joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6adbc6c0
Capabilities:
Get file attributes

Disassembly:
push ebx
mov ebx, edx
sub esp, 0x98
lea edx, [esp + 0x28]
mov dword [esp + 0x10], 0x12
mov dword [esp + 8], edx
lea edx, [esp + 0x20]
mov dword [esp + 0xc], 0x68
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.ntdll.dll_NtQueryInformationFile
sub esp, 0x14
test eax, eax
jns 0x6adbc6ff
cmp eax, 0x80000005
jne 0x6adbc75b
mov eax, dword [esp + 0x48]
mov edx, dword [esp + 0x2c]
mov dword [ebx], eax
mov eax, dword [esp + 0x60]
mov dword [ebx + 0xc], edx
mov edx, dword [esp + 0x3c]
mov dword [ebx + 4], eax
mov eax, dword [esp + 0x28]
mov dword [ebx + 0x14], edx
mov edx, dword [esp + 0x34]
mov dword [ebx + 8], eax
mov eax, dword [esp + 0x38]
mov dword [ebx + 0x1c], edx
mov edx, dword [esp + 0x6c]
mov dword [ebx + 0x10], eax
mov eax, dword [esp + 0x30]
mov dword [ebx + 0x24], edx
mov edx, dword [esp + 0x5c]
mov dword [ebx + 0x18], eax
mov eax, dword [esp + 0x68]
mov dword [ebx + 0x2c], edx
mov dword [ebx + 0x20], eax
mov eax, dword [esp + 0x58]
mov dword [ebx + 0x28], eax
mov eax, dword [esp + 0x70]
mov dword [ebx + 0x30], eax
xor eax, eax
add esp, 0x98
pop ebx
ret

Function at 0x6adbca70
Capabilities:
Get file attributes

Disassembly:
push esi
mov esi, edx
push ebx
sub esp, 0xb4
lea edx, [esp + 0x30]
mov dword [esp + 0x10], 0x15
mov dword [esp + 8], edx
lea edx, [esp + 0x28]
mov dword [esp + 0xc], pe_nt_image_headers32
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.ntdll.dll_NtQueryInformationFile
sub esp, 0x14
mov ebx, eax
test eax, eax
js 0x6adbcab3
mov eax, dword [esp + 0x30]
test eax, eax
jne 0x6adbcac0
add esp, 0xb4
mov eax, ebx
pop ebx
pop esi
ret
mov dword [esp + 4], eax
lea eax, [esp + 0x34]
mov dword [esp], eax
call fcn.6ad8d4f0
mov dword [esi + 0x20], eax
test eax, eax
je 0x6adbcaea
mov eax, dword [esp + 0x30]
mov word [esi + 0x26], ax
add esp, 0xb4
mov eax, ebx
pop ebx
pop esi
ret
mov ebx, 0xc0000017
jmp 0x6adbcab3
Function at 0x6adbd770
Capabilities:
Get file attributes

Disassembly:
push ebp
push edi
push esi
push ebx
push eax
mov eax, 0x1058
call fcn.6adfb260
sub esp, eax
mov eax, dword [esp + eax]
mov dword [esp + 0x28], edx
mov edi, eax
mov eax, dword [esp + 0x1070]
mov edx, dword [esp + 0x1074]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x1078]
mov dword [esp + 0x24], edx
test byte [eax + 0xa], 4
je 0x6adbd870
lea ebp, [esp + 0x50]
mov esi, 0x1000
mov ebx, ebp
lea eax, [esp + 0x38]
mov dword [esp + 0x10], 0x16
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov dword [esp], edi
call sub.ntdll.dll_NtQueryInformationFile
sub esp, 0x14
test eax, eax
jns 0x6adbd900
cmp eax, 0x80000005
jne 0x6adbd810
add esi, esi
cmp ebx, ebp
je 0x6adbd860
mov dword [esp + 4], esi
mov dword [esp], ebx
call fcn.6adab660
test eax, eax
je 0x6adbd960
mov ebx, eax
jmp 0x6adbd7bc
jl 0x6ae12263
cmp eax, 0xc0000004
jge 0x6adbd850
cmp eax, 0xc0000002
jl 0x6ae12263
mov ecx, dword [esp + 0x28]
xor eax, eax
test dword [ecx + 0x24], 0x410
je 0x6adbd885
cmp ebx, ebp
jne 0x6adbd8dd
add esp, 0x105c
pop ebx
pop esi
pop edi
pop ebp
ret
cmp eax, 0xc00000bb
je 0x6adbd828
jmp 0x6ae12263
mov dword [esp], esi
call fcn.6adab620
jmp 0x6adbd800
mov ecx, dword [esp + 0x28]
xor eax, eax
test dword [ecx + 0x24], 0x410
jne 0x6adbd83f
lea ebp, [esp + 0x50]
mov ebx, ebp
mov eax, dword [esp + 0x1078]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x40], 0x3a003a
mov dword [esp + 0x44], 0x440024
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 4], edx
mov edx, 7
mov dword [esp + 8], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x48], 0x540041
mov dword [esp], eax
lea eax, [esp + 0x40]
mov dword [esp + 0x4c], 0x41
call fcn.6adbd6b0
cmp ebx, ebp
je 0x6adbd83f
mov dword [esp], ebx
mov dword [esp + 0x28], eax
call fcn.6adab650
mov eax, dword [esp + 0x28]
add esp, 0x105c
pop ebx
pop esi
pop edi
pop ebp
ret
mov edx, dword [esp + 0x3c]
xor eax, eax
test edx, edx
je 0x6adbd837
mov dword [esp + 0x20], ebx
mov esi, dword [esp + 0x1078]
mov dword [esp + 0x2c], ebp
jmp 0x6adbd928
mov edx, dword [ebx]
test edx, edx
je 0x6adbd970
add ebx, edx
mov ecx, dword [esp + 0x28]
mov edx, dword [ebx + 4]
mov dword [esp + 0xc], esi
lea eax, [ebx + 0x18]
mov dword [esp + 8], ecx
mov edi, dword [ebx + 8]
shr edx, 1
mov ebp, dword [ebx + 0xc]
mov dword [esp], edi
mov dword [esp + 4], ebp
call fcn.6adbd6b0
test eax, eax
je 0x6adbd920
mov ebx, dword [esp + 0x20]
mov ebp, dword [esp + 0x2c]
jmp 0x6adbd837
mov eax, 0x27
jmp 0x6adbd837
mov ebx, dword [esp + 0x20]
mov ebp, dword [esp + 0x2c]
jmp 0x6adbd837
mov ecx, dword [esp + 0x1078]
mov edx, dword [ecx]
mov edx, dword [edx + 0x80]
mov dword [esp], eax
mov dword [esp + 4], str.__ls_:_Failed_to_query_stream_information
add edx, 8
mov dword [esp + 8], edx
call fcn.6ae11e11
mov eax, 0x32
jmp 0x6adbd837
Function at 0x6adc03f0
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x4c
lea eax, [esp + 0x1c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
sub esp, 4
mov eax, dword [esp + 0x30]
add esp, 0x4c
ret

Function at 0x6adc0410
Capabilities:
Get memory capacity

Disassembly:
push edi
xor eax, eax
mov ecx, 0xf
push ebx
sub esp, 0x54
lea edi, [esp + 0x14]
mov dword [esp + 0x10], 0x40
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
sub esp, 4
mov edi, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov dword [esp + 8], 0x64
mov eax, dword [esp + 0x38]
mov edx, dword [esp + 0x3c]
mov dword [esp + 0xc], 0
mov ebx, ecx
cmp edi, eax
sbb ebx, edx
cmovb edx, ecx
cmovb eax, edi
imul ecx, edx, 0x55
mov edx, 0x55
mul edx
add edx, ecx
mov dword [esp], eax
mov dword [esp + 4], edx
call fcn.6adfb3e0
add esp, 0x54
pop ebx
pop edi
ret

Function at 0x6adc0570
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], 1
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
sub esp, 0xc
test eax, eax
je 0x6adc05a8
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
cmp eax, 5
je 0x6adc05e0
call ebx
mov ebx, eax
call dword [sym.imp.msvcrt.dll__errno]
mov ecx, eax
mov eax, ebx
call fcn.6adbfec0
mov dword [ecx], eax
lea esp, [ebp - 0xc]
mov eax, 0xffffffff
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sub.msvcrt.dll_wcslen
mov ecx, eax
lea eax, [eax + eax + 0x39]
shr eax, 4
shl eax, 4
call fcn.6adfb260
sub esp, eax
mov eax, dword [ebp + 0xc]
lea esi, [esp + 0x1b]
mov dword [esp + 8], ecx
and esi, 0xfffffff0
mov dword [esp + 4], eax
mov dword [esp], esi
call fcn.6adfb930
mov dword [esp + 8], 5
mov dword [esp + 4], str..orig
mov dword [esp], eax
call fcn.6adfb930
mov dword [esp + 4], 9
mov dword [esp], eax
mov edi, eax
call fcn.6adab900
xor eax, eax
mov word [edi + 0x12], ax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], esi
mov edi, dword [sym.imp.KERNEL32.dll_MoveFileW]
mov dword [esp], eax
call edi
sub esp, 8
test eax, eax
je 0x6adc05b5
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
sub esp, 4
test eax, eax
je 0x6adc06b1
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call edi
sub esp, 8
test eax, eax
jne 0x6adc059b
call fcn.6adc0370
mov eax, dword [ebp + 8]
mov dword [esp], str.Atomic_semantics_not_respected_in_failed_rename____new_file_is_at___ls__
mov dword [esp + 4], eax
call fcn.6ae0f273
mov eax, 1
jmp 0x6adc059d
call fcn.6adc0370
mov dword [esp + 4], esi
mov dword [esp], str.Failed_to_delete_original_file__moved_to___ls__
call fcn.6ae0f273
jmp 0x6adc0675
Function at 0x6adc0750
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push esi
push ebx
mov ebx, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0xc], ebx
mov dword [esp + 0x14], 1
mov dword [esp + 0x10], esi
pop ebx
pop esi
jmp 0x6adc0170

Function at 0x6adc0780
Capabilities:
Read file on windows

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov edi, dword [esp + 0x40]
mov esi, dword [esp + 0x48]
mov dword [esp], edi
call dword [sym.imp.msvcrt.dll__get_osfhandle]
mov dword [esp + 0x2c], 0xffffffff
mov ebx, eax
cmp eax, 0xffffffff
je 0x6adc07f8
cmp esi, 0x100000
mov eax, 0x100000
mov dword [esp], 0
cmova esi, eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
sub esp, 4
lea eax, [esp + 0x2c]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 8], esi
mov dword [esp + 4], eax
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
sub esp, 0x14
test eax, eax
je 0x6adc0832
mov ebx, dword [esp + 0x2c]
cmp ebx, esi
ja 0x6adc0808
add esp, 0x30
mov eax, ebx
pop ebx
pop esi
pop edi
ret
mov dword [esp + 8], 0x250
mov dword [esp + 4], str.src_win32_replacements.c
mov dword [esp], str.result___count
call dword [0x6ae132b8]
mov ebx, dword [esp + 0x2c]
add esp, 0x30
mov eax, ebx
pop ebx
pop esi
pop edi
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0xc], edi
mov dword [esp], eax
mov ebx, eax
mov dword [esp + 8], esi
mov dword [esp + 4], str.Error_reading__zu_bytes_from_fd__d
call fcn.6ae11dc3
mov eax, ebx
or ebx, 0xffffffff
call fcn.6adc0150
jmp 0x6adc07f8

Function at 0x6adc0860
Capabilities:
Write file on windows

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov edi, dword [esp + 0x40]
mov esi, dword [esp + 0x48]
mov dword [esp], edi
call dword [sym.imp.msvcrt.dll__get_osfhandle]
mov dword [esp + 0x2c], 0xffffffff
mov ebx, eax
cmp eax, 0xffffffff
je 0x6adc08d8
cmp esi, 0x100000
mov eax, 0x100000
mov dword [esp], 0
cmova esi, eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
sub esp, 4
lea eax, [esp + 0x2c]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 8], esi
mov dword [esp + 4], eax
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub esp, 0x14
test eax, eax
je 0x6adc0912
mov ebx, dword [esp + 0x2c]
cmp ebx, esi
ja 0x6adc08e8
add esp, 0x30
mov eax, ebx
pop ebx
pop esi
pop edi
ret
mov dword [esp + 8], 0x268
mov dword [esp + 4], str.src_win32_replacements.c
mov dword [esp], str.result___count
call dword [0x6ae132b8]
mov ebx, dword [esp + 0x2c]
add esp, 0x30
mov eax, ebx
pop ebx
pop esi
pop edi
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0xc], edi
mov dword [esp], eax
mov ebx, eax
mov dword [esp + 8], esi
mov dword [esp + 4], str.Error_writing__zu_bytes_to_fd__d
call fcn.6ae11dc3
mov eax, ebx
or ebx, 0xffffffff
call fcn.6adc0150
jmp 0x6adc08d8
Function at 0x6adc0d50
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov ebx, dword [esp + 0x34]
mov esi, dword [esp + 0x30]
test ebx, ebx
je 0x6adc0d83
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, dword [0x6ae132b8]
nop
mov dword [esp + 4], ebx
mov dword [esp], esi
call sub.ADVAPI32.dll_SystemFunction036
sub esp, 8
test al, al
je 0x6adc0d8b
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
call ebp
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x6ae29828
mov dword [esp], eax
call fcn.6ae11dc3
mov dword [esp + 8], 0x302
mov dword [esp + 4], str.src_win32_replacements.c
mov dword [esp], 0x6ae2986a
call edi
jmp 0x6adc0d70
Function at 0x6adc3310
Capabilities:
Contain obfuscated stackstrings
Print debug messages

Disassembly:
push edi
xor eax, eax
mov ecx, 0x10
sub esp, 0x88
lea edi, [esp + 0x40]
mov dword [esp + 0x15], 0x6f727245
mov dword [esp + 0x19], 0x6c632072
mov dword [esp + 0x1d], 0x696e6165
mov dword [esp + 0x21], 0x7520676e
mov dword [esp + 0x25], 0x70732070
mov dword [esp + 0x29], 0x6b5f6e69
mov dword [esp + 0x2d], 0x20737965
mov dword [esp + 0x31], 0x20726f66
mov dword [esp + 0x35], 0x65726874
mov dword [esp + 0x39], 0x206461
mov dword [esp + 0x3d], 0
mov dword [esp + 0x7c], 0
rep stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea edx, [esp + 0x3c]
mov dword [esp + 8], 0xa
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll__ultoa]
cmp byte [esp + 0x3c], 0
je 0x6adc33eb
mov eax, 0x27
lea edx, [esp + 0x15]
jmp 0x6adc33bd
cmp eax, 0x6a
je 0x6adc33da
mov ecx, eax
add eax, 1
cmp byte [edx + eax], 0
jne 0x6adc33b8
cmp eax, 0x6a
je 0x6adc33da
add ecx, 2
mov byte [esp + eax + 0x15], 0xa
mov byte [esp + ecx + 0x15], 0
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
sub esp, 4
call sub.msvcrt.dll_abort
mov ecx, 0x28
mov eax, 0x27
lea edx, [esp + 0x15]
jmp 0x6adc33d0

Function at 0x6adc3740
Capabilities:
Allocate thread local storage

Disassembly:
push edi
mov eax, 0x6ae6b0b8
push esi
push ebx
sub esp, 0x10
call fcn.6adc30d0
lea esi, [eax + 4]
mov ebx, eax
mov dword [esp], esi
call fcn.6adc28e0
mov edi, dword [0x6ae6b0b8]
test edi, edi
jne 0x6adc37a8
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x6ae13034], eax
cmp eax, 0xffffffff
je 0x6ae129dd
mov dword [0x6ae6b0b8], 1
mov dword [esp], esi
call fcn.6adc2c20
test ebx, ebx
je 0x6adc3798
mov eax, ebx
call fcn.6adc3400
add esp, 0x10
xor eax, eax
pop ebx
pop esi
pop edi
ret
cmp edi, 1
je 0x6adc3785
mov dword [esp], 2
call dword [0x6ae132b0]
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0x6ae6b0b8
mov dword [esp + 4], str._once__p_is__d_n
mov dword [esp], eax
call fcn.6adc30a0
jmp 0x6adc3785
call sub.msvcrt.dll_abort
Function at 0x6adc37e0
Capabilities:
Set thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
call fcn.6adc34f0
mov edx, dword [entry3]
test edx, edx
je 0x6adc3910
mov ebx, eax
test eax, eax
je 0x6adc3910
mov dword [eax + 0x24], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebx + 0x3c], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [ebx + 0x1c], 0xffffffff
mov dword [ebx + 0x18], eax
sub esp, 0x10
lea eax, [ebx + 0x38]
mov dword [esp], eax
call fcn.6adc2f70
cmp eax, 1
je 0x6adc391c
mov ebp, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebx + 0x38], 0xffffffff
mov dword [ebx + 0x64], 0
mov dword [ebx + 0x14], 0
call ebp
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov esi, eax
call ebp
lea edx, [ebx + 0x14]
mov dword [esp + 8], edi
mov dword [esp + 0x18], 2
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edx
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
sub esp, 0x1c
test eax, eax
je fcn.6ae129e2
mov eax, dword [ebx + 0x14]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [ebx + 0x68], 0
mov dword [ebx + 0x6c], eax
movzx eax, byte [ebx + 0x20]
sub esp, 4
and eax, 0xffffffcf
or eax, 0x10
mov byte [ebx + 0x20], al
mov eax, dword [0x6ae13034]
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
je 0x6adc3921
add esp, 0x2c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
add esp, 0x2c
xor ebx, ebx
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
call fcn.6adc3310
jmp fcn.6ae129e2

Function at 0x6adc3930
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
sub esp, 0x1c
cmp dword [0x6ae6b0b8], 1
je 0x6adc3941
call fcn.6adc3740
mov eax, dword [0x6ae13034]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x6adc3960
add esp, 0x1c
ret
add esp, 0x1c
jmp fcn.6adc37e0
Function at 0x6adc3c50
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
push ebx
sub esp, 0x10
mov eax, dword [esp + 0x24]
test eax, eax
jne 0x6adc3c80
mov ebx, dword [esp + 0x28]
test ebx, ebx
je 0x6adc3d50
add esp, 0x10
mov eax, 1
pop ebx
pop esi
pop edi
ret 0xc
cmp eax, 1
je 0x6adc3d80
cmp eax, 3
jne 0x6adc3c6a
mov eax, dword [0x6ae13034]
cmp eax, 0xffffffff
je 0x6adc3c6a
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x6adc3c6a
test byte [eax + 0x20], 0x30
je 0x6adc3db0
mov eax, dword [eax + 0xb4]
test eax, eax
je 0x6adc3cc3
call fcn.6adc3970
mov eax, dword [ebx + 0x14]
test eax, eax
je 0x6adc3cf5
mov dword [esp], eax
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
mov eax, dword [ebx + 0x18]
sub esp, 4
test eax, eax
je 0x6adc3ce7
mov dword [esp], eax
call esi
sub esp, 4
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x14], 0
lea eax, [ebx + 0x1c]
mov dword [esp], eax
call fcn.6adc2db0
lea eax, [ebx + 0x38]
mov dword [esp], eax
call fcn.6adc2f70
cmp eax, 1
je 0x6adc3e30
mov ecx, dword [ebx + 0xb0]
mov dword [ebx + 0x38], 0xffffffff
test ecx, ecx
je 0x6adc3ea0
mov eax, dword [0x6ae13034]
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
jmp 0x6adc3c6a
mov eax, dword [0x6ae6b094]
test eax, eax
je 0x6adc3c6a
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_RemoveVectoredExceptionHandler]
mov dword [0x6ae6b094], 0
sub esp, 4
jmp 0x6adc3c6a
mov dword [esp + 4], 0x6adc2fe0
mov dword [esp], 1
call dword [sym.imp.KERNEL32.dll_AddVectoredExceptionHandler]
sub esp, 8
mov dword [0x6ae6b094], eax
mov eax, 1
add esp, 0x10
pop ebx
pop esi
pop edi
ret 0xc
mov edx, dword [ebx + 0x68]
mov eax, dword [eax + 0x18]
test edx, edx
jne 0x6adc3e38
test eax, eax
je 0x6adc3dca
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov eax, dword [ebx + 0xb4]
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x68], 1
test eax, eax
je 0x6adc3de7
call fcn.6adc3970
lea edi, [ebx + 0x1c]
lea esi, [ebx + 0x38]
test byte [ebx + 0x24], 4
je 0x6adc3e80
mov eax, dword [ebx + 0x14]
mov dword [ebx], 0xdeadbeef
test eax, eax
je 0x6adc3e10
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov dword [ebx + 0x14], 0
mov dword [esp], edi
call fcn.6adc2db0
mov dword [esp], esi
call fcn.6adc2f70
cmp eax, 1
jne 0x6adc3d14
call fcn.6adc3310
lea esi, [esi]
test eax, eax
je 0x6adc3e48
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
lea eax, [ebx + 0x1c]
mov dword [ebx + 0x18], 0
mov dword [esp], eax
call fcn.6adc2db0
lea eax, [ebx + 0x38]
mov dword [esp], eax
call fcn.6adc2f70
cmp eax, 1
je 0x6adc3e30
mov dword [ebx + 0x38], 0xffffffff
jmp 0x6adc3c6a
mov dword [esp], edi
call fcn.6adc2db0
mov dword [esp], esi
call fcn.6adc2f70
cmp eax, 1
jne 0x6adc3e6a
jmp 0x6adc3e30
mov eax, ebx
call fcn.6adc35b0
jmp 0x6adc3d29
Function at 0x6adc4770
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 0x1c
cmp dword [0x6ae6b0b8], 1
je 0x6adc4781
call fcn.6adc3740
mov eax, dword [0x6ae13034]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x6adc47a0
mov eax, dword [eax + 0x18]
add esp, 0x1c
ret
call fcn.6adc37e0
test eax, eax
jne 0x6adc4796
add esp, 0x1c
ret

Function at 0x6adc4800
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 0x1c
cmp dword [0x6ae6b0b8], 1
je 0x6adc4811
call fcn.6adc3740
mov eax, dword [0x6ae13034]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x6adc4830
add eax, 0xc
add esp, 0x1c
ret
call fcn.6adc37e0
test eax, eax
jne 0x6adc4826
jmp 0x6adc4829

Function at 0x6adc4860
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov esi, dword [esp + 0x20]
call fcn.6adc3930
mov dword [eax + 4], esi
mov ebx, eax
mov eax, dword [eax + 0xb4]
test eax, eax
je 0x6adc4882
call fcn.6adc3970
test byte [ebx + 0x20], 0x30
jne 0x6adc489c
add ebx, 0x70
mov dword [esp + 4], 1
mov dword [esp], ebx
call dword [sym.imp.msvcrt.dll_longjmp]
mov eax, dword [0x6ae13034]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
push edx
test eax, eax
je 0x6adc48df
cmp dword [ebx + 0x14], 0
mov eax, dword [eax + 0x18]
je 0x6adc4923
mov dword [ebx + 0x68], 1
mov esi, dword [ebx + 4]
test eax, eax
je 0x6adc48d2
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
mov dword [ebx + 0x18], 0
test byte [ebx + 0x24], 4
jne 0x6adc48e8
mov dword [esp], esi
call dword [sym.imp.msvcrt.dll__endthreadex]
mov eax, dword [ebx + 0x14]
mov dword [ebx], 0xdeadbeef
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
mov dword [ebx + 0x14], 0
mov eax, ebx
call fcn.6adc3720
mov eax, dword [0x6ae13034]
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push eax
push eax
jmp 0x6adc48df
mov dword [ebx], 0xdeadbeef
test eax, eax
je 0x6adc4937
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
mov dword [ebx + 0x18], 0
mov esi, dword [ebx + 4]
jmp 0x6adc4902

Function at 0x6adc4950
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x6ae6b0c0]
test eax, eax
jne 0x6adc4960
xor eax, eax
ret
sub esp, 0x1c
cmp dword [0x6ae6b0b8], 1
je 0x6adc4971
call fcn.6adc3740
mov eax, dword [0x6ae13034]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x6adc49b0
mov edx, dword [eax + 0x10]
test edx, edx
jle 0x6adc4998
xor eax, eax
add esp, 0x1c
ret
test byte [eax + 0x20], 3
je 0x6adc498d
mov eax, dword [eax + 0x24]
and eax, 1
jmp 0x6adc498f
call fcn.6adc37e0
test eax, eax
je 0x6adc498d
jmp 0x6adc4986
Function at 0x6adc49c0
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 0x1c
cmp dword [0x6ae6b0b8], 1
je 0x6adc49d1
call fcn.6adc3740
mov eax, dword [0x6ae13034]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x6adc4a10
mov edx, dword [esp + 0x20]
add eax, 0x10
test edx, edx
jle 0x6adc4a00
lock add dword [eax], 1
add esp, 0x1c
ret
lock sub dword [eax], 1
add esp, 0x1c
ret
call fcn.6adc37e0
test eax, eax
jne 0x6adc49e6
add esp, 0x1c
ret

Function at 0x6adc4b10
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
cmp dword [0x6ae6b0b8], 1
je 0x6adc4b23
call fcn.6adc3740
mov eax, dword [0x6ae13034]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x6adc4b80
test byte [ebx + 0x20], 0xc
jne 0x6adc4b49
mov eax, dword [0x6ae6b0c0]
test eax, eax
jne 0x6adc4b50
add esp, 0x14
pop ebx
pop esi
ret
lea esi, [ebx + 0x1c]
mov dword [esp], esi
call fcn.6adc28e0
movzx eax, byte [ebx + 0x20]
test al, 3
je 0x6adc4b72
mov edx, dword [ebx + 0x24]
test dl, 1
je 0x6adc4b72
mov ecx, dword [ebx + 0x10]
test ecx, ecx
jle 0x6adc4b91
mov dword [esp], esi
call fcn.6adc2c20
add esp, 0x14
pop ebx
pop esi
ret
call fcn.6adc37e0
mov ebx, eax
test eax, eax
jne 0x6adc4b3a
add esp, 0x14
pop ebx
pop esi
ret
and eax, 0xfffffff3
and edx, 0xfffffffe
or eax, 4
mov dword [ebx + 0x24], edx
mov byte [ebx + 0x20], al
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x6adc4bb1
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push eax
mov dword [esp], esi
call fcn.6adc2c20
call fcn.6adc4a20
nop
push esi
xor esi, esi
push ebx
sub esp, 0x14
mov eax, dword [esp + 0x20]
test eax, eax
je 0x6adc4be8
mov dword [esp], eax
call fcn.6adc2780
mov ecx, 0xfffffffe
cmp ecx, eax
sbb esi, edx
mov esi, 0xffffffff
cmovae esi, eax
cmp dword [0x6ae6b0b8], 1
je 0x6adc4bf6
call fcn.6adc3740
mov eax, dword [0x6ae13034]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x6adc4c68
test esi, esi
je 0x6adc4c40
call fcn.6adc4b10
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x6adc4c78
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
sub esp, 8
call fcn.6adc4b10
add esp, 0x14
xor eax, eax
pop ebx
pop esi
ret
call fcn.6adc4b10
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_Sleep]
sub esp, 4
call fcn.6adc4b10
add esp, 0x14
xor eax, eax
pop ebx
pop esi
ret
call fcn.6adc37e0
mov ebx, eax
jmp 0x6adc4c0d
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_Sleep]
sub esp, 4
jmp 0x6adc4c2d