003e170
cmp esi, edi
je 0x10120cc8
mov eax, dword [0x101b4344]
cmp eax, edi
jge 0x10120cb6
xor eax, eax
jmp 0x10120cbd
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov eax, dword [eax]
push esi
push edi
push eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov ecx, dword [ebx + 0xa4ec]
cmp ecx, edi
je 0x10120cda
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
mov ecx, dword [ebx + 0xa4f0]
mov dword [ebx + 0xa4ec], edi
cmp ecx, edi
je 0x10120cf2
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
test byte [ebx + 0xa386], 1
mov dword [ebx + 0xa4f0], edi
jne 0x10120d1f
mov esi, dword [ebx + 0xa4e8]
cmp esi, edi
je 0x10120d19
call fcn.100b9890
push esi
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [ebx + 0xa4e8], edi
cmp byte [ebx + 0xa624], 0
mov dword [ebx + 0xa620], edi
je 0x10120d5e
mov esi, dword [ebx + 0xa618]
cmp esi, edi
je 0x10120d57
mov eax, dword [0x101b4344]
cmp eax, edi
jge 0x10120d45
xor eax, eax
jmp 0x10120d4c
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov ecx, dword [eax]
push esi
push edi
push ecx
call dword [sym.imp.kernel32.dll_HeapFree]
mov byte [ebx + 0xa624], 0
mov dword [ebx + 0xa618], edi
mov dword [ebx + 0xa61c], edi
cmp byte [ebx + 0xa614], 0
mov dword [ebx + 0xa610], edi
je 0x10120da9
mov esi, dword [ebx + 0xa608]
cmp esi, edi
je 0x10120da2
mov eax, dword [0x101b4344]
cmp eax, edi
jge 0x10120d90
xor eax, eax
jmp 0x10120d97
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov edx, dword [eax]
push esi
push edi
push edx
call dword [sym.imp.kernel32.dll_HeapFree]
mov byte [ebx + 0xa614], 0
mov dword [ebx + 0xa608], edi
mov dword [ebx + 0xa60c], edi
cmp byte [ebx + 0xa604], 0
mov dword [ebx + 0xa600], edi
je 0x10120df4
mov esi, dword [ebx + 0xa5f8]
cmp esi, edi
je 0x10120ded
mov eax, dword [0x101b4344]
cmp eax, edi
jge 0x10120ddb
xor eax, eax
jmp 0x10120de2
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov eax, dword [eax]
push esi
push edi
push eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov byte [ebx + 0xa604], 0
mov dword [ebx + 0xa5f8], edi
mov dword [ebx + 0xa5fc], edi
cmp byte [ebx + 0xa5f4], 0
mov dword [ebx + 0xa5f0], edi
je 0x10120e3f
mov esi, dword [ebx + 0xa5e8]
cmp esi, edi
je 0x10120e38
mov eax, dword [0x101b4344]
cmp eax, edi
jge 0x10120e26
xor eax, eax
jmp 0x10120e2d
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov ecx, dword [eax]
push esi
push edi
push ecx
call dword [sym.imp.kernel32.dll_HeapFree]
mov byte [ebx + 0xa5f4], 0
mov dword [ebx + 0xa5e8], edi
mov dword [ebx + 0xa5ec], edi
lea edi, [ebx + 0xa5e8]
mov esi, 0x13
sub edi, 0xc
call fcn.10123f00
sub esi, 1
jns 0x10120e56
pop edi
pop esi
mov ecx, ebx
pop ebx
jmp fcn.10127f00
Function at 0x10124420
Capabilities:
Get thread local storage value

Disassembly:
cmp byte [esi + 0xc], 0
mov dword [esi + 8], 0
je 0x10124459
push edi
mov edi, dword [esi]
test edi, edi
je 0x10124454
mov eax, dword [0x101b4344]
test eax, eax
jge 0x10124441
xor eax, eax
jmp 0x10124448
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov eax, dword [eax]
push edi
push 0
push eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov byte [esi + 0xc], 0
pop edi
push esi
mov dword [esi], 0
mov dword [esi + 4], 0
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
add esp, 4
mov eax, esi
ret

Function at 0x10127c70
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x101b4344]
test eax, eax
jge 0x10127c7d
xor eax, eax
jmp 0x10127c84
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp dword [eax + 0xc], 0
je 0x10127ca9
mov ecx, dword [eax + 0xc]
test ecx, ecx
jne 0x10127c94
xor eax, eax
ret
mov edx, dword [ecx]
mov dword [eax + 0xc], edx
test edx, edx
jne 0x10127ca0
mov dword [eax + 0x10], edx
mov dword [ecx], 0xfefefefe
mov eax, ecx
ret
mov ecx, dword [eax + 8]
push 0x10
push 0x100
call fcn.100bb9d0
ret

Function at 0x10127cc0
Capabilities:
Get thread local storage value

Disassembly:
test esi, esi
je 0x10127d09
mov eax, dword [0x101b4344]
push edi
test eax, eax
jge 0x10127cd2
xor edi, edi
jmp 0x10127cdb
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov edi, eax
push 0x100
push 0xfe
push esi
call sub.msvcrt.dll_memset
mov dword [esi], 0
mov eax, dword [edi + 0x10]
add esp, 0xc
test eax, eax
je 0x10127d02
mov dword [eax], esi
mov dword [edi + 0x10], esi
pop edi
ret
mov dword [edi + 0xc], esi
mov dword [edi + 0x10], esi
pop edi
ret

Function at 0x10131f10
Capabilities:
Get thread local storage value

Disassembly:
cmp word [esi + 0x40], 0
push edi
mov edi, dword [sym.imp.kernel32.dll_TlsGetValue]
je 0x10131f5f
mov eax, dword [0x101b4344]
test eax, eax
jge 0x10131f2b
xor eax, eax
jmp 0x10131f2e
push eax
call edi
movzx ecx, word [esi + 0x40]
cmp ecx, dword [eax + 0x128]
ja 0x10131f56
mov edx, dword [esi + 4]
mov eax, dword [eax + 0x124]
shl ecx, 4
lea eax, [ecx + eax - 0x10]
test edx, edx
je 0x10131f56
mov ecx, dword [eax + 4]
mov dword [edx], ecx
mov dword [eax + 4], edx
xor edx, edx
mov word [esi + 0x40], dx
mov dword [esi + 4], edx
cmp word [esi + 0x42], 0
je 0x10131fa7
mov eax, dword [0x101b4344]
test eax, eax
jge 0x10131f73
xor eax, eax
jmp 0x10131f76
push eax
call edi
movzx ecx, word [esi + 0x42]
cmp ecx, dword [eax + 0x128]
ja 0x10131f9e
mov edx, dword [esi + 0xc]
mov eax, dword [eax + 0x124]
shl ecx, 4
lea eax, [ecx + eax - 0x10]
test edx, edx
je 0x10131f9e
mov ecx, dword [eax + 4]
mov dword [edx], ecx
mov dword [eax + 4], edx
xor edx, edx
mov word [esi + 0x42], dx
mov dword [esi + 0xc], edx
pop edi
ret
Function at 0x10135360
Capabilities:
Get thread local storage value

Disassembly:
test esi, esi
je 0x101353a6
mov eax, dword [0x101b4344]
test eax, eax
jl 0x101353a6
push edi
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov edi, eax
test edi, edi
je 0x101353a5
push 0x44
push 0xfe
push esi
call sub.msvcrt.dll_memset
mov dword [esi], 0
mov eax, dword [edi + 0x1c]
add esp, 0xc
test eax, eax
je 0x1013539f
mov dword [eax], esi
mov dword [edi + 0x1c], esi
pop edi
ret
mov dword [edi + 0x18], esi
mov dword [edi + 0x1c], esi
pop edi
ret