joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10264c7d
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push edi
push dword [0x1039deb8]
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, ebx
je 0x10264ca2
mov edi, dword [eax + 0x74]
jmp 0x10264ca4
xor edi, edi
cmp edi, ebx
jne 0x10264cc7
push 0x80040014
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor ecx, ecx
call fcn.1026238c
lea ecx, [ebp - 0x10]
call fcn.102bde00
jmp 0x10264d6d
push esi
mov esi, dword [ebp + 8]
cmp esi, ebx
je 0x10264cdd
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x14]
shr eax, 2
test al, 1
jne 0x10264cdf
xor esi, esi
test esi, esi
je 0x10264d51
cmp edi, dword [esi + 8]
je 0x10264cef
push 0x8004001e
jmp 0x10264d56
mov ecx, esi
call fcn.10261249
mov eax, dword [eax + 0x50]
push edi
push eax
push 1
lea ecx, [ebp - 0x10]
call fcn.102bde47
test eax, eax
je 0x10264d51
push esi
lea ecx, [ebp - 4]
call fcn.102623a4
cmp dword [ebp + 0x18], ebx
je 0x10264d51
cmp dword [edi + 0x10], ebx
je 0x10264d3b
mov ecx, esi
call fcn.10261249
test eax, eax
je 0x10264d3b
mov ecx, esi
call fcn.10261249
test byte [eax + 0x54], 0x20
je 0x10264d3b
push 0x8004001f
jmp 0x10264d56
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call fcn.102c2060
mov ebx, eax
jmp 0x10264d5c
push 0x80070057
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [ebp - 4]
call fcn.1026238c
lea ecx, [ebp - 0x10]
call fcn.102bde00
pop esi
pop edi
mov eax, ebx
pop ebx
leave
ret 0x14

Function at 0x10264d75
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push edi
push dword [0x1039deb8]
xor ebx, ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, ebx
je 0x10264d97
mov edi, dword [eax + 0x74]
jmp 0x10264d99
xor edi, edi
cmp edi, ebx
jne 0x10264dad
push 0x80040014
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x10264e49
push edi
push ebx
push 1
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x10], ebx
call fcn.102bde47
test eax, eax
jne 0x10264dcd
push 0x80070057
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x10264e41
push esi
mov esi, dword [ebp + 8]
cmp esi, ebx
je 0x10264de3
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x14]
shr eax, 2
test al, 1
jne 0x10264de5
xor esi, esi
cmp esi, ebx
je 0x10264e35
cmp edi, dword [esi + 8]
je 0x10264df5
push 0x8004001e
jmp 0x10264e3a
cmp dword [ebp + 0x18], ebx
je 0x10264e35
cmp dword [edi + 0x10], ebx
je 0x10264e1e
mov ecx, esi
call fcn.10261249
test eax, eax
je 0x10264e1e
mov ecx, esi
call fcn.10261249
test byte [eax + 0x54], 0x20
je 0x10264e1e
push 0x8004001f
jmp 0x10264e3a
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call fcn.102c1584
mov dword [ebp - 4], eax
jmp 0x10264e40
push 0x80070057
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop esi
lea ecx, [ebp - 0x10]
call fcn.102bde00
mov eax, dword [ebp - 4]
pop edi
pop ebx
leave
ret 0x14
Function at 0x10264e52
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push dword [0x1039deb8]
xor esi, esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, esi
je 0x10264e70
mov eax, dword [eax + 0x74]
jmp 0x10264e72
xor eax, eax
cmp eax, esi
jne 0x10264e83
push 0x80040014
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x10264ebd
push eax
push esi
push esi
lea ecx, [ebp - 0xc]
mov dword [ebp - 0xc], esi
call fcn.102bde47
test eax, eax
jne 0x10264ea2
push 0x80070057
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x10264eb5
call fcn.10261033
cmp eax, esi
jne 0x10264eaf
xor eax, eax
jmp 0x10264eb2
mov eax, dword [eax + 0x20]
mov esi, dword [eax + 0x4c]
lea ecx, [ebp - 0xc]
call fcn.102bde00
mov eax, esi
pop esi
leave
ret

Function at 0x10264ec2
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
and dword [ebp - 4], 0
push edi
push dword [0x1039deb8]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x10264ee2
mov edi, dword [eax + 0x74]
jmp 0x10264ee4
xor edi, edi
test edi, edi
jne 0x10264ef8
push 0x80040014
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x10264f90
and dword [ebp - 0x10], 0
push edi
push 0
push 1
lea ecx, [ebp - 0x10]
call fcn.102bde47
test eax, eax
jne 0x10264f1a
push 0x80070057
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x10264f88
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x10264f30
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x14]
shr eax, 2
test al, 1
jne 0x10264f32
xor esi, esi
test esi, esi
jne 0x10264f3d
push 0x80070057
jmp 0x10264f6c
cmp edi, dword [esi + 8]
je 0x10264f49
push 0x8004001e
jmp 0x10264f6c
cmp dword [edi + 0x10], 0
je 0x10264f74
mov ecx, esi
call fcn.10261249
test eax, eax
je 0x10264f74
mov ecx, esi
call fcn.10261249
test byte [eax + 0x54], 0x20
je 0x10264f74
push 0x8004001f
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x10264f87
push dword [ebp + 0xc]
lea ecx, [esi + 0xc]
push esi
call fcn.10262421
mov dword [ebp - 4], 1
pop esi
lea ecx, [ebp - 0x10]
call fcn.102bde00
mov eax, dword [ebp - 4]
pop edi
leave
ret 8

Function at 0x10268057
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
je 0x102680d9
push ebx
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x102680d9
push esi
push edi
call dword [sym.imp.USER32.dll_EmptyClipboard]
push SysReAllocString
push ebx
push 2
push dword [ebp + 8]
call fcn.101ef4cb
push eax
call fcn.102107c2
mov edi, eax
push edi
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
cmp esi, ebx
je 0x102680d7
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x102680d1
push edi
push dword [ebp + 8]
push eax
call fcn.102f7ffa
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
jne 0x102680cf
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov bl, 1
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop esi
mov al, bl
pop ebx
pop ebp
ret 4
Function at 0x1026bd7e
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov esi, eax
call fcn.102cef76
movzx eax, ax
mov dword [ebp - 4], eax
test ax, ax
jne 0x1026bda5
xor al, al
jmp 0x1026be27
push ebx
push edi
push esi
push dword [ebp + 8]
mov esi, dword [sym.imp.USER32.dll_VkKeyScanExW]
call esi
movzx ebx, ax
movzx eax, bx
mov edi, 0xffff
mov dword [ebp - 8], eax
mov eax, edi
cmp bx, ax
je 0x1026bdce
and ebx, 0xff
movzx eax, word [ebp - 4]
imul eax, eax, 0x10001
push eax
push dword [ebp + 0xc]
call esi
movzx eax, ax
mov dword [ebp + 8], eax
cmp ax, di
je 0x1026be23
movzx eax, al
cmp ax, bx
jne 0x1026be23
cmp word [ebp + 0xc], 0x7f
ja 0x1026be1f
push dword [ebp + 0xc]
call fcn.102ea0d6
push dword [ebp + 0xc]
mov si, ax
call fcn.102ea0c3
cmp si, ax
jne 0x1026be1f
mov cx, word [ebp + 8]
xor eax, eax
cmp word [ebp - 8], cx
sete al
jmp 0x1026be25
mov al, 1
jmp 0x1026be25
xor al, al
pop edi
pop ebx
pop esi
leave
ret 8
Function at 0x1028698a
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x1039fb98]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
push 0x204
lea eax, [ebp - 0x208]
push esi
push eax
mov dword [ebp - 0x20c], esi
call fcn.102f835e
add esp, 0xc
push 0x104
lea eax, [ebp - 0x20c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x10286a9e
cmp word [ebp - 0x20c], si
je 0x10286a9e
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x20c]
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, eax
cmp edi, esi
jne 0x10286a0c
push esi
push 0x646e6d71
jmp 0x10286aa4
push edi
call sym.osetup.dll_void____stdcall_NetUI::HAlloc_unsigned_long_int_
mov ebx, eax
cmp ebx, esi
jne 0x10286a23
push esi
push 0x646e6d72
jmp 0x10286aa4
push ebx
push edi
push esi
lea eax, [ebp - 0x20c]
push eax
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
jne 0x10286a3e
push esi
push 0x646e6d73
jmp 0x10286a8f
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x210]
push eax
push 0x10003b00
push ebx
mov dword [ebp - 0x214], esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x10286a89
mov edx, dword [ebp - 0x210]
cmp edx, esi
je 0x10286a89
mov ecx, dword [edx + 8]
mov eax, 0x60001
cmp ecx, eax
jbe 0x10286a7c
xor esi, esi
inc esi
jmp 0x10286a94
jne 0x10286a94
cmp dword [edx + 0xc], 0x194c0001
jb 0x10286a94
jmp 0x10286a77
push esi
push 0x646e6d74
call fcn.102d8670
push ebx
call sym.osetup.dll_void___stdcall_NetUI::HFree_void__
mov eax, esi
jmp 0x10286aab
push esi
push 0x646e6c73
call fcn.102d8670
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.102f77a6
leave
ret 4
Function at 0x10286abc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x1039fb98]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x103a5e58], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x220], eax
mov eax, dword [ebp + 0xc]
push ebx
mov dword [ebp - 0x224], eax
jne 0x10286c34
cmp dword [0x103a5e54], 0
je 0x10286aff
xor eax, eax
jmp 0x10286c57
push esi
push edi
xor esi, esi
mov edi, 0x1012a244
inc esi
push edi
mov dword [0x103a5e54], esi
call fcn.102254c9
mov ebx, eax
test ebx, ebx
je 0x10286b29
push ebx
call fcn.1028698a
test eax, eax
jne 0x10286c05
and dword [ebp - 0x214], 0
lea eax, [ebp - 0x214]
push eax
push esi
push 0
push 0x1012a208
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10286c05
and dword [ebp - 0x21c], eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x21c]
push eax
push 0
push 0x1012a1f0
push dword [ebp - 0x214]
mov dword [ebp - 0x218], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10286bf9
cmp dword [ebp - 0x21c], esi
jne 0x10286bf9
mov eax, dword [ebp - 0x218]
cmp eax, 2
jbe 0x10286bf9
shr eax, 1
cmp word [ebp + eax*2 - 0x212], 0
je 0x10286bba
xor ecx, ecx
mov word [ebp + eax*2 - 0x210], cx
jmp 0x10286bbb
dec eax
cmp word [ebp + eax*2 - 0x212], 0x5c
mov esi, 0x104
je 0x10286bdd
push esi
lea eax, [ebp - 0x210]
push eax
push 0x10003b00
call fcn.101ef613
push esi
lea eax, [ebp - 0x210]
push eax
push edi
call fcn.101ef613
lea eax, [ebp - 0x210]
push eax
call fcn.102254c9
mov ebx, eax
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
test ebx, ebx
jne 0x10286c1c
push 0
push 0x646e6d75
call fcn.102d8670
jmp 0x10286af8
push ebx
call fcn.1028698a
test eax, eax
jne 0x10286c2e
push eax
push 0x646e6d76
jmp 0x10286c12
mov dword [0x103a5e58], ebx
push dword [ebp - 0x224]
push dword [0x103a5e58]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 0x220]
mov dword [ecx], eax
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.102f77a6
leave
ret 8
Function at 0x102bbdfa
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, dword [edi + 0x9c]
push edi
push dword [0x1039deb8]
shl esi, 0x1f
sar esi, 0x1f
call ebx
mov eax, dword [edi + 0x74]
test eax, eax
je 0x102bbe2d
push dword [eax + 0xc]
call fcn.1025205e
test esi, esi
jne 0x102bbe3e
call fcn.102bbde6
push edi
mov ecx, eax
call fcn.102cc4b0
push edi
call fcn.102bbcc7
push 0
call fcn.1025205e
push 0
push dword [0x1039deb8]
call ebx
pop edi
test esi, esi
pop esi
pop ebx
jne 0x102bbe69
dec dword [0x103a6040]
jne 0x102bbe69
call fcn.102bbd6e
pop ebp
ret 4
Function at 0x102bbe94
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
mov esi, dword [ebp + 0x10]
xor ebx, ebx
mov dword [ebp - 4], 0x8004000a
mov dword [esi], ebx
call fcn.102623cf
test eax, eax
je 0x102bbed1
push dword [0x1039deb8]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
inc dword [eax + 0x98]
mov eax, dword [eax + 0x74]
mov dword [esi], eax
xor eax, eax
jmp 0x102bc08a
cmp dword [ebp + 0xc], ebx
jne 0x102bbef0
call fcn.102bbd28
cmp eax, ebx
jne 0x102bbee9
mov eax, 0x8007000e
jmp 0x102bc08a
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 4]
push edi
cmp eax, ebx
je 0x102bbf00
cmp eax, 2
jne 0x102bbf15
xor esi, esi
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 8], ebx
cmp eax, 2
jne 0x102bbf21
cmp dword [ecx + 0x10], ebx
je 0x102bbf21
mov dword [ebp - 4], 0x80070057
jmp 0x102bc04e
xor edx, edx
dec eax
inc edx
cmp edx, eax
mov eax, dword [ecx + 0xc]
sbb edi, edi
neg edi
sub eax, ebx
je 0x102bbf3a
dec eax
jne 0x102bbf53
push 2
pop ebx
jmp 0x102bbf53
push 0x1000
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, dword [ebp + 8]
mov ebx, eax
neg ebx
sbb ebx, ebx
and ebx, 0xfffffffe
inc ebx
inc ebx
mov ecx, dword [ecx + 0x10]
test ecx, ecx
je 0x102bbfe2
push ecx
call fcn.102623ec
mov esi, eax
test esi, esi
jne 0x102bbf76
mov dword [ebp - 4], 0x80070057
jmp 0x102bc02c
and dword [ebp - 0x10], 0
mov ecx, esi
call fcn.102bbcac
cmp dword [esi + 0x18], 2
jne 0x102bbf97
mov dword [ebp - 4], 0x80070057
mov dword [ebp - 0x10], 1
jmp 0x102bbfaf
xor ecx, ecx
lea eax, [esi + 4]
inc ecx
lock xadd dword [eax], ecx
lea eax, [ebp - 0x18]
push eax
push ebx
push edi
push dword [esi + 0xc]
call fcn.10252224
dec dword [esi + 8]
mov ecx, esi
call fcn.1026238c
cmp dword [ebp - 0x10], 0
jne 0x102bc02c
lea eax, [ebp - 8]
push eax
push dword [ebp + 0xc]
call fcn.102cc711
mov dword [ebp - 4], eax
test eax, eax
jl 0x102bc02c
cmp dword [ebp + 0xc], 0
je 0x102bbffc
mov eax, dword [ebp - 8]
mov dword [0x103a6038], eax
jmp 0x102bc012
lea eax, [ebp - 0xc]
push eax
push ebx
push edi
push 0
call fcn.10252224
test eax, eax
jge 0x102bbfbf
mov dword [ebp - 4], 0x8007000e
jmp 0x102bc02c
mov edi, dword [ebp - 8]
call fcn.102bbde6
push edi
mov ecx, eax
call fcn.102cc493
inc dword [0x103a6040]
test esi, esi
jne 0x102bc069
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0xc]
push dword [ebp + 8]
call fcn.102bdee5
mov dword [ebp - 4], eax
test eax, eax
jge 0x102bc064
cmp dword [ebp - 8], 0
je 0x102bc03e
push dword [ebp - 8]
call fcn.102bbdfa
and dword [ebp - 8], 0
cmp dword [ebp - 0xc], 0
je 0x102bc04c
push dword [ebp - 0xc]
call fcn.102522fc
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
jne 0x102bc05f
call fcn.102bbd28
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebp - 4]
jmp 0x102bc089
mov esi, dword [ebp - 0x14]
jmp 0x102bc070
mov ecx, esi
call fcn.102bdde7
cmp dword [ebp + 0xc], 0
jne 0x102bc082
call fcn.102bbd28
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebp + 0x10]
mov dword [eax], esi
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x102bca60
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
test edi, edi
je 0x102bcac1
mov eax, dword [edi]
push 0
mov ecx, edi
call dword [eax]
mov eax, dword [esi + 0x100]
mov dword [esi + eax*4], edi
inc dword [esi + 0x100]
cmp dword [esi + 0x100], 0x40
jl 0x102bcac1
push dword [0x1039b850]
mov edi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
call edi
test eax, eax
je 0x102bcaba
push dword [0x1039b850]
call edi
mov edx, dword [eax]
push 0x50
lea ecx, [esi + 0x80]
push ecx
push 0x20
mov ecx, eax
call dword [edx + 0x14]
add dword [esi + 0x100], 0xffffffe0
pop edi
pop esi
pop ebp
ret 4

Function at 0x102bd36e
Capabilities:
Get thread local storage value

Disassembly:
push esi
push edi
mov edi, ecx
lea esi, [edi + 0x100]
mov eax, dword [esi]
test eax, eax
jg 0x102bd3a1
push dword [0x1039b850]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edx, dword [eax]
push 0x50
push 0x20
push edi
push esi
mov ecx, eax
call dword [edx + 0xc]
mov eax, dword [esi]
test eax, eax
jne 0x102bd3a1
xor edi, edi
jmp 0x102bd3bf
dec eax
push 0x50
mov dword [esi], eax
mov edi, dword [edi + eax*4]
push 0
push edi
call fcn.102f835e
add esp, 0xc
test edi, edi
je 0x102bd3bf
mov ecx, edi
call fcn.1029e41c
mov eax, edi
pop edi
pop esi
ret

Function at 0x102bd4c2
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
test ebx, ebx
jle 0x102bd533
cmp ebx, dword [ebp + 0xc]
je 0x102bd533
push dword [0x1039b850]
mov esi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
call esi
test eax, eax
je 0x102bd529
push dword [0x1039b850]
call esi
mov esi, eax
mov eax, dword [edi]
xor ecx, ecx
cmp eax, ecx
je 0x102bd503
add eax, 0xfffffff8
mov dword [ebp + 0xc], eax
jmp 0x102bd506
mov dword [ebp + 0xc], ecx
push ecx
push SysReAllocString
push ecx
push 8
push ebx
call fcn.10259e5f
push eax
push dword [ebp + 0xc]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 8]
test eax, eax
je 0x102bd533
add eax, 8
mov dword [edi], eax
mov eax, dword [edi]
mov dword [eax - 8], ebx
xor eax, eax
inc eax
jmp 0x102bd535
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x102bdd8e
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
push 2
mov dword [edi], 0x10139214
lea esi, [edi + 0x20]
pop ebx
mov eax, dword [esi]
test eax, eax
je 0x102bddae
push eax
call fcn.102bdcc9
and dword [esi], 0
add esi, 4
dec ebx
jne 0x102bdd9f
mov eax, dword [edi + 0xc]
test eax, eax
je 0x102bddc1
push eax
call fcn.102522fc
push dword [0x1039deb8]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push 0
mov ecx, eax
call fcn.102bdcf1
mov ecx, edi
pop edi
pop esi
pop ebx
jmp fcn.102c9e2f
Function at 0x102bee99
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push edi
mov edi, ecx
mov eax, dword [edi]
test eax, eax
je 0x102beead
mov ebx, dword [eax - 8]
jmp 0x102beeaf
xor ebx, ebx
mov ecx, dword [ebp + 8]
test ecx, ecx
jl 0x102bef6d
cmp ecx, ebx
jge 0x102bef6d
dec ebx
push esi
mov dword [ebp + 8], ebx
test ebx, ebx
jle 0x102bef3d
cmp ecx, ebx
jge 0x102beee7
mov edx, ebx
sub edx, ecx
lea eax, [eax + ecx*8]
shl edx, 3
push edx
lea ecx, [eax + 8]
push ecx
push eax
call fcn.102fa5b7
add esp, 0xc
push dword [0x1039b850]
mov esi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
call esi
test eax, eax
je 0x102bef36
push dword [0x1039b850]
call esi
mov esi, dword [edi]
push 0
push SysReAllocString
push 0
mov dword [ebp - 4], eax
mov eax, dword [eax]
push 8
push ebx
sub esi, 8
mov dword [ebp - 8], eax
call fcn.10259e5f
mov ecx, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
push esi
call dword [eax + 8]
mov ebx, dword [ebp + 8]
test eax, eax
je 0x102bef36
add eax, 8
mov dword [edi], eax
mov eax, dword [edi]
mov dword [eax - 8], ebx
jmp 0x102bef67
push dword [0x1039b850]
mov esi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
call esi
test eax, eax
je 0x102bef64
push dword [0x1039b850]
call esi
mov ecx, dword [edi]
mov edx, dword [eax]
sub ecx, 8
push ecx
mov ecx, eax
call dword [edx + 0x10]
and dword [edi], 0
xor eax, eax
inc eax
pop esi
jmp 0x102bef6f
xor eax, eax
pop edi
pop ebx
leave
ret 4

Function at 0x102bef9c
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.102bee99
Function at 0x102bfadb
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
and dword [eax], 0
sub esp, 0x10
test byte [ecx + 0x38], 0x80
jne 0x102bfaf5
push 2
pop eax
jmp 0x102bfbce
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
cmp dword [ecx + 0x10], 0
push ebx
push esi
push edi
je 0x102bfb81
mov ebx, dword [ecx + 0x10]
mov byte [ecx + 0x2c], 1
push dword [0x1039deb8]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
add esi, 8
mov ecx, esi
call fcn.102cca5c
mov edi, eax
test edi, edi
je 0x102bfba8
push edi
push ebx
call dword [sym.imp.GDI32.dll_GetClipRgn]
cmp eax, 0xffffffff
jne 0x102bfb40
push edi
mov ecx, esi
call fcn.102ccaab
jmp 0x102bfba8
test eax, eax
jne 0x102bfb4e
push edi
mov ecx, esi
call fcn.102ccaab
xor edi, edi
mov eax, dword [ebp + 0xc]
push dword [eax + 0xc]
push dword [eax + 8]
push dword [eax + 4]
push dword [eax]
push ebx
call dword [sym.imp.GDI32.dll_IntersectClipRect]
mov ebx, eax
cmp ebx, 1
jne 0x102bfb78
test edi, edi
je 0x102bfb78
push edi
mov ecx, esi
call fcn.102ccaab
jmp 0x102bfb7d
mov eax, dword [ebp + 0x10]
mov dword [eax], edi
mov eax, ebx
jmp 0x102bfbcb
lea eax, [ebp - 0x10]
push eax
call fcn.10253a11
push dword [ebp + 0xc]
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.USER32.dll_EqualRect]
test eax, eax
jne 0x102bfbc8
push 0x10
call sym.osetup.dll_void____stdcall_NetUI::HAlloc_unsigned_long_int_
mov ebx, eax
test ebx, ebx
jne 0x102bfbac
xor eax, eax
jmp 0x102bfbcb
mov eax, dword [ebp + 8]
push dword [ebp + 0xc]
lea esi, [ebp - 0x10]
mov edi, ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ecx, dword [eax + 4]
call fcn.102539be
mov eax, dword [ebp + 0x10]
mov dword [eax], ebx
push 2
pop eax
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x102c1797
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov eax, dword [esi + 0x1c]
push edi
or edi, 0xffffffff
test eax, eax
je 0x102c17d3
add eax, 0xfffffff8
je 0x102c17d3
mov ecx, dword [eax + 8]
test ecx, ecx
je 0x102c17b9
add ecx, 0xfffffff8
jmp 0x102c17bb
xor ecx, ecx
mov eax, dword [eax + 0x28]
cmp eax, edi
jae 0x102c17c8
mov edi, eax
test eax, eax
je 0x102c17ce
mov eax, ecx
test ecx, ecx
jne 0x102c17ad
cmp edi, 0xa
jbe 0x102c181a
push dword [0x1039deb8]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x102c17eb
add ecx, 0xfffffff8
jmp 0x102c17ed
xor ecx, ecx
test ecx, ecx
je 0x102c181a
mov edx, dword [ecx + 8]
test edx, edx
je 0x102c17fd
add edx, 0xfffffff8
jmp 0x102c17ff
xor edx, edx
cmp dword [ecx + 0x10], eax
jne 0x102c1814
mov ecx, dword [ecx + 0x40]
sub ecx, dword [ebp + 8]
jns 0x102c180e
xor ecx, ecx
cmp ecx, edi
jae 0x102c1814
mov edi, ecx
mov ecx, edx
test edx, edx
jne 0x102c17f1
mov eax, edi
pop edi
pop esi
pop ebp
ret 4