joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10004e90
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100afda8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push edi
push dword [0x100db8a4]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [ebp + 8]
lea ecx, [edi + 0x3c]
cmp eax, ecx
jne 0x10004ede
push 0x65b
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
push ebx
push esi
lea esi, [edi + 0x44]
push esi
mov dword [ebp - 0x10], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [ebp - 4], 0
cmp dword [edi + 0x34], 0
jne 0x10004f0d
mov ebx, dword [sym.imp.KERNEL32.dll_SetLastError]
push 6
call ebx
mov dword [ebp + 8], 0
jmp 0x10004f58
xor ebx, ebx
cmp dword [edi + 0x38], ebx
jbe 0x10004f47
xor ecx, ecx
mov dword [ebp + 8], ecx
lea esp, [esp]
mov eax, dword [edi + 0x34]
push dword [ebp + 0x10]
add eax, ecx
push dword [ebp + 0xc]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x4c]
test eax, eax
je 0x10004f80
mov ecx, dword [ebp + 8]
inc ebx
add ecx, 0x90
mov dword [ebp + 8], ecx
cmp ebx, dword [edi + 0x38]
jb 0x10004f20
mov ebx, dword [sym.imp.KERNEL32.dll_SetLastError]
push 0
call ebx
mov dword [ebp + 8], 1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push edi
call ebx
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop esi
pop ebx
pop edi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
mov ebx, dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp + 8], 0
jmp 0x10004f58
Function at 0x10005060
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100afda8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push dword [0x100db8a4]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, dword [ebp + 8]
lea ecx, [ebx + 0x3c]
cmp eax, ecx
jne 0x100050ae
push 0x65b
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
push esi
push edi
lea esi, [ebx + 0x44]
push esi
mov dword [ebp - 0x10], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [ebp - 4], 0
cmp dword [ebx + 0x34], 0
jne 0x100050dd
mov ebx, dword [sym.imp.KERNEL32.dll_SetLastError]
push 6
call ebx
mov dword [ebp + 8], 0
jmp 0x10005125
xor edi, edi
cmp dword [ebx + 0x38], edi
jbe 0x10005114
xor ecx, ecx
mov dword [ebp + 8], ecx
lea esp, [esp]
mov eax, dword [ebx + 0x34]
push dword [ebp + 0xc]
add eax, ecx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x54]
test eax, eax
je 0x1000514d
mov ecx, dword [ebp + 8]
inc edi
add ecx, 0x90
mov dword [ebp + 8], ecx
cmp edi, dword [ebx + 0x38]
jb 0x100050f0
mov ebx, dword [sym.imp.KERNEL32.dll_SetLastError]
push 0
call ebx
mov dword [ebp + 8], 1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push edi
call ebx
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
mov ebx, dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp + 8], 0
jmp 0x10005125
Function at 0x10005220
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100afda8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push dword [0x100db8a4]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, dword [ebp + 8]
lea ecx, [ebx + 0x3c]
cmp eax, ecx
jne 0x1000526e
push 0x65b
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
push esi
push edi
lea esi, [ebx + 0x44]
push esi
mov dword [ebp - 0x10], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [ebp - 4], 0
cmp dword [ebx + 0x34], 0
jne 0x1000529d
mov ebx, dword [sym.imp.KERNEL32.dll_SetLastError]
push 6
call ebx
mov dword [ebp + 8], 0
jmp 0x100052e5
xor edi, edi
cmp dword [ebx + 0x38], edi
jbe 0x100052d4
xor ecx, ecx
mov dword [ebp + 8], ecx
lea esp, [esp]
mov eax, dword [ebx + 0x34]
push dword [ebp + 0xc]
add eax, ecx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x5c]
test eax, eax
je 0x1000530d
mov ecx, dword [ebp + 8]
inc edi
add ecx, 0x90
mov dword [ebp + 8], ecx
cmp edi, dword [ebx + 0x38]
jb 0x100052b0
mov ebx, dword [sym.imp.KERNEL32.dll_SetLastError]
push 0
call ebx
mov dword [ebp + 8], 1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push edi
call ebx
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
mov ebx, dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp + 8], 0
jmp 0x100052e5
Function at 0x100053e0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100afda8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push edi
push dword [0x100db8a4]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [ebp + 8]
lea ecx, [edi + 0x3c]
cmp eax, ecx
jne 0x1000542e
push 0x65b
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
push ebx
push esi
lea esi, [edi + 0x44]
push esi
mov dword [ebp - 0x10], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [ebp - 4], 0
cmp dword [edi + 0x34], 0
mov ebx, dword [sym.imp.KERNEL32.dll_SetLastError]
jne 0x1000545d
push 6
call ebx
mov dword [ebp + 8], 0
jmp 0x100054db
cmp dword [edi + 0x60], 0
je 0x10005471
mov ecx, edi
call fcn.100060d0
mov dword [ebp + 8], eax
test eax, eax
jne 0x100054db
xor ebx, ebx
cmp dword [edi + 0x38], ebx
jbe 0x1000549d
xor esi, esi
lea ebx, [ebx]
mov eax, dword [edi + 0x34]
push dword [ebp + 0xc]
add eax, esi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x64]
inc ebx
add esi, 0x90
cmp ebx, dword [edi + 0x38]
jb 0x10005480
lea esi, [edi + 0x44]
cmp dword [edi + 0x60], 0
je 0x100054ac
cmp dword [edi + 0x94], 1
jne 0x100054bf
mov ebx, dword [sym.imp.KERNEL32.dll_SetLastError]
push 0
call ebx
mov dword [ebp + 8], 1
jmp 0x100054db
mov ecx, edi
call fcn.10006130
mov ebx, dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, eax
push edi
call ebx
xor eax, eax
test edi, edi
sete al
mov dword [ebp + 8], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push edi
call ebx
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop esi
pop ebx
pop edi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x100055d0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100afda8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push dword [0x100db8a4]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, dword [ebp + 8]
lea ecx, [ebx + 0x3c]
cmp eax, ecx
jne 0x1000561e
push 0x65b
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
push esi
push edi
lea esi, [ebx + 0x44]
push esi
mov dword [ebp - 0x10], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [ebp - 4], 0
cmp dword [ebx + 0x34], 0
jne 0x1000564d
mov ebx, dword [sym.imp.KERNEL32.dll_SetLastError]
push 6
call ebx
mov dword [ebp + 8], 0
jmp 0x10005695
xor edi, edi
cmp dword [ebx + 0x38], edi
jbe 0x10005684
xor ecx, ecx
mov dword [ebp + 8], ecx
lea esp, [esp]
mov eax, dword [ebx + 0x34]
push dword [ebp + 0xc]
add eax, ecx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x6c]
test eax, eax
je 0x100056bd
mov ecx, dword [ebp + 8]
inc edi
add ecx, 0x90
mov dword [ebp + 8], ecx
cmp edi, dword [ebx + 0x38]
jb 0x10005660
mov ebx, dword [sym.imp.KERNEL32.dll_SetLastError]
push 0
call ebx
mov dword [ebp + 8], 1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push edi
call ebx
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
mov ebx, dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp + 8], 0
jmp 0x10005695
Function at 0x10005790
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100afda8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push dword [0x100db8a4]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, dword [ebp + 8]
lea ecx, [ebx + 0x3c]
cmp eax, ecx
jne 0x100057de
push 0x65b
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
push esi
push edi
lea esi, [ebx + 0x44]
push esi
mov dword [ebp - 0x10], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [ebp - 4], 0
cmp dword [ebx + 0x34], 0
jne 0x1000580d
mov ebx, dword [sym.imp.KERNEL32.dll_SetLastError]
push 6
call ebx
mov dword [ebp + 8], 0
jmp 0x10005855
xor edi, edi
cmp dword [ebx + 0x38], edi
jbe 0x10005844
xor ecx, ecx
mov dword [ebp + 8], ecx
lea esp, [esp]
mov eax, dword [ebx + 0x34]
push dword [ebp + 0xc]
add eax, ecx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x74]
test eax, eax
je 0x1000587d
mov ecx, dword [ebp + 8]
inc edi
add ecx, 0x90
mov dword [ebp + 8], ecx
cmp edi, dword [ebx + 0x38]
jb 0x10005820
mov ebx, dword [sym.imp.KERNEL32.dll_SetLastError]
push 0
call ebx
mov dword [ebp + 8], 1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push edi
call ebx
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
mov ebx, dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp + 8], 0
jmp 0x10005855

Function at 0x10005950
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x100afd88
push eax
mov dword fs:[0], esp
push ebx
push esi
push edi
push dword [0x100db8a4]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [ebp + 8]
lea ecx, [edi + 0x3c]
cmp eax, ecx
jne 0x100059a1
push 0x65b
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
lea esi, [edi + 0x44]
push esi
mov dword [ebp + 8], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [ebp - 4], 0
mov edx, dword [edi + 0x34]
mov ebx, dword [sym.imp.KERNEL32.dll_SetLastError]
test edx, edx
jne 0x100059cf
push 6
call ebx
mov dword [ebp + 8], 0
jmp 0x100059fb
mov eax, dword [ebp + 0xc]
cmp eax, dword [edi + 0x38]
jb 0x100059e4
push 0x57
call ebx
mov dword [ebp + 8], 0
jmp 0x100059fb
push dword [ebp + 0x14]
lea ecx, [eax + eax*8]
push dword [ebp + 0x10]
shl ecx, 4
add ecx, edx
push ecx
mov eax, dword [ecx]
call dword [eax + 0x7c]
mov dword [ebp + 8], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push edi
call ebx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x10005a30
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x100afd88
push eax
mov dword fs:[0], esp
push ebx
push esi
push edi
push dword [0x100db8a4]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [ebp + 8]
lea ecx, [edi + 0x3c]
cmp eax, ecx
jne 0x10005a81
push 0x65b
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
lea esi, [edi + 0x44]
push esi
mov dword [ebp + 8], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [ebp - 4], 0
mov edx, dword [edi + 0x34]
mov ebx, dword [sym.imp.KERNEL32.dll_SetLastError]
test edx, edx
jne 0x10005aaf
push 6
call ebx
mov dword [ebp + 8], 0
jmp 0x10005ad8
mov eax, dword [ebp + 0xc]
cmp eax, dword [edi + 0x38]
jb 0x10005ac4
push 0x57
call ebx
mov dword [ebp + 8], 0
jmp 0x10005ad8
lea ecx, [eax + eax*8]
shl ecx, 4
add ecx, edx
push ecx
mov eax, dword [ecx]
call dword [eax + 0x80]
mov dword [ebp + 8], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push edi
call ebx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x10005c80
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100afda8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push edi
push dword [0x100db8a4]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [ebp + 8]
lea ecx, [edi + 0x3c]
cmp eax, ecx
jne 0x10005cce
push 0x65b
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
push ebx
push esi
lea esi, [edi + 0x44]
push esi
mov dword [ebp - 0x10], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [ebp - 4], 0
cmp dword [edi + 0x34], 0
jne 0x10005cfd
mov ebx, dword [sym.imp.KERNEL32.dll_SetLastError]
push 6
call ebx
mov dword [ebp + 8], 0
jmp 0x10005d62
cmp dword [edi + 0x60], 0
je 0x10005d19
mov ebx, dword [sym.imp.KERNEL32.dll_SetLastError]
push 0xaa
call ebx
mov dword [ebp + 8], 0
jmp 0x10005d62
xor ebx, ebx
cmp dword [edi + 0x38], ebx
jbe 0x10005d51
xor eax, eax
mov dword [ebp + 8], eax
mov ecx, dword [edi + 0x34]
push dword [ebp + 0xc]
add ecx, eax
push dword [ecx + 0x88]
mov eax, dword [ecx]
push ecx
call dword [eax + 0x98]
test eax, eax
je 0x10005d8a
mov eax, dword [ebp + 8]
inc ebx
add eax, 0x90
mov dword [ebp + 8], eax
cmp ebx, dword [edi + 0x38]
jb 0x10005d25
mov ebx, dword [sym.imp.KERNEL32.dll_SetLastError]
push 0
call ebx
mov dword [ebp + 8], 1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push edi
call ebx
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop esi
pop ebx
pop edi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
mov ebx, dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp + 8], 0
jmp 0x10005d62
Function at 0x10006190
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x100afd88
push eax
mov dword fs:[0], esp
push ebx
push esi
push edi
push dword [0x100db8a4]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, dword [ebp + 8]
lea ecx, [ebx + 0x3c]
cmp eax, ecx
jne 0x100061e1
push 0x65b
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
lea esi, [ebx + 0x44]
push esi
mov dword [ebp + 8], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [ebp - 4], 0
cmp dword [ebx + 0x34], 0
jne 0x1000620e
mov ebx, dword [sym.imp.KERNEL32.dll_SetLastError]
push 6
call ebx
mov dword [ebp + 8], 0
jmp 0x1000628b
cmp dword [ebx + 0x60], 0
je 0x1000627a
push dword [ebx + 0x6c]
call dword [sym.imp.KERNEL32.dll_SetEvent]
cmp dword [ebx + 0x38], 0
jbe 0x10006253
xor edi, edi
xor esi, esi
jmp 0x10006230
mov ecx, dword [ebx + 0x34]
add ecx, edi
push dword [ecx + 0x88]
mov eax, dword [ecx]
push ecx
call dword [eax + 0xa4]
inc esi
add edi, 0x90
cmp esi, dword [ebx + 0x38]
jb 0x10006230
lea esi, [ebx + 0x44]
push dword [ebx + 0x64]
mov dword [ebx + 0x60], 0
call fcn.1009c380
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 4
push dword [ebx + 0x6c]
call edi
push dword [ebx + 0x70]
call edi
push dword [ebx + 0x74]
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_SetLastError]
push 0
call ebx
mov dword [ebp + 8], 1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push edi
call ebx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10006500
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100afda8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push edi
push dword [0x100db8a4]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [ebp + 8]
lea ecx, [edi + 0x3c]
cmp eax, ecx
jne 0x1000654e
push 0x65b
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
push ebx
push esi
lea esi, [edi + 0x44]
push esi
mov dword [ebp - 0x10], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [ebp - 4], 0
cmp dword [edi + 0x34], 0
mov ebx, dword [sym.imp.KERNEL32.dll_SetLastError]
jne 0x10006580
push 6
call ebx
mov dword [ebp + 8], 0
jmp 0x10006604
cmp dword [edi + 0x60], 0
je 0x10006594
mov ecx, edi
call fcn.100060d0
mov dword [ebp + 8], eax
test eax, eax
jne 0x10006604
xor ebx, ebx
cmp dword [edi + 0x38], ebx
jbe 0x100065c6
xor esi, esi
lea ecx, [ecx]
mov ecx, dword [edi + 0x34]
push dword [ebp + 0xc]
add ecx, esi
push dword [ecx + 0x88]
mov eax, dword [ecx]
push ecx
call dword [eax + 0xb4]
inc ebx
add esi, 0x90
cmp ebx, dword [edi + 0x38]
jb 0x100065a0
lea esi, [edi + 0x44]
cmp dword [edi + 0x60], 0
je 0x100065d5
cmp dword [edi + 0x94], 1
jne 0x100065e8
mov ebx, dword [sym.imp.KERNEL32.dll_SetLastError]
push 0
call ebx
mov dword [ebp + 8], 1
jmp 0x10006604
mov ecx, edi
call fcn.10006130
mov ebx, dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, eax
push edi
call ebx
xor eax, eax
test edi, edi
sete al
mov dword [ebp + 8], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push edi
call ebx
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop esi
pop ebx
pop edi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x100066f0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x100afde8
push eax
mov dword fs:[0], esp
sub esp, 0x68
push ebx
push esi
push edi
push dword [0x100db8a4]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [ebp + 8]
lea ecx, [edi + 0x3c]
cmp eax, ecx
jne 0x10006748
push 0x65b
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov ecx, dword [esp + 0x74]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
lea esi, [edi + 0x44]
push esi
mov dword [esp + 0x40], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [esp + 0x7c], 0
mov edx, dword [edi + 0x34]
mov ebx, dword [sym.imp.KERNEL32.dll_SetLastError]
test edx, edx
jne 0x10006779
push 6
call ebx
mov dword [esp + 0x3c], 0
jmp 0x100067af
mov eax, dword [ebp + 0xc]
cmp eax, dword [edi + 0x38]
jb 0x1000678f
push 0x57
call ebx
mov dword [esp + 0x3c], 0
jmp 0x100067af
fld qword [ebp + 0x10]
lea ecx, [eax + eax*8]
shl ecx, 4
sub esp, 8
add ecx, edx
fstp qword [esp]
push dword [ecx + 0x88]
call fcn.1002fd90
mov dword [esp + 0x3c], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push edi
call ebx
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x74]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x100067e0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x100afd88
push eax
mov dword fs:[0], esp
push ebx
push esi
push edi
push dword [0x100db8a4]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [ebp + 8]
lea ecx, [edi + 0x3c]
cmp eax, ecx
jne 0x10006831
push 0x65b
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
lea esi, [edi + 0x44]
push esi
mov dword [ebp + 8], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [ebp - 4], 0
mov edx, dword [edi + 0x34]
mov ebx, dword [sym.imp.KERNEL32.dll_SetLastError]
test edx, edx
jne 0x1000685f
push 6
call ebx
mov dword [ebp + 8], 0
jmp 0x1000688d
mov eax, dword [ebp + 0xc]
cmp eax, dword [edi + 0x38]
jb 0x10006874
push 0x57
call ebx
mov dword [ebp + 8], 0
jmp 0x1000688d
push dword [ebp + 0x10]
lea ecx, [eax + eax*8]
shl ecx, 4
add ecx, edx
push dword [ecx + 0x88]
call fcn.1002fe50
mov dword [ebp + 8], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push edi
call ebx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10006980
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x100afd88
push eax
mov dword fs:[0], esp
push ebx
push esi
push edi
push dword [0x100db8a4]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [ebp + 8]
lea ecx, [edi + 0x3c]
cmp eax, ecx
jne 0x100069d1
push 0x65b
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
lea esi, [edi + 0x44]
push esi
mov dword [ebp + 8], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [ebp - 4], 0
mov edx, dword [edi + 0x34]
mov ebx, dword [sym.imp.KERNEL32.dll_SetLastError]
test edx, edx
jne 0x100069ff
push 6
call ebx
mov dword [ebp + 8], 0
jmp 0x10006a31
mov eax, dword [ebp + 0xc]
cmp eax, dword [edi + 0x38]
jb 0x10006a14
push 0x57
call ebx
mov dword [ebp + 8], 0
jmp 0x10006a31
push dword [ebp + 0x10]
lea ecx, [eax + eax*8]
shl ecx, 4
add ecx, edx
push dword [ecx + 0x8c]
mov eax, dword [ecx]
push ecx
call dword [eax + 0x98]
mov dword [ebp + 8], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push edi
call ebx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x10006a60
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x100afd88
push eax
mov dword fs:[0], esp
push ebx
push esi
push edi
push dword [0x100db8a4]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [ebp + 8]
lea ecx, [edi + 0x3c]
cmp eax, ecx
jne 0x10006ab1
push 0x65b
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
lea esi, [edi + 0x44]
push esi
mov dword [ebp + 8], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [ebp - 4], 0
mov edx, dword [edi + 0x34]
mov ebx, dword [sym.imp.KERNEL32.dll_SetLastError]
test edx, edx
jne 0x10006adf
push 6
call ebx
mov dword [ebp + 8], 0
jmp 0x10006b14
mov eax, dword [ebp + 0xc]
cmp eax, dword [edi + 0x38]
jb 0x10006af4
push 0x57
call ebx
mov dword [ebp + 8], 0
jmp 0x10006b14
push dword [ebp + 0x14]
lea ecx, [eax + eax*8]
push dword [ebp + 0x10]
shl ecx, 4
add ecx, edx
push dword [ecx + 0x8c]
mov eax, dword [ecx]
push ecx
call dword [eax + 0x9c]
mov dword [ebp + 8], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push edi
call ebx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0x10