joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4042f7
Capabilities:
Read file on windows

Disassembly:
push ecx
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
push edi
push 2
push 0xffffffffffffffff
push 0xffffffffffffffea
push ebp
call fcn.0040f32c
mov ebx, edx
add esp, 0x10
mov esi, eax
test ebx, ebx
jl 0x40446a
jg 0x404326
test esi, esi
jb 0x40446a
mov edi, dword [esp + 0x20]
push 0x16
push edi
push ebp
call fcn.00417558
add esp, 0xc
test eax, eax
js 0x40446a
movzx ecx, byte [edi + 3]
movzx eax, byte [edi + 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [edi + 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [edi]
shl ecx, 8
or ecx, eax
cmp ecx, 0x6054b50
jne 0x404388
push edi
call fcn.00404879
pop ecx
test eax, eax
je 0x40437f
push ebx
push esi
push edi
push ebp
call fcn.0040f32c
add esp, 0x10
mov esi, eax
mov ebx, edx
mov eax, esi
mov edx, ebx
jmp 0x40446f
push 2
xor ebx, ebx
push ebx
push ebx
push ebp
call fcn.0040f32c
mov ebp, eax
add esp, 0x10
mov eax, edx
mov dword [esp + 0x14], eax
cmp eax, ebx
jl 0x40446a
jg 0x4043b1
cmp ebp, ebx
jb 0x40446a
mov ecx, 0x10015
cmp eax, ebx
jg 0x4043c6
jl 0x4043c0
cmp ebp, ecx
jae 0x4043c6
mov esi, ebp
mov ecx, eax
jmp 0x4043ca
mov esi, ecx
mov ecx, ebx
mov eax, esi
neg eax
push 2
adc ecx, ebx
neg ecx
push ecx
push eax
push dword [esp + 0x28]
call fcn.0040f32c
add esp, 0x10
cmp edx, ebx
jl 0x40446a
jg 0x4043f0
cmp eax, ebx
jb 0x40446a
push 0x10015
call fcn.0040f32c
mov ebx, eax
pop ecx
test ebx, ebx
je 0x40446a
push esi
push ebx
push dword [esp + 0x24]
call fcn.00417558
add esp, 0xc
mov dword [esp + 0x10], eax
test eax, eax
js 0x404463
lea edx, [ebx + eax]
lea esi, [edx - 0x16]
jmp 0x40445f
cmp byte [esi], 0x50
jne 0x40445e
movzx ecx, byte [esi + 3]
movzx eax, byte [esi + 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 1]
shl ecx, 8
or ecx, eax
shl ecx, 8
or ecx, 0x50
cmp ecx, 0x6054b50
jne 0x40445e
movzx ecx, byte [esi + 0x15]
movzx eax, byte [esi + 0x14]
shl ecx, 8
or ecx, eax
lea eax, [esi + 0x16]
add eax, ecx
cmp eax, edx
je 0x404476
dec esi
cmp esi, ebx
jae 0x40441f
push ebx
call fcn.0040f32c
pop ecx
or eax, 0xffffffff
or edx, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
push 0x16
push esi
push edi
call fcn.0040a130
push ebx
call fcn.0040f32c
mov eax, dword [esp + 0x20]
add eax, ebx
sub eax, esi
mov esi, dword [esp + 0x24]
cdq
sub ebp, eax
push edi
sbb esi, edx
call fcn.00404879
add esp, 0x14
test eax, eax
je 0x4044b6
push esi
push ebp
push edi
push dword [esp + 0x28]
call fcn.0040f32c
add esp, 0x10
mov ebp, eax
mov esi, edx
mov eax, ebp
mov edx, esi
jmp 0x40446f
Function at 0x40f32c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x40f33b
pop dword [ebp - 0x28]
mov eax, 0x848056e8
sub eax, 0x843f63ad
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0x56a42528
sub dword [ebp - 0x38], 0x851dfdd
mov dword [ebp - 0x34], 0xc53abe36
add dword [ebp - 0x34], 0x6cf88e0f
mov dword [ebp - 0x30], 0x5954ad1d
add dword [ebp - 0x30], 0xf2f79711
mov dword [ebp - 0x2c], 0x66cbbf3b
sub dword [ebp - 0x2c], 0x66cbbf3b
lea eax, [ebp - 0x38]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0xd4750dbf
sub dword [ebp - 0x38], 0x6002a469
mov dword [ebp - 0x34], 0x37ebba46
sub dword [ebp - 0x34], 0xf67f58d1
mov dword [ebp - 0x30], 0x249d0201
add dword [ebp - 0x30], 0x3ed26a6b
mov dword [ebp - 0x2c], 0x302e5e5e
sub dword [ebp - 0x2c], 0x302e5e5e
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, 0x7dfddf
add eax, 0xffc45279
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x3e428
push 0
call eax
mov ecx, 0xaab8399c
sub ecx, 0xaab7f014
mov edx, eax
mov ebx, 0x6924037c
add ebx, 0x971fd684
add ebx, dword [ebp - 0x28]
mov esi, 0x3021daa
add esi, 0xa57a6ab6
xor dword [ebp - 4], 0x5cb9460f
mov edi, dword [ebx]
xor dword [ebp - 0x18], 0xd5ddff82
add edi, esi
xor dword [ebp - 0xc], edx
mov dword [edx], edi
add edx, 0xbaa77cf3
sub edx, 0xbaa77cef
add ebx, 0x16169449
add ebx, 0xe9e96bbb
loop 0x40f458
add eax, 0xc990ede6
add eax, 0x36702b0d
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xa04e2a6b
sub ecx, 0xa00e2a6b
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x10007cac
Capabilities:
Read file on windows

Disassembly:
push ecx
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
push edi
push 2
push 0xffffffffffffffff
push 0xffffffffffffffea
push ebp
call fcn.1001b592
mov ebx, edx
add esp, 0x10
mov esi, eax
test ebx, ebx
jl 0x10007e1f
jg 0x10007cdb
test esi, esi
jb 0x10007e1f
mov edi, dword [esp + 0x20]
push 0x16
push edi
push ebp
call fcn.10017328
add esp, 0xc
test eax, eax
js 0x10007e1f
movzx ecx, byte [edi + 3]
movzx eax, byte [edi + 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [edi + 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [edi]
shl ecx, 8
or ecx, eax
cmp ecx, 0x6054b50
jne 0x10007d3d
push edi
call fcn.1000822e
pop ecx
test eax, eax
je 0x10007d34
push ebx
push esi
push edi
push ebp
call fcn.1001b592
add esp, 0x10
mov esi, eax
mov ebx, edx
mov eax, esi
mov edx, ebx
jmp 0x10007e24
push 2
xor ebx, ebx
push ebx
push ebx
push ebp
call fcn.1001b592
mov ebp, eax
add esp, 0x10
mov eax, edx
mov dword [esp + 0x14], eax
cmp eax, ebx
jl 0x10007e1f
jg 0x10007d66
cmp ebp, ebx
jb 0x10007e1f
mov ecx, 0x10015
cmp eax, ebx
jg 0x10007d7b
jl 0x10007d75
cmp ebp, ecx
jae 0x10007d7b
mov esi, ebp
mov ecx, eax
jmp 0x10007d7f
mov esi, ecx
mov ecx, ebx
mov eax, esi
neg eax
push 2
adc ecx, ebx
neg ecx
push ecx
push eax
push dword [esp + 0x28]
call fcn.1001b592
add esp, 0x10
cmp edx, ebx
jl 0x10007e1f
jg 0x10007da5
cmp eax, ebx
jb 0x10007e1f
push 0x10015
call fcn.1001b592
mov ebx, eax
pop ecx
test ebx, ebx
je 0x10007e1f
push esi
push ebx
push dword [esp + 0x24]
call fcn.10017328
add esp, 0xc
mov dword [esp + 0x10], eax
test eax, eax
js 0x10007e18
lea edx, [ebx + eax]
lea esi, [edx - 0x16]
jmp 0x10007e14
cmp byte [esi], 0x50
jne 0x10007e13
movzx ecx, byte [esi + 3]
movzx eax, byte [esi + 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 1]
shl ecx, 8
or ecx, eax
shl ecx, 8
or ecx, 0x50
cmp ecx, 0x6054b50
jne 0x10007e13
movzx ecx, byte [esi + 0x15]
movzx eax, byte [esi + 0x14]
shl ecx, 8
or ecx, eax
lea eax, [esi + 0x16]
add eax, ecx
cmp eax, edx
je 0x10007e2b
dec esi
cmp esi, ebx
jae 0x10007dd4
push ebx
call fcn.1001b592
pop ecx
or eax, 0xffffffff
or edx, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
push 0x16
push esi
push edi
call fcn.1000a190
push ebx
call fcn.1001b592
mov eax, dword [esp + 0x20]
add eax, ebx
sub eax, esi
mov esi, dword [esp + 0x24]
cdq
sub ebp, eax
push edi
sbb esi, edx
call fcn.1000822e
add esp, 0x14
test eax, eax
je 0x10007e6b
push esi
push ebp
push edi
push dword [esp + 0x28]
call fcn.1001b592
add esp, 0x10
mov ebp, eax
mov esi, edx
mov eax, ebp
mov edx, esi
jmp 0x10007e24
Function at 0x1001b592
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x1001b5a1
pop dword [ebp - 0x14]
mov eax, 0x1001b5a1
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0xdd36d043
sub dword [ebp - 0x24], 0x8ee48af8
mov dword [ebp - 0x20], 0xe1fa5f6b
sub dword [ebp - 0x20], 0xafc71326
mov dword [ebp - 0x1c], 0x276f6b22
sub dword [ebp - 0x1c], 0xdb2326f4
mov dword [ebp - 0x18], 0x90a9ad85
add dword [ebp - 0x18], 0x6f56527b
lea eax, [ebp - 0x24]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0x50b96702
add dword [ebp - 0x24], 0x23b90254
mov dword [ebp - 0x20], 0xd0bb81b4
add dword [ebp - 0x20], 0x70b0dfc1
mov dword [ebp - 0x1c], 0xa2268a58
sub dword [ebp - 0x1c], 0x3eb71dec
mov dword [ebp - 0x18], 0x20d5d97c
sub dword [ebp - 0x18], 0x20d5d97c
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x3a2fd
push 0
call eax
mov ecx, 0x3966
mov esi, eax
mov edi, 0x10035a00
add edi, dword [ebp - 0x14]
mov edx, 0xba2f26e7
xor dword [ebp - 4], 0xe3ab3979
mov ebx, dword [edi]
sub dword [ebp - 0x10], 0x60f7d724
add ebx, edx
xor dword [ebp - 0x10], 0x8789a787
mov dword [esi], ebx
sub dword [ebp - 0xc], 0xcf87773a
add esi, 0x9002d175
add esi, 0x6ffd2e8f
add edi, 4
loop 0x1001b6a2
add eax, 0xd06ae57e
sub eax, 0xd06a0d13
mov ebx, eax
add eax, 0x8c0ce5f9
add eax, 0x73f31a0c
mov ecx, 0x4e048450
add ecx, 0xc1fb7bb0
add ecx, dword [ebp - 0x14]
call ebx
leave
ret
Function at 0x403082
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
xor ebx, ebx
push edi
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, 0x442800
push 0x400
add eax, 0x3e8
push esi
push ebx
mov dword [0x43470c], eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 3
push 0x80000000
push esi
call fcn.00406047
mov edi, eax
cmp edi, 0xffffffff
mov dword [ebp - 0xc], edi
mov dword [0x40a018], edi
jne 0x4030dc
mov eax, str.Error_launching_installer
jmp 0x4032b2
push esi
mov esi, 0x440800
push esi
call fcn.00406557
push esi
call fcn.00405e72
push eax
push 0x443000
call fcn.00406557
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, ebx
mov dword [0x42aa24], eax
mov esi, eax
jbe 0x4031f5
mov ebx, 0x416a18
mov eax, dword [0x434714]
mov edi, esi
neg eax
sbb eax, eax
and eax, 0x7e00
add eax, 0x200
cmp esi, eax
jb 0x403130
mov edi, eax
push edi
push ebx
call fcn.004034d4
test eax, eax
je 0x40325f
cmp dword [0x434714], 0
jne 0x4031c2
push 0x1c
lea eax, [ebp - 0x28]
push ebx
push eax
call fcn.00406002
mov eax, dword [ebp - 0x28]
test eax, 0xfffffff0
jne 0x4031d0
cmp dword [ebp - 0x24], 0xdeadbeef
jne 0x4031d0
cmp dword [ebp - 0x18], 0x74736e49
jne 0x4031d0
cmp dword [ebp - 0x1c], 0x74666f73
jne 0x4031d0
cmp dword [ebp - 0x20], 0x6c6c754e
jne 0x4031d0
or dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [0x41ea18]
and eax, 2
or dword [0x4347a0], eax
mov eax, dword [ebp - 0x10]
cmp eax, esi
mov dword [0x434714], ecx
ja 0x403258
test byte [ebp + 8], 8
jne 0x4031b4
test byte [ebp + 8], 4
jne 0x4031f3
inc dword [ebp - 4]
lea esi, [eax - 4]
cmp edi, esi
jbe 0x4031d0
mov edi, esi
jmp 0x4031d0
test byte [ebp + 8], 2
jne 0x4031d0
push 0
call fcn.0040301e
pop ecx
cmp esi, dword [0x42aa24]
jae 0x4031e5
push edi
push ebx
push dword [ebp - 8]
call fcn.00406a38
mov dword [ebp - 8], eax
add dword [0x41ea18], edi
sub esi, edi
jne 0x403115
xor ebx, ebx
push 1
call fcn.0040301e
cmp dword [0x434714], ebx
pop ecx
nop
nop
cmp dword [ebp - 4], ebx
jmp 0x40322c
push dword [ebp - 0x14]
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
mov eax, dword [0x434714]
add eax, 0x1c
push eax
call fcn.004034ea
push dword [ebp - 0x14]
push esi
push ebx
push 0xffffffffffffffff
call fcn.004032b9
cmp eax, dword [ebp - 0x14]
jmp 0x403269
mov eax, str.Installer_integrity_check_has_failed._Common_causes_include_nincomplete_download_and_damaged_media._Contact_the_ninstallers_author_to_obtain_a_new_copy._n_nMore_information_at:_nhttp:__nsis.sf.net_NSIS_Error
jmp 0x4032b2
push 1
call fcn.0040301e
pop ecx
jmp 0x403258
test byte [ebp - 0x28], 1
mov dword [0x434710], esi
mov eax, dword [esi]
mov dword [0x434718], eax
je 0x403282
inc dword [0x43471c]
push 8
lea eax, [esi + 0x44]
pop ecx
sub eax, 8
add dword [eax], esi
dec ecx
jne 0x403288
push 1
push ebx
push ebx
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [esi + 0x3c], eax
add esi, 4
push 0x40
push esi
push 0x434720
call fcn.00406002
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x10068c30
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
mov edi, edi
push esi
mov esi, dword [sym.imp.kernel32.dll_InterlockedCompareExchange]
push 0xfffffffffffffffe
push 0xfffffffffffffffe
push 0x101f3dec
mov dword [ebx], 0
call esi
cmp eax, 0xfffffffe
jne 0x10068cbd
push edi
push 0
push 1
push 0x101f7e54
call esi
cmp eax, 1
jne 0x10068c7a
mov edi, dword [sym.imp.kernel32.dll_Sleep]
push 1
call edi
push 0
push 1
push 0x101f7e54
call esi
cmp eax, 1
je 0x10068c66
push 0xfffffffffffffffe
push 0xfffffffffffffffe
push 0x101f3dec
call esi
mov edi, dword [sym.imp.kernel32.dll_InterlockedExchange]
mov esi, eax
cmp esi, 0xfffffffe
jne 0x10068ca7
call dword [sym.imp.kernel32.dll_TlsAlloc]
mov esi, eax
cmp esi, 0xffffffff
je 0x10068ca7
push esi
push 0x101f3dec
call edi
push 0
push 0x101f7e54
call edi
pop edi
cmp esi, 0xffffffff
jne 0x10068cbd
mov eax, 0x8007000e
pop esi
ret
mov eax, dword [0x101f3dec]
test eax, eax
js 0x10068ce1
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x10068ce1
inc dword [eax + 0x12c]
mov dword [ebx], 1
xor eax, eax
pop esi
ret
push 0x130
call dword [sym.imp.msvcrt.dll_malloc]
mov esi, eax
add esp, 4
test esi, esi
je 0x10068cb6
push 0x130
push 0
push esi
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [esi + 0x12c], 1
push esi
mov dword [ebx], 1
push dword [0x101f3dec]
call dword [sym.imp.kernel32.dll_TlsSetValue]
xor eax, eax
pop esi
ret

Function at 0x1006e5a0
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x101f3dec]
push edi
test eax, eax
jns 0x1006e5ae
xor edi, edi
jmp 0x1006e5b7
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov edi, eax
xor ecx, ecx
lea edx, [edi + 0x24]
lea esp, [esp]
cmp dword [ecx*4 + 0x10027c6c], esi
jne 0x1006e5ce
cmp dword [edx], 0
jne 0x1006e5e4
inc ecx
add edx, 8
cmp ecx, 0xf
jb 0x1006e5c0
mov ecx, dword [edi + 0x20]
push 0x10
push esi
call fcn.1009d9b0
pop edi
ret
mov edx, dword [edi + ecx*8 + 0x24]
test edx, edx
je 0x1006e600
mov eax, dword [edx]
mov dword [edi + ecx*8 + 0x24], eax
test eax, eax
jne 0x1006e5fa
mov dword [edi + ecx*8 + 0x28], eax
mov dword [edx], 0xfefefefe
cmp ecx, 0xf
jae 0x1006e5d7
mov eax, edx
pop edi
ret

Function at 0x1006f290
Capabilities:
Get thread local storage value

Disassembly:
test esi, esi
je 0x1006f2e5
mov eax, dword [0x101f3dec]
push ebx
push edi
test eax, eax
jns 0x1006f2a3
xor edi, edi
jmp 0x1006f2ac
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov edi, eax
mov ebx, dword [esi + 4]
push dword [ebx*4 + 0x10027c6c]
push 0xfe
push esi
call sub.msvcrt.dll_memset
mov dword [esi], 0
mov eax, dword [edi + ebx*8 + 0x28]
add esp, 0xc
test eax, eax
je 0x1006f2db
mov dword [eax], esi
mov dword [edi + ebx*8 + 0x28], esi
pop edi
pop ebx
ret
mov dword [edi + ebx*8 + 0x24], esi
mov dword [edi + ebx*8 + 0x28], esi
pop edi
pop ebx
ret
Function at 0x10090ff0
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push esi
mov esi, ecx
mov ecx, dword [sym.imp.kernel32.dll_TlsGetValue]
push edi
mov edi, dword [esi + 0x1342c]
mov dword [esi], 0x1003c238
test edi, edi
je 0x1009102d
mov eax, dword [0x101f3dec]
test eax, eax
jns 0x10091019
xor eax, eax
jmp 0x1009101c
push eax
call ecx
push edi
push 0
push dword [eax]
call dword [sym.imp.kernel32.dll_HeapFree]
mov ecx, dword [sym.imp.kernel32.dll_TlsGetValue]
mov edi, dword [esi + 0x13444]
test edi, edi
je 0x10091052
mov eax, dword [0x101f3dec]
test eax, eax
jns 0x10091044
xor eax, eax
jmp 0x10091047
push eax
call ecx
push edi
push 0
push dword [eax]
call dword [sym.imp.kernel32.dll_HeapFree]
mov ecx, dword [esi + 0x134b8]
test ecx, ecx
je 0x1009106c
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [esi + 0x134b8], 0
lea eax, [esi + 0x134bc]
call fcn.10090f30
pop edi
mov ecx, esi
pop esi
jmp fcn.101485a0

Function at 0x1009d9b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x1009d9bf
pop dword [ebp - 0x24]
mov eax, 0xeec9c5a
add eax, 0x11d3d65
sub dword [ebp - 0x24], eax
push 0x40
push 0x1000
push 0x7f452
push 0
mov eax, 0x7d5542ae
add eax, 0x92aacde2
add eax, dword [ebp - 0x24]
call dword [eax]
mov ecx, 0x50f9
mov edi, eax
mov edx, 0x10207000
add edx, dword [ebp - 0x24]
mov esi, 0x2ff9e9cd
sub esi, 0xae9b1e47
add dword [ebp - 0x18], ecx
mov ebx, dword [edx]
mov dword [ebp - 0x20], 0x90ce0ee9
xor ebx, esi
sub dword [ebp - 0xc], 0xa21afb26
mov dword [edi], ebx
mov dword [ebp - 4], 0xb47b79f2
add edi, 0xde1896ef
sub edi, 0xde1896eb
add edx, 0x96e50d5a
add edx, 0x691af2aa
loop 0x1009da12
add eax, 0x136b7
mov ebx, eax
add eax, 0x1ac9c89c
add eax, 0xe5363769
mov ecx, 0x10000000
add ecx, dword [ebp - 0x24]
call ebx
leave
ret

Function at 0x100ac020
Capabilities:
Get thread local storage value

Disassembly:
cmp esi, 0xaaaaaaa
jbe 0x100ac02b
xor eax, eax
ret
mov eax, dword [0x101f3dec]
test eax, eax
jns 0x100ac038
xor eax, eax
jmp 0x100ac03f
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
lea ecx, [esi + esi*2]
add ecx, ecx
add ecx, ecx
add ecx, ecx
push ecx
push 0
push dword [eax]
call dword [sym.imp.kernel32.dll_HeapAlloc]
ret

Function at 0x100ac480
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push esi
mov esi, dword [ebx + 4]
test esi, esi
je 0x100ac4ed
mov eax, dword [esi + 0xc]
cmp eax, dword [edi + 0xc]
jb 0x100ac4bd
mov eax, dword [0x101f3dec]
test eax, eax
jns 0x100ac4a9
xor eax, eax
push edi
push eax
push dword [eax]
call dword [sym.imp.kernel32.dll_HeapFree]
pop esi
ret
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
push edi
push 0
push dword [eax]
call dword [sym.imp.kernel32.dll_HeapFree]
pop esi
ret
test esi, esi
je 0x100ac4ed
mov eax, dword [0x101f3dec]
test eax, eax
jns 0x100ac4db
xor eax, eax
push esi
push eax
push dword [eax]
call dword [sym.imp.kernel32.dll_HeapFree]
mov dword [ebx + 4], edi
pop esi
ret
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
push esi
push 0
push dword [eax]
call dword [sym.imp.kernel32.dll_HeapFree]
mov dword [ebx + 4], edi
pop esi
ret
Function at 0x100ac540
Capabilities:
Get thread local storage value

Disassembly:
mov edx, dword [esi + 4]
push edi
test edx, edx
je 0x100ac558
mov edi, dword [edx + 0xc]
cmp edi, eax
jb 0x100ac558
mov dword [esi + 4], 0
jmp 0x100ac5c2
mov ecx, dword [esi + 8]
cmp ecx, eax
jbe 0x100ac561
mov eax, ecx
cmp eax, 0xffffffff
je 0x100ac5d6
cmp eax, 0xffffcfff
ja 0x100ac5d6
lea edi, [eax + 0x3000]
cmp edi, 0xffffffef
ja 0x100ac5d6
mov eax, dword [0x101f3dec]
push ebx
lea ebx, [edi + 0x10]
test eax, eax
jns 0x100ac589
xor eax, eax
jmp 0x100ac590
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
push ebx
push 0
push dword [eax]
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov edx, eax
pop ebx
test edx, edx
jne 0x100ac5a9
mov eax, 0x8007000e
pop edi
ret
mov eax, dword [esi]
mov ecx, edi
test eax, eax
je 0x100ac5ba
add ecx, dword [eax + 0xc]
mov eax, dword [eax]
test eax, eax
jne 0x100ac5b1
cmp ecx, dword [esi + 8]
jbe 0x100ac5c2
mov dword [esi + 8], ecx
mov eax, dword [esi]
mov dword [edx], eax
mov dword [edx + 0xc], edi
mov dword [edx + 8], 0
mov dword [esi], edx
xor eax, eax
pop edi
ret
mov eax, 0x80070216
pop edi
ret

Function at 0x100ace50
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push edi
mov edi, eax
cmp ecx, edi
jae 0x100acec5
lea eax, [ecx + ecx*2]
push ebx
add eax, eax
push esi
lea esi, [edx + eax*8 + 0x2c]
sub edi, ecx
lea eax, [esi - 0x2c]
test eax, eax
je 0x100acebd
mov eax, dword [esi - 4]
mov edx, dword [esi - 0xc]
xor ecx, ecx
call fcn.100acf30
cmp byte [esi], 0
mov dword [esi - 4], 0
je 0x100aceaf
mov ebx, dword [esi - 0xc]
test ebx, ebx
je 0x100aceac
mov eax, dword [0x101f3dec]
test eax, eax
jns 0x100ace9a
xor eax, eax
jmp 0x100acea1
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
push ebx
push 0
push dword [eax]
call dword [sym.imp.kernel32.dll_HeapFree]
mov byte [esi], 0
mov dword [esi - 0xc], 0
mov dword [esi - 8], 0
add esi, 0x30
dec edi
jne 0x100ace66
pop esi
pop ebx
pop edi
ret

Function at 0x100aced0
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [esi + 8]
mov edx, dword [esi]
xor ecx, ecx
call fcn.100ace50
cmp byte [esi + 0xc], 0
mov dword [esi + 8], 0
je 0x100acf14
push edi
mov edi, dword [esi]
test edi, edi
je 0x100acf0f
mov eax, dword [0x101f3dec]
test eax, eax
jns 0x100acefd
xor eax, eax
jmp 0x100acf04
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
push edi
push 0
push dword [eax]
call dword [sym.imp.kernel32.dll_HeapFree]
mov byte [esi + 0xc], 0
pop edi
mov dword [esi + 4], 0
mov dword [esi], 0
ret
Function at 0x100acf30
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebx
mov ebx, eax
cmp ecx, ebx
jae 0x100acf96
push esi
lea eax, [ecx + ecx*4]
push edi
lea esi, [edx + eax*4 + 0x10]
sub ebx, ecx
lea eax, [esi - 0x10]
test eax, eax
je 0x100acf8e
cmp byte [esi], 0
mov dword [esi - 4], 0
je 0x100acf80
mov edi, dword [esi - 0xc]
test edi, edi
je 0x100acf7d
mov eax, dword [0x101f3dec]
test eax, eax
jns 0x100acf6b
xor eax, eax
jmp 0x100acf72
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
push edi
push 0
push dword [eax]
call dword [sym.imp.kernel32.dll_HeapFree]
mov byte [esi], 0
mov dword [esi - 0xc], 0
mov dword [esi - 8], 0
add esi, 0x14
dec ebx
jne 0x100acf44
pop edi
pop esi
pop ebx
ret

Function at 0x100acfa0
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [esi + 8]
mov edx, dword [esi]
xor ecx, ecx
call fcn.100acf30
cmp byte [esi + 0xc], 0
mov dword [esi + 8], 0
je 0x100acfe4
push edi
mov edi, dword [esi]
test edi, edi
je 0x100acfdf
mov eax, dword [0x101f3dec]
test eax, eax
jns 0x100acfcd
xor eax, eax
jmp 0x100acfd4
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
push edi
push 0
push dword [eax]
call dword [sym.imp.kernel32.dll_HeapFree]
mov byte [esi + 0xc], 0
pop edi
mov dword [esi + 4], 0
mov dword [esi], 0
ret

Function at 0x100d78a0
Capabilities:
Get thread local storage value

Disassembly:
mov ecx, dword [sym.imp.kernel32.dll_TlsGetValue]
push ebx
mov ebx, dword [sym.imp.kernel32.dll_HeapFree]
push esi
mov esi, dword [edi + 0x18]
test esi, esi
je 0x100d78d2
mov eax, dword [0x101f3dec]
test eax, eax
jns 0x100d78c2
xor eax, eax
jmp 0x100d78c5
push eax
call ecx
push esi
push 0
push dword [eax]
call ebx
mov ecx, dword [sym.imp.kernel32.dll_TlsGetValue]
mov esi, dword [edi + 0x1c]
mov dword [edi + 0x18], 0
test esi, esi
je 0x100d78f7
mov eax, dword [0x101f3dec]
test eax, eax
jns 0x100d78ed
xor eax, eax
jmp 0x100d78f0
push eax
call ecx
push esi
push 0
push dword [eax]
call ebx
mov esi, dword [edi + 0x20]
mov dword [edi + 0x1c], 0
test esi, esi
je 0x100d7920
mov eax, dword [0x101f3dec]
test eax, eax
jns 0x100d7912
xor eax, eax
jmp 0x100d7919
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
push esi
push 0
push dword [eax]
call ebx
mov esi, dword [edi + 0x28]
mov dword [edi + 0x20], 0
test esi, esi
je 0x100d7949
mov eax, dword [0x101f3dec]
test eax, eax
jns 0x100d793b
xor eax, eax
jmp 0x100d7942
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
push esi
push 0
push dword [eax]
call ebx
lea esi, [edi + 0x1d0]
mov dword [edi + 0x28], 0
call fcn.100e3000
push 0xd4
lea eax, [edi + 0x1e0]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
pop esi
pop ebx
ret