joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100058a9c
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov esi, ecx
mov ecx, dword [0x1000de268]
mov edi, edx
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x100058ac8
mov rcx, qword [rax + 0x10]
jmp 0x100058aca
xor ecx, ecx
test rcx, rcx
je 0x100058ae8
call fcn.10005a13c
mov rbx, rax
test rax, rax
je 0x100058ae8
mov dword [rax + 8], esi
mov dword [rax + 0xc], edi
mov dword [rax], 0x87
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x100058b04
Capabilities:
Get thread local storage value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x30
mov r12d, ecx
mov ecx, dword [0x1000de268]
mov edi, r9d
mov esi, r8d
mov ebp, edx
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x100058b41
mov rcx, qword [rax + 0x10]
jmp 0x100058b43
xor ecx, ecx
test rcx, rcx
je 0x100058b81
call fcn.10005a13c
mov rbx, rax
test rax, rax
je 0x100058b81
and dword [rax], 0xffffffc8
or dword [rax], 8
lea rcx, [rax + 8]
mov r9d, esi
mov r8d, ebp
mov edx, r12d
mov dword [rsp + 0x20], edi
call qword [sym.imp.USER32.dll_SetRect]
mov r11d, dword [rbx]
and r11d, 0x3f
bts r11d, 7
mov dword [rbx], r11d
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop r12
ret

Function at 0x100058ba8
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov edi, ecx
mov ecx, dword [0x1000de268]
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x100058bcd
mov rcx, qword [rax + 0x10]
jmp 0x100058bcf
xor ecx, ecx
test rcx, rcx
je 0x100058bf2
call fcn.10005a13c
mov rbx, rax
test rax, rax
je 0x100058bf2
and dword [rax + 0x14], 0
mov byte [rax + 8], 2
mov dword [rax + 0x10], edi
mov dword [rax], 0x89
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x100058c08
Capabilities:
Get thread local storage value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x20
mov r12d, ecx
mov ecx, dword [0x1000de268]
mov dil, r9b
mov esi, r8d
mov ebp, edx
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x100058c45
mov rcx, qword [rax + 0x10]
jmp 0x100058c47
xor ecx, ecx
test rcx, rcx
je 0x100058c6d
call fcn.10005a13c
mov rbx, rax
test rax, rax
je 0x100058c6d
mov byte [rax + 8], dil
mov dword [rax + 0x10], r12d
mov dword [rax + 0x14], ebp
mov dword [rax + 0x18], esi
mov dword [rax], 0x89
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop r12
ret
Function at 0x100058c94
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov ecx, dword [0x1000de268]
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x100058cba
mov rcx, qword [rax + 0x10]
jmp 0x100058cbc
xor ecx, ecx
test rcx, rcx
je 0x100058cd8
call fcn.10005a13c
mov rbx, rax
test rax, rax
je 0x100058cd8
mov qword [rax + 8], rdi
mov dword [rax], 0x8a
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x100058cec
Capabilities:
Get thread local storage value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x40
mov r12, rcx
mov ecx, dword [0x1000de268]
mov r14b, r9b
mov esi, r8d
mov bl, dl
xor edi, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x100058d2d
mov r13, qword [rax + 0x10]
jmp 0x100058d30
xor r13d, r13d
mov rbp, r12
test r13, r13
je 0x100058e7f
cmp bl, 2
je 0x100058d46
cmp bl, 7
jne 0x100058d51
mov rcx, r12
call fcn.10006c764
mov rbp, rax
test rbp, rbp
jne 0x100058d5d
xor eax, eax
jmp 0x100058e95
mov rcx, r13
call fcn.10005a13c
mov rdi, rax
test rax, rax
je 0x100058e7f
and dword [rax], 0xffffffcb
and byte [rax + 0x1c], 0x3c
or dword [rax], 0xb
mov cl, byte [rsp + 0x80]
and qword [rdi + 0x10], 0
mov qword [rax + 8], rbp
add cl, cl
and r14b, 1
lea r8, [rsp + 0x20]
or r14b, cl
mov edx, 0x20
mov rcx, rbp
shl r14b, 6
or byte [rax + 0x1c], r14b
mov al, byte [rax + 0x1d]
and al, 0xfd
or al, 1
mov byte [rdi + 0x1d], al
call qword [sym.imp.GDI32.dll_GetObjectW]
movzx eax, word [rsp + 0x28]
and byte [rdi + 0x1c], 0xc3
movzx r11d, word [rsp + 0x24]
mov word [rdi + 0x1a], ax
mov al, bl
mov word [rdi + 0x18], r11w
and al, 0xf
shl al, 2
or byte [rdi + 0x1c], al
test bl, bl
je 0x100058e65
cmp bl, 2
jbe 0x100058df7
cmp bl, 3
je 0x100058dfd
cmp bl, 6
je 0x100058e4e
cmp bl, 7
jne 0x100058e69
mov byte [rdi + 0x1e], sil
jmp 0x100058e69
cmp esi, 0xffffffff
jne 0x100058e4e
cmp qword [rdi + 8], 0
je 0x100058e4e
xor ecx, ecx
call qword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov r13, rax
test rax, rax
je 0x100058e4e
mov rdx, qword [rdi + 8]
mov rcx, rax
call qword [sym.imp.GDI32.dll_SelectObject]
xor r8d, r8d
xor edx, edx
mov rcx, r13
mov rbx, rax
call qword [sym.imp.GDI32.dll_GetPixel]
mov rdx, rbx
mov rcx, r13
mov esi, eax
call qword [sym.imp.GDI32.dll_SelectObject]
mov rcx, r13
call qword [sym.imp.GDI32.dll_DeleteDC]
movzx eax, si
mov byte [rdi + 0x1e], sil
shr ax, 8
shr esi, 0x10
mov byte [rdi + 0x20], sil
mov byte [rdi + 0x1f], al
jmp 0x100058e69
mov byte [rdi + 0x1e], 0
and dword [rdi], 0x3f
bts dword [rdi], 7
test r12, r12
je 0x100058e92
cmp rbp, r12
je 0x100058e92
mov rcx, r12
jmp 0x100058e8c
test rbp, rbp
je 0x100058e92
cmp rbp, r12
je 0x100058e92
mov rcx, rbp
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rax, rdi
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r13
pop r12
ret
Function at 0x100058ebc
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x60
mov rbp, rcx
mov ecx, dword [0x1000de268]
mov r13b, r8b
mov r12b, dl
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x100058ef6
mov rdi, qword [rax + 0x10]
jmp 0x100058ef8
xor edi, edi
test rdi, rdi
je 0x100058fe5
mov rcx, rdi
call fcn.10005a13c
mov rbx, rax
test rax, rax
je 0x100058fe5
mov cl, byte [rax + 0x1d]
and qword [rax + 0x10], 0
and r12b, 1
add r13b, r13b
and cl, 0xfd
xor sil, sil
or r12b, r13b
or cl, 1
mov byte [rax + 0x1e], 0
shl r12b, 6
mov dword [rax], 0x8b
mov qword [rax + 8], rbp
or r12b, 1
mov byte [rax + 0x1d], cl
mov byte [rax + 0x1c], r12b
test rbp, rbp
je 0x100058fc5
lea rdx, [rsp + 0x20]
mov rcx, rbp
call qword [sym.imp.USER32.dll_GetIconInfo]
test eax, eax
je 0x100058fc5
mov rcx, qword [rsp + 0x38]
mov ebp, 0x20
lea r8, [rsp + 0x40]
mov edx, ebp
call qword [sym.imp.GDI32.dll_GetObjectW]
test eax, eax
jne 0x100058f95
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x40]
mov edx, ebp
call qword [sym.imp.GDI32.dll_GetObjectW]
test eax, eax
je 0x100058faa
movzx eax, word [rsp + 0x44]
mov sil, 1
mov word [rbx + 0x18], ax
movzx eax, word [rsp + 0x48]
mov word [rbx + 0x1a], ax
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.GDI32.dll_DeleteObject]
test sil, sil
jne 0x100058fe5
mov rcx, qword [rdi + 0x20]
test rcx, rcx
je 0x100058fd7
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + 8]
mov rax, qword [rdi + 0x18]
mov qword [rbx + 0x20], rax
mov qword [rdi + 0x18], rbx
xor ebx, ebx
lea r11, [rsp + 0x60]
mov rax, rbx
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r13
pop r12
pop rdi
ret

Function at 0x1000591bc
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov ecx, dword [0x1000de268]
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x1000591e2
mov rcx, qword [rax + 0x10]
jmp 0x1000591e4
xor ecx, ecx
test rcx, rcx
je 0x100059210
call fcn.10005a13c
mov rbx, rax
test rax, rax
je 0x100059210
and dword [rax], 0xffffffce
or dword [rax], 0xe
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_AddAtomW]
and dword [rbx], 0x3f
bts dword [rbx], 7
mov word [rbx + 8], ax
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1000648b0
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x1000de138]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rsi, rdx
xor edx, edx
movzx edi, cx
lea ecx, [rdx + 0x12]
mov ebp, r8d
lea rbx, [0x10000ff58]
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
test eax, eax
je 0x100064915
bts eax, 9
lea rdx, [rsp + 0x30]
mov r8d, 0x20
shl eax, 0x10
mov ecx, eax
call qword [sym.imp.USER32.dll_GetKeyNameTextW]
lea rdx, [rsp + 0x30]
test eax, eax
cmove rdx, rbx
mov rbx, rdx
movzx eax, di
lea r8, [0x10000ff60]
mov rdx, rbp
mov r9, rbx
mov rcx, rsi
mov dword [rsp + 0x20], eax
call fcn.100058674
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1000cd7d0
mov rbx, qword [rsp + 0xb8]
add rsp, 0x80
pop rdi
pop rsi
pop rbp
ret
Function at 0x10006f240
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r15
sub rsp, 0x20
cmp dword [0x1000e2d3c], 0
mov r12, r9
mov rbp, r8
mov rsi, rdx
mov rdi, rcx
movabs r15, 0x8000000000000001
je 0x10006f2d6
cmp byte [0x1000e2d00], 0
mov al, byte [0x1000e2d40]
je 0x10006f299
cmp al, 4
jae 0x10006f28e
test al, al
jne 0x10006f2d6
test byte [0x1000e2d38], 1
jne 0x10006f2bc
jmp 0x10006f2d6
cmp al, 4
jae 0x10006f2a1
test al, al
jne 0x10006f2d6
test qword [0x1000e2d28], r15
je 0x10006f2d6
mov rcx, qword [0x1000e2d30]
mov rax, rcx
and rax, r15
cmp rax, rcx
jne 0x10006f2d6
mov rcx, qword [0x1000e2d10]
lea r8, [0x10000d208]
lea rdx, [0x10000d358]
call fcn.1000531fc
mov rcx, rdi
call fcn.10006fe48
mov ebx, eax
test eax, eax
js 0x10006f37e
lea r8, [0x1000114c8]
mov rdx, rsi
mov rcx, rbp
mov qword [rdi + 0x18], rbp
mov ebx, 0x8004005a
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rsi, rax
test rax, rax
je 0x10006f376
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x10006f376
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdx, rsi
mov rcx, rbp
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rcx, rbx
mov edx, eax
call fcn.10006f0e0
mov rsi, rax
test rax, rax
je 0x10006f371
mov r8, qword [rdi + 0x18]
mov r9, r12
mov rdx, rax
mov rcx, rdi
call fcn.10006f4cc
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rsi
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x10006f376
mov ebx, 0x8007000e
mov rcx, rdi
call fcn.10006fe88
cmp dword [0x1000e2d3c], 0
je 0x10006f3e6
cmp byte [0x1000e2d00], 0
mov al, byte [0x1000e2d40]
je 0x10006f3a9
cmp al, 4
jae 0x10006f39e
test al, al
jne 0x10006f3e6
test byte [0x1000e2d38], 1
jne 0x10006f3cc
jmp 0x10006f3e6
cmp al, 4
jae 0x10006f3b1
test al, al
jne 0x10006f3e6
test qword [0x1000e2d28], r15
je 0x10006f3e6
mov rcx, qword [0x1000e2d30]
mov rax, rcx
and rax, r15
cmp rax, rcx
jne 0x10006f3e6
mov rcx, qword [0x1000e2d10]
lea r8, [0x10000d208]
lea rdx, [0x10000d368]
call fcn.1000531fc
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r15
pop r12
pop rdi
ret
Function at 0x10006f408
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x240
mov rax, qword [0x1000de138]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rdi, rcx
lea rcx, [rsp + 0x20]
mov edx, 0x104
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
dec eax
cmp eax, 0x102
ja 0x10006f499
lea r8, [0x1000114d8]
lea rcx, [rsp + 0x20]
mov edx, 0x104
call fcn.10006da60
mov r11d, eax
test eax, eax
js 0x10006f49f
lea r8d, [rbx + 8]
lea rcx, [rsp + 0x20]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rbx, rax
test rax, rax
je 0x10006f480
xor r11d, r11d
jmp 0x10006f49f
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx r11d, ax
or r11d, 0x80070000
test eax, eax
cmovle r11d, eax
jmp 0x10006f49f
mov r11d, 0x8007007a
mov qword [rdi], rbx
mov eax, r11d
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.1000cd7d0
mov rbx, qword [rsp + 0x258]
add rsp, 0x240
pop rdi
ret
Function at 0x100078858
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ecx, dword [0x1000de268]
xor edi, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
jne 0x10007887f
mov eax, 0x8000ffff
jmp 0x10007889e
cmp byte [rax + 0x18], dil
jne 0x10007889c
mov edx, 6
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
mov edi, eax
test eax, eax
js 0x10007889c
mov byte [rbx + 0x18], 1
mov eax, edi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1000788b0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ecx, dword [0x1000de268]
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
test rax, rax
jne 0x1000788d7
mov eax, 0x8000ffff
jmp 0x1000788ee
cmp byte [rax + 0x19], bl
jne 0x1000788ec
call qword [sym.imp.UxTheme.dll_BufferedPaintInit]
mov ebx, eax
test eax, eax
js 0x1000788ec
mov byte [rdi + 0x19], 1
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x100078d1c
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov ecx, dword [0x1000de268]
xor ebx, ebx
cmp ecx, 0xffffffff
jne 0x100078d3d
mov edi, 0x80004005
jmp 0x100078eb0
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x100078d52
inc dword [rax + 8]
xor eax, eax
jmp 0x100078f08
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
lea r8d, [rdx + 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
je 0x100078eab
mov ecx, dword [0x1000de268]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
and qword [rbx + 0x10], 0
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 0x20]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
je 0x100078eab
and qword [rax + 0x10], 0
and qword [rax + 0x18], 0
and qword [rax + 0x20], 0
mov dword [rax + 8], 0x30
lea rcx, [0x1000127d8]
mov qword [rax], rcx
mov dword [rax + 0xc], 0x780
mov qword [rbx + 0x10], rax
call fcn.100081158
mov edi, eax
test eax, eax
js 0x100078eb0
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
lea r8d, [rdx + 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r11, rax
test rax, rax
je 0x100078e2e
mov ecx, 0x80000000
and dword [rax], ecx
xor eax, eax
mov qword [r11 + 8], rax
mov qword [r11 + 0x10], rax
and dword [r11 + 0x18], ecx
mov qword [r11 + 0x20], rax
mov qword [r11 + 0x28], rax
and dword [r11 + 0x30], ecx
mov qword [r11 + 0x38], rax
mov qword [r11 + 0x40], rax
xor eax, eax
mov edi, 0x8007000e
test r11, r11
cmove eax, edi
mov qword [rbx + 0x28], r11
mov edi, eax
test eax, eax
js 0x100078eb0
and dword [rbx + 0x1c], 0
xor eax, eax
mov dword [rbx + 8], 1
mov byte [rbx + 0x19], 0
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rax
and dword [rsp + 0x2c], eax
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x18
mov dword [rsp + 0x24], 2
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x30], rax
call sub.wmpdui.dll_InitGadgets
mov qword [rbx], rax
test rax, rax
jne 0x100078e9d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x100078eb0
lea rcx, [rbx + 0x30]
call fcn.10007c67c
jmp 0x100078d4b
mov edi, 0x8007000e
call fcn.10008121c
test rbx, rbx
je 0x100078f06
mov rcx, qword [rbx]
test rcx, rcx
je 0x100078ec7
call sub.wmpdui.dll_DeleteHandle
cmp qword [rbx + 0x28], 0
je 0x100078ed6
mov rcx, rbx
call fcn.10007d084
cmp dword [0x1000e21b0], 0
je 0x100078ee4
call fcn.10007c8cc
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [0x1000de268]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, edi
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x100078f1c
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov ecx, dword [0x1000de268]
cmp ecx, 0xffffffff
jne 0x100078f45
mov eax, 0x80004005
jmp 0x100079084
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
test rax, rax
jne 0x100078f5d
mov eax, 0x8004000a
jmp 0x100079084
call sub.wmpdui.dll_DUserFlushMessages
call sub.wmpdui.dll_DUserFlushDeferredMessages
dec dword [rdi + 8]
cmp dword [rdi + 8], 0
jg 0x100079082
mov rcx, qword [rdi]
call sub.wmpdui.dll_DeleteHandle
mov rcx, rdi
call fcn.10007d084
cmp byte [rdi + 0x19], 0
je 0x100078f90
call qword [sym.imp.UxTheme.dll_BufferedPaintUnInit]
cmp byte [rdi + 0x18], 0
je 0x100078f9c
call qword [sym.imp.ole32.dll_CoUninitialize]
call fcn.10008121c
cmp dword [0x1000e21b0], 0
je 0x10007903e
mov ecx, dword [0x1000de268]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, qword [rax + 0x30]
test rbx, rbx
je 0x100079005
cmp dword [rbx], 0
jbe 0x100079005
cmp qword [rbx + 8], 0
je 0x100078ff3
xor ebp, ebp
cmp dword [rbx], ebp
jbe 0x100078ff3
xor esi, esi
mov rcx, qword [rbx + 8]
mov rdx, qword [rsi + rcx + 8]
mov rcx, qword [rsi + rcx]
call fcn.10007c81c
inc ebp
add rsi, 0x10
cmp ebp, dword [rbx]
jb 0x100078fd7
lea rcx, [0x100012970]
call fcn.10007ca78
call qword [sym.imp.KERNEL32.dll_DebugBreak]
call fcn.10007c8cc
mov rcx, qword [0x1000e2990]
test rcx, rcx
je 0x100079024
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
and qword [0x1000e2990], 0
mov rcx, qword [0x1000e2998]
test rcx, rcx
je 0x10007903e
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
and qword [0x1000e2998], 0
mov rbx, qword [rdi + 0x10]
xor edx, edx
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [0x1000de268]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x10007c67c
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x30
xor r12d, r12d
lea rax, [rsp + 0x70]
mov rsi, rcx
mov qword [rcx], r12
lea rdx, [0x1000128c8]
mov r9d, 0x20019
mov rcx, 0xffffffff80000002
xor r8d, r8d
mov ebx, r12d
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
cmp eax, r12d
jne 0x10007c727
mov rcx, qword [rsp + 0x70]
lea rax, [rsp + 0x68]
lea rdx, [0x100012900]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x60], r12d
mov dword [rsp + 0x68], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
cmp eax, r12d
jne 0x10007c717
cmp dword [rsp + 0x60], r12d
mov eax, r12d
setne al
mov dword [0x1000e21b0], eax
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, r12d
je 0x10007c73b
movzx ebx, di
or ebx, 0x80070000
cmp edi, r12d
cmovle ebx, edi
cmp ebx, r12d
jl 0x10007c7ad
cmp dword [0x1000e21b0], r12d
je 0x10007c7a8
mov qword [rsi], r12
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
lea r8d, [rdx + 0x10]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
cmp rax, r12
jne 0x10007c76e
mov ebx, 0x8007000e
jmp 0x10007c7ad
mov dword [rax], r12d
mov qword [rax + 8], r12
mov byte [rax + 0x10], r12b
mov dword [rax + 0x14], r12d
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor edx, edx
lea r8d, [rdx + 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rbx + 8], rax
cmp rax, r12
je 0x10007c7fd
mov dword [rbx + 0x14], 3
mov qword [rsi], rbx
mov ebx, r12d
cmp ebx, r12d
jge 0x10007c7f0
mov rdi, qword [rsi]
cmp rdi, r12
je 0x10007c7e6
mov rbp, qword [rdi + 8]
cmp rbp, r12
je 0x10007c7d2
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbp
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rsi], r12
mov dword [0x1000e21b0], r12d
mov eax, ebx
add rsp, 0x30
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x10007c767
Function at 0x10007c8cc
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov ecx, dword [0x1000de268]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, qword [rax + 0x30]
test rbx, rbx
je 0x10007c961
cmp qword [rbx + 8], 0
je 0x10007c930
xor edi, edi
cmp dword [rbx], edi
jbe 0x10007c930
xor esi, esi
mov rax, qword [rbx + 8]
mov rbp, qword [rsi + rax + 8]
test rbp, rbp
je 0x10007c926
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbp
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
inc edi
add rsi, 0x10
cmp edi, dword [rbx]
jb 0x10007c904
mov rdi, qword [rbx + 8]
test rdi, rdi
je 0x10007c94d
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x10007c97c
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, rcx
mov ecx, dword [0x1000de268]
mov edi, 0x80004005
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, qword [rax + 0x30]
test rsi, rsi
je 0x10007ca5b
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov r8d, 0x2708
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
je 0x10007c9fc
and qword [rax], 0
lea rcx, [rax + 8]
xor edx, edx
mov r8d, 0x100
call sub.msvcrt.dll_memset
lea rcx, [rbx + 0x108]
xor edx, edx
mov r8d, 0x2600
call sub.msvcrt.dll_memset
test rbx, rbx
je 0x10007ca23
mov rcx, rbx
call fcn.10009ab58
test eax, eax
jne 0x10007ca23
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor ebx, ebx
mov r8, rbx
mov rdx, rbp
mov rcx, rsi
call fcn.10007b88c
mov edi, eax
test eax, eax
jns 0x10007ca52
test rbx, rbx
je 0x10007ca5b
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x10007ca5b
xor edi, edi
test rbx, rbx
sete dil
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov eax, edi
add rsp, 0x20
pop rdi
ret