joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10052a70
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
sub eax, 0x10000
push eax
call fcn.10052c40
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jbe 0x10052b4d
mov edx, dword [ebp - 4]
cmp edx, dword [section..data]
jb 0x10052aba
mov eax, dword [ebp - 4]
cmp eax, dword [0x10064004]
ja 0x10052aba
mov ecx, dword [ebp - 4]
sub ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x10052a8a
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call sub.KERNEL32.dll_VirtualQuery
test eax, eax
jne 0x10052adf
jmp 0x10052b4d
cmp dword [ebp - 0x14], 0x10000
jne 0x10052b33
cmp dword [ebp - 0x18], 0x10000
jb 0x10052b33
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call sub.KERNEL32.dll_VirtualAlloc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10052b16
mov eax, dword [ebp - 8]
jmp 0x10052b4f
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x677
jne 0x10052b26
xor eax, eax
jmp 0x10052b4f
mov eax, dword [ebp - 4]
sub eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x10052b48
mov ecx, dword [ebp - 0x20]
sub ecx, 0x10000
push ecx
call fcn.10052c40
add esp, 4
mov dword [ebp - 4], eax
jmp 0x10052a8a
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x10052b60
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push eax
call fcn.10052c70
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x10052c35
mov edx, dword [ebp - 4]
cmp edx, dword [section..data]
jb 0x10052ba5
mov eax, dword [ebp - 4]
cmp eax, dword [0x10064004]
ja 0x10052ba5
mov ecx, dword [ebp - 4]
add ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x10052b75
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call sub.KERNEL32.dll_VirtualQuery
test eax, eax
jne 0x10052bca
jmp 0x10052c35
cmp dword [ebp - 0x14], 0x10000
jne 0x10052c1e
cmp dword [ebp - 0x18], 0x10000
jb 0x10052c1e
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call sub.KERNEL32.dll_VirtualAlloc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10052c01
mov eax, dword [ebp - 8]
jmp 0x10052c37
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x677
jne 0x10052c11
xor eax, eax
jmp 0x10052c37
mov eax, dword [ebp - 4]
add eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x10052c30
mov ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 0x18]
push ecx
call fcn.10052c70
add esp, 4
mov dword [ebp - 4], eax
jmp 0x10052b75
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10052ca0
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.10053090
add esp, 0xc
mov dword [ebp - 4], 0
cmp dword [0x100a9124], 0
jne 0x10052cdd
cmp dword [0x100a9120], 0
je 0x10052cdd
mov eax, dword [0x100a9120]
mov dword [0x100a9124], eax
cmp dword [0x100a9124], 0
je 0x10052d5a
mov ecx, dword [0x100a9124]
cmp dword [ecx + 8], 0
je 0x10052d5a
mov edx, dword [0x100a9124]
mov eax, dword [edx + 8]
cmp eax, dword [ebp - 0x10]
jb 0x10052d5a
mov ecx, dword [0x100a9124]
mov edx, dword [ecx + 8]
cmp edx, dword [ebp - 0xc]
ja 0x10052d5a
mov eax, dword [0x100a9124]
mov ecx, dword [eax + 8]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
cmp edx, dword [ebp - 0x10]
jb 0x10052d29
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0xc]
jbe 0x10052d30
xor eax, eax
jmp 0x10052e79
mov ecx, dword [0x100a9124]
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x40]
mov dword [ecx + 8], eax
push 0x48
push 0xcc
mov ecx, dword [ebp - 4]
push ecx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov eax, dword [ebp - 4]
jmp 0x10052e79
mov edx, dword [0x100a9120]
mov dword [0x100a9124], edx
jmp 0x10052d76
mov eax, dword [0x100a9124]
mov ecx, dword [eax + 4]
mov dword [0x100a9124], ecx
cmp dword [0x100a9124], 0
je 0x10052db6
cmp dword [0x100a9124], 0
je 0x10052db4
mov edx, dword [0x100a9124]
cmp dword [edx + 8], 0
je 0x10052db4
mov eax, dword [0x100a9124]
mov ecx, dword [eax + 8]
cmp ecx, dword [ebp - 0x10]
jb 0x10052db4
mov edx, dword [0x100a9124]
mov eax, dword [edx + 8]
cmp eax, dword [ebp - 0xc]
ja 0x10052db4
jmp 0x10052d0e
jmp 0x10052d68
mov ecx, dword [ebp + 8]
and ecx, 0xffff
mov edx, dword [ebp + 8]
sub edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.10052e80
add esp, 0xc
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x10052e77
mov eax, dword [ebp - 0x18]
mov dword [0x100a9124], eax
mov ecx, dword [0x100a9124]
mov dword [ecx], 0x52727464
mov edx, dword [0x100a9124]
mov dword [edx + 8], 0
mov eax, dword [0x100a9124]
mov ecx, dword [0x100a9120]
mov dword [eax + 4], ecx
mov edx, dword [0x100a9124]
mov dword [0x100a9120], edx
mov dword [ebp - 0x14], 0
mov eax, dword [0x100a9124]
add eax, 0x48
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0x38c
jmp 0x10052e47
mov ecx, dword [ebp - 8]
sub ecx, 1
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 1
jle 0x10052e67
imul edx, dword [ebp - 8], 0x48
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x14]
mov dword [eax + edx + 0x40], ecx
imul edx, dword [ebp - 8], 0x48
add edx, dword [ebp - 4]
mov dword [ebp - 0x14], edx
jmp 0x10052e3e
mov eax, dword [0x100a9124]
mov ecx, dword [ebp - 0x14]
mov dword [eax + 8], ecx
jmp 0x10052d0e
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10053bc0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x100a9120]
mov dword [ebp - 4], eax
jmp 0x10053bd9
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
je 0x10053c00
lea eax, [ebp - 8]
push eax
push 0x40
push 0x10000
mov ecx, dword [ebp - 4]
push ecx
call sub.KERNEL32.dll_VirtualProtect
test eax, eax
jne 0x10053bfe
call sub.KERNEL32.dll_GetLastError
jmp 0x10053c02
jmp 0x10053bd0
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x100540a0
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [0x100a9130], eax
je 0x100540bd
mov eax, 0x10dd
jmp 0x100541a0
mov eax, dword [0x100a9140]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1005413c
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x14]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
movzx eax, byte [edx + 0x36]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
push edx
call sub.KERNEL32.dll_VirtualProtect
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
jne 0x10054118
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x10], 0
je 0x10054118
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
push eax
call fcn.10053120
add esp, 4
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 0xc], ecx
push 0x18
mov edx, dword [ebp - 0xc]
push edx
call fcn.100555f2
add esp, 8
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
jmp 0x100540c5
mov dword [0x100a9140], 0
call fcn.10053a00
mov ecx, dword [0x100a913c]
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
je 0x1005418a
mov edx, dword [ebp - 8]
mov eax, dword [edx + 4]
push eax
call sub.KERNEL32.dll_ResumeThread
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
push 8
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.100555f2
add esp, 8
mov edx, dword [ebp - 0x18]
mov dword [ebp - 8], edx
jmp 0x10054154
mov dword [0x100a913c], 0
mov dword [0x100a9130], 0
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x10054680
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x100a9134], 0
je 0x10054699
mov eax, dword [0x100a9134]
jmp 0x10054738
call sub.KERNEL32.dll_GetCurrentThread
cmp dword [ebp + 8], eax
jne 0x100546aa
xor eax, eax
jmp 0x10054738
push 8
call fcn.100555c2
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10054702
mov dword [ebp - 8], 8
cmp dword [ebp - 4], 0
je 0x100546eb
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x10], ecx
push 8
mov edx, dword [ebp - 0x10]
push edx
call fcn.100555f2
add esp, 8
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov dword [0x100a9134], eax
mov dword [0x100a9138], 0
mov eax, dword [ebp - 8]
jmp 0x10054738
mov ecx, dword [ebp + 8]
push ecx
call sub.KERNEL32.dll_SuspendThread
cmp eax, 0xffffffff
jne 0x1005471a
call sub.KERNEL32.dll_GetLastError
mov dword [ebp - 8], eax
jmp 0x100546ca
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov dword [edx + 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [0x100a913c]
mov dword [ecx], edx
mov eax, dword [ebp - 4]
mov dword [0x100a913c], eax
xor eax, eax
mov esp, ebp
pop ebp
ret 4
Function at 0x10003b3b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x10003b4a
pop dword [ebp - 0x20]
mov eax, 0xcee0490c
sub eax, 0xbee00dc2
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0xc3932ffb
sub dword [ebp - 0x30], 0x7540eab0
mov dword [ebp - 0x2c], 0x7d6ecbd2
sub dword [ebp - 0x2c], 0x4b3b7f8d
mov dword [ebp - 0x28], 0x2673d195
sub dword [ebp - 0x28], 0xda278d67
mov dword [ebp - 0x24], 0x6d82016e
add dword [ebp - 0x24], 0x927dfe92
lea eax, [ebp - 0x30]
push eax
mov eax, 0x9c853f8
add eax, 0x637fc4c
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0xa3d3fb09
add dword [ebp - 0x30], 0xd09e6e4d
mov dword [ebp - 0x2c], 0xd5e89696
add dword [ebp - 0x2c], 0x6b83cadf
mov dword [ebp - 0x28], 0x7a6a31d6
sub dword [ebp - 0x28], 0x16fac56a
mov dword [ebp - 0x24], 0x9ee1ee2
add dword [ebp - 0x24], 0xf611e11e
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, 0x2343f48d
sub eax, 0x1343a43d
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x36c92
push 0
call eax
mov ecx, 0x4801
mov edi, eax
mov ebx, 0xc0055a74
sub ebx, 0xb004c274
add ebx, dword [ebp - 0x20]
mov esi, 0xbe5fb5aa
mov dword [ebp - 0x1c], 0xa85cd916
mov edx, dword [ebx]
xor dword [ebp - 0x10], 0xfd826745
add edx, esi
add dword [ebp - 0x1c], 0xcd4b473f
mov dword [edi], edx
xor dword [ebp - 0x14], ecx
add edi, 0x2ec1d238
add edi, 0xd13e2dcc
add ebx, 4
loop 0x10003c60
add eax, 0x68dc4cd5
add eax, 0x9724c602
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 0x20]
call ebx
leave
ret
Function at 0x40b468
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x416408]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00406147
mov dword [ebp - 0x14], eax
cmp dword [0x4561d4], esi
jne 0x40b55b
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40b4e8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40b63b
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40b63b
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40b63b
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x4561d4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x4561d8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x4561dc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4561e4], eax
test eax, eax
je 0x40b558
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4561e0], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40b580
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40b573
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40b595
push 4
pop eax
jmp 0x40b63d
cmp dword [ebp - 0x14], esi
je 0x40b595
push dword [0x4561d4]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40b57a
mov eax, dword [0x4561e0]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40b5f3
cmp dword [0x4561e4], edi
je 0x40b5f3
push eax
call ebx
push dword [0x4561e4]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40b5f3
test eax, eax
je 0x40b5f3
call ecx
test eax, eax
je 0x40b5e8
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40b5e8
test byte [ebp - 8], 1
jne 0x40b5f3
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40b623
mov eax, dword [0x4561d8]
cmp eax, edi
je 0x40b620
push eax
call ebx
test eax, eax
je 0x40b620
call eax
mov esi, eax
test esi, esi
je 0x40b620
mov eax, dword [0x4561dc]
cmp eax, edi
je 0x40b620
push eax
call ebx
test eax, eax
je 0x40b620
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x4561d4]
call ebx
test eax, eax
je 0x40b63b
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40b63d
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00403ac6
mov esp, ebp
pop ebp
ret
Function at 0x100a4820
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
mov edi, edi
push esi
mov esi, dword [sym.imp.kernel32.dll_InterlockedCompareExchange]
push 0xfffffffffffffffe
push 0xfffffffffffffffe
push 0x101e316c
mov dword [ebx], 0
call esi
cmp eax, 0xfffffffe
jne 0x100a48ad
push edi
push 0
push 1
push 0x101e8a94
call esi
cmp eax, 1
jne 0x100a486a
mov edi, dword [sym.imp.kernel32.dll_Sleep]
push 1
call edi
push 0
push 1
push 0x101e8a94
call esi
cmp eax, 1
je 0x100a4856
push 0xfffffffffffffffe
push 0xfffffffffffffffe
push 0x101e316c
call esi
mov edi, dword [sym.imp.kernel32.dll_InterlockedExchange]
mov esi, eax
cmp esi, 0xfffffffe
jne 0x100a4897
call dword [sym.imp.kernel32.dll_TlsAlloc]
mov esi, eax
cmp esi, 0xffffffff
je 0x100a4897
push esi
push 0x101e316c
call edi
push 0
push 0x101e8a94
call edi
pop edi
cmp esi, 0xffffffff
jne 0x100a48ad
mov eax, 0x8007000e
pop esi
ret
mov eax, dword [0x101e316c]
test eax, eax
jl 0x100a48d1
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x100a48d1
inc dword [eax + 0x12c]
mov dword [ebx], 1
xor eax, eax
pop esi
ret
push 0x130
call sub.msvcrt.dll_malloc
mov esi, eax
add esp, 4
test esi, esi
je 0x100a48a6
push 0x130
push 0
push esi
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [esi + 0x12c], 1
mov dword [ebx], 1
mov eax, dword [0x101e316c]
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
xor eax, eax
pop esi
ret

Function at 0x100a9db0
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x101e316c]
test eax, eax
jge 0x100a9dbd
xor eax, eax
jmp 0x100a9dc4
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
xor ecx, ecx
lea edx, [eax + 0x24]
lea esp, [esp]
cmp dword [ecx*4 + 0x10053234], edi
jne 0x100a9dde
cmp dword [edx], 0
jne 0x100a9df3
inc ecx
add edx, 8
cmp ecx, 0xf
jb 0x100a9dd0
mov ecx, dword [eax + 0x20]
push 0x10
push edi
call fcn.101d14b0
ret
mov edx, dword [eax + ecx*8 + 0x24]
test edx, edx
je 0x100a9e15
push esi
mov esi, dword [edx]
mov dword [eax + ecx*8 + 0x24], esi
test esi, esi
pop esi
jne 0x100a9e0f
mov dword [eax + ecx*8 + 0x28], 0
mov dword [edx], 0xfefefefe
cmp ecx, 0xf
jb 0x100a9e26
mov ecx, dword [eax + 0x20]
push 0x10
push edi
call fcn.101d14b0
ret
mov eax, edx
ret

Function at 0x100aaa70
Capabilities:
Get thread local storage value

Disassembly:
test esi, esi
je 0x100aaac4
mov eax, dword [0x101e316c]
push ebx
push edi
test eax, eax
jge 0x100aaa83
xor ebx, ebx
jmp 0x100aaa8c
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov ebx, eax
mov edi, dword [esi + 4]
mov eax, dword [edi*4 + 0x10053234]
push eax
push 0xfe
push esi
call sub.msvcrt.dll_memset
lea ecx, [ebx + edi*8 + 0x28]
mov dword [esi], 0
mov eax, dword [ecx]
add esp, 0xc
test eax, eax
je 0x100aaabc
pop edi
mov dword [eax], esi
mov dword [ecx], esi
pop ebx
ret
mov dword [ebx + edi*8 + 0x24], esi
pop edi
mov dword [ecx], esi
pop ebx
ret
Function at 0x100da4b0
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebx
xor ebx, ebx
mov dword [esi + 8], ebx
cmp byte [esi + 0xc], bl
je 0x100da4e7
push edi
mov edi, dword [esi]
cmp edi, ebx
je 0x100da4e3
mov eax, dword [0x101e316c]
cmp eax, ebx
jge 0x100da4d1
xor eax, eax
jmp 0x100da4d8
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov eax, dword [eax]
push edi
push ebx
push eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov byte [esi + 0xc], bl
pop edi
mov dword [esi + 4], ebx
mov dword [esi], ebx
pop ebx
ret

Function at 0x100daa10
Capabilities:
Get thread local storage value

Disassembly:
cmp esi, 0xaaaaaaa
jbe 0x100daa1b
xor eax, eax
ret
mov eax, dword [0x101e316c]
test eax, eax
jge 0x100daa28
xor eax, eax
jmp 0x100daa2f
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov edx, dword [eax]
lea ecx, [esi + esi*2]
add ecx, ecx
add ecx, ecx
add ecx, ecx
push ecx
push 0
push edx
call dword [sym.imp.kernel32.dll_HeapAlloc]
ret

Function at 0x100dae50
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x101e316c]
test eax, eax
jge 0x100dae5d
xor eax, eax
jmp 0x100dae64
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov edx, dword [eax]
lea ecx, [esi + esi*2]
add ecx, ecx
add ecx, ecx
add ecx, ecx
push ecx
push 0
push edx
call dword [sym.imp.kernel32.dll_HeapAlloc]
ret

Function at 0x100daed0
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push esi
mov esi, dword [edi + 4]
test esi, esi
je 0x100daf41
mov eax, dword [esi + 0xc]
cmp eax, dword [ebx + 0xc]
jb 0x100daf0f
mov eax, dword [0x101e316c]
test eax, eax
jge 0x100daefa
xor eax, eax
mov ecx, dword [eax]
push ebx
push eax
push ecx
call dword [sym.imp.kernel32.dll_HeapFree]
pop esi
ret
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov ecx, dword [eax]
push ebx
push 0
push ecx
call dword [sym.imp.kernel32.dll_HeapFree]
pop esi
ret
test esi, esi
je 0x100daf41
mov eax, dword [0x101e316c]
test eax, eax
jge 0x100daf2e
xor eax, eax
mov edx, dword [eax]
push esi
push eax
push edx
call dword [sym.imp.kernel32.dll_HeapFree]
mov dword [edi + 4], ebx
pop esi
ret
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov edx, dword [eax]
push esi
push 0
push edx
call dword [sym.imp.kernel32.dll_HeapFree]
mov dword [edi + 4], ebx
pop esi
ret
Function at 0x10101cd0
Capabilities:
Get thread local storage value

Disassembly:
mov ecx, dword [ebx + 8]
push esi
xor esi, esi
push edi
cmp ecx, esi
je 0x10101ce3
mov eax, dword [ecx]
mov edx, dword [eax]
push 1
call edx
mov edi, dword [ebx + 0x1a4]
mov dword [ebx + 8], esi
cmp edi, esi
je 0x10101d08
call fcn.10117760
lea esi, [edi + 0x28]
call fcn.10118ed0
push edi
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
add esp, 4
xor esi, esi
mov dword [ebx + 0x1a4], esi
cmp byte [ebx + 0x1a0], 0
mov dword [ebx + 0x19c], esi
je 0x10101d4d
mov edi, dword [ebx + 0x194]
cmp edi, esi
je 0x10101d46
mov eax, dword [0x101e316c]
cmp eax, esi
jge 0x10101d34
xor eax, eax
jmp 0x10101d3b
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov eax, dword [eax]
push edi
push esi
push eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov byte [ebx + 0x1a0], 0
mov dword [ebx + 0x194], esi
mov dword [ebx + 0x198], esi
mov esi, ebx
call fcn.10101be0
pop edi
pop esi
ret

Function at 0x10117350
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebx
push esi
mov esi, eax
xor ebx, ebx
cmp dword [esi + 4], ebx
jbe 0x1011737c
push edi
xor edi, edi
mov eax, dword [esi + 0xc]
mov ecx, dword [eax + edi + 0x10]
test ecx, ecx
je 0x10117372
push 1
call fcn.101d14b0
inc ebx
add edi, 0x18
cmp ebx, dword [esi + 4]
jb 0x10117360
pop edi
mov esi, dword [esi + 0xc]
test esi, esi
je 0x101173af
mov eax, dword [0x101e316c]
test eax, eax
jge 0x1011739c
xor eax, eax
mov ecx, dword [eax]
push esi
push eax
push ecx
call dword [sym.imp.kernel32.dll_HeapFree]
pop esi
pop ebx
ret
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov ecx, dword [eax]
push esi
push 0
push ecx
call dword [sym.imp.kernel32.dll_HeapFree]
pop esi
pop ebx
ret

Function at 0x10117950
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ecx
push esi
push edi
mov edi, ecx
mov esi, edx
test eax, eax
jne 0x101179af
lea ecx, [ecx]
cmp dword [eax*4 + 0x1006ea30], edi
jae 0x10117971
inc eax
cmp eax, 0x1c
jb 0x10117960
jmp 0x10117978
mov edi, dword [eax*4 + 0x1006ea30]
mov eax, dword [0x101e316c]
test eax, eax
jge 0x10117985
xor eax, eax
jmp 0x1011798c
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov edx, dword [eax]
lea ecx, [edi*4]
push ecx
push 0
push edx
call dword [sym.imp.kernel32.dll_HeapAlloc]
test eax, eax
jne 0x101179ac
mov eax, 0x8007000e
pop edi
pop esi
pop ecx
ret
mov dword [esi + 0x38], eax
mov ecx, eax
neg ecx
sbb ecx, ecx
and ecx, edi
push ecx
mov ecx, eax
add esi, 0x28
mov eax, edi
call fcn.101d14b0
pop edi
pop esi
pop ecx
ret