joyce8/EMBER2024-capa huggingface dataset:
Function at 0x3f00f4b2
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [0x3f0118e8], ebx
push esi
push edi
jne 0x3f00f532
push 0x3f00f610
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x3f00f56d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x3f00f604
push edi
call esi
test eax, eax
mov dword [0x3f0118e8], eax
je 0x3f00f56d
push 0x3f00f5f4
push edi
call esi
push 0x3f00f5e0
push edi
mov dword [0x3f0118ec], eax
call esi
cmp dword [0x3f011614], 2
mov dword [0x3f0118f0], eax
jne 0x3f00f532
push 0x3f00f5c4
push edi
call esi
test eax, eax
mov dword [0x3f0118f8], eax
je 0x3f00f532
push 0x3f00f5ac
push edi
call esi
mov dword [0x3f0118f4], eax
mov eax, dword [0x3f0118f4]
test eax, eax
je 0x3f00f577
call eax
test eax, eax
je 0x3f00f55e
lea ecx, [ebp - 4]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [0x3f0118f8]
test eax, eax
je 0x3f00f55e
test byte [ebp - 8], 1
jne 0x3f00f577
cmp dword [0x3f011620], 4
jb 0x3f00f571
or byte [ebp + 0x12], 0x20
jmp 0x3f00f596
xor eax, eax
jmp 0x3f00f5a6
or byte [ebp + 0x12], 4
jmp 0x3f00f596
mov eax, dword [0x3f0118ec]
test eax, eax
je 0x3f00f596
call eax
mov ebx, eax
test ebx, ebx
je 0x3f00f596
mov eax, dword [0x3f0118f0]
test eax, eax
je 0x3f00f596
push ebx
call eax
mov ebx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [0x3f0118e8]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x3f00f844
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
push edi
push 4
pop eax
call fcn.3f0067dc
mov ebx, esp
push 0x1c
lea eax, [ebp - 0x24]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x3f00f8d9
mov edi, dword [ebp - 0x20]
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x44]
lea esi, [eax - 1]
not esi
and esi, ebx
sub esi, eax
mov dword [ebp - 4], eax
mov eax, dword [0x3f011614]
mov ecx, eax
dec ecx
neg ecx
sbb ecx, ecx
and ecx, 0xffff1000
add ecx, 0x11000
add ecx, edi
cmp esi, ecx
jb 0x3f00f8d9
cmp eax, 1
je 0x3f00f8f1
mov ebx, edi
mov edi, 0x1000
push 0x1c
lea eax, [ebp - 0x24]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x3f00f8d9
add ebx, dword [ebp - 0x18]
test dword [ebp - 0x14], edi
je 0x3f00f8ae
test byte [ebp - 0xf], 1
mov ebx, dword [ebp - 0x24]
je 0x3f00f8d5
xor eax, eax
inc eax
jmp 0x3f00f90d
cmp esi, ebx
jae 0x3f00f8dd
xor eax, eax
jmp 0x3f00f90d
push 4
push edi
push dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x3f011614]
jmp 0x3f00f8f3
mov ebx, esi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 8]
push ecx
inc eax
push eax
push dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x54]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10002780
Capabilities:
Get thread local storage value

Disassembly:
push ebx
mov eax, dword [0x1002b150]
push esi
push edi
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
lea ebp, [eax + 0x49c]
lea ecx, [eax + 0x4b0]
mov esi, eax
push ecx
push ebp
mov dword [ebp], 0x20
lea eax, [esi + 0x4b4]
push 0xffffffffffffffff
mov dword [esi + 0x4a0], eax
mov dword [esi + 0x4b0], 2
mov eax, dword [esi + 0x4a0]
push eax
call fcn.1000e960
add esp, 0x10
mov dword [esi + 0x5d84], eax
test eax, eax
jne 0x10002941
mov ecx, dword [esp + 0x14]
test ecx, ecx
jle 0x100027f8
mov eax, dword [esi + 0x4a0]
cmp byte [eax], cl
je 0x100027f8
mov eax, 0xfffffff7
pop ebp
pop edi
pop esi
pop ebx
ret
mov eax, dword [esi + 0x4ac]
xor edi, edi
xor ebx, ebx
cmp dword [eax + 0xf4], edi
jle 0x100028b3
cmp dword [ebp], 1
ja 0x10002874
add ebx, 0x1f
mov eax, dword [esi + 0x4a0]
lea ecx, [esi + 0x4b5]
lea edx, [esi + 0x4b0]
mov al, byte [eax]
push edx
push ebp
mov byte [esi + 0x4b4], al
push 0xffffffffffffffff
mov dword [ebp], 0x1f
mov dword [esi + 0x4a0], ecx
mov dword [esi + 0x4b0], 2
mov ecx, dword [esi + 0x4a0]
push ecx
call fcn.1000e960
add esp, 0x10
mov dword [esi + 0x5d84], eax
test eax, eax
jne 0x100028a3
lea eax, [esi + 0x4b4]
mov dword [esi + 0x4a0], eax
inc dword [ebp]
mov eax, dword [esi + 0x4a0]
cmp byte [eax], 0xff
jne 0x10002885
cmp byte [eax + 1], 0xd8
je 0x100028ae
inc eax
mov dword [esi + 0x4a0], eax
dec dword [ebp]
mov ecx, dword [esi + 0x4ac]
cmp dword [ecx + 0xf4], ebx
jg 0x1000280e
jmp 0x100028b3
mov eax, dword [esi + 0x5d84]
pop ebp
pop edi
pop esi
pop ebx
ret
mov edi, 1
test edi, edi
je 0x1000293c
mov eax, dword [ebp]
lea ecx, [esi + 0x4b0]
neg eax
mov dword [esi + 0x4b0], 3
push ecx
mov edx, dword [esi + 0x4a0]
push ebp
push eax
push edx
call fcn.1000e960
add esp, 0x10
mov dword [esi + 0x5d84], eax
test eax, eax
jne 0x10002941
lea eax, [esi + 0x4b4]
lea ecx, [esi + 0x4b0]
push ecx
mov dword [ebp], 2
push ebp
mov dword [esi + 0x4a0], eax
mov dword [esi + 0x4b0], 2
push 0xffffffffffffffff
mov eax, dword [esi + 0x4a0]
push eax
call fcn.1000e960
add esp, 0x10
mov ecx, eax
mov dword [esi + 0x5d84], eax
cmp ecx, 1
mov eax, 0
pop ebp
adc eax, 0xffffffff
pop edi
and eax, ecx
pop esi
pop ebx
ret
mov eax, 0xfffffff7
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x10002950
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 4
mov eax, dword [0x1002b150]
push ebx
push esi
push edi
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
lea edi, [eax + 0x49c]
lea ebp, [eax + 0x4b0]
mov ebx, eax
push ebp
push edi
mov dword [edi], 0x20
lea eax, [ebx + 0x4b4]
push 0xffffffffffffffff
mov dword [ebx + 0x4a0], eax
mov dword [ebp], 2
mov eax, dword [ebx + 0x4a0]
push eax
call fcn.1000e960
add esp, 0x10
mov dword [ebx + 0x5d84], eax
test eax, eax
jne 0x10002aac
xor esi, esi
mov eax, dword [ebx + 0x4ac]
mov dword [esp + 0x10], esi
cmp dword [eax + 0xf4], esi
jle 0x10002a66
cmp dword [edi], 1
ja 0x10002a1d
add esi, 0x1f
mov eax, dword [ebx + 0x4a0]
lea ecx, [ebx + 0x4b5]
push ebp
mov al, byte [eax]
push edi
push 0xffffffffffffffff
mov byte [ebx + 0x4b4], al
mov dword [edi], 0x1f
mov dword [ebx + 0x4a0], ecx
mov dword [ebp], 2
mov ecx, dword [ebx + 0x4a0]
push ecx
call fcn.1000e960
add esp, 0x10
mov dword [ebx + 0x5d84], eax
test eax, eax
jne 0x10002a50
lea eax, [ebx + 0x4b4]
mov dword [ebx + 0x4a0], eax
inc dword [edi]
mov ecx, dword [ebx + 0x4a0]
cmp byte [ecx], 0xff
jne 0x10002a33
mov al, byte [ecx + 1]
cmp al, 0xc0
jb 0x10002a33
cmp al, 0xff
jb 0x10002a5e
inc ecx
mov dword [ebx + 0x4a0], ecx
dec dword [edi]
mov eax, dword [ebx + 0x4ac]
cmp dword [eax + 0xf4], esi
jg 0x100029c3
jmp 0x10002a66
mov eax, dword [ebx + 0x5d84]
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
mov dword [esp + 0x10], 1
cmp dword [esp + 0x10], 0
je 0x10002aa7
mov eax, dword [edi]
push ebp
push edi
mov dword [ebp], 3
neg eax
push eax
mov ecx, dword [ebx + 0x4a0]
push ecx
call fcn.1000e960
add esp, 0x10
mov ecx, eax
mov dword [ebx + 0x5d84], eax
cmp ecx, 1
mov eax, 0
pop ebp
adc eax, 0xffffffff
pop edi
and eax, ecx
pop esi
pop ebx
add esp, 4
ret
mov eax, 0xfffffff7
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
Function at 0x10002ac0
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 0x20
mov eax, dword [0x1002b150]
push ebx
push esi
push edi
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edx, dword [eax + 0x4ac]
lea esi, [esp + 0x20]
mov ecx, dword [edx + 0x3c]
mov ebx, dword [edx + 0x40]
add edx, 0x3c
mov dword [esi], ecx
mov dword [esi + 4], ebx
mov ebp, dword [edx + 8]
mov ecx, dword [edx + 0xc]
mov dword [esi + 8], ebp
xor edx, edx
mov dword [esi + 0xc], ecx
cmp byte [eax + 0x4a4], dl
jbe 0x10002b7b
lea edi, [eax + 0x4f4]
mov ecx, dword [esp + 0x38]
mov esi, dword [esp + 0x34]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], edx
mov ecx, dword [edi]
mov ebx, dword [eax + 0x4ac]
add edi, 4
add esi, 4
mov ebp, dword [esp + ecx*4 + 0x20]
mov ecx, dword [esp + 0x10]
add dword [esp + 0x10], 4
mov dword [ebx + ecx + 0x3c], ebp
mov ecx, dword [edi - 0x14]
mov ebp, ecx
shl ecx, 5
add ecx, ebp
add ecx, eax
add ecx, 0x62a8
mov dword [esi - 4], ecx
mov ecx, dword [esp + 0x14]
add dword [esp + 0x14], 4
mov ebx, dword [edi - 0x24]
mov ebp, ebx
shl ebx, 4
add ebx, ebp
shl ebx, 4
add ebx, eax
add ebx, 0x632c
mov dword [ecx], ebx
xor ecx, ecx
mov dword [edi - 4], edx
inc edx
mov cl, byte [eax + 0x4a4]
cmp ecx, edx
ja 0x10002b17
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x20
ret
Function at 0x10003f60
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 0xc4
mov eax, dword [0x1002b150]
push ebx
push esi
push edi
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
lea ecx, [eax + 0x4b0]
mov esi, eax
push ecx
lea eax, [esi + 0x4b4]
mov dword [esi + 0x49c], 2
lea edx, [esi + 0x49c]
mov dword [esi + 0x4a0], eax
mov dword [esi + 0x4b0], 2
push edx
mov eax, dword [esi + 0x4a0]
push 0xffffffffffffffff
push eax
call fcn.1000e960
add esp, 0x10
mov dword [esi + 0x5d84], eax
test eax, eax
jne 0x10004186
cmp dword [esi + 0x49c], 2
je 0x10003fde
mov eax, 0xfffffff7
pop ebp
pop edi
pop esi
pop ebx
add esp, 0xc4
ret
mov eax, dword [esi + 0x4a0]
xor ecx, ecx
xor ebx, ebx
mov cl, byte [eax]
mov dword [esi + 0x4a8], ecx
mov eax, dword [esi + 0x4a0]
inc eax
mov dword [esi + 0x4a0], eax
mov bl, byte [eax]
mov eax, dword [esi + 0x4a8]
shl eax, 8
or ebx, eax
sub ebx, 2
mov dword [esi + 0x4a8], ebx
cmp ebx, 0x204
jbe 0x1000402b
mov eax, 0xffffffcf
pop ebp
pop edi
pop esi
pop ebx
add esp, 0xc4
ret
test ebx, ebx
jle 0x10004184
lea eax, [esi + 0x4b0]
lea ecx, [esi + 0x49c]
lea edx, [esp + 0x13]
push eax
mov dword [esi + 0x49c], 1
mov dword [esi + 0x4b0], 2
push ecx
push 0xffffffffffffffff
push edx
call fcn.1000e960
add esp, 0x10
mov dword [esi + 0x5d84], eax
test eax, eax
jne 0x10004191
dec ebx
test byte [esp + 0x13], 0xf0
je 0x10004103
lea eax, [esp + 0x54]
lea ecx, [esi + 0x4b0]
push ecx
lea edx, [esi + 0x49c]
push edx
mov dword [esi + 0x4a0], eax
mov dword [esi + 0x49c], 0x80
mov dword [esi + 0x4b0], 2
push 0xffffffffffffffff
mov eax, dword [esi + 0x4a0]
push eax
call fcn.1000e960
add esp, 0x10
mov dword [esi + 0x5d84], eax
test eax, eax
jne 0x100041a2
mov al, byte [esp + 0x13]
xor ecx, ecx
and al, 0xf
lea ebp, [esp + 0x54]
mov cl, al
mov edx, 0x40
mov eax, dword [esi + 0x4ac]
mov edi, dword [eax + ecx*4 + 0x3c]
xor eax, eax
xor ecx, ecx
mov al, byte [ebp]
mov cl, byte [ebp + 1]
shl eax, 8
add edi, 4
or eax, ecx
add ebp, 2
dec edx
mov dword [edi - 4], eax
jne 0x100040e6
jmp 0x10004176
lea eax, [esp + 0x14]
lea ecx, [esi + 0x4b0]
push ecx
lea edx, [esi + 0x49c]
push edx
mov dword [esi + 0x4a0], eax
mov dword [esi + 0x49c], 0x40
mov dword [esi + 0x4b0], 2
push 0xffffffffffffffff
mov eax, dword [esi + 0x4a0]
push eax
call fcn.1000e960
add esp, 0x10
mov dword [esi + 0x5d84], eax
test eax, eax
jne 0x100041b3
mov al, byte [esp + 0x13]
xor ecx, ecx
and al, 0xf
lea edi, [esp + 0x14]
mov cl, al
mov eax, dword [esi + 0x4ac]
mov edx, dword [eax + ecx*4 + 0x3c]
mov eax, 0x40
xor ecx, ecx
inc edi
add edx, 4
mov cl, byte [edi - 1]
dec eax
mov dword [edx - 4], ecx
jne 0x10004167
sub ebx, dword [esi + 0x49c]
test ebx, ebx
jg 0x10004033
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0xc4
ret
mov eax, dword [esi + 0x5d84]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0xc4
ret
mov eax, dword [esi + 0x5d84]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0xc4
ret
mov eax, dword [esi + 0x5d84]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0xc4
ret
Function at 0x100041d0
Capabilities:
Get thread local storage value

Disassembly:
push ebx
mov eax, dword [0x1002b150]
push esi
push edi
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
lea ebp, [eax + 0x49c]
lea edi, [eax + 0x4b4]
lea esi, [eax + 0x4b0]
mov ebx, eax
push esi
mov dword [ebp], 2
push ebp
mov dword [ebx + 0x4a0], edi
push 0xffffffffffffffff
mov dword [esi], 2
mov eax, dword [ebx + 0x4a0]
push eax
call fcn.1000e960
add esp, 0x10
mov dword [ebx + 0x5d84], eax
test eax, eax
jne 0x100042d1
cmp dword [ebp], 2
je 0x10004238
mov eax, 0xfffffff7
pop ebp
pop edi
pop esi
pop ebx
ret
mov ecx, dword [ebx + 0x4a0]
xor eax, eax
mov al, byte [ecx]
mov dword [ebx + 0x4a8], eax
xor eax, eax
mov ecx, dword [ebx + 0x4a0]
inc ecx
mov dword [ebx + 0x4a0], ecx
mov al, byte [ecx]
mov ecx, dword [ebx + 0x4a8]
shl ecx, 8
push esi
or eax, ecx
push ebp
sub eax, 2
push 0xffffffffffffffff
mov dword [ebx + 0x4a8], eax
mov dword [ebp], eax
mov dword [ebx + 0x4a0], edi
mov dword [esi], 2
mov edi, dword [ebx + 0x4a0]
push edi
call fcn.1000e960
add esp, 0x10
mov dword [ebx + 0x5d84], eax
test eax, eax
jne 0x100042d1
mov eax, dword [ebp]
cmp dword [ebx + 0x4a8], eax
je 0x100042ae
mov eax, 0xffffffcc
pop ebp
pop edi
pop esi
pop ebx
ret
mov eax, dword [ebx + 0x4a0]
xor ecx, ecx
xor edx, edx
mov cl, byte [eax]
shl ecx, 8
mov dl, byte [eax + 1]
or ecx, edx
mov eax, dword [esp + 0x14]
mov dword [eax], ecx
xor eax, eax
add dword [ebx + 0x4a0], 2
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x100042e0
Capabilities:
Get thread local storage value

Disassembly:
push ebx
mov eax, dword [0x1002b150]
push esi
push edi
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
lea ebp, [eax + 0x49c]
lea edi, [eax + 0x4b4]
lea esi, [eax + 0x4b0]
mov ebx, eax
push esi
mov dword [ebp], 2
push ebp
mov dword [ebx + 0x4a0], edi
push 0xffffffffffffffff
mov dword [esi], 2
mov eax, dword [ebx + 0x4a0]
push eax
call fcn.1000e960
add esp, 0x10
mov dword [ebx + 0x5d84], eax
test eax, eax
jne 0x1000441a
cmp dword [ebp], 2
je 0x10004348
mov eax, 0xfffffff7
pop ebp
pop edi
pop esi
pop ebx
ret
mov ecx, dword [ebx + 0x4a0]
xor eax, eax
mov al, byte [ecx]
mov dword [ebx + 0x4a8], eax
xor eax, eax
mov ecx, dword [ebx + 0x4a0]
inc ecx
mov dword [ebx + 0x4a0], ecx
mov al, byte [ecx]
mov ecx, dword [ebx + 0x4a8]
shl ecx, 8
or eax, ecx
sub eax, 2
mov dword [ebx + 0x4a8], eax
cmp eax, 0x20
jbe 0x1000438c
mov eax, 0xffffffde
pop ebp
pop edi
pop esi
pop ebx
ret
push esi
mov dword [ebp], eax
push ebp
mov dword [ebx + 0x4a0], edi
push 0xffffffffffffffff
mov dword [esi], 2
mov eax, dword [ebx + 0x4a0]
push eax
call fcn.1000e960
add esp, 0x10
mov dword [ebx + 0x5d84], eax
test eax, eax
jne 0x1000441a
mov eax, dword [ebp]
cmp dword [ebx + 0x4a8], eax
je 0x100043cd
mov eax, 0xffffffcc
pop ebp
pop edi
pop esi
pop ebx
ret
mov eax, dword [ebx + 0x4a0]
xor ecx, ecx
mov cl, byte [eax]
mov eax, dword [ebx + 0x4ac]
mov dword [eax + 4], ecx
mov eax, dword [ebx + 0x4a0]
inc eax
xor ecx, ecx
mov dword [ebx + 0x4a0], eax
mov edx, dword [ebx + 0x4ac]
mov cl, byte [eax]
mov eax, dword [edx + 4]
shl eax, 8
or ecx, eax
mov dword [edx + 4], ecx
inc dword [ebx + 0x4a0]
mov eax, dword [ebx + 0x4ac]
add edx, 4
mov edx, dword [eax + 4]
mov dword [eax + 0x130], edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x10004cb0
Capabilities:
Get thread local storage value

Disassembly:
push ebx
mov eax, dword [0x1002b150]
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, eax
mov eax, dword [eax + 0x5e34]
mov dword [ecx + 0x5e54], eax
mov edx, dword [ecx + 0x5e38]
mov dword [ecx + 0x5e58], edx
mov eax, dword [ecx + 0x5e50]
cmp eax, 3
ja case.default.0x10004ce8
jmp dword [eax*4 + 0x10004dd4]
mov eax, dword [ecx + 0x5e3c]
pop edi
pop esi
mov dword [ecx + 0x5e5c], eax
mov edx, dword [ecx + 0x5e40]
pop ebx
mov dword [ecx + 0x5e60], edx
ret
mov eax, dword [ecx + 0x5e3c]
sub edx, edx
mov dword [ecx + 0x5e5c], eax
mov ebx, dword [ecx + 0x5e58]
mov edi, dword [ecx + 0x5e18]
mov eax, ebx
div edi
mov eax, dword [ecx + 0x5e68]
lea esi, [eax + edx]
cmp esi, edi
ja 0x10004d43
add eax, ebx
pop edi
dec eax
pop esi
pop ebx
mov dword [ecx + 0x5e60], eax
ret
sub ebx, edx
add ebx, edi
pop edi
dec ebx
pop esi
mov dword [ecx + 0x5e60], ebx
pop ebx
ret
mov eax, dword [ecx + 0x5e64]
mov edx, dword [ecx + 0x5e54]
lea esi, [edx + eax]
cmp dword [ecx + 0x5c50], esi
jb 0x10004d6d
add eax, edx
jmp 0x10004d73
mov eax, dword [ecx + 0x5e1c]
dec eax
pop edi
pop esi
mov dword [ecx + 0x5e5c], eax
mov eax, dword [ecx + 0x5e18]
pop ebx
add eax, dword [ecx + 0x5e58]
dec eax
mov dword [ecx + 0x5e60], eax
ret
mov eax, dword [ecx + 0x5e1c]
dec eax
mov dword [ecx + 0x5e5c], eax
mov eax, dword [ecx + 0x5e58]
mov edx, dword [ecx + 0x5e68]
lea esi, [eax + edx]
cmp esi, dword [ecx + 0x5c54]
ja 0x10004dc2
add eax, edx
pop edi
dec eax
pop esi
pop ebx
mov dword [ecx + 0x5e60], eax
ret
mov eax, dword [ecx + 0x5e20]
dec eax
mov dword [ecx + 0x5e60], eax
pop edi
pop esi
pop ebx
ret
Function at 0x10004df0
Capabilities:
Get thread local storage value

Disassembly:
push ebx
mov eax, dword [0x1002b150]
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, dword [eax + 0x5e3c]
mov ebx, dword [eax + 0x5e14]
mov ecx, eax
inc esi
mov eax, esi
sub edx, edx
div ebx
test edx, edx
je 0x10004e60
sub edx, edx
mov dword [ecx + 0x5e34], esi
mov esi, dword [ecx + 0x5e3c]
mov ebx, dword [ecx + 0x5e14]
mov edi, dword [ecx + 0x5e44]
mov eax, esi
div ebx
add edx, edi
cmp edx, ebx
jb 0x10004e51
mov eax, ebx
sub edx, edx
div edi
pop edi
lea eax, [esi + edx]
pop esi
mov dword [ecx + 0x5e3c], eax
xor eax, eax
pop ebx
ret
lea eax, [esi + edi]
pop edi
pop esi
mov dword [ecx + 0x5e3c], eax
xor eax, eax
pop ebx
ret
mov edi, dword [ecx + 0x5e40]
sub edx, edx
inc edi
mov eax, edi
div dword [ecx + 0x5e18]
test edx, edx
je 0x10004eb7
mov esi, dword [ecx + 0x5e34]
sub edx, edx
mov eax, esi
div ebx
sub esi, edx
mov dword [ecx + 0x5e34], esi
mov eax, dword [ecx + 0x5e44]
add eax, esi
dec eax
mov dword [ecx + 0x5e3c], eax
mov eax, dword [ecx + 0x5e40]
inc eax
pop edi
pop esi
mov dword [ecx + 0x5e38], eax
mov edx, dword [ecx + 0x5e28]
xor eax, eax
pop ebx
add dword [ecx + 0x5e40], edx
ret
cmp dword [ecx + 0x5c50], esi
jle 0x10004f01
sub edx, edx
mov dword [ecx + 0x5e34], esi
mov eax, dword [ecx + 0x5e44]
add dword [ecx + 0x5e3c], eax
mov eax, dword [ecx + 0x5e38]
mov esi, eax
div dword [ecx + 0x5e18]
sub esi, edx
pop edi
mov dword [ecx + 0x5e38], esi
mov eax, dword [ecx + 0x5e28]
add eax, esi
pop esi
dec eax
pop ebx
mov dword [ecx + 0x5e40], eax
mov eax, 1
ret
cmp dword [ecx + 0x5c54], edi
jle 0x10004f42
mov dword [ecx + 0x5e34], 0
mov eax, dword [ecx + 0x5e44]
dec eax
mov dword [ecx + 0x5e3c], eax
mov eax, dword [ecx + 0x5e40]
inc eax
pop edi
pop esi
mov dword [ecx + 0x5e38], eax
mov edx, dword [ecx + 0x5e28]
mov eax, 1
pop ebx
add dword [ecx + 0x5e40], edx
ret
mov eax, 2
pop edi
pop esi
pop ebx
ret

Function at 0x10004f50
Capabilities:
Get thread local storage value

Disassembly:
push esi
mov eax, dword [0x1002b150]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
mov eax, dword [eax + 0x5e90]
test eax, eax
je 0x10004f7c
push eax
call fcn.1000ef20
mov dword [esi + 0x5e90], 0
add esp, 4
mov eax, dword [esi + 0x5e8c]
test eax, eax
je 0x10004f99
push eax
call fcn.1000ef20
mov dword [esi + 0x5e8c], 0
add esp, 4
xor eax, eax
mov dword [esi + 0x5e98], eax
mov dword [esi + 0x5e94], eax
pop esi
ret

Function at 0x10004fb0
Capabilities:
Get thread local storage value

Disassembly:
push esi
mov eax, dword [0x1002b150]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
mov edi, dword [esp + 0xc]
shl edi, 2
push edi
call fcn.1000ef10
add esp, 4
mov dword [esi + 0x5e90], eax
mov dword [esi + 0x5e98], eax
test eax, eax
jne 0x10004fe8
mov eax, 0xffffffff
pop edi
pop esi
ret
push edi
call fcn.1000ef10
add esp, 4
mov dword [esi + 0x5e8c], eax
mov dword [esi + 0x5e94], eax
cmp eax, 1
sbb eax, eax
pop edi
pop esi
ret
Function at 0x10005010
Capabilities:
Get thread local storage value

Disassembly:
push esi
mov eax, dword [0x1002b150]
push edi
push eax
mov edi, 1
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [eax + 0x5e94]
mov edx, dword [eax + 0x5e98]
mov dword [eax + 0x5ea0], 0
cmp dword [eax + 0x5e88], edi
jbe 0x10005063
lea esi, [ecx + 4]
mov ecx, dword [ecx]
add ecx, dword [edx]
cmp ecx, dword [esi]
jne 0x10005063
mov ecx, dword [edx + 4]
add edx, 4
inc edi
add dword [eax + 0x5ea0], ecx
mov ecx, esi
cmp dword [eax + 0x5e88], edi
ja 0x10005041
pop edi
pop esi
ret

Function at 0x10005070
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 8
mov eax, dword [0x1002b150]
push ebx
push esi
push edi
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp dword [esp + 0x20], 0
mov esi, eax
je 0x100050cd
mov edi, dword [esp + 0x24]
test edi, edi
je 0x100050cd
jle 0x100050f3
lea ebp, [esi + 0x5868]
mov ebx, dword [esp + 0x1c]
mov dword [esp + 0x14], edi
mov ecx, dword [ebx]
mov edx, dword [ebp]
mov eax, dword [esi + 0x7b8]
add ebp, 4
imul eax, dword [esp + 0x20]
push eax
add ebx, 4
push ecx
push edx
call fcn.1000eef0
add esp, 0xc
dec dword [esp + 0x14]
jne 0x100050a4
jmp 0x100050f3
mov ecx, dword [esi + 0x5868]
xor eax, eax
cmp dword [esi + 0x7b8], eax
jle 0x100050ea
mov byte [ecx], pe_nt_image_headers32
inc ecx
inc eax
cmp dword [esi + 0x7b8], eax
jg 0x100050dd
mov edi, 1
mov dword [esp + 0x20], edi
mov dword [esp + 0x10], 0
cmp dword [esi + 0x7c0], 0
jle 0x10005170
lea ecx, [esi + 0x5868]
mov eax, dword [esp + 0x20]
dec eax
mov dword [esp + 0x14], eax
mov ebx, dword [esi + 0x7b8]
mov ebp, dword [esi + 0x7b8]
mov edx, dword [esi + 0x7b8]
mov eax, dword [esi + 0x7bc]
imul ebx, dword [esp + 0x14]
imul edx, dword [esp + 0x20]
imul eax, dword [esi + 0x7b8]
add ebx, dword [ecx]
add ebp, ebx
cmp eax, edx
jle 0x1000515d
mov al, byte [ebx]
inc ebx
mov byte [ebp], al
inc ebp
inc edx
mov eax, dword [esi + 0x7b8]
imul eax, dword [esi + 0x7bc]
cmp eax, edx
jg 0x10005144
add ecx, 4
inc dword [esp + 0x10]
mov eax, dword [esp + 0x10]
cmp dword [esi + 0x7c0], eax
jg 0x10005113
cmp dword [esi + 0x7c0], edi
jle 0x100051af
lea ebp, [esi + edi*4 + 0x5868]
lea ebx, [esi + edi*4 + 0x5864]
mov edx, dword [ebp]
mov eax, dword [esi + 0x7b8]
mov ecx, dword [ebx]
add ebp, 4
imul eax, dword [esi + 0x7bc]
push eax
inc edi
push ecx
push edx
call fcn.1000eef0
add esp, 0xc
cmp dword [esi + 0x7c0], edi
jg 0x10005186
pop ebp
pop edi
pop esi
pop ebx
add esp, 8
ret
Function at 0x100051c0
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 8
mov eax, dword [0x1002b150]
push ebx
push esi
push edi
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebp, dword [esp + 0x20]
mov dword [esp + 0x10], eax
mov edi, dword [ebp + 8]
mov edx, dword [ebp]
cmp edi, edx
jl 0x100052ac
mov ecx, dword [ebp + 4]
mov eax, dword [ebp + 0xc]
cmp ecx, eax
jg 0x100052ac
sub edi, edx
sub eax, ecx
inc edi
inc eax
xor esi, esi
mov dword [esp + 0x14], eax
cmp eax, esi
je 0x100052ac
mov eax, dword [ebp + 4]
mov edx, dword [esp + 0x10]
add eax, esi
mov ecx, dword [edx + eax*4 + 0x5868]
mov eax, dword [edx + 0x7b8]
mov edx, dword [ebp]
cmp eax, 0xa
je 0x10005245
imul edx, eax
imul eax, edi
push eax
add ecx, edx
mov edx, dword [esp + 0x20]
push ecx
mov eax, dword [edx + esi*4]
push eax
call fcn.1000eef0
add esp, 0xc
jmp 0x100052a1
test dl, 1
jne 0x1000526f
imul eax, edx
cdq
sub eax, edx
lea edx, [edi + 1]
sar eax, 1
shr edx, 1
add eax, ecx
mov ecx, dword [esp + 0x1c]
push edx
push eax
mov edx, dword [ecx + esi*4]
push edx
call fcn.1000eef0
add esp, 0xc
jmp 0x100052a1
imul eax, edx
cdq
sub eax, edx
mov edx, dword [esp + 0x1c]
sar eax, 1
mov ebx, dword [edx + esi*4]
add ecx, eax
xor edx, edx
test edi, edi
je 0x100052a1
test dl, 1
mov al, byte [ecx]
jne 0x10005296
shr al, 4
inc ecx
mov byte [ebx], al
jmp 0x1000529c
shl al, 4
or byte [ebx], al
inc ebx
inc edx
cmp edx, edi
jb 0x10005287
inc esi
cmp dword [esp + 0x14], esi
ja 0x1000520b
pop ebp
pop edi
pop esi
pop ebx
add esp, 8
ret