joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5bdefc
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp byte [ebp + 0xc], 0
push ebx
push esi
mov esi, ecx
jne 0x5bdf76
cmp byte [ebp + 8], 0
jne 0x5bdf76
xor ebx, ebx
test byte [esi + 0x32], 2
je 0x5bdf6d
test byte [esi + 0x7d], 0x40
je 0x5bdf2d
cmp dword [esi + 0x3c], ebx
je 0x5bdf2d
xor eax, eax
inc eax
jmp 0x5be075
push 1
call fcn.005c3778
mov eax, dword [esi + 0x3c]
cmp eax, ebx
je 0x5bdf6d
mov dword [ebp - 8], eax
push 4
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 0x10], 0x10
mov dword [ebp - 0xc], 0x83ff
call fcn.005f9d8d
mov ecx, dword [esi + 4]
cmp ecx, ebx
je 0x5be073
push esi
call fcn.005bc4f5
jmp 0x5be073
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x1c]
jmp 0x5bdf78
xor ebx, ebx
push edi
mov edi, dword [esi + 4]
cmp edi, ebx
je 0x5bdf9b
mov ecx, esi
call fcn.005fffbe
mov eax, dword [edi]
push esi
mov ecx, edi
call dword [eax + 0x2c]
jmp 0x5bdf9b
mov ecx, dword [esi + 8]
push ebx
push ebx
call fcn.005bdefc
cmp dword [esi + 8], ebx
jne 0x5bdf91
lea ecx, [esi + 0x14]
call fcn.005b6ac6
mov ecx, dword [esi + 0x2c]
cmp ecx, ebx
je 0x5bdfbd
test byte [esi + 0x32], 0x40
jne 0x5bdfba
call fcn.005f74a6
mov dword [esi + 0x2c], ebx
call fcn.005adeb4
mov edi, eax
cmp edi, ebx
je 0x5be03f
cmp dword [edi], ebx
jle 0x5be03f
test byte [esi + 0x32], 2
je 0x5bdfea
push 1
push ebx
push esi
lea ecx, [edi + 0x64]
call fcn.005b889e
push 1
push ebx
push esi
lea ecx, [edi + 0x58]
call fcn.005b889e
mov eax, dword [esi + 0x1c]
or ecx, 0xffffffff
cmp eax, ecx
je 0x5bdffd
mov edx, dword [edi + 0x10]
mov dword [edx + eax*8], ebx
mov dword [esi + 0x1c], ecx
mov eax, dword [esi + 0x20]
cmp eax, ecx
je 0x5be00d
mov edx, dword [edi + 0x20]
mov dword [edx + eax*8], ebx
mov dword [esi + 0x20], ecx
mov eax, dword [esi + 0x24]
cmp eax, ecx
je 0x5be03f
cmp eax, dword [edi + 0x78]
jl 0x5be03b
imul eax, eax, 0x1c
add eax, dword [edi + 0x30]
mov ebx, eax
cmp byte [ebx], 0
jne 0x5be02d
mov ecx, ebx
call fcn.005b896a
mov eax, dword [ebx + 0x18]
and dword [ebx + 4], 0
cmp eax, dword [edi + 0x78]
jge 0x5be019
xor ebx, ebx
or dword [esi + 0x24], 0xffffffff
or byte [esi + 0x32], 0x20
mov al, byte [esi + 0x32]
test al, 8
pop edi
jne 0x5be06e
mov ecx, dword [esi + 0x28]
cmp ecx, ebx
je 0x5be065
test byte [ecx + 0xc], 4
jne 0x5be06e
cmp ecx, ebx
je 0x5be065
push ecx
call fcn.006443dd
mov dword [esi + 0x28], ebx
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x20]
jmp 0x5be073
or al, 0x10
mov byte [esi + 0x32], al
xor eax, eax
pop esi
pop ebx
leave
ret 8
Function at 0x5c96cf
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x72acfc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x60], ebx
push edi
jne 0x5c9736
push 0x105
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x107
lea eax, [ebp - 0x214]
push eax
push 0x451bf0
call fcn.00596332
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea eax, [ebp - 0x214]
push eax
call edi
cmp eax, ebx
mov dword [esi + 0x60], eax
jne 0x5c9736
push 0x451bdc
call edi
mov dword [esi + 0x60], eax
mov esi, dword [esi + 0x60]
cmp esi, ebx
mov edi, dword [sym.imp.USER32.dll_LoadCursorW]
je 0x5c976c
mov eax, dword [ebp + 8]
sub eax, ebx
je 0x5c975e
dec eax
dec eax
je 0x5c975a
dec eax
je 0x5c9756
push 2
pop eax
jmp 0x5c9761
push 4
jmp 0x5c9753
push 3
jmp 0x5c9753
xor eax, eax
inc eax
movzx eax, ax
push eax
push esi
call edi
cmp eax, ebx
jne 0x5c9780
cmp dword [ebp + 8], ebx
je 0x5c9778
push 0x7f00
jmp 0x5c977d
push 0x7f88
push ebx
call edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0066d880
leave
ret 4

Function at 0x5cfd15
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
push 0
lea ecx, [esi + 0x94]
call fcn.005ae441
mov ecx, esi
pop esi
jmp fcn.005cf8f0

Function at 0x5cfded
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
mov eax, dword [0x72acfc]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
mov eax, dword [esi + 0x9c]
test eax, eax
je 0x5cff13
test byte [esi + 0x32], 4
jne 0x5cff13
test byte [esi + 0xc4], 8
je 0x5cff13
push ebx
push edi
push eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov edi, eax
cmp edi, 0x40
lea ebx, [ebp - 0x84]
jb 0x5cfe50
push 2
push edi
call fcn.005b6a8b
mov ebx, eax
test ebx, ebx
je 0x5cff11
test edi, edi
jle 0x5cfe65
inc edi
push edi
push ebx
push dword [esi + 0x9c]
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x5cfe69
and word [ebx], 0
lea eax, [ebp - 0x8c]
push eax
mov ecx, esi
call fcn.005a9eed
mov edi, eax
test edi, edi
jne 0x5cfe82
mov edi, 0x40322c
push edi
push ebx
call fcn.00595e63
test eax, eax
je 0x5cfef6
push edi
push dword [esi + 0x9c]
call dword [sym.imp.USER32.dll_SetWindowTextW]
push esi
call fcn.005cfbc6
mov esi, eax
xor edi, edi
cmp esi, edi
je 0x5cfef6
mov eax, dword [0x7199b0]
movzx ecx, byte [eax + 4]
push edi
and ecx, 3
push ecx
push eax
mov ecx, esi
mov dword [ebp - 0x88], edi
call fcn.005ba335
push eax
lea ecx, [ebp - 0x88]
call fcn.005a598e
push dword [ebp - 0x88]
call fcn.005a5944
test al, al
jne 0x5cfee7
push edi
mov ecx, esi
call fcn.005d206c
mov ecx, dword [ebp - 0x88]
cmp ecx, edi
je 0x5cfef6
call sym.osetup.dll_public:_void___thiscall_NetUI::BaseValue::Release_void_
mov ecx, dword [ebp - 0x8c]
call sym.osetup.dll_public:_void___thiscall_NetUI::BaseValue::Release_void_
lea eax, [ebp - 0x84]
cmp ebx, eax
je 0x5cff11
push ebx
call sym.osetup.dll_void___stdcall_NetUI::HFree_void__
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0066d880
leave
ret
Function at 0x5da7c5
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
mov ebx, ecx
mov ecx, dword [ebx + 0xd0]
test ecx, ecx
je 0x5da7e8
cmp dword [ecx + 0xb8], 0
jne 0x5da7e8
xor eax, eax
jmp 0x5da873
push esi
xor esi, esi
push edi
mov edi, dword [ebp + 8]
inc esi
cmp dword [edi + 4], 0x100
mov eax, esi
jne 0x5da868
test ecx, ecx
je 0x5da811
cmp dword [ecx + 0x7c], 0
je 0x5da811
mov eax, ecx
mov eax, dword [eax + 0x7c]
mov ecx, dword [eax]
push edi
push eax
call dword [ecx + 0x14]
cmp dword [edi + 8], 9
jne 0x5da868
test eax, eax
je 0x5da868
push 8
pop ecx
xor eax, eax
lea edi, [ebp - 0x20]
rep stosd dword es:[edi], eax
and dword [ebp - 0x18], eax
mov dword [ebp - 0x14], esi
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x10
mov word [ebp - 8], 9
mov dword [ebp - 0x10], 2
mov dword [ebp - 0x20], ebx
call esi
test ax, ax
jns 0x5da84e
or dword [ebp - 0xc], 0xc
push 0x11
call esi
test ax, ax
jns 0x5da85b
or dword [ebp - 0xc], 3
lea eax, [ebp - 0x20]
push eax
mov ecx, ebx
call fcn.005c354f
xor eax, eax
xor ecx, ecx
test eax, eax
sete cl
pop edi
pop esi
mov eax, ecx
pop ebx
leave
ret 4
Function at 0x5ee5f1
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0x14]
xor ebx, ebx
cmp edi, ebx
je 0x5ee602
mov dword [edi], ebx
push dword [0x71e8c0]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
cmp esi, ebx
jne 0x5ee6ba
mov esi, dword [ebp + 8]
cmp esi, ebx
jne 0x5ee69e
mov eax, dword [ebp + 0x10]
sub eax, ebx
je 0x5ee62c
dec eax
je 0x5ee648
dec eax
jne 0x5ee641
push 8
push ebx
push dword [0x72dca4]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
cmp esi, ebx
jne 0x5ee64c
mov eax, 0x8007000e
jmp 0x5ee6c2
push 0x10
jmp 0x5ee62e
mov eax, dword [ebp + 0x10]
sub eax, ebx
mov edi, 0x80004005
je 0x5ee65e
dec eax
je 0x5ee67c
dec eax
jne 0x5ee671
mov dword [esi + 4], 1
mov dword [esi], 0x458388
xor edi, edi
cmp edi, ebx
jge 0x5ee6aa
mov ecx, esi
call fcn.005ee461
mov eax, edi
jmp 0x5ee6c2
push dword [ebp + 0xc]
and dword [esi + 0xc], 0xfffffffc
mov ecx, esi
mov dword [esi + 4], 1
mov dword [esi], 0x45836c
mov dword [esi + 8], ebx
call fcn.005ee2c0
mov edi, eax
jmp 0x5ee66d
xor ecx, ecx
lea eax, [esi + 4]
inc ecx
lock xadd dword [eax], ecx
jmp 0x5ee6ad
mov edi, dword [ebp + 0x14]
push esi
push dword [0x71e8c0]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
cmp edi, ebx
je 0x5ee6c0
mov dword [edi], esi
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 0x10

Function at 0x5f2b01
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push dword [ebp + 0xc]
mov esi, ecx
push dword [ebp + 8]
lea ecx, [ebp - 8]
call fcn.005f20bb
push 0xffffffffffffffff
push 0x2e
lea ecx, [ebp - 8]
call fcn.005bfb63
cmp eax, 0xffffffff
jne 0x5f2b34
lea ecx, [ebp - 8]
call fcn.005bf7ec
xor al, al
jmp 0x5f2b67
push ebx
mov ecx, esi
call fcn.005f2a78
xor ebx, ebx
cmp eax, ebx
je 0x5f2b6c
cmp word [eax], bx
je 0x5f2b6c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0xffffffffffffffff
push eax
call fcn.005fe677
test eax, eax
jge 0x5f2b8a
lea ecx, [ebp - 8]
call fcn.005bf7ec
xor al, al
pop ebx
pop esi
leave
ret 0xc
push dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push dword [ebp + 8]
call fcn.005bff1c
test eax, eax
jge 0x5f2b8a
lea ecx, [ebp - 8]
call fcn.005bf7ec
mov al, bl
jmp 0x5f2b66
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
cmp eax, ebx
jne 0x5f2b98
mov eax, 0x40322c
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x5f2b7e
test al, 0x10
jne 0x5f2b7e
mov bl, 1
jmp 0x5f2b7e

Function at 0x5f890a
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x72acfc]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x114
lea eax, [ebp - 0x118]
push 0
push eax
call fcn.0066e181
add esp, 0xc
lea eax, [ebp - 0x118]
push eax
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
xor eax, eax
inc eax
cmp dword [ebp - 0x114], 5
ja 0x5f8962
jne 0x5f8960
cmp dword [ebp - 0x110], eax
jae 0x5f8962
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0066d880
leave
ret
Function at 0x5f9618
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push edi
push dword [0x728f98]
xor edi, edi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, edi
je 0x5f9639
mov eax, dword [eax + 0x16c]
jmp 0x5f963b
xor eax, eax
cmp eax, edi
jne 0x5f964c
push 0x80040014
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x5f969a
push eax
push edi
push edi
lea ecx, [ebp - 0xc]
mov dword [ebp - 0xc], edi
call fcn.0063ab78
test eax, eax
jne 0x5f966b
push 0x80070057
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x5f9692
push esi
mov esi, dword [ebp + 0xc]
cmp esi, edi
je 0x5f9686
mov ecx, dword [ebp + 8]
cmp ecx, edi
je 0x5f9686
mov eax, dword [ecx]
call dword [eax + 0xc]
xor edi, edi
mov dword [esi], eax
inc edi
jmp 0x5f9691
push 0x80070057
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop esi
lea ecx, [ebp - 0xc]
call fcn.0063ab31
mov eax, edi
pop edi
leave
ret 8

Function at 0x5f96a1
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push edi
push dword [0x728f98]
xor ebx, ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, ebx
je 0x5f96c6
mov edi, dword [eax + 0x16c]
jmp 0x5f96c8
xor edi, edi
cmp edi, ebx
jne 0x5f96d9
push 0x80040014
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x5f9749
push edi
push ebx
push ebx
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x10], ebx
call fcn.0063ab78
test eax, eax
je 0x5f9736
push esi
mov esi, dword [ebp + 8]
cmp esi, ebx
je 0x5f9705
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x14]
shr eax, 2
test al, 1
je 0x5f9705
mov ecx, esi
jmp 0x5f9707
xor ecx, ecx
cmp ecx, ebx
pop esi
je 0x5f9736
cmp edi, dword [ecx + 8]
je 0x5f9718
push 0x8004001e
jmp 0x5f973b
cmp dword [ebp + 0xc], ebx
je 0x5f9736
cmp dword [ebp + 0x10], ebx
je 0x5f9736
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.0063bf8d
mov dword [ebp - 4], 1
jmp 0x5f9741
push 0x80070057
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea ecx, [ebp - 0x10]
call fcn.0063ab31
mov eax, dword [ebp - 4]
pop edi
pop ebx
leave
ret 0xc
Function at 0x5f9752
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
and dword [ebp - 4], 0
push edi
push dword [0x728f98]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x5f9775
mov edi, dword [eax + 0x16c]
jmp 0x5f9777
xor edi, edi
test edi, edi
jne 0x5f9788
push 0x80040014
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x5f9801
and dword [ebp - 0x10], 0
push edi
push 0
push 0
lea ecx, [ebp - 0x10]
call fcn.0063ab78
test eax, eax
jne 0x5f97aa
push 0x80070057
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x5f97f9
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x5f97c4
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x14]
shr eax, 2
test al, 1
je 0x5f97c4
mov ecx, esi
jmp 0x5f97c6
xor ecx, ecx
test ecx, ecx
je 0x5f97ed
cmp edi, dword [ecx + 8]
je 0x5f97d6
push 0x8004001e
jmp 0x5f97f2
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x5f97ed
call fcn.0063bfba
fstp dword [esi]
mov dword [ebp - 4], 1
jmp 0x5f97f8
push 0x80070057
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop esi
lea ecx, [ebp - 0x10]
call fcn.0063ab31
mov eax, dword [ebp - 4]
pop edi
leave
ret 8

Function at 0x5f9809
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
and dword [ebp - 4], 0
push edi
push dword [0x728f98]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x5f982c
mov edi, dword [eax + 0x16c]
jmp 0x5f982e
xor edi, edi
test edi, edi
jne 0x5f9842
push 0x80040014
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x5f98df
and dword [ebp - 0x10], 0
push edi
push 0
push 0
lea ecx, [ebp - 0x10]
call fcn.0063ab78
test eax, eax
jne 0x5f9864
push 0x80070057
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x5f98d7
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x5f987e
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x14]
shr eax, 2
test al, 1
je 0x5f987e
mov ecx, esi
jmp 0x5f9880
xor ecx, ecx
test ecx, ecx
je 0x5f98cb
cmp edi, dword [ecx + 8]
je 0x5f9890
push 0x8004001e
jmp 0x5f98d0
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x5f98cb
cmp dword [eax], 0x14
jne 0x5f98cb
mov edx, dword [eax + 4]
mov esi, edx
and esi, 7
cmp esi, edx
jne 0x5f98cb
test byte [ecx + 0x38], 8
jne 0x5f98b5
push 0x8004003c
jmp 0x5f98d0
push eax
call fcn.0063c9e9
test eax, eax
jl 0x5f98c8
mov dword [ebp - 4], 1
jmp 0x5f98d6
push eax
jmp 0x5f98d0
push 0x80070057
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop esi
lea ecx, [ebp - 0x10]
call fcn.0063ab31
mov eax, dword [ebp - 4]
pop edi
leave
ret 8
Function at 0x5f98e7
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push edi
push dword [0x728f98]
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, ebx
je 0x5f9909
mov edi, dword [eax + 0x16c]
jmp 0x5f990b
xor edi, edi
cmp edi, ebx
jne 0x5f991f
push 0x80040014
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x5f99b6
push edi
push ebx
push 1
lea ecx, [ebp - 0xc]
mov dword [ebp - 0xc], ebx
call fcn.0063ab78
test eax, eax
jne 0x5f993f
push 0x80070057
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x5f99ae
push esi
mov esi, dword [ebp + 8]
cmp esi, ebx
je 0x5f9959
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x14]
shr eax, 2
test al, 1
je 0x5f9959
mov ecx, esi
jmp 0x5f995b
xor ecx, ecx
test ecx, ecx
je 0x5f99a2
cmp edi, dword [ecx + 8]
je 0x5f996b
push 0x8004001e
jmp 0x5f99a7
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x5f99a2
cmp dword [eax], 0x14
jne 0x5f99a2
mov edx, dword [eax + 4]
mov esi, edx
and esi, 7
cmp esi, edx
jne 0x5f99a2
test byte [ecx + 0x38], 8
jne 0x5f9990
push 0x8004003c
jmp 0x5f99a7
push eax
call fcn.0063ca13
test eax, eax
jl 0x5f999f
xor ebx, ebx
inc ebx
jmp 0x5f99ad
push eax
jmp 0x5f99a7
push 0x80070057
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop esi
lea ecx, [ebp - 0xc]
call fcn.0063ab31
pop edi
mov eax, ebx
pop ebx
leave
ret 8

Function at 0x5f99be
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
and dword [ebp - 4], 0
push edi
push dword [0x728f98]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x5f99e1
mov edi, dword [eax + 0x16c]
jmp 0x5f99e3
xor edi, edi
test edi, edi
jne 0x5f99f4
push 0x80040014
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x5f9a61
and dword [ebp - 0x10], 0
push edi
push 0
push 0
lea ecx, [ebp - 0x10]
call fcn.0063ab78
test eax, eax
jne 0x5f9a10
push 0x80070057
jmp 0x5f9a53
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x5f9a2a
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x14]
shr eax, 2
test al, 1
je 0x5f9a2a
mov ecx, esi
jmp 0x5f9a2c
xor ecx, ecx
test ecx, ecx
pop esi
je 0x5f9a09
cmp edi, dword [ecx + 8]
je 0x5f9a3d
push 0x8004001e
jmp 0x5f9a53
push dword [ebp + 0xc]
call fcn.0063ca53
test eax, eax
jl 0x5f9a52
mov dword [ebp - 4], 1
jmp 0x5f9a59
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea ecx, [ebp - 0x10]
call fcn.0063ab31
mov eax, dword [ebp - 4]
pop edi
leave
ret 8
Function at 0x5f9a69
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push edi
push dword [0x728f98]
xor ebx, ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, ebx
je 0x5f9a8e
mov edi, dword [eax + 0x16c]
jmp 0x5f9a90
xor edi, edi
cmp edi, ebx
jne 0x5f9aa4
push 0x80040014
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x5f9b26
push edi
push ebx
push ebx
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x10], ebx
call fcn.0063ab78
test eax, eax
je 0x5f9b13
mov eax, dword [ebp + 0x10]
and eax, 0x11c
cmp eax, dword [ebp + 0x10]
jne 0x5f9b13
push esi
mov esi, dword [ebp + 8]
cmp esi, ebx
je 0x5f9add
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x14]
shr eax, 2
test al, 1
je 0x5f9add
mov ecx, esi
jmp 0x5f9adf
xor ecx, ecx
cmp ecx, ebx
pop esi
je 0x5f9b13
cmp edi, dword [ecx + 8]
je 0x5f9af0
push 0x8004001e
jmp 0x5f9b18
cmp dword [ebp + 0xc], ebx
je 0x5f9b13
mov eax, dword [ebp + 0x10]
shr eax, 8
test al, 1
jne 0x5f9b1e
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.0063c5df
mov dword [ebp - 4], 1
jmp 0x5f9b1e
push 0x80070057
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea ecx, [ebp - 0x10]
call fcn.0063ab31
mov eax, dword [ebp - 4]
pop edi
pop ebx
leave
ret 0xc

Function at 0x5f9b2f
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
and dword [ebp - 4], 0
push edi
push dword [0x728f98]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x5f9b52
mov edi, dword [eax + 0x16c]
jmp 0x5f9b54
xor edi, edi
test edi, edi
jne 0x5f9b68
push 0x80040014
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x5f9bfa
and dword [ebp - 0x10], 0
push edi
push 0
push 0
lea ecx, [ebp - 0x10]
call fcn.0063ab78
test eax, eax
jne 0x5f9b8a
push 0x80070057
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x5f9bf2
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x5f9ba4
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x14]
shr eax, 2
test al, 1
je 0x5f9ba4
mov ecx, esi
jmp 0x5f9ba6
xor ecx, ecx
test ecx, ecx
je 0x5f9be6
test dword [ecx + 0x38], 0x100000
je 0x5f9bf1
cmp edi, dword [ecx + 8]
je 0x5f9bbf
push 0x8004001e
jmp 0x5f9beb
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x5f9be6
cmp dword [eax], 0x18
jne 0x5f9be6
mov edx, dword [eax + 4]
mov esi, edx
and esi, 0xf
cmp esi, edx
jne 0x5f9be6
push eax
call fcn.0063db6b
mov dword [ebp - 4], 1
jmp 0x5f9bf1
push 0x80070057
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop esi
lea ecx, [ebp - 0x10]
call fcn.0063ab31
mov eax, dword [ebp - 4]
pop edi
leave
ret 8
Function at 0x5f9c02
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
push dword [0x728f98]
xor esi, esi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, esi
je 0x5f9c27
mov edi, dword [eax + 0x16c]
jmp 0x5f9c29
xor edi, edi
cmp edi, esi
jne 0x5f9c3d
push 0x80040014
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x5f9cdc
push ebx
push edi
xor ebx, ebx
push esi
inc ebx
push ebx
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x10], esi
call fcn.0063ab78
test eax, eax
je 0x5f9cc8
mov esi, dword [ebp + 8]
test esi, esi
je 0x5f9c6c
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x14]
shr eax, 2
test bl, al
je 0x5f9c6c
mov ecx, esi
jmp 0x5f9c6e
xor ecx, ecx
test ecx, ecx
je 0x5f9cc8
test dword [ecx + 0x38], 0x100000
je 0x5f9cd3
cmp edi, dword [ecx + 8]
je 0x5f9c87
push 0x8004001e
jmp 0x5f9ccd
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x5f9cc8
cmp dword [eax], 0x18
jne 0x5f9cc8
mov edx, dword [eax + 4]
mov esi, edx
and esi, 0xf
cmp esi, edx
jne 0x5f9cc8
mov edx, dword [eax + 8]
mov esi, edx
and esi, 3
cmp esi, edx
jne 0x5f9cc8
cmp dword [eax + 0xc], ebx
ja 0x5f9cc8
cmp dword [eax + 0x10], 2
ja 0x5f9cc8
push eax
call fcn.0063e20f
test eax, eax
jl 0x5f9cc5
mov dword [ebp - 4], ebx
jmp 0x5f9cd3
push eax
jmp 0x5f9ccd
push 0x80070057
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea ecx, [ebp - 0x10]
call fcn.0063ab31
pop ebx
mov eax, dword [ebp - 4]
pop edi
pop esi
leave
ret 8

Function at 0x5f9ce5
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x5f9d82
mov esi, dword [edi + 8]
test esi, esi
je 0x5f9d82
cmp dword [edi + 4], 0x8000
jl 0x5f9d82
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x14]
mov dword [ebp + 8], eax
shr eax, 1
test al, 1
je 0x5f9d82
push dword [0x728f98]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x5f9d31
mov ecx, dword [eax + 0x16c]
jmp 0x5f9d33
xor ecx, ecx
cmp byte [ecx + 0x17], 0
mov eax, dword [esi + 8]
jne 0x5f9d82
cmp byte [eax + 0x17], 0
jne 0x5f9d82
cmp ecx, eax
jne 0x5f9d6f
test byte [ebp + 0xc], 1
lea ecx, [esi + 0xc]
je 0x5f9d64
mov eax, dword [ebp + 8]
shr eax, 2
test al, 1
je 0x5f9d64
push 0
push edi
push esi
call fcn.0063b3b9
jmp 0x5f9d87
push 0
push edi
push esi
call fcn.0063b26f
jmp 0x5f9d87
push dword [ebp + 0xc]
mov eax, dword [eax + 0x20]
mov ecx, dword [ecx + 0x20]
push esi
push edi
push eax
call fcn.005f9491
jmp 0x5f9d87
mov eax, 0x80070057
pop edi
pop esi
pop ebp
ret 8
Function at 0x5f9f3b
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push dword [0x728f98]
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, ebx
je 0x5f9f5d
mov esi, dword [eax + 0x16c]
jmp 0x5f9f5f
xor esi, esi
cmp esi, ebx
jne 0x5f9f70
push 0x80040014
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x5f9fcd
push esi
push ebx
push ebx
lea ecx, [ebp - 0xc]
mov dword [ebp - 0xc], ebx
call fcn.0063ab78
test eax, eax
jne 0x5f9f8f
push 0x80070057
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x5f9fc5
push edi
mov edi, dword [ebp + 8]
cmp edi, ebx
je 0x5f9fa9
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x14]
shr eax, 2
test al, 1
je 0x5f9fa9
mov eax, edi
jmp 0x5f9fab
xor eax, eax
test eax, eax
pop edi
je 0x5f9f82
cmp esi, dword [eax + 8]
je 0x5f9fbc
push 0x8004001e
jmp 0x5f9f87
mov ebx, dword [eax + 0x38]
and ebx, 0xfffff
lea ecx, [ebp - 0xc]
call fcn.0063ab31
pop esi
mov eax, ebx
pop ebx
leave
ret 4

Function at 0x5fa000
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push edi
push dword [0x728f98]
xor ebx, ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, ebx
je 0x5fa025
mov edi, dword [eax + 0x16c]
jmp 0x5fa027
xor edi, edi
cmp edi, ebx
jne 0x5fa038
push 0x80040014
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x5fa0a0
push edi
push ebx
push ebx
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x10], ebx
call fcn.0063ab78
test eax, eax
je 0x5fa08d
push esi
mov esi, dword [ebp + 8]
cmp esi, ebx
je 0x5fa064
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x14]
shr eax, 2
test al, 1
je 0x5fa064
mov ecx, esi
jmp 0x5fa066
xor ecx, ecx
cmp ecx, ebx
pop esi
je 0x5fa08d
cmp edi, dword [ecx + 8]
je 0x5fa077
push 0x8004001e
jmp 0x5fa092
cmp dword [ebp + 0xc], ebx
je 0x5fa08d
push dword [ebp + 0xc]
call fcn.0063e648
mov dword [ebp - 4], 1
jmp 0x5fa098
push 0x80070057
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea ecx, [ebp - 0x10]
call fcn.0063ab31
mov eax, dword [ebp - 4]
pop edi
pop ebx
leave
ret 8