joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6d1060
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x78
mov esi, esp
mov dword [esi + 0x60], ebp
mov dword [esi + 0x64], esp
mov dword [esi + 0x70], 0xffffffff
mov dword [esi + 0x6c], 0x7079b0
lea eax, [esi + 0x68]
mov ecx, dword fs:[0]
mov dword [esi + 0x68], ecx
mov dword fs:[0], eax
mov eax, dword [0x919434]
test eax, eax
je 0x6d11be
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jbe 0x6d10c4
mov ecx, dword [eax]
mov edx, eax
xor edi, edi
add edx, 8
or ecx, dword [eax + 4]
cmovne edi, edx
jne 0x6d11f9
mov eax, dword [0x919434]
test eax, eax
je 0x6d11dd
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x6d11f7
mov edi, eax
test eax, eax
jne 0x6d115a
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x58], 0x919434
movzx eax, byte [0x919aa5]
mov eax, dword [0x919820]
test eax, eax
jne 0x6d1120
call dword [sym.imp.kernel32.dll_GetProcessHeap]
test eax, eax
je 0x6d121b
mov dword [0x919820], eax
push 0x50
push 0
push eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
test eax, eax
je 0x6d121b
mov edi, eax
lea eax, [esi + 0x10]
push 0x50
push eax
push edi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov eax, dword [0x919434]
test eax, eax
je 0x6d120c
dec eax
push edi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov eax, dword [edi]
mov ebx, dword [edi + 4]
mov dword [esi + 0xc], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 8], eax
mov eax, dword [edi + 0x10]
mov dword [edi], 1
mov dword [edi + 4], 0
add edi, 8
mov dword [esi + 4], eax
push 0x40
push 0x8cc570
push edi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
or ebx, dword [esi + 0xc]
je 0x6d11f9
mov edx, dword [esi + 8]
cmp edx, 2
je 0x6d11f9
mov ecx, dword [esi + 4]
lock dec dword [ecx]
sete al
test edx, edx
je 0x6d11b3
test al, al
je 0x6d11f9
call fcn.006c87c0
jmp 0x6d11f9
test al, al
je 0x6d11f9
call fcn.006c92f0
jmp 0x6d11f9
mov ecx, 0x919434
call fcn.00721c80
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
ja 0x6d10af
jmp 0x6d10c4
mov ecx, 0x919434
call fcn.00721c80
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jne 0x6d10e2
xor edi, edi
mov eax, dword [esi + 0x68]
mov dword fs:[0], eax
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, 0x919434
call fcn.00721c80
jmp 0x6d1152
mov ecx, 8
mov edx, 0x50
mov dword [esi + 0x70], 0
call fcn.00709d20
ud2
Function at 0x6d12a0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x7079c0
lea eax, [ebp - 0x18]
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
mov eax, dword [0x919410]
test eax, eax
je 0x6d13f3
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jbe 0x6d12fa
mov esi, eax
mov eax, dword [eax + 4]
add esi, 4
test eax, eax
cmove esi, eax
jne 0x6d142e
mov eax, dword [0x919410]
test eax, eax
je 0x6d1412
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x6d142c
mov esi, eax
test eax, eax
jne 0x6d1387
mov dword [ebp - 0x24], 0x919410
mov dword [ebp - 0x20], 0
movzx eax, byte [0x919aa5]
mov eax, dword [0x919820]
test eax, eax
jne 0x6d134f
call dword [sym.imp.kernel32.dll_GetProcessHeap]
test eax, eax
je 0x6d1461
mov dword [0x919820], eax
push 8
push 0
push eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
test eax, eax
je 0x6d1461
mov dword [eax], 0x919410
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0x919410]
test eax, eax
je 0x6d1441
dec eax
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
movzx eax, byte [0x919aa5]
mov eax, dword [0x919820]
test eax, eax
jne 0x6d13aa
call dword [sym.imp.kernel32.dll_GetProcessHeap]
test eax, eax
je 0x6d1450
mov dword [0x919820], eax
push 0x14
push 0
push eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
test eax, eax
je 0x6d1450
mov dword [eax], 1
mov dword [eax + 4], 1
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
add esi, 4
mov byte [eax + 0x10], 0
mov ecx, dword [esi]
mov dword [esi], eax
test ecx, ecx
je 0x6d142e
lock dec dword [ecx]
jne 0x6d142e
call fcn.0051c200
jmp 0x6d142e
mov ecx, 0x919410
call fcn.00721c80
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
ja 0x6d12e7
jmp 0x6d12fa
mov ecx, 0x919410
call fcn.00721c80
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jne 0x6d1318
xor esi, esi
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, esi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, 0x919410
call fcn.00721c80
jmp 0x6d137f
mov ecx, 4
mov edx, 0x14
call fcn.00709d20
ud2
mov ecx, 4
mov edx, 8
mov dword [ebp - 0x10], 0
call fcn.00709d20
ud2
Function at 0x6d73a0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
mov eax, dword [0x919464]
test eax, eax
je 0x6d73c6
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jbe 0x6d73dc
mov ecx, dword [eax + 4]
add eax, 8
test ecx, ecx
cmove eax, ecx
je 0x6d73dc
pop esi
ret
mov ecx, 0x919464
call fcn.00721c80
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
ja 0x6d73b7
mov eax, dword [0x919464]
test eax, eax
je 0x6d7482
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x6d749c
mov esi, eax
test eax, eax
jne 0x6d7453
movzx eax, byte [0x919aa5]
mov eax, dword [0x919820]
test eax, eax
jne 0x6d7423
call dword [sym.imp.kernel32.dll_GetProcessHeap]
test eax, eax
je 0x6d74ac
mov dword [0x919820], eax
push 0x1c
push 0
push eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
test eax, eax
je 0x6d74ac
mov dword [eax], 0x919464
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0x919464]
test eax, eax
je 0x6d74a0
dec eax
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov dword [esi + 4], 1
lea eax, [esi + 8]
mov dword [esi + 0xc], 0
mov dword [esi + 8], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x18], 0
pop esi
ret
mov ecx, 0x919464
call fcn.00721c80
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jne 0x6d73fa
xor eax, eax
pop esi
ret
mov ecx, 0x919464
call fcn.00721c80
jmp 0x6d744b
mov ecx, 4
mov edx, 0x1c
call fcn.00709d20
ud2

Function at 0x6d74c0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
mov eax, dword [0x919478]
test eax, eax
je 0x6d74e6
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jbe 0x6d74fc
mov ecx, dword [eax + 4]
add eax, 8
test ecx, ecx
cmove eax, ecx
je 0x6d74fc
pop esi
ret
mov ecx, 0x919478
call fcn.00721c80
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
ja 0x6d74d7
mov eax, dword [0x919478]
test eax, eax
je 0x6d757a
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x6d7590
mov esi, eax
test eax, eax
jne 0x6d7567
movzx eax, byte [0x919aa5]
mov eax, dword [0x919820]
test eax, eax
jne 0x6d7537
call dword [sym.imp.kernel32.dll_GetProcessHeap]
test eax, eax
je 0x6d75a0
mov dword [0x919820], eax
push 0xc
push 0
push eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
test eax, eax
je 0x6d75a0
mov dword [eax], 0x919478
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0x919478]
test eax, eax
je 0x6d7594
dec eax
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov dword [esi + 4], 1
lea eax, [esi + 8]
mov dword [esi + 8], 0
pop esi
ret
mov ecx, 0x919478
call fcn.00721c80
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jne 0x6d7512
xor eax, eax
pop esi
ret
mov ecx, 0x919478
call fcn.00721c80
jmp 0x6d755f
mov ecx, 4
mov edx, 0xc
call fcn.00709d20
ud2
Function at 0x6d75c0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
mov eax, dword [0x919488]
test eax, eax
je 0x6d75ec
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jbe 0x6d7602
mov edx, dword [eax]
mov esi, eax
mov ecx, eax
xor eax, eax
add esi, 8
or edx, dword [ecx + 4]
cmovne eax, esi
je 0x6d7602
pop esi
ret
mov ecx, 0x919488
call fcn.00721c80
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
ja 0x6d75d7
mov eax, dword [0x919488]
test eax, eax
je 0x6d769a
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x6d76b4
mov esi, eax
test eax, eax
jne 0x6d7680
movzx eax, byte [0x919aa5]
mov eax, dword [0x919820]
test eax, eax
jne 0x6d7649
call dword [sym.imp.kernel32.dll_GetProcessHeap]
test eax, eax
je 0x6d76c4
mov dword [0x919820], eax
push 0x20
push 0
push eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
test eax, eax
je 0x6d76c4
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 0x18], 0x919488
mov esi, eax
mov eax, dword [0x919488]
test eax, eax
je 0x6d76b8
dec eax
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
movaps xmm0, xmmword [0x725c60]
lea eax, [esi + 8]
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov byte [esi + 0x14], 3
pop esi
ret
mov ecx, 0x919488
call fcn.00721c80
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jne 0x6d7620
xor eax, eax
pop esi
ret
mov ecx, 0x919488
call fcn.00721c80
jmp 0x6d7678
mov ecx, 8
mov edx, 0x20
call fcn.00709d20
ud2
Function at 0x6d7aa0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x34
mov eax, dword [esp + 0x4c]
mov esi, ecx
cmp dword [eax], 0
je 0x6d7b5a
cmp dword [eax + 0x1c], 0
je 0x6d7b5a
cmp dword [eax + 0x24], 0
je 0x6d7b5a
cmp dword [eax + 4], 3
jb 0x6d7b5a
mov ebx, dword [esp + 0x48]
mov ecx, dword [eax + 0x20]
mov edi, edx
xor edx, edx
cmp ecx, ebx
cmovbe edx, edi
ja 0x6d7b5a
mov ebp, dword [eax + 0x28]
cmp ecx, 0xfffffffd
mov dword [esp + 0x28], edx
mov dword [esp + 0x2c], ebx
ja 0x6d7b5a
lea eax, [ecx + 2]
cmp eax, ebx
ja 0x6d7b5a
mov dword [esp + 0x30], eax
movzx eax, word [edx + ecx]
lea ecx, [esp + 0x14]
rol ax, 8
movzx edx, ax
lea eax, [esp + 0x28]
push eax
call fcn.006e6490
add esp, 4
movzx eax, byte [esp + 0x24]
test al, al
je 0x6d7b5a
movzx ecx, word [esp + 0x25]
mov byte [esp + 3], al
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x1c]
mov word [esp + 4], cx
movzx ecx, byte [esp + 0x27]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x18]
mov byte [esp + 6], cl
xor ecx, ecx
cmp ebp, ebx
cmova edi, ecx
mov ecx, dword [esp + 0x20]
jbe 0x6d7b68
mov dword [esi], 5
add esp, 0x34
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [esp + 8], edx
mov edx, ebp
mov dword [esp + 0xc], eax
inc edx
je 0x6d7b5a
cmp edx, ebx
ja 0x6d7b5a
movzx ebp, byte [edi + ebp]
cmp ebp, 3
je 0x6d7b9c
test ebp, ebp
jne 0x6d7b5a
movzx eax, word [esp + 0x50]
mov ebp, edx
add ebp, eax
jb 0x6d7b5a
cmp ebp, ebx
mov ebp, 0
jbe 0x6d7ba5
jmp 0x6d7b5a
sub ebx, edx
mov ebp, 1
mov eax, ebx
add edi, edx
movzx edx, word [esp + 4]
mov word [esi + 0x21], dx
movzx edx, byte [esp + 6]
mov byte [esi + 0x23], dl
mov edx, dword [esp + 0x10]
mov dword [esi], 4
mov dword [esi + 4], ebp
mov dword [esi + 8], edi
mov dword [esi + 0xc], eax
mov edi, dword [esp + 0xc]
mov dword [esi + 0x10], edx
mov edx, dword [esp + 8]
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edx
mov dword [esi + 0x1c], ecx
movzx ecx, byte [esp + 3]
mov byte [esi + 0x20], cl
jmp 0x6d7b60
Function at 0x6e6900
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push edi
push esi
movzx ebx, byte [ecx + 3]
mov esi, dword [esp + 0x10]
movzx edi, word [ecx]
test ebx, ebx
je 0x6e6920
xor eax, eax
cmp edi, esi
cmova edx, eax
jbe 0x6e695c
jmp 0x6e69b5
cmp edi, esi
jae 0x6e697b
movzx eax, byte [edx + edi]
inc edi
mov ebx, 1
mov word [ecx], di
mov ah, al
and ah, 0x3f
inc ah
test al, 0x40
mov byte [ecx + 2], ah
sete ah
xor ah, 3
test al, al
movzx eax, ah
cmovns ebx, eax
mov byte [ecx + 3], bl
push esi
call fcn.006e6900
add esp, 4
movaps xmm1, xmm0
jmp 0x6e69b5
cmp ebx, 1
je 0x6e697f
cmp ebx, 3
jne 0x6e698e
lea ebx, [edi + 2]
cmp ebx, esi
mov word [ecx], bx
ja 0x6e69b5
movzx eax, word [edx + edi]
rol ax, 8
cwde
jmp 0x6e699c
xor eax, eax
jmp 0x6e69b5
xorps xmm1, xmm1
dec byte [ecx + 2]
mov eax, 1
jne 0x6e69b5
jmp 0x6e69b1
lea ebx, [edi + 1]
cmp edi, esi
mov word [ecx], bx
jae 0x6e69b5
movsx eax, byte [edx + edi]
xorps xmm1, xmm1
cvtsi2ss xmm1, eax
mulss xmm1, xmm0
dec byte [ecx + 2]
mov eax, 1
jne 0x6e69b5
mov byte [ecx + 3], 0
movaps xmm0, xmm1
pop esi
pop edi
pop ebx
ret
Function at 0x6eb820
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
mov esi, dword [esp + 0x34]
cmp esi, 2
jb 0x6eb928
cmp esi, 4
jb 0x6eb928
movzx eax, word [edx]
cmp eax, 0x100
jne 0x6eb928
cmp esi, 6
jb 0x6eb928
movzx eax, word [edx + 4]
mov edi, esi
rol ax, 8
movzx eax, ax
sub edi, eax
jb 0x6eb928
cmp edi, 2
jb 0x6eb928
add eax, edx
movzx ebx, word [eax]
rol bx, 8
movzx ebx, bx
add ebx, ebx
lea ebp, [ebx + ebx*2 + 2]
cmp ebp, edi
ja 0x6eb928
cmp esi, 8
mov dword [esp + 0x1c], ebx
jb 0x6eb928
movzx ebp, word [edx + 6]
mov ebx, esi
rol bp, 8
movzx ebp, bp
sub ebx, ebp
jb 0x6eb928
cmp ebx, 2
jb 0x6eb928
add ebp, edx
mov dword [esp + 0xc], ebp
mov ebp, dword [esp + 0xc]
movzx ebp, word [ebp]
rol bp, 8
movzx ebp, bp
add ebp, ebp
mov dword [esp + 0x18], ebp
lea ebp, [ebp + ebp*2 + 2]
cmp ebp, ebx
ja 0x6eb928
cmp esi, 0xa
mov dword [esp + 0x14], ebx
jb 0x6eb928
movzx ebp, word [edx + 8]
rol bp, 8
movzx ebp, bp
cmp ebp, esi
ja 0x6eb928
mov ebx, esi
sub ebx, ebp
cmp ebx, 2
jb 0x6eb928
add ebp, edx
mov dword [esp + 8], ebp
mov ebp, dword [esp + 8]
movzx ebp, word [ebp]
rol bp, 8
movzx ebp, bp
mov dword [esp + 0x10], ebp
lea ebp, [ebp + ebp + 2]
cmp ebp, ebx
ja 0x6eb928
cmp word [edx + 2], 0
mov dword [esp + 4], 0
je 0x6eb97c
cmp esi, 0xe
jae 0x6eb936
mov dword [ecx], 0
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
mov ebp, dword [edx + 0xa]
test ebp, ebp
je 0x6eb97c
bswap ebp
cmp ebp, esi
ja 0x6eb97c
sub esi, ebp
cmp esi, 2
jb 0x6eb97c
add edx, ebp
movzx ebp, word [edx]
cmp ebp, 0x100
jne 0x6eb97c
cmp esi, 8
jb 0x6eb97c
mov ebp, dword [edx + 4]
bswap ebp
mov dword [esp], ebp
lea ebp, [ebp*8 + 7]
cmp ebp, esi
jae 0x6eb97c
shl dword [esp], 3
lea ebp, [edx + 8]
mov dword [esp + 4], edx
jmp 0x6eb97c
mov edx, dword [esp + 4]
mov dword [ecx + 0x30], edx
mov dword [ecx + 0x34], esi
mov edx, dword [esp]
mov esi, dword [esp + 8]
mov dword [ecx + 0x38], ebp
mov dword [ecx + 0x3c], edx
lea edx, [esi + 2]
mov dword [ecx + 0x24], ebx
mov dword [ecx + 0x28], edx
mov edx, dword [esp + 0x10]
add edx, edx
mov dword [ecx + 0x2c], edx
mov dword [ecx], eax
add eax, 2
mov dword [ecx + 4], edi
mov edx, dword [esp + 0x14]
mov dword [ecx + 8], eax
mov eax, dword [esp + 0x1c]
lea eax, [eax + eax*2]
mov dword [ecx + 0xc], eax
mov eax, dword [esp + 0xc]
mov dword [ecx + 0x10], eax
add eax, 2
mov dword [ecx + 0x14], edx
mov dword [ecx + 0x18], eax
mov eax, dword [esp + 0x18]
lea eax, [eax + eax*2]
mov dword [ecx + 0x1c], eax
mov dword [ecx + 0x20], esi
jmp 0x6eb92e
Function at 0x6f9950
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x707c60
lea eax, [ebp - 0x18]
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
mov eax, dword [0x9194a4]
test eax, eax
je 0x6f9a52
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jbe 0x6f99aa
mov edi, eax
mov eax, dword [eax + 4]
add edi, 8
test eax, eax
cmove edi, eax
jne 0x6f9a8d
mov eax, dword [0x9194a4]
test eax, eax
je 0x6f9a71
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x6f9a8b
mov esi, eax
test eax, eax
jne 0x6f9a29
movzx eax, byte [0x919aa5]
mov eax, dword [0x919820]
test eax, eax
jne 0x6f99f1
call dword [sym.imp.kernel32.dll_GetProcessHeap]
test eax, eax
je 0x6f9aaf
mov dword [0x919820], eax
push 0xc
push 0
push eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
test eax, eax
je 0x6f9aaf
mov dword [eax], 0x9194a4
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0x9194a4]
test eax, eax
je 0x6f9aa0
dec eax
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
push 2
push 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
cmp dword [esi + 4], 0
lea edi, [esi + 8]
mov dword [esi + 4], 1
mov dword [esi + 8], 0
je 0x6f9a8d
call dword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x6f9a8d
mov ecx, 0x9194a4
call fcn.00721c80
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
ja 0x6f9997
jmp 0x6f99aa
mov ecx, 0x9194a4
call fcn.00721c80
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jne 0x6f99c8
xor edi, edi
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, 0x9194a4
call fcn.00721c80
jmp 0x6f9a21
mov ecx, 4
mov edx, 0xc
mov dword [ebp - 0x10], 0
call fcn.00709d20
ud2
Function at 0x6fc370
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov ebx, edx
mov esi, ecx
call fcn.006f9950
test eax, eax
je 0x6fc3ef
mov eax, dword [0x9194c4]
test eax, eax
je 0x6fc3b9
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jbe 0x6fc3cf
cmp dword [eax + 4], 0
mov edi, eax
je 0x6fc3cf
mov eax, dword [edi + 8]
test eax, eax
mov dword [esp + 4], eax
jne 0x6fc4c6
add edi, 8
jmp 0x6fc495
mov ecx, 0x9194c4
call fcn.00721c80
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
ja 0x6fc39a
mov eax, dword [0x9194c4]
test eax, eax
je 0x6fc410
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x6fc425
mov ebp, eax
cmp eax, 1
jne 0x6fc47c
mov eax, esp
mov ecx, 0x8f7944
mov edx, 0x46
push 0x8f79dc
push 0x8f7914
push eax
call fcn.0070a360
add esp, 0xc
ud2
mov ecx, 0x9194c4
call fcn.00721c80
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
jne 0x6fc3e4
movzx eax, byte [0x919aa5]
mov eax, dword [0x919820]
test eax, eax
jne 0x6fc448
call dword [sym.imp.kernel32.dll_GetProcessHeap]
test eax, eax
je 0x6fc4e9
mov dword [0x919820], eax
push 0xc
push 0
push eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
test eax, eax
je 0x6fc4e9
mov dword [eax], 0x9194c4
mov dword [eax + 4], 0
mov ebp, eax
mov eax, dword [0x9194c4]
test eax, eax
je 0x6fc4dd
dec eax
push ebp
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov dword [ebp + 4], 1
mov dword [ebp + 8], 0
lea edi, [ebp + 8]
mov dword [esp + 4], 0
lea eax, [esp + 4]
push eax
push 0x8f79fc
push 0x17
push 0
push 0x8f79ec
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jne 0x6fc4d5
mov eax, dword [esp + 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
test eax, eax
jne 0x6fc4d5
mov eax, dword [esp + 4]
mov dword [edi], eax
mov dword [esp + 4], eax
movzx edx, bl
mov ecx, dword [eax]
push edx
push esi
push eax
call dword [ecx + 0x20]
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, 0x9194c4
call fcn.00721c80
jmp 0x6fc474
mov ecx, 4
mov edx, 0xc
call fcn.00709d20
ud2
Function at 0x6fc500
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov ebx, edx
mov esi, ecx
call fcn.006f9950
test eax, eax
je 0x6fc57f
mov eax, dword [0x9194b4]
test eax, eax
je 0x6fc549
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jbe 0x6fc55f
cmp dword [eax + 4], 0
mov edi, eax
je 0x6fc55f
mov eax, dword [edi + 8]
test eax, eax
mov dword [esp + 4], eax
jne 0x6fc656
add edi, 8
jmp 0x6fc625
mov ecx, 0x9194b4
call fcn.00721c80
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
ja 0x6fc52a
mov eax, dword [0x9194b4]
test eax, eax
je 0x6fc5a0
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x6fc5b5
mov ebp, eax
cmp eax, 1
jne 0x6fc60c
mov eax, esp
mov ecx, 0x8f7944
mov edx, 0x46
push 0x8f79dc
push 0x8f7914
push eax
call fcn.0070a360
add esp, 0xc
ud2
mov ecx, 0x9194b4
call fcn.00721c80
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
jne 0x6fc574
movzx eax, byte [0x919aa5]
mov eax, dword [0x919820]
test eax, eax
jne 0x6fc5d8
call dword [sym.imp.kernel32.dll_GetProcessHeap]
test eax, eax
je 0x6fc679
mov dword [0x919820], eax
push 0xc
push 0
push eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
test eax, eax
je 0x6fc679
mov dword [eax], 0x9194b4
mov dword [eax + 4], 0
mov ebp, eax
mov eax, dword [0x9194b4]
test eax, eax
je 0x6fc66d
dec eax
push ebp
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov dword [ebp + 4], 1
mov dword [ebp + 8], 0
lea edi, [ebp + 8]
mov dword [esp + 4], 0
lea eax, [esp + 4]
push eax
push 0x8f7a0c
push 0x17
push 0
push 0x8f79ec
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jne 0x6fc665
mov eax, dword [esp + 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
test eax, eax
jne 0x6fc665
mov eax, dword [esp + 4]
mov dword [edi], eax
mov dword [esp + 4], eax
movzx edx, bl
mov ecx, dword [eax]
push esi
push eax
call dword [ecx + edx*4 + 0x10]
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, 0x9194b4
call fcn.00721c80
jmp 0x6fc604
mov ecx, 4
mov edx, 0xc
call fcn.00709d20
ud2
Function at 0x6fd140
Capabilities:
Log keystrokes via input method manager

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x707cd0
mov ebx, ecx
mov edi, dword [ebp + 8]
mov esi, edx
lea eax, [ebp - 0x18]
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
push 0
push 0
push edi
push edx
call dword [sym.imp.imm32.dll_ImmGetCompositionStringW]
test eax, eax
je 0x6fd1f4
js 0x6fd20a
mov dword [ebp - 0x28], ebx
mov ecx, eax
movzx eax, byte [0x919aa5]
mov eax, dword [0x919820]
test eax, eax
jne 0x6fd1b6
mov ebx, ecx
call dword [sym.imp.kernel32.dll_GetProcessHeap]
test eax, eax
je 0x6fd23a
mov ecx, ebx
mov dword [0x919820], eax
push ecx
push 0
push eax
mov ebx, ecx
call dword [sym.imp.kernel32.dll_HeapAlloc]
test eax, eax
je 0x6fd23a
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x24], ebx
push ebx
mov dword [ebp - 0x20], eax
push eax
push edi
push esi
call dword [sym.imp.imm32.dll_ImmGetCompositionStringW]
mov ecx, dword [ebp - 0x28]
test eax, eax
js 0x6fd212
mov edx, dword [ebp - 0x20]
mov esi, dword [ebp - 0x24]
mov dword [ecx], edx
mov dword [ecx + 4], esi
mov dword [ecx + 8], eax
jmp 0x6fd229
mov dword [ebx], 1
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
jmp 0x6fd229
mov dword [ebx], 0
jmp 0x6fd229
mov dword [ecx], 0
push dword [ebp - 0x20]
push 0
push dword [0x919820]
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, 1
mov edx, ebx
call fcn.00709d20
ud2
Function at 0x7089cc
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
test eax, eax
je 0x708a0b
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x708a0b
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x708a0b
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x708a0b
cmp dword [ecx + 0x74], 0xe
jbe 0x708a0b
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret