joyce8/EMBER2024-capa huggingface dataset:
Function at 0xf2310
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov ebx, ecx
push edi
push ebx
call fcn.0015c8ae
mov edi, eax
add esp, 4
test edi, edi
jne 0xf2397
call fcn.000ee7f0
mov eax, dword [0x1aa224]
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0xf236a
push 0xc08
call fcn.0015c8ae
add esp, 4
mov esi, eax
push 0xc08
push edi
push esi
call fcn.00153d90
add esp, 0xc
push esi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [esi], 0x1000000
call fcn.00158d34
push ebx
push dword [eax]
call fcn.0015d09d
add esp, 4
push eax
push str.tsk_malloc:__s___Iu_requested_
call fcn.000ee5f0
mov eax, edi
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ebx
push 0
push edi
call fcn.00153d90
add esp, 0xc
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0xf23b0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov eax, edx
push edi
push eax
push ecx
mov dword [ebp - 4], eax
call fcn.0015ba92
mov edi, eax
add esp, 8
test edi, edi
jne 0xf2432
call fcn.000ee7f0
mov ebx, dword [0x1aa224]
push ebx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0xf240a
push 0xc08
call fcn.0015c8ae
add esp, 4
mov esi, eax
push 0xc08
push edi
push esi
call fcn.00153d90
add esp, 0xc
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [esi], 0x1000000
call fcn.00158d34
push dword [ebp - 4]
push dword [eax]
call fcn.0015d09d
add esp, 4
push eax
push str.tsk_realloc:__s___Iu_requested_
call fcn.000ee5f0
add esp, 0xc
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100840
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
push edi
push 0x200
push 0
push 0x400
call fcn.00135350
add esp, 0xc
cmp eax, 0x200
je 0x1008ab
test eax, eax
js 0x1008a6
call fcn.000ee7f0
mov edi, dword [0x1aa224]
push edi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x1008a0
push 0xc08
call fcn.0015c8ae
add esp, 4
mov esi, eax
push 0xc08
push 0
push esi
call fcn.00153d90
add esp, 0xc
push esi
push edi
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [esi], 0x8000004
mov al, 1
pop edi
pop esi
ret
pop edi
xor al, al
pop esi
ret
Function at 0x10cf70
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push esi
push edi
mov edi, dword [0x1aa224]
push edi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x10cfb2
push 0xc08
call fcn.0015c8ae
add esp, 4
mov esi, eax
push 0xc08
push 0
push esi
call fcn.00153d90
add esp, 0xc
push esi
push edi
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
cmp dword [esi], 0
lea edi, [esi + 0x405]
jne 0x10cfc3
mov dword [esi], 0x1000002
mov edx, dword [ebp + 8]
test edx, edx
je 0x10d001
mov eax, edi
lea esi, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10cfd0
lea ecx, [ebp + 0xc]
sub eax, esi
push ecx
push 0
push edx
mov ecx, 0x400
sub ecx, eax
add eax, edi
push ecx
push eax
call fcn.000a1850
mov ecx, dword [eax]
push dword [eax + 4]
or ecx, 2
push ecx
call fcn.00158a01
add esp, 0x1c
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x113d80
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebx
push esi
push edi
push 0
push 3
mov edi, ecx
call fcn.000eef60
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x113ed7
mov ecx, dword [ebx + 8]
mov edx, 0x70
mov ecx, dword [ecx + 0xc8]
call fcn.00131c60
mov ecx, eax
test ecx, ecx
jne 0x113e13
call fcn.000ee7f0
mov edi, dword [0x1aa224]
push edi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x113df3
push 0xc08
call fcn.0015c8ae
add esp, 4
mov esi, eax
push 0xc08
push 0
push esi
call fcn.00153d90
add esp, 0xc
push esi
push edi
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push str.Volume_Info_attribute_not_found_in__Volume
mov dword [esi], 0x8000009
call fcn.000ee5f0
add esp, 4
mov ecx, ebx
call fcn.000eef10
mov al, 1
pop edi
pop esi
pop ebx
ret
test byte [ecx + 8], 4
je 0x113ebb
mov eax, dword [ecx + 0x20]
or eax, dword [ecx + 0x24]
je 0x113ebb
mov esi, dword [ecx + 0x50]
mov al, byte [esi + 8]
cmp al, 1
jne 0x113e4d
cmp byte [esi + 9], 2
jne 0x113e4d
mov ecx, ebx
mov byte [edi + 0x11c], 0x21
call fcn.000eef10
xor al, al
pop edi
pop esi
pop ebx
ret
cmp al, 3
jne 0x113e88
cmp byte [esi + 9], 0
jne 0x113e6a
mov ecx, ebx
mov byte [edi + 0x11c], al
call fcn.000eef10
xor al, al
pop edi
pop esi
pop ebx
ret
cmp al, 3
jne 0x113e88
cmp byte [esi + 9], 1
jne 0x113e88
mov ecx, ebx
mov byte [edi + 0x11c], 0x13
call fcn.000eef10
xor al, al
pop edi
pop esi
pop ebx
ret
call fcn.000ee7f0
mov ecx, 0x800000f
call fcn.000ee550
movzx eax, byte [esi + 9]
push eax
movzx eax, byte [esi + 8]
push eax
push str.unknown_version:__d._d_n
call fcn.000ee5f0
add esp, 0xc
mov ecx, ebx
call fcn.000eef10
mov al, 1
pop edi
pop esi
pop ebx
ret
call fcn.000ee7f0
mov ecx, 0x800000f
call fcn.000ee550
push str.load_version:_VINFO_is_a_non_resident_attribute
call fcn.000ee5f0
add esp, 4
pop edi
pop esi
mov al, 1
pop ebx
ret
Function at 0x130640
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, edx
push edi
test esi, esi
jne 0x1306a5
call fcn.000ee7f0
mov edi, dword [0x1aa224]
push edi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x13068b
push 0xc08
call fcn.0015c8ae
add esp, 4
mov esi, eax
push 0xc08
push 0
push esi
call fcn.00153d90
add esp, 0xc
push esi
push edi
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push str.Null_fs_attr_in_tsk_fs_attr_set_str
mov dword [esi], 0x8000006
call fcn.000ee5f0
add esp, 4
mov al, 1
pop edi
pop esi
pop ecx
pop ebp
ret
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov dword [esi + 0x14], eax
mov ax, word [ebp + 0x10]
mov dword [esi + 4], ecx
mov ecx, esi
mov dword [esi + 8], 5
mov word [esi + 0x18], ax
mov dword [esi + 0x48], 0
call fcn.00130580
test al, al
jne 0x13069e
mov edi, dword [ebp + 0x18]
cmp dword [esi + 0x54], edi
jae 0x1306ee
mov ecx, dword [esi + 0x50]
mov edx, edi
call fcn.000f23b0
mov dword [esi + 0x50], eax
test eax, eax
je 0x13069e
mov dword [esi + 0x54], edi
push dword [esi + 0x54]
push 0
push dword [esi + 0x50]
call fcn.00153d90
add esp, 0xc
push edi
push dword [ebp + 0x14]
push dword [esi + 0x50]
call fcn.00153810
add esp, 0xc
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], 0
xor al, al
pop edi
pop esi
pop ecx
pop ebp
ret
Function at 0x130720
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, edx
test ecx, ecx
je 0x130865
cmp dword [ecx + 8], 0
je 0x130865
test edi, edi
jne 0x130763
call fcn.000ee7f0
mov ecx, 0x8000006
call fcn.000ee550
push str.Null_fs_attr_in_tsk_fs_attr_set_run
call fcn.000ee5f0
add esp, 4
mov al, 1
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
mov edx, dword [ebp + 0x2c]
mov esi, dword [ebp + 0x28]
mov ebx, dword [ebp + 0x18]
cmp edx, dword [ebp + 0x1c]
jg 0x1307a3
jl 0x130777
cmp esi, ebx
jae 0x1307a3
call fcn.000ee7f0
mov ecx, 0x8000006
call fcn.000ee550
push dword [ebp + 0x1c]
push ebx
push dword [ebp + 0x2c]
push esi
push str.tsk_fs_attr_set_run:_alloc_size___llu__is_less_than_size___llu_
call fcn.000ee5f0
add esp, 0x14
mov al, 1
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
mov eax, dword [ebp + 0x30]
or eax, 3
mov dword [edi + 4], ecx
mov dword [edi + 8], eax
mov ecx, edi
mov eax, dword [ebp + 0x10]
mov dword [edi + 0x14], eax
mov ax, word [ebp + 0x14]
mov word [edi + 0x18], ax
mov eax, dword [ebp + 0x1c]
mov dword [edi + 0x24], eax
mov eax, dword [ebp + 0x20]
mov dword [edi + 0x40], eax
mov eax, dword [ebp + 0x24]
mov dword [edi + 0x3c], edx
mov edx, dword [ebp + 0xc]
mov dword [edi + 0x44], eax
mov eax, dword [ebp + 0x34]
mov dword [edi + 0x20], ebx
mov dword [edi + 0x38], esi
mov dword [edi + 0x48], eax
call fcn.00130580
test al, al
jne 0x1308b7
mov esi, dword [ebp + 8]
test esi, esi
jne 0x130803
mov dword [edi + 0x28], esi
mov dword [edi + 0x2c], esi
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
mov eax, dword [esi + 8]
or eax, dword [esi + 0xc]
je 0x130848
mov ecx, 0x28
call fcn.000f2310
mov dword [eax + 0x20], 1
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
mov ecx, dword [esi + 8]
mov dword [eax + 0x18], ecx
mov ecx, dword [esi + 0xc]
mov dword [eax], esi
mov esi, eax
mov dword [eax + 0x1c], ecx
mov dword [edi + 0x28], esi
mov dword [edi + 0x2c], esi
cmp dword [esi], 0
je 0x13085d
mov esi, dword [esi]
mov dword [edi + 0x2c], esi
cmp dword [esi], 0
jne 0x130853
xor al, al
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
call fcn.000ee7f0
mov edi, dword [0x1aa224]
push edi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x1308a4
push 0xc08
call fcn.0015c8ae
add esp, 4
mov esi, eax
push 0xc08
push 0
push esi
call fcn.00153d90
add esp, 0xc
push esi
push edi
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push str.Null_fs_file_in_tsk_fs_attr_set_run
mov dword [esi], 0x8000006
call fcn.000ee5f0
add esp, 4
pop edi
pop esi
mov al, 1
pop ebx
pop ecx
pop ebp
ret
Function at 0x130e00
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
mov esi, ecx
push edi
xor edi, edi
mov dword [ebp - 0x14], esi
test byte [esi + 8], 4
mov eax, dword [esi + 4]
mov eax, dword [eax + 0xc]
jne 0x130e72
mov edi, dword [0x1aa224]
push edi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x130e56
push 0xc08
call fcn.0015c8ae
add esp, 4
mov esi, eax
push 0xc08
push 0
push esi
call fcn.00153d90
add esp, 0xc
push esi
push edi
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push str.tsk_fs_file_walk_res:_called_with_non_resident_data
mov dword [esi], 0x8000006
call fcn.000ee5f0
add esp, 4
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, dword [esi + 0x20]
mov eax, dword [eax + 0x50]
cmp ebx, eax
cmova ebx, eax
test dl, 4
jne 0x130e8f
mov ecx, ebx
call fcn.000f2310
mov edi, eax
test edi, edi
je 0x130e69
mov edx, dword [esi + 0x24]
xorps xmm0, xmm0
mov ecx, dword [esi + 0x20]
mov dword [ebp - 0x18], 0
movlpd qword [ebp - 0x10], xmm0
test edx, edx
jl 0x130f57
jg 0x130eb6
test ecx, ecx
je 0x130f57
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
sub ecx, eax
sbb edx, dword [ebp - 4]
js 0x130ed3
jg 0x130ecf
cmp ecx, ebx
jbe 0x130ed3
mov esi, ebx
jmp 0x130ed8
mov esi, dword [esi + 0x20]
sub esi, eax
test edi, edi
je 0x130f0a
cmp esi, ebx
je 0x130ef3
mov eax, ebx
sub eax, esi
push eax
lea eax, [esi + edi]
push 0
push eax
call fcn.00153d90
add esp, 0xc
mov eax, dword [ebp - 0x14]
push esi
mov eax, dword [eax + 0x50]
add eax, dword [ebp - 0xc]
push eax
push edi
call fcn.00153810
mov eax, dword [ebp - 0xc]
add esp, 0xc
push dword [ebp + 0xc]
push 0x105
push esi
push edi
push 0
push 0
push dword [ebp - 4]
push eax
mov eax, dword [ebp - 0x14]
push dword [eax + 4]
call dword [ebp + 8]
add esp, 0x24
mov dword [ebp - 0x18], eax
test eax, eax
jne 0x130f57
mov eax, dword [ebp - 0xc]
add eax, esi
mov esi, dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
adc dword [ebp - 4], 0
mov edx, dword [esi + 0x24]
mov ecx, dword [esi + 0x20]
cmp dword [ebp - 4], edx
jl 0x130ec2
jg 0x130f57
cmp eax, ecx
jb 0x130ec2
test edi, edi
je 0x130f64
push edi
call fcn.00158d47
add esp, 4
cmp dword [ebp - 0x18], 2
pop edi
pop esi
sete al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1313c0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, edx
mov esi, ecx
call fcn.000ee7f0
test esi, esi
je 0x1314d1
mov eax, dword [esi + 4]
test eax, eax
je 0x1314d1
cmp dword [eax + 8], 0
je 0x1314d1
mov eax, dword [eax + 0xc]
test eax, eax
je 0x1314d1
cmp dword [eax], 0x10101010
je 0x13141b
mov ecx, 0x8000006
call fcn.000ee550
push str.tsk_fs_attr_walk:_called_with_unallocated_structures
call fcn.000ee5f0
add esp, 4
mov al, 1
pop edi
pop esi
pop ebp
ret
mov eax, dword [esi + 8]
test al, 0x20
je 0x131457
mov eax, dword [esi + 0x64]
test eax, eax
jne 0x131446
mov ecx, 0x8000006
call fcn.000ee550
push str.tsk_fs_attr_walk:_compressed_attribute_found__but_special_function_not_defined
call fcn.000ee5f0
add esp, 4
mov al, 1
pop edi
pop esi
pop ebp
ret
push dword [ebp + 0xc]
push dword [ebp + 8]
push edi
push esi
call eax
add esp, 0x10
pop edi
pop esi
pop ebp
ret
test al, 4
je 0x131484
push 2
call fcn.00158e14
add esp, 4
push eax
call fcn.00159622
add esp, 4
mov edx, edi
mov ecx, esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00130e00
add esp, 8
pop edi
pop esi
pop ebp
ret
test al, 2
je 0x1314b1
push 2
call fcn.00158e14
add esp, 4
push eax
call fcn.00159622
add esp, 4
mov edx, edi
mov ecx, esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00130f80
add esp, 8
pop edi
pop esi
pop ebp
ret
mov ecx, 0x8000006
call fcn.000ee550
push dword [esi + 8]
push str.tsk_fs_attr_walk:_called_with_unknown_attribute_type:__x
call fcn.000ee5f0
add esp, 8
mov al, 1
pop edi
pop esi
pop ebp
ret
mov edi, dword [0x1aa224]
push edi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x13150b
push 0xc08
call fcn.0015c8ae
add esp, 4
mov esi, eax
push 0xc08
push 0
push esi
call fcn.00153d90
add esp, 0xc
push esi
push edi
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push str.tsk_fs_attr_walk:_called_with_NULL_pointers
mov dword [esi], 0x8000006
call fcn.000ee5f0
add esp, 4
mov al, 1
pop edi
pop esi
pop ebp
ret
Function at 0x131a20
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ecx
push esi
mov eax, ecx
mov esi, edx
push edi
test eax, eax
jne 0x131a83
call fcn.000ee7f0
mov edi, dword [0x1aa224]
push edi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x131a6a
push 0xc08
call fcn.0015c8ae
add esp, 4
mov esi, eax
push 0xc08
push 0
push esi
call fcn.00153d90
add esp, 0xc
push esi
push edi
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push str.Null_list_in_tsk_fs_attrlist_add
mov dword [esi], 0x8000006
call fcn.000ee5f0
add esp, 4
mov al, 1
pop edi
pop esi
pop ecx
ret
or dword [esi + 8], 1
mov ecx, dword [eax]
test ecx, ecx
jne 0x131a95
mov dword [eax], esi
xor al, al
pop edi
pop esi
pop ecx
ret
mov edx, dword [esi + 0x14]
cmp dword [ecx + 0x14], edx
jne 0x131aa7
mov ax, word [ecx + 0x18]
cmp ax, word [esi + 0x18]
je 0x131ab9
mov eax, dword [ecx]
test eax, eax
je 0x131ae3
mov ecx, eax
test ecx, ecx
jne 0x131a98
xor al, al
pop edi
pop esi
pop ecx
ret
call fcn.000ee7f0
mov ecx, 0x8000006
call fcn.000ee550
movzx eax, word [esi + 0x18]
push eax
push dword [esi + 0x14]
push str.datalist_add:_Type__d_and_Id__d_already_in_list
call fcn.000ee5f0
add esp, 0xc
mov al, 1
pop edi
pop esi
pop ecx
ret
pop edi
mov dword [ecx], esi
xor al, al
pop esi
pop ecx
ret

Function at 0x131af0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebx
push esi
mov ebx, ecx
xor eax, eax
push edi
mov edi, edx
test ebx, ebx
jne 0x131b54
call fcn.000ee7f0
mov edi, dword [0x1aa224]
push edi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x131b3b
push 0xc08
call fcn.0015c8ae
add esp, 4
mov esi, eax
push 0xc08
push ebx
push esi
call fcn.00153d90
add esp, 0xc
push esi
push edi
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push str.Null_list_in_tsk_fs_attrlist_getnew__
mov dword [esi], 0x8000006
call fcn.000ee5f0
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
ret
cmp edi, 2
je 0x131b80
cmp edi, 4
je 0x131b80
call fcn.000ee7f0
mov ecx, 0x8000006
call fcn.000ee550
push str.Invalid_Type_in_tsk_fs_attrlist_getnew__
call fcn.000ee5f0
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
ret
mov esi, dword [ebx]
test esi, esi
je 0x131bc2
cmp dword [esi + 8], 0
jne 0x131baa
cmp edi, 2
jne 0x131b9f
cmp dword [esi + 0x28], 0
jne 0x131bb6
test eax, eax
jne 0x131baa
mov eax, esi
jmp 0x131baa
cmp dword [esi + 0x54], 0
jne 0x131bb6
test eax, eax
cmove eax, esi
mov esi, dword [esi]
test esi, esi
jne 0x131b86
test eax, eax
je 0x131bc2
mov esi, eax
or edi, 1
mov eax, esi
mov dword [esi + 8], edi
pop edi
pop esi
pop ebx
ret
mov ecx, edi
call fcn.00130460
mov esi, eax
test esi, esi
je 0x131b4e
mov edx, esi
mov ecx, ebx
call fcn.00131a20
test al, al
je 0x131bb6
mov ecx, esi
call fcn.00130510
pop edi
pop esi
xor eax, eax
pop ebx
ret
Function at 0x131c60
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebx
push esi
xor esi, esi
mov ebx, edx
push edi
test ecx, ecx
jne 0x131cc3
call fcn.000ee7f0
mov edi, dword [0x1aa224]
push edi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x131caa
push 0xc08
call fcn.0015c8ae
add esp, 4
mov esi, eax
push 0xc08
push 0
push esi
call fcn.00153d90
add esp, 0xc
push esi
push edi
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push str.tsk_fs_attrlist_get:_Null_list_pointer
mov dword [esi], 0x8000006
call fcn.000ee5f0
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
ret
mov ecx, dword [ecx]
test ecx, ecx
je 0x131d10
nop dword [eax]
test byte [ecx + 8], 1
je 0x131cfa
mov eax, dword [ecx + 0x14]
cmp eax, ebx
jne 0x131cfa
cmp eax, 0x80
jne 0x131cea
cmp dword [ecx + 0xc], 0
je 0x131d0a
test esi, esi
je 0x131cf8
mov ax, word [esi + 0x18]
cmp ax, word [ecx + 0x18]
jbe 0x131cfa
mov esi, ecx
mov ecx, dword [ecx]
test ecx, ecx
jne 0x131cd0
test esi, esi
je 0x131d10
mov eax, esi
pop edi
pop esi
pop ebx
ret
mov eax, ecx
pop edi
pop esi
pop ebx
ret
mov edi, dword [0x1aa224]
push edi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x131d4a
push 0xc08
call fcn.0015c8ae
add esp, 4
mov esi, eax
push 0xc08
push 0
push esi
call fcn.00153d90
add esp, 0xc
push esi
push edi
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push ebx
push str.tsk_fs_attrlist_get:_Attribute__d_not_found
mov dword [esi], 0x8000011
call fcn.000ee5f0
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
ret

Function at 0x131d70
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, edx
test ecx, ecx
jne 0x131dda
call fcn.000ee7f0
mov edi, dword [0x1aa224]
push edi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x131dbe
push 0xc08
call fcn.0015c8ae
add esp, 4
mov esi, eax
push 0xc08
push 0
push esi
call fcn.00153d90
add esp, 0xc
push esi
push edi
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push str.tsk_fs_attrlist_get_id:_Null_list_pointer
mov dword [esi], 0x8000006
call fcn.000ee5f0
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ecx]
mov si, word [ebp + 8]
test eax, eax
je 0x131dfb
test byte [eax + 8], 1
je 0x131df5
cmp dword [eax + 0x14], edi
jne 0x131df5
cmp word [eax + 0x18], si
je 0x131e53
mov eax, dword [eax]
test eax, eax
jne 0x131de4
mov eax, dword [0x1aa224]
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test ebx, ebx
jne 0x131e39
push 0xc08
call fcn.0015c8ae
add esp, 4
mov ebx, eax
push 0xc08
push 0
push ebx
call fcn.00153d90
add esp, 0xc
push ebx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
movzx eax, si
push eax
push edi
push str.tsk_fs_attrlist_get_id:_Attribute__d__d_not_found
mov dword [ebx], 0x8000011
call fcn.000ee5f0
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x131e60
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ecx
push ebx
push esi
xor esi, esi
push edi
test ecx, ecx
jne 0x131ec3
call fcn.000ee7f0
mov edi, dword [0x1aa224]
push edi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x131ea9
push 0xc08
call fcn.0015c8ae
add esp, 4
mov esi, eax
push 0xc08
push 0
push esi
call fcn.00153d90
add esp, 0xc
push esi
push edi
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push str.tsk_fs_attrlist_get_name_type:_Null_list_pointer
mov dword [esi], 0x8000006
call fcn.000ee5f0
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
pop ecx
ret
mov edx, dword [ecx]
test edx, edx
je 0x131f3a
nop dword [eax]
test byte [edx + 8], 1
je 0x131f29
cmp dword [edx + 0x14], 0xa0
jne 0x131f29
mov eax, dword [edx + 0xc]
test eax, eax
je 0x131f29
mov ecx, str._SII
nop dword [eax + eax]
mov bl, byte [eax]
cmp bl, byte [ecx]
jne 0x131f10
test bl, bl
je 0x131f0c
mov bl, byte [eax + 1]
cmp bl, byte [ecx + 1]
jne 0x131f10
add eax, 2
add ecx, 2
test bl, bl
jne 0x131ef0
xor eax, eax
jmp 0x131f15
sbb eax, eax
or eax, 1
test eax, eax
jne 0x131f29
test esi, esi
je 0x131f27
mov ax, word [esi + 0x18]
cmp ax, word [edx + 0x18]
jbe 0x131f29
mov esi, edx
mov edx, dword [edx]
test edx, edx
jne 0x131ed0
test esi, esi
je 0x131f3a
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
ret
mov edi, dword [0x1aa224]
push edi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x131f74
push 0xc08
call fcn.0015c8ae
add esp, 4
mov esi, eax
push 0xc08
push 0
push esi
call fcn.00153d90
add esp, 0xc
push esi
push edi
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push 0xa0
push str.tsk_fs_attrlist_get:_Attribute__d_not_found
mov dword [esi], 0x8000011
call fcn.000ee5f0
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x131fa0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebx
push esi
xor esi, esi
push edi
mov edi, edx
test ecx, ecx
jne 0x132003
call fcn.000ee7f0
mov edi, dword [0x1aa224]
push edi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x131fea
push 0xc08
call fcn.0015c8ae
add esp, 4
mov esi, eax
push 0xc08
push 0
push esi
call fcn.00153d90
add esp, 0xc
push esi
push edi
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push str.tsk_fs_attrlist_get_idx:_Null_list_pointer
mov dword [esi], 0x8000006
call fcn.000ee5f0
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
ret
mov eax, dword [ecx]
test eax, eax
je 0x132021
nop dword [eax]
test byte [eax + 8], 1
je 0x13201b
cmp esi, edi
je 0x132071
inc esi
mov eax, dword [eax]
test eax, eax
jne 0x132010
mov ebx, dword [0x1aa224]
push ebx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x13205b
push 0xc08
call fcn.0015c8ae
add esp, 4
mov esi, eax
push 0xc08
push 0
push esi
call fcn.00153d90
add esp, 0xc
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push edi
push str.tsk_fs_attrlist_get_idx:_Attribute_index__d_not_found
mov dword [esi], 0x8000011
call fcn.000ee5f0
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
ret
Function at 0x132080
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ecx
push esi
xor eax, eax
push edi
test ecx, ecx
jne 0x1320e1
call fcn.000ee7f0
mov edi, dword [0x1aa224]
push edi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x1320c8
push 0xc08
call fcn.0015c8ae
add esp, 4
mov esi, eax
push 0xc08
push 0
push esi
call fcn.00153d90
add esp, 0xc
push esi
push edi
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push str.tsk_fs_attrlist_get_len:_Null_list_pointer
mov dword [esi], 0x8000006
call fcn.000ee5f0
add esp, 4
xor eax, eax
pop edi
pop esi
pop ecx
ret
mov ecx, dword [ecx]
test ecx, ecx
je 0x1320f4
test byte [ecx + 8], 1
je 0x1320ee
inc eax
mov ecx, dword [ecx]
test ecx, ecx
jne 0x1320e7
pop edi
pop esi
pop ecx
ret