joyce8/EMBER2024-capa huggingface dataset:
Function at 0x609e8d
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
push esi
push edi
mov dword [ebp - 8], ebx
je 0x609ef8
push 0x3d
push dword [ebp + 8]
call fcn.0060b8b1
mov esi, eax
cmp esi, ebx
pop ecx
pop ecx
mov dword [ebp - 0xc], esi
je 0x609ef8
cmp dword [ebp + 8], esi
je 0x609ef8
xor eax, eax
cmp byte [esi + 1], al
sete al
mov dword [ebp - 4], eax
mov eax, dword [0x664888]
cmp eax, dword [0x66488c]
jne 0x609ede
mov edi, eax
call fcn.00609e2c
mov dword [0x664888], eax
cmp eax, ebx
jne 0x609f37
cmp dword [ebp + 0xc], ebx
je 0x609f00
cmp dword [0x664890], ebx
je 0x609f00
call fcn.00605ebb
test eax, eax
je 0x609f37
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
cmp dword [ebp - 4], ebx
jne 0x60a03b
push 4
call fcn.0060212a
cmp eax, ebx
pop ecx
mov dword [0x664888], eax
je 0x609ef8
mov dword [eax], ebx
cmp dword [0x664890], ebx
jne 0x609f37
push 4
call fcn.0060212a
cmp eax, ebx
pop ecx
mov dword [0x664890], eax
je 0x609ef8
mov dword [eax], ebx
mov ebx, dword [0x664888]
mov edi, esi
mov esi, dword [ebp + 8]
sub edi, esi
push esi
call fcn.00609ddf
mov edi, eax
test edi, edi
pop ecx
jl 0x609f90
cmp dword [ebx], 0
je 0x609f90
lea esi, [ebx + edi*4]
push dword [esi]
call fcn.00602080
xor eax, eax
cmp dword [ebp - 4], eax
pop ecx
jne 0x609f78
mov eax, dword [ebp + 8]
mov dword [esi], eax
jmp 0x609fc6
mov ecx, dword [esi + 4]
mov dword [esi], ecx
inc edi
add esi, 4
cmp dword [esi], eax
jne 0x609f6f
mov eax, edi
shl eax, 2
push eax
push ebx
call fcn.00603970
test eax, eax
pop ecx
pop ecx
je 0x609fc6
jmp 0x609fc1
cmp dword [ebp - 4], 0
jne 0x60a034
test edi, edi
jge 0x609fa0
neg edi
lea eax, [edi*4 + 8]
push eax
push ebx
call fcn.00603970
test eax, eax
pop ecx
pop ecx
je 0x609ef8
lea ecx, [eax + edi*4]
and dword [ecx + 4], 0
mov dword [ecx], esi
mov dword [0x664888], eax
cmp dword [ebp + 0xc], 0
je 0x60a01d
push dword [ebp + 8]
call fcn.00605e30
inc eax
inc eax
push eax
call fcn.0060212a
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x60a01d
push dword [ebp + 8]
push esi
call fcn.00608e90
mov eax, esi
sub eax, dword [ebp + 8]
pop ecx
add eax, dword [ebp - 0xc]
pop ecx
and byte [eax], 0
mov ecx, dword [ebp - 4]
inc eax
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
test eax, eax
jne 0x60a016
or dword [ebp - 8], 0xffffffff
push esi
call fcn.00602080
pop ecx
cmp dword [ebp - 4], 0
je 0x60a02c
push dword [ebp + 8]
call fcn.00602080
pop ecx
mov eax, dword [ebp - 8]
jmp 0x609efb
push esi
call fcn.00602080
pop ecx
xor eax, eax
jmp 0x609efb
Function at 0x60a870
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
push edi
push 4
pop eax
call fcn.006021b0
mov ebx, esp
push 0x1c
lea eax, [ebp - 0x24]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x60a905
mov edi, dword [ebp - 0x20]
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x44]
lea esi, [eax - 1]
not esi
and esi, ebx
sub esi, eax
mov dword [ebp - 4], eax
mov eax, dword [0x664868]
mov ecx, eax
dec ecx
neg ecx
sbb ecx, ecx
and ecx, 0xffff1000
add ecx, 0x11000
add ecx, edi
cmp esi, ecx
jb 0x60a905
cmp eax, 1
je 0x60a91d
mov ebx, edi
mov edi, 0x1000
push 0x1c
lea eax, [ebp - 0x24]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x60a905
add ebx, dword [ebp - 0x18]
test dword [ebp - 0x14], edi
je 0x60a8da
test byte [ebp - 0xf], 1
mov ebx, dword [ebp - 0x24]
je 0x60a901
xor eax, eax
inc eax
jmp 0x60a939
cmp esi, ebx
jae 0x60a909
xor eax, eax
jmp 0x60a939
push 4
push edi
push dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x664868]
jmp 0x60a91f
mov ebx, esi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 8]
push ecx
inc eax
push eax
push dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x54]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x60a941
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [0x664b44], ebx
push esi
push edi
jne 0x60a9c1
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x60a9fc
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x64120c
push edi
call esi
test eax, eax
mov dword [0x664b44], eax
je 0x60a9fc
push str.GetActiveWindow
push edi
call esi
push str.GetLastActivePopup
push edi
mov dword [0x664b48], eax
call esi
cmp dword [0x664868], 2
mov dword [0x664b4c], eax
jne 0x60a9c1
push str.GetUserObjectInformationA
push edi
call esi
test eax, eax
mov dword [0x664b54], eax
je 0x60a9c1
push str.GetProcessWindowStation
push edi
call esi
mov dword [0x664b50], eax
mov eax, dword [0x664b50]
test eax, eax
je 0x60aa06
call eax
test eax, eax
je 0x60a9ed
lea ecx, [ebp - 4]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [0x664b54]
test eax, eax
je 0x60a9ed
test byte [ebp - 8], 1
jne 0x60aa06
cmp dword [0x664874], 4
jb 0x60aa00
or byte [ebp + 0x12], 0x20
jmp 0x60aa25
xor eax, eax
jmp 0x60aa35
or byte [ebp + 0x12], 4
jmp 0x60aa25
mov eax, dword [0x664b48]
test eax, eax
je 0x60aa25
call eax
mov ebx, eax
test ebx, ebx
je 0x60aa25
mov eax, dword [0x664b4c]
test eax, eax
je 0x60aa25
push ebx
call eax
mov ebx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [0x664b44]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x60b918
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1008
call fcn.006021b0
mov eax, dword [0x659c50]
xor eax, dword [ebp + 4]
push ebx
mov ebx, dword [ebp + 8]
push esi
xor esi, esi
cmp ebx, dword [0x74c580]
mov dword [ebp - 4], eax
jae 0x60ba58
mov eax, ebx
sar eax, 5
mov eax, dword [eax*4 + 0x74c5a0]
mov ecx, ebx
and ecx, 0x1f
test byte [eax + ecx*8 + 4], 1
je 0x60ba58
push 1
push esi
push ebx
call fcn.00609451
add esp, 0xc
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
je 0x60ba62
push 2
push esi
push ebx
call fcn.00609451
add esp, 0xc
cmp eax, 0xffffffff
je 0x60ba62
push edi
mov edi, dword [ebp + 0xc]
sub edi, eax
test edi, edi
jle 0x60ba05
push 0x1000
lea eax, [ebp - 0x1008]
push esi
push eax
call fcn.0060a810
push 0x8000
push ebx
call fcn.00604253
add esp, 0x14
mov dword [ebp + 8], eax
mov eax, 0x1000
cmp edi, eax
jge 0x60b9c4
mov eax, edi
push eax
lea eax, [ebp - 0x1008]
push eax
push ebx
call fcn.00609246
add esp, 0xc
cmp eax, 0xffffffff
je 0x60b9e2
sub edi, eax
test edi, edi
jg 0x60b9b9
jmp 0x60b9f8
cmp dword [0x664860], 5
jne 0x60b9f5
mov dword [0x66485c], 0xd
or esi, 0xffffffff
push dword [ebp + 8]
push ebx
call fcn.00604253
pop ecx
pop ecx
jmp 0x60ba45
jge 0x60ba45
push 0
push dword [ebp + 0xc]
push ebx
call fcn.00609451
push ebx
call fcn.0060a3cf
add esp, 0x10
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov esi, eax
neg esi
sbb esi, esi
neg esi
dec esi
cmp esi, 0xffffffff
jne 0x60ba45
mov dword [0x66485c], 0xd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x664860], eax
push 0
push dword [ebp - 8]
push ebx
call fcn.00609451
add esp, 0xc
mov eax, esi
pop edi
jmp 0x60ba65
mov dword [0x66485c], 9
or eax, 0xffffffff
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
pop esi
pop ebx
call fcn.00605f57
leave
ret
Function at 0x612238
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
push esi
mov dword [ebp - 4], edi
xor eax, eax
mov edi, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x1c], esi
mov eax, dword [ebp + 0xc]
shr eax, 2
add eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
rdtsc
mov esi, dword [ebp - 0x14]
mov ecx, eax
rdtsc
mov esi, dword [esi]
mov edi, eax
rdtsc
sub eax, edi
sub edi, ecx
mov edx, eax
lea esi, [edi*4]
shr edi, 2
add edi, esi
xor eax, eax
sub edi, edx
setge al
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
test eax, eax
je 0x61219f
mov edi, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
shr ecx, 7
pxor xmm0, xmm0
mov esi, esi
lea edi, [edi]
movdqa xmmword [edi], xmm0
movdqa xmmword [edi + 0x10], xmm0
movdqa xmmword [edi + 0x20], xmm0
movdqa xmmword [edi + 0x30], xmm0
movdqa xmmword [edi + 0x40], xmm0
movdqa xmmword [edi + 0x50], xmm0
movdqa xmmword [edi + 0x60], xmm0
movdqa xmmword [edi + 0x70], xmm0
lea edi, [edi + 0x80]
dec ecx
jne 0x612164
emms
jmp 0x61222d
mov eax, dword [ebp + 0xc]
mov edx, eax
shr edx, 1
shr eax, 2
add edx, dword [ebp + 8]
add edx, eax
mov dword [ebp - 0xc], edx
rdtsc
mov esi, dword [ebp - 0xc]
mov ecx, eax
rdtsc
mov esi, dword [esi]
mov edi, eax
rdtsc
sub eax, edi
sub edi, ecx
mov edx, eax
lea esi, [edi*4]
shr edi, 2
add edi, esi
xor eax, eax
sub edi, edx
setge al
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
test eax, eax
jne 0x61214e
mov edi, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
shr ecx, 7
pxor xmm0, xmm0
movntdq xmmword [edi], xmm0
movntdq xmmword [edi + 0x10], xmm0
movntdq xmmword [edi + 0x20], xmm0
movntdq xmmword [edi + 0x30], xmm0
movntdq xmmword [edi + 0x40], xmm0
movntdq xmmword [edi + 0x50], xmm0
movntdq xmmword [edi + 0x60], xmm0
movntdq xmmword [edi + 0x70], xmm0
lea edi, [edi + 0x80]
dec ecx
jne 0x6121f4
sfence
emms
mov esi, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x18]
mov esp, ebp
pop ebp
ret
test dword [0x664b88], 0xfffffe00
jne 0x612104
test dword [0x664b88], 0xffffff80
jne 0x6120e0
test dword [0x664b88], 0xffffffff
jne 0x612324
call fcn.006123c8
jmp fcn.00612238
push ebp
mov ebp, esp
push esi
mov dword [ebp - 4], edi
xor eax, eax
mov edi, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
rep stosb byte es:[edi], al
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x61fd16
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x659c50]
xor eax, dword [ebp + 4]
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
mov dword [ebp - 4], eax
je 0x61fd8f
push ebx
call fcn.0061fcdf
test eax, eax
pop ecx
jne 0x61fd61
mov dword [0x664860], 0xf
mov dword [0x66485c], 0xd
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
pop ebx
call fcn.00605f57
leave
ret
and byte [ebp + 0xb], 0
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10c]
push eax
push 0x104
lea eax, [ebp + 8]
add bl, 0x40
push eax
mov byte [ebp + 8], bl
mov byte [ebp + 9], 0x3a
mov byte [ebp + 0xa], 0x2e
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
jmp 0x61fda1
lea eax, [ebp - 0x10c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x61fd51
inc eax
cmp eax, 0x104
ja 0x61fd51
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jne 0x61fdd8
cmp eax, dword [ebp + 0x10]
jg 0x61fdbc
mov eax, dword [ebp + 0x10]
push eax
call fcn.0060212a
pop ecx
mov ecx, eax
test ecx, ecx
jne 0x61fdec
mov dword [0x66485c], 0xc
jmp 0x61fd51
cmp eax, dword [ebp + 0x10]
jle 0x61fdec
mov dword [0x66485c], 0x22
jmp 0x61fd51
lea eax, [ebp - 0x10c]
push eax
push ecx
call fcn.00608e90
pop ecx
pop ecx
jmp 0x61fd53
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x407ef8
nop
nop
mov ecx, 0x2daa6c5f
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x42e04e
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x42e024
nop
mov eax, section..data
nop
mov ebx, 0x42cd70
nop
mov ecx, 0x79d13df2
nop
nop
nop
nop
test eax, eax
nop
je 0x42e084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x42e06c
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x6d641711
Capabilities:
Get thread local storage value

Disassembly:
push esi
mov esi, ecx
push dword [0x6d7a23c4]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov eax, dword [eax + 0x8c]
mov dword [esi], eax
mov eax, dword [eax + 4]
mov dword [esi + 4], eax
mov eax, dword [esi]
mov eax, dword [eax + 8]
mov dword [esi + 8], eax
mov eax, dword [esi]
mov eax, dword [eax + 0xc]
mov dword [esi + 0xc], eax
mov eax, esi
pop esi
ret

Function at 0x6d646037
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], ecx
lea esi, [edi + 8]
lea eax, [esi + 0x70]
push eax
push ebx
call fcn.6d6462e3
lea eax, [esi + 0x6c]
push eax
push ebx
call fcn.6d6462e3
add esp, 0x10
push dword [0x6d7a23c4]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push eax
lea ecx, [ebp - 0x1c]
call fcn.6d6b5a73
mov eax, dword [esi]
push ebx
mov ecx, esi
call dword [eax + 0x1c]
mov ecx, eax
call fcn.6d709599
lea ecx, [ebp - 0x1c]
call fcn.6d6b5aa6
mov ecx, dword [ebp - 4]
push edi
push ebx
call fcn.6d708780
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x6d6461b8
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0
mov ebx, ecx
lea esi, [edi + 8]
lea eax, [esi + 0x70]
push eax
call fcn.6d72c38c
lea eax, [esi + 0x6c]
push 0
push eax
call fcn.6d72c38c
add esp, 0x10
push dword [0x6d7a23c4]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push eax
lea ecx, [ebp - 0x18]
call fcn.6d6b5a73
push dword [ebp + 8]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x1c]
mov ecx, eax
call fcn.6d709604
lea ecx, [ebp - 0x18]
call fcn.6d6b5aa6
push edi
mov ecx, ebx
push dword [ebp + 8]
call fcn.6d708a41
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x6d646222
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
mov ebx, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
lea esi, [edi + 8]
lea eax, [esi + 0x70]
cmp eax, ebx
jb 0x6d64624d
cmp eax, dword [ebp + 0x14]
jae 0x6d64624d
push 0
push eax
call fcn.6d72c38c
pop ecx
pop ecx
lea eax, [esi + 0x6c]
cmp eax, ebx
jb 0x6d646263
cmp eax, dword [ebp + 0x14]
jae 0x6d646263
push 0
push eax
call fcn.6d72c38c
pop ecx
pop ecx
push dword [0x6d7a23c4]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push eax
lea ecx, [ebp - 0x1c]
call fcn.6d6b5a73
push dword [ebp + 0x14]
mov eax, dword [esi]
mov ecx, esi
push ebx
push dword [ebp + 8]
call dword [eax + 0x1c]
mov ecx, eax
call fcn.6d709637
lea ecx, [ebp - 0x1c]
call fcn.6d6b5aa6
push dword [ebp + 0x14]
mov ecx, dword [ebp - 4]
push ebx
push edi
push dword [ebp + 8]
call fcn.6d708a74
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x6d64b4a3
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov ebx, dword [esi]
mov eax, ebx
and eax, 7
cmp al, 5
je 0x6d64b506
cmp dword [0x6d7b5a98], 0
je 0x6d64b4ff
push dword [0x6d7a23c4]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push eax
lea ecx, [ebp - 0x10]
call fcn.6d64bc19
mov esi, dword [esi + 4]
lea ecx, [esi + 8]
call fcn.6d7085ea
push eax
push str.___Skipping_revocation_of_object_of_type__s_because_its_no_longer_biased_
push dword [0x6d7bf31c]
call fcn.6d71fdc8
add esp, 0xc
lea ecx, [ebp - 0x10]
call fcn.6d6a63ec
push 1
jmp 0x6d64b673
mov eax, ebx
xor edx, edx
sar eax, 3
and eax, 0xf
and eax, 0xf
shl eax, 3
mov edi, eax
or al, 1
or edi, 5
cmp dword [0x6d7b5a98], edx
mov dword [ebp + 8], eax
je 0x6d64b57f
cmp dword [ebp + 0x10], edx
jne 0x6d64b57f
push dword [0x6d7a23c4]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push eax
lea ecx, [ebp - 0x10]
call fcn.6d64bc19
push dword [ebp + 0x14]
mov eax, dword [esi + 4]
xor ecx, ecx
cmp dword [ebp + 0xc], ecx
setne cl
push ecx
lea ecx, [eax + 8]
push dword [eax + 0x60]
call fcn.6d7085ea
push eax
push ebx
push esi
push str.Revoking_bias_of_object_0x_08x___mark_0x_08x___type__s___prototype_header_0x_08x___allow_rebias__d___requesting_thread_0x_08x
push dword [0x6d7bf31c]
call fcn.6d71fdc8
add esp, 0x20
lea ecx, [ebp - 0x10]
call fcn.6d6a63ec
mov eax, dword [ebp + 8]
xor edx, edx
and ebx, 0xfffffe00
jne 0x6d64b5aa
cmp dword [ebp + 0xc], edx
jne 0x6d64b58e
mov dword [esi], eax
cmp dword [0x6d7b5a98], edx
je 0x6d64b671
cmp dword [ebp + 0x10], edx
jne 0x6d64b671
push str.__Revoked_bias_of_anonymously_biased_object
jmp 0x6d64b5ea
cmp dword [ebp + 0x14], ebx
je 0x6d64b5f9
mov ecx, dword [0x6d7c1d78]
cmp ecx, edx
je 0x6d64b5c5
cmp ecx, ebx
je 0x6d64b5f9
mov ecx, dword [ecx + 0xa0]
jmp 0x6d64b5b5
cmp dword [ebp + 0xc], edx
je 0x6d64b5ce
mov dword [esi], edi
jmp 0x6d64b5d0
mov dword [esi], eax
cmp dword [0x6d7b5a98], edx
je 0x6d64b671
cmp dword [ebp + 0x10], edx
jne 0x6d64b671
push str.__Revoked_bias_of_object_biased_toward_dead_thread
push dword [0x6d7bf31c]
call fcn.6d71fdc8
pop ecx
pop ecx
jmp 0x6d64b671
push ebx
call fcn.6d64b679
pop ecx
xor ebx, ebx
xor ecx, ecx
cmp dword [eax], ebx
jle 0x6d64b641
mov edx, dword [eax + 8]
mov edx, dword [edx + ebx*4]
cmp dword [edx], esi
jne 0x6d64b61b
mov ecx, dword [edx + 4]
mov dword [ecx], 0
inc ebx
cmp ebx, dword [eax]
jl 0x6d64b608
test ecx, ecx
je 0x6d64b641
mov eax, dword [ebp + 8]
mov dword [ecx], eax
mov dword [esi], ecx
cmp dword [0x6d7b5a98], 0
je 0x6d64b671
cmp dword [ebp + 0x10], 0
jne 0x6d64b671
push str.__Revoked_bias_of_currently_locked_object
jmp 0x6d64b5ea
cmp dword [0x6d7b5a98], 0
je 0x6d64b662
cmp dword [ebp + 0x10], 0
jne 0x6d64b662
push str.__Revoked_bias_of_currently_unlocked_object
push dword [0x6d7bf31c]
call fcn.6d71fdc8
pop ecx
pop ecx
cmp dword [ebp + 0xc], 0
je 0x6d64b66c
mov dword [esi], edi
jmp 0x6d64b671
mov eax, dword [ebp + 8]
mov dword [esi], eax
push 2
pop eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x6d64bafa
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
mov esi, dword [ebp + 8]
cmp dword [esi], 0
je 0x6d64bb29
push dword [0x6d7a23c4]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.6d64bb2c
lea eax, [ebp - 0x28]
push eax
call fcn.6d76a82f
pop ecx
pop esi
leave
ret
Function at 0x6d660adc
Capabilities:
Get thread local storage value

Disassembly:
cmp dword [ecx + 0x18], 0
je 0x6d660af6
cmp dword [ecx + 0x30], 0
jne 0x6d660af6
test byte [ecx + 0x34], 0x10
je 0x6d660af1
xor eax, eax
ret
jmp 0x6d683de7
mov eax, dword [ecx + 0x30]
ret
push edi
mov edi, ecx
call fcn.6d682cf1
test eax, eax
je 0x6d683e0b
mov eax, dword [edi + 4]
mov eax, dword [eax]
lea ecx, [eax + 8]
call fcn.6d7083e6
neg eax
sbb eax, eax
neg eax
mov dword [edi + 0x30], eax
pop edi
ret
push ebx
push esi
push dword [0x6d7a23c4]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
push 6
push ebx
call fcn.6d681e40
mov eax, dword [edi + 4]
pop ecx
pop ecx
mov eax, dword [eax]
lea ecx, [eax + 8]
call fcn.6d7083e6
mov esi, eax
neg esi
sbb esi, esi
neg esi
mov dword [edi + 0x30], esi
mov ecx, dword [ebx + 0x2c]
call fcn.6d67a7cf
push 4
push 6
push ebx
call fcn.6d681d7e
add esp, 0xc
mov eax, esi
pop esi
pop ebx
pop edi
ret
Function at 0x6d67f09d
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0x14]
push ebx
mov ebx, ecx
push esi
push edi
mov dword [ebx + 8], eax
cmp dword [0x6d792124], 0
je 0x6d67f257
lea eax, [ebp + 0x14]
lea ecx, [ebp - 4]
push eax
call fcn.6d6a9287
push dword [0x6d7a23c4]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push eax
lea ecx, [ebp - 0x14]
call fcn.6d64bc19
mov eax, dword [ebp + 0x18]
push dword [ebp + 0xc]
mov eax, dword [eax + 0xc]
push str.space
push eax
call fcn.6d723d85
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
mov dword [ebp + 0x18], edi
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, ecx
inc edi
push edi
call fcn.6d71c250
mov esi, eax
add esp, 0x10
test esi, esi
mov dword [ebp + 0xc], esi
jne 0x6d67f121
push str.char_in_C:_BUILD_AREA_jdk1.5.0_13_hotspot_src_share_vmgc_implementation_sharedcSpaceCounters.cpp
push edi
call fcn.6d6c65d4
pop ecx
pop ecx
mov edi, dword [ebp + 0x18]
or ecx, 0xffffffff
xor eax, eax
mov dword [ebx + 0xc], esi
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push str.name
mov eax, ecx
mov esi, edi
mov edi, dword [ebp + 0xc]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push dword [ebx + 0xc]
call fcn.6d723d3f
push dword [ebp + 0x14]
push dword [ebp + 8]
push eax
push 5
pop edi
push edi
call fcn.6d723de2
mov eax, dword [ebp + 0x14]
xor esi, esi
add esp, 0x18
cmp dword [eax + 4], esi
jne 0x6d67f247
push str.maxCapacity
push dword [ebx + 0xc]
call fcn.6d723d3f
push dword [ebp + 0x14]
push esi
push dword [ebp + 0x10]
push 2
push eax
push edi
call fcn.6d723e50
mov eax, dword [ebp + 0x14]
add esp, 0x20
cmp dword [eax + 4], esi
jne 0x6d67f247
push str.capacity
push dword [ebx + 0xc]
call fcn.6d723d3f
mov edx, dword [ebx + 8]
push dword [ebp + 0x14]
mov ecx, dword [edx + 8]
mov edx, dword [edx + 4]
sub ecx, edx
push esi
push ecx
push 2
push eax
push edi
call fcn.6d723f82
mov dword [ebx], eax
mov eax, dword [ebp + 0x14]
add esp, 0x20
cmp dword [eax + 4], esi
jne 0x6d67f247
push str.used
push dword [ebx + 0xc]
call fcn.6d723d3f
push 8
mov dword [ebp + 0x18], eax
call fcn.6d641742
add esp, 0xc
cmp eax, esi
je 0x6d67f1fe
mov ecx, dword [ebx + 8]
mov dword [eax], sym.jvm.dll_const_ContiguousSpaceUsedHelper::vftable
mov dword [eax + 4], ecx
jmp 0x6d67f200
xor eax, eax
push dword [ebp + 0x14]
push eax
push 2
push dword [ebp + 0x18]
push edi
call fcn.6d724010
mov dword [ebx + 4], eax
mov eax, dword [ebp + 0x14]
add esp, 0x14
cmp dword [eax + 4], esi
jne 0x6d67f247
push str.initCapacity
push dword [ebx + 0xc]
call fcn.6d723d3f
mov ecx, dword [ebx + 8]
push dword [ebp + 0x14]
mov edx, dword [ecx + 8]
push esi
sub edx, dword [ecx + 4]
push edx
push 2
push eax
push edi
call fcn.6d723e50
mov eax, dword [ebp + 0x14]
add esp, 0x20
lea ecx, [ebp - 0x14]
call fcn.6d6a63ec
lea ecx, [ebp - 4]
call fcn.6d6a92d6
pop edi
mov eax, ebx
pop esi
pop ebx
leave
ret 0x14