joyce8/EMBER2024-capa huggingface dataset:
Function at 0x30159a93
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
xor ebx, ebx
cmp dword [0x3027f6d4], ebx
push esi
push edi
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
jne 0x30159ac0
mov ebx, 0x80004005
lea ecx, [ebp - 4]
call fcn.30159559
mov eax, ebx
jmp 0x30159c02
lea ecx, [ebp - 4]
call fcn.301597e9
mov eax, dword [sym.OFFDIAG.exe_unsigned_long_int_NetUI::g_dwElSlot]
cmp eax, 0xffffffff
mov esi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
je 0x30159adf
push eax
call esi
cmp eax, ebx
jne 0x30159af5
call fcn.3015948e
mov edi, eax
cmp edi, ebx
jl 0x30159bd8
mov dword [ebp - 8], 1
push dword [sym.OFFDIAG.exe_unsigned_long_int_NetUI::g_dwElSlot]
call esi
cmp eax, ebx
je 0x30159b06
inc dword [eax + 4]
jmp 0x30159ab1
push 0x34
call sym.OFFDIAG.exe_void____stdcall_NetUI::HAllocAndZero_unsigned_long_int_
mov esi, eax
cmp esi, ebx
jne 0x30159b1a
mov edi, 0x8007000e
jmp 0x30159b92
push esi
push dword [sym.OFFDIAG.exe_unsigned_long_int_NetUI::g_dwElSlot]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
lea eax, [esi + 8]
push eax
call fcn.3013bf50
mov edi, eax
cmp edi, ebx
jl 0x30159b92
lea eax, [esi + 0xc]
push eax
push 8
call fcn.3015b108
mov edi, eax
cmp edi, ebx
jl 0x30159b92
mov dword [esi + 4], 1
mov byte [esi + 0x10], bl
mov byte [esi + 0x11], bl
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
xor eax, eax
lea edi, [ebp - 0x1c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor edi, edi
lea eax, [ebp - 0x1c]
inc edi
push eax
mov dword [ebp - 0x1c], 0x14
mov dword [ebp - 0x18], 2
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], ebx
call fcn.3015ff5a
cmp eax, ebx
mov dword [esi], eax
jne 0x30159be4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp esi, ebx
je 0x30159bce
mov ecx, dword [esi + 0xc]
cmp ecx, ebx
je 0x30159ba2
call sym.OFFDIAG.exe_protected_virtual:_void___thiscall_NetUI::Node::_FinalDestroy_void_
mov eax, dword [esi + 8]
cmp eax, ebx
je 0x30159baf
push eax
call fcn.3013b3e1
mov eax, dword [esi]
cmp eax, ebx
je 0x30159bbb
push eax
call fcn.3015ecae
push esi
call sym.OFFDIAG.exe_void___stdcall_NetUI::HFree_void__
push ebx
push dword [sym.OFFDIAG.exe_unsigned_long_int_NetUI::g_dwElSlot]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
cmp dword [ebp - 8], ebx
je 0x30159bd8
call fcn.301599e7
lea ecx, [ebp - 4]
call fcn.30159559
mov eax, edi
jmp 0x30159c02
cmp dword [0x3027f6c0], edi
jne 0x30159bf8
mov eax, dword [0x3027f6d8]
cmp eax, ebx
je 0x30159bf8
push ebx
call eax
lea ecx, [ebp - 4]
call fcn.30159559
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x30159c07
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
cmp dword [0x3027f6d4], ebx
mov dword [ebp - 4], ebx
lea ecx, [ebp - 4]
jne 0x30159c29
call fcn.30159559
mov eax, 0x80004005
pop ebx
leave
ret
push esi
call fcn.301597e9
mov eax, dword [sym.OFFDIAG.exe_unsigned_long_int_NetUI::g_dwElSlot]
cmp eax, 0xffffffff
jne 0x30159c4b
mov ebx, 0x80004005
lea ecx, [ebp - 4]
call fcn.30159559
mov eax, ebx
pop esi
jmp 0x30159c26
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
cmp esi, ebx
jne 0x30159c5f
mov ebx, 0x8004000a
jmp 0x30159c3e
dec dword [esi + 4]
cmp dword [esi + 4], ebx
jg 0x30159c3e
push ebx
lea ecx, [esi + 0x20]
call fcn.30139c1e
push ebx
lea ecx, [esi + 0x24]
call fcn.30139c1e
push ebx
lea ecx, [esi + 0x28]
call fcn.30139c1e
push ebx
lea ecx, [esi + 0x2c]
call fcn.30139c1e
push ebx
lea ecx, [esi + 0x30]
call fcn.3019ace9
cmp dword [0x3027f6c0], 1
jne 0x30159caa
mov eax, dword [0x3027f6d8]
cmp eax, ebx
je 0x30159caa
push 1
call eax
push dword [esi]
call fcn.3015ecae
cmp byte [esi + 0x10], bl
je 0x30159cbc
call dword [sym.imp.ole32.dll_CoUninitialize]
cmp byte [esi + 0x11], bl
je 0x30159cc7
call dword [sym.imp.ole32.dll_OleUninitialize]
mov ecx, dword [esi + 0xc]
call sym.OFFDIAG.exe_protected_virtual:_void___thiscall_NetUI::Node::_FinalDestroy_void_
push dword [esi + 8]
call fcn.3013b3e1
mov eax, dword [esi + 0x18]
cmp eax, ebx
je 0x30159ce4
push eax
call sym.OFFDIAG.exe_void___stdcall_NetUI::HFree_void__
push esi
call sym.OFFDIAG.exe_void___stdcall_NetUI::HFree_void__
push ebx
push dword [sym.OFFDIAG.exe_unsigned_long_int_NetUI::g_dwElSlot]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
call fcn.301599e7
jmp 0x30159c3e

Function at 0x3015ed5a
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push edi
push dword [0x3026b738]
xor edi, edi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, edi
je 0x3015ed7b
mov eax, dword [eax + 0x16c]
jmp 0x3015ed7d
xor eax, eax
cmp eax, edi
jne 0x3015ed8e
push 0x80040014
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x3015eddc
push eax
push edi
push edi
lea ecx, [ebp - 0xc]
mov dword [ebp - 0xc], edi
call fcn.301b2a98
test eax, eax
jne 0x3015edad
push 0x80070057
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x3015edd4
push esi
mov esi, dword [ebp + 0xc]
cmp esi, edi
je 0x3015edc8
mov ecx, dword [ebp + 8]
cmp ecx, edi
je 0x3015edc8
mov eax, dword [ecx]
call dword [eax + 0xc]
xor edi, edi
mov dword [esi], eax
inc edi
jmp 0x3015edd3
push 0x80070057
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop esi
lea ecx, [ebp - 0xc]
call fcn.301b2a51
mov eax, edi
pop edi
leave
ret 8
Function at 0x3015ede3
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push edi
push dword [0x3026b738]
xor ebx, ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, ebx
je 0x3015ee08
mov edi, dword [eax + 0x16c]
jmp 0x3015ee0a
xor edi, edi
cmp edi, ebx
jne 0x3015ee1b
push 0x80040014
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x3015ee8b
push edi
push ebx
push ebx
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x10], ebx
call fcn.301b2a98
test eax, eax
je 0x3015ee78
push esi
mov esi, dword [ebp + 8]
cmp esi, ebx
je 0x3015ee47
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x14]
shr eax, 2
test al, 1
je 0x3015ee47
mov ecx, esi
jmp 0x3015ee49
xor ecx, ecx
cmp ecx, ebx
pop esi
je 0x3015ee78
cmp edi, dword [ecx + 8]
je 0x3015ee5a
push 0x8004001e
jmp 0x3015ee7d
cmp dword [ebp + 0xc], ebx
je 0x3015ee78
cmp dword [ebp + 0x10], ebx
je 0x3015ee78
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.301b330a
mov dword [ebp - 4], 1
jmp 0x3015ee83
push 0x80070057
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea ecx, [ebp - 0x10]
call fcn.301b2a51
mov eax, dword [ebp - 4]
pop edi
pop ebx
leave
ret 0xc

Function at 0x3015ee94
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
and dword [ebp - 4], 0
push edi
push dword [0x3026b738]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x3015eeb7
mov edi, dword [eax + 0x16c]
jmp 0x3015eeb9
xor edi, edi
test edi, edi
jne 0x3015eeca
push 0x80040014
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x3015ef43
and dword [ebp - 0x10], 0
push edi
push 0
push 0
lea ecx, [ebp - 0x10]
call fcn.301b2a98
test eax, eax
jne 0x3015eeec
push 0x80070057
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x3015ef3b
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x3015ef06
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x14]
shr eax, 2
test al, 1
je 0x3015ef06
mov ecx, esi
jmp 0x3015ef08
xor ecx, ecx
test ecx, ecx
je 0x3015ef2f
cmp edi, dword [ecx + 8]
je 0x3015ef18
push 0x8004001e
jmp 0x3015ef34
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x3015ef2f
call fcn.301b3337
fstp dword [esi]
mov dword [ebp - 4], 1
jmp 0x3015ef3a
push 0x80070057
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop esi
lea ecx, [ebp - 0x10]
call fcn.301b2a51
mov eax, dword [ebp - 4]
pop edi
leave
ret 8
Function at 0x3015ef4b
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
and dword [ebp - 4], 0
push edi
push dword [0x3026b738]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x3015ef6e
mov edi, dword [eax + 0x16c]
jmp 0x3015ef70
xor edi, edi
test edi, edi
jne 0x3015ef84
push 0x80040014
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x3015f021
and dword [ebp - 0x10], 0
push edi
push 0
push 0
lea ecx, [ebp - 0x10]
call fcn.301b2a98
test eax, eax
jne 0x3015efa6
push 0x80070057
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x3015f019
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x3015efc0
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x14]
shr eax, 2
test al, 1
je 0x3015efc0
mov ecx, esi
jmp 0x3015efc2
xor ecx, ecx
test ecx, ecx
je 0x3015f00d
cmp edi, dword [ecx + 8]
je 0x3015efd2
push 0x8004001e
jmp 0x3015f012
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x3015f00d
cmp dword [eax], 0x14
jne 0x3015f00d
mov edx, dword [eax + 4]
mov esi, edx
and esi, 7
cmp esi, edx
jne 0x3015f00d
test byte [ecx + 0x38], 8
jne 0x3015eff7
push 0x8004003c
jmp 0x3015f012
push eax
call fcn.301b3d66
test eax, eax
jl 0x3015f00a
mov dword [ebp - 4], 1
jmp 0x3015f018
push eax
jmp 0x3015f012
push 0x80070057
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop esi
lea ecx, [ebp - 0x10]
call fcn.301b2a51
mov eax, dword [ebp - 4]
pop edi
leave
ret 8

Function at 0x3015f029
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push edi
push dword [0x3026b738]
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, ebx
je 0x3015f04b
mov edi, dword [eax + 0x16c]
jmp 0x3015f04d
xor edi, edi
cmp edi, ebx
jne 0x3015f061
push 0x80040014
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x3015f0f8
push edi
push ebx
push 1
lea ecx, [ebp - 0xc]
mov dword [ebp - 0xc], ebx
call fcn.301b2a98
test eax, eax
jne 0x3015f081
push 0x80070057
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x3015f0f0
push esi
mov esi, dword [ebp + 8]
cmp esi, ebx
je 0x3015f09b
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x14]
shr eax, 2
test al, 1
je 0x3015f09b
mov ecx, esi
jmp 0x3015f09d
xor ecx, ecx
test ecx, ecx
je 0x3015f0e4
cmp edi, dword [ecx + 8]
je 0x3015f0ad
push 0x8004001e
jmp 0x3015f0e9
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x3015f0e4
cmp dword [eax], 0x14
jne 0x3015f0e4
mov edx, dword [eax + 4]
mov esi, edx
and esi, 7
cmp esi, edx
jne 0x3015f0e4
test byte [ecx + 0x38], 8
jne 0x3015f0d2
push 0x8004003c
jmp 0x3015f0e9
push eax
call fcn.301b3d90
test eax, eax
jl 0x3015f0e1
xor ebx, ebx
inc ebx
jmp 0x3015f0ef
push eax
jmp 0x3015f0e9
push 0x80070057
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop esi
lea ecx, [ebp - 0xc]
call fcn.301b2a51
pop edi
mov eax, ebx
pop ebx
leave
ret 8
Function at 0x3015f100
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
and dword [ebp - 4], 0
push edi
push dword [0x3026b738]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x3015f123
mov edi, dword [eax + 0x16c]
jmp 0x3015f125
xor edi, edi
test edi, edi
jne 0x3015f136
push 0x80040014
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x3015f1a3
and dword [ebp - 0x10], 0
push edi
push 0
push 0
lea ecx, [ebp - 0x10]
call fcn.301b2a98
test eax, eax
jne 0x3015f152
push 0x80070057
jmp 0x3015f195
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x3015f16c
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x14]
shr eax, 2
test al, 1
je 0x3015f16c
mov ecx, esi
jmp 0x3015f16e
xor ecx, ecx
test ecx, ecx
pop esi
je 0x3015f14b
cmp edi, dword [ecx + 8]
je 0x3015f17f
push 0x8004001e
jmp 0x3015f195
push dword [ebp + 0xc]
call fcn.301b3dd0
test eax, eax
jl 0x3015f194
mov dword [ebp - 4], 1
jmp 0x3015f19b
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea ecx, [ebp - 0x10]
call fcn.301b2a51
mov eax, dword [ebp - 4]
pop edi
leave
ret 8

Function at 0x3015f1ab
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push edi
push dword [0x3026b738]
xor ebx, ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, ebx
je 0x3015f1d0
mov edi, dword [eax + 0x16c]
jmp 0x3015f1d2
xor edi, edi
cmp edi, ebx
jne 0x3015f1e6
push 0x80040014
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x3015f268
push edi
push ebx
push ebx
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x10], ebx
call fcn.301b2a98
test eax, eax
je 0x3015f255
mov eax, dword [ebp + 0x10]
and eax, 0x11c
cmp eax, dword [ebp + 0x10]
jne 0x3015f255
push esi
mov esi, dword [ebp + 8]
cmp esi, ebx
je 0x3015f21f
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x14]
shr eax, 2
test al, 1
je 0x3015f21f
mov ecx, esi
jmp 0x3015f221
xor ecx, ecx
cmp ecx, ebx
pop esi
je 0x3015f255
cmp edi, dword [ecx + 8]
je 0x3015f232
push 0x8004001e
jmp 0x3015f25a
cmp dword [ebp + 0xc], ebx
je 0x3015f255
mov eax, dword [ebp + 0x10]
shr eax, 8
test al, 1
jne 0x3015f260
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.301b395c
mov dword [ebp - 4], 1
jmp 0x3015f260
push 0x80070057
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea ecx, [ebp - 0x10]
call fcn.301b2a51
mov eax, dword [ebp - 4]
pop edi
pop ebx
leave
ret 0xc
Function at 0x3015f271
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
and dword [ebp - 4], 0
push edi
push dword [0x3026b738]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x3015f294
mov edi, dword [eax + 0x16c]
jmp 0x3015f296
xor edi, edi
test edi, edi
jne 0x3015f2aa
push 0x80040014
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x3015f33c
and dword [ebp - 0x10], 0
push edi
push 0
push 0
lea ecx, [ebp - 0x10]
call fcn.301b2a98
test eax, eax
jne 0x3015f2cc
push 0x80070057
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x3015f334
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x3015f2e6
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x14]
shr eax, 2
test al, 1
je 0x3015f2e6
mov ecx, esi
jmp 0x3015f2e8
xor ecx, ecx
test ecx, ecx
je 0x3015f328
test dword [ecx + 0x38], 0x100000
je 0x3015f333
cmp edi, dword [ecx + 8]
je 0x3015f301
push 0x8004001e
jmp 0x3015f32d
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x3015f328
cmp dword [eax], 0x18
jne 0x3015f328
mov edx, dword [eax + 4]
mov esi, edx
and esi, 0xf
cmp esi, edx
jne 0x3015f328
push eax
call fcn.301b4eb2
mov dword [ebp - 4], 1
jmp 0x3015f333
push 0x80070057
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop esi
lea ecx, [ebp - 0x10]
call fcn.301b2a51
mov eax, dword [ebp - 4]
pop edi
leave
ret 8

Function at 0x3015f344
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
push dword [0x3026b738]
xor esi, esi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, esi
je 0x3015f369
mov edi, dword [eax + 0x16c]
jmp 0x3015f36b
xor edi, edi
cmp edi, esi
jne 0x3015f37f
push 0x80040014
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x3015f41e
push ebx
push edi
xor ebx, ebx
push esi
inc ebx
push ebx
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x10], esi
call fcn.301b2a98
test eax, eax
je 0x3015f40a
mov esi, dword [ebp + 8]
test esi, esi
je 0x3015f3ae
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x14]
shr eax, 2
test bl, al
je 0x3015f3ae
mov ecx, esi
jmp 0x3015f3b0
xor ecx, ecx
test ecx, ecx
je 0x3015f40a
test dword [ecx + 0x38], 0x100000
je 0x3015f415
cmp edi, dword [ecx + 8]
je 0x3015f3c9
push 0x8004001e
jmp 0x3015f40f
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x3015f40a
cmp dword [eax], 0x18
jne 0x3015f40a
mov edx, dword [eax + 4]
mov esi, edx
and esi, 0xf
cmp esi, edx
jne 0x3015f40a
mov edx, dword [eax + 8]
mov esi, edx
and esi, 3
cmp esi, edx
jne 0x3015f40a
cmp dword [eax + 0xc], ebx
ja 0x3015f40a
cmp dword [eax + 0x10], 2
ja 0x3015f40a
push eax
call fcn.301b554f
test eax, eax
jl 0x3015f407
mov dword [ebp - 4], ebx
jmp 0x3015f415
push eax
jmp 0x3015f40f
push 0x80070057
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea ecx, [ebp - 0x10]
call fcn.301b2a51
pop ebx
mov eax, dword [ebp - 4]
pop edi
pop esi
leave
ret 8
Function at 0x3015f427
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x3015f4c4
mov esi, dword [edi + 8]
test esi, esi
je 0x3015f4c4
cmp dword [edi + 4], 0x8000
jl 0x3015f4c4
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x14]
mov dword [ebp + 8], eax
shr eax, 1
test al, 1
je 0x3015f4c4
push dword [0x3026b738]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x3015f473
mov ecx, dword [eax + 0x16c]
jmp 0x3015f475
xor ecx, ecx
cmp byte [ecx + 0x17], 0
mov eax, dword [esi + 8]
jne 0x3015f4c4
cmp byte [eax + 0x17], 0
jne 0x3015f4c4
cmp ecx, eax
jne 0x3015f4b1
test byte [ebp + 0xc], 1
lea ecx, [esi + 0xc]
je 0x3015f4a6
mov eax, dword [ebp + 8]
shr eax, 2
test al, 1
je 0x3015f4a6
push 0
push edi
push esi
call fcn.301b5dd9
jmp 0x3015f4c9
push 0
push edi
push esi
call fcn.301b5c8f
jmp 0x3015f4c9
push dword [ebp + 0xc]
mov eax, dword [eax + 0x20]
mov ecx, dword [ecx + 0x20]
push esi
push edi
push eax
call fcn.3015ebd3
jmp 0x3015f4c9
mov eax, 0x80070057
pop edi
pop esi
pop ebp
ret 8

Function at 0x3015f67d
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push dword [0x3026b738]
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, ebx
je 0x3015f69f
mov esi, dword [eax + 0x16c]
jmp 0x3015f6a1
xor esi, esi
cmp esi, ebx
jne 0x3015f6b2
push 0x80040014
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x3015f70f
push esi
push ebx
push ebx
lea ecx, [ebp - 0xc]
mov dword [ebp - 0xc], ebx
call fcn.301b2a98
test eax, eax
jne 0x3015f6d1
push 0x80070057
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x3015f707
push edi
mov edi, dword [ebp + 8]
cmp edi, ebx
je 0x3015f6eb
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x14]
shr eax, 2
test al, 1
je 0x3015f6eb
mov eax, edi
jmp 0x3015f6ed
xor eax, eax
test eax, eax
pop edi
je 0x3015f6c4
cmp esi, dword [eax + 8]
je 0x3015f6fe
push 0x8004001e
jmp 0x3015f6c9
mov ebx, dword [eax + 0x38]
and ebx, 0xfffff
lea ecx, [ebp - 0xc]
call fcn.301b2a51
pop esi
mov eax, ebx
pop ebx
leave
ret 4
Function at 0x3015f742
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push edi
push dword [0x3026b738]
xor ebx, ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, ebx
je 0x3015f767
mov edi, dword [eax + 0x16c]
jmp 0x3015f769
xor edi, edi
cmp edi, ebx
jne 0x3015f77a
push 0x80040014
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x3015f7e2
push edi
push ebx
push ebx
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x10], ebx
call fcn.301b2a98
test eax, eax
je 0x3015f7cf
push esi
mov esi, dword [ebp + 8]
cmp esi, ebx
je 0x3015f7a6
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x14]
shr eax, 2
test al, 1
je 0x3015f7a6
mov ecx, esi
jmp 0x3015f7a8
xor ecx, ecx
cmp ecx, ebx
pop esi
je 0x3015f7cf
cmp edi, dword [ecx + 8]
je 0x3015f7b9
push 0x8004001e
jmp 0x3015f7d4
cmp dword [ebp + 0xc], ebx
je 0x3015f7cf
push dword [ebp + 0xc]
call fcn.301b6f9c
mov dword [ebp - 4], 1
jmp 0x3015f7da
push 0x80070057
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea ecx, [ebp - 0x10]
call fcn.301b2a51
mov eax, dword [ebp - 4]
pop edi
pop ebx
leave
ret 8

Function at 0x3015f7eb
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push edi
push dword [0x3026b738]
xor ebx, ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, ebx
je 0x3015f810
mov edi, dword [eax + 0x16c]
jmp 0x3015f812
xor edi, edi
cmp edi, ebx
jne 0x3015f826
push 0x80040014
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x3015f8a8
push edi
push ebx
push ebx
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x10], ebx
call fcn.301b2a98
test eax, eax
je 0x3015f895
mov eax, dword [ebp + 0x10]
and eax, 0x11c
cmp eax, dword [ebp + 0x10]
jne 0x3015f895
push esi
mov esi, dword [ebp + 8]
cmp esi, ebx
je 0x3015f85f
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x14]
shr eax, 2
test al, 1
je 0x3015f85f
mov ecx, esi
jmp 0x3015f861
xor ecx, ecx
cmp ecx, ebx
pop esi
je 0x3015f895
cmp edi, dword [ecx + 8]
je 0x3015f872
push 0x8004001e
jmp 0x3015f89a
cmp dword [ebp + 0xc], ebx
je 0x3015f895
mov eax, dword [ebp + 0x10]
shr eax, 8
test al, 1
jne 0x3015f8a0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.301b722a
mov dword [ebp - 4], 1
jmp 0x3015f8a0
push 0x80070057
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea ecx, [ebp - 0x10]
call fcn.301b2a51
mov eax, dword [ebp - 4]
pop edi
pop ebx
leave
ret 0xc
Function at 0x3015f8b1
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
push edi
push dword [0x3026b738]
xor edi, edi
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, edi
je 0x3015f8d6
mov esi, dword [eax + 0x16c]
jmp 0x3015f8d8
xor esi, esi
cmp esi, edi
jne 0x3015f8ec
push 0x80040014
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x3015f990
push esi
push edi
push 1
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x10], edi
call fcn.301b2a98
test eax, eax
jne 0x3015f90c
push 0x80070057
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x3015f988
push ebx
mov ebx, dword [ebp + 8]
cmp ebx, edi
je 0x3015f926
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x14]
shr eax, 2
test al, 1
je 0x3015f926
mov ecx, ebx
jmp 0x3015f928
xor ecx, ecx
cmp ecx, edi
jne 0x3015f933
push 0x80070057
jmp 0x3015f93d
cmp esi, dword [ecx + 8]
je 0x3015f945
push 0x8004001e
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x3015f987
cmp dword [esi + 0x10], edi
je 0x3015f97b
xor eax, eax
lea edi, [ebp - 0x20]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x10
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], 0x800c
call fcn.3015f4cf
xor ecx, ecx
test eax, eax
setge cl
mov dword [ebp - 4], ecx
jmp 0x3015f987
call fcn.301b41d5
mov dword [ebp - 4], 1
pop ebx
lea ecx, [ebp - 0x10]
call fcn.301b2a51
mov eax, dword [ebp - 4]
pop edi
pop esi
leave
ret 4

Function at 0x3015f9c5
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
push dword [0x3026b738]
xor edi, edi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, edi
je 0x3015f9e7
mov esi, dword [eax + 0x16c]
jmp 0x3015f9e9
xor esi, esi
cmp esi, edi
jne 0x3015f9fa
push 0x80040014
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x3015fa42
push esi
push edi
push edi
lea ecx, [ebp - 0xc]
mov dword [ebp - 0xc], edi
call fcn.301b2a98
test eax, eax
jne 0x3015fa19
push 0x80070057
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x3015fa3a
push dword [ebp + 8]
call fcn.3015ebb0
cmp eax, edi
je 0x3015fa0c
cmp esi, dword [eax + 8]
je 0x3015fa31
push 0x8004001e
jmp 0x3015fa11
cmp dword [ebp + 0xc], edi
jne 0x3015fa0c
movzx edi, byte [eax + 0x14]
lea ecx, [ebp - 0xc]
call fcn.301b2a51
mov eax, edi
pop edi
pop esi
leave
ret 8