joyce8/EMBER2024-capa huggingface dataset:
Function at 0x72a13118
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
cmp esi, edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 4], edi
jl 0x72a13138
cmp esi, 0x3fffffff
jbe 0x72a1313f
push 5
call fcn.72a0e22c
push dword [ebp + 0xc]
call fcn.72a132e0
push dword [0x72a4ef9c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov eax, dword [eax + 0x18]
push 0xffffffffffffffef
pop ecx
mov eax, dword [eax]
mov dword [ebp + 0xc], ecx
mov dword [ebp - 0x10], eax
lea eax, [esi + esi]
cmp eax, ecx
ja 0x72a1316b
mov dword [ebp + 0xc], eax
push dword [ebp + 0xc]
push edi
call dword [sym.imp.OLEAUT32.dll_DllRegisterServer]
cmp eax, edi
mov dword [ebp - 8], eax
jne 0x72a13188
call fcn.72a138be
push 0xe
call fcn.72a0e22c
mov ebx, dword [ebp - 8]
lea edi, [esi - 1]
test esi, esi
je 0x72a131e6
mov esi, 0xff
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x10]
call fcn.72a13b42
cmp eax, 0xffffffff
je 0x72a1321b
mov ecx, dword [ebp + 0xc]
cmp dword [ebp - 0xc], ecx
ja 0x72a1322a
cmp eax, esi
jle 0x72a13216
mov ecx, eax
mov byte [ebp + 0xb], al
sar ecx, 8
mov byte [ebp + 0xa], cl
xor ecx, ecx
cmp eax, esi
setg cl
push 1
inc ecx
push ebx
lea eax, [ebp + 0xa]
push ecx
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
add dword [ebp - 0xc], 2
inc ebx
inc ebx
mov eax, edi
dec edi
test eax, eax
jne 0x72a13197
call fcn.72a138be
cmp dword [ebp - 4], 0
je 0x72a13233
cmp dword [ebp - 4], 0x3e
jne 0x72a131ff
mov eax, dword [ebp - 0x10]
cmp dword [eax], 0x20
je 0x72a13233
push dword [ebp - 8]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
cmp dword [ebp - 4], 0
je 0x72a13250
push dword [ebp - 4]
call fcn.72a0e22c
mov byte [ebp + 0xa], al
jmp 0x72a131bf
cmp dword [ebp - 4], 0
jne 0x72a131e6
mov dword [ebp - 4], 0x3e
jmp 0x72a131e6
mov dword [ebp - 4], 0xe
jmp 0x72a131e6
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 0xc]
je 0x72a13250
push eax
lea eax, [ebp - 8]
push dword [ebp - 8]
push eax
call fcn.72a1a58f
test eax, eax
jne 0x72a13250
push 0xe
jmp 0x72a13211
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x72a140b0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push dword [0x72a4ef9c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov eax, dword [eax + 0x18]
and dword [ebp - 4], 0
movsx ebx, word [eax + 0xc]
mov edi, dword [eax + 8]
test ebx, ebx
jle 0x72a1411d
cmp word [edi], 0
je 0x72a14112
mov esi, dword [edi + 8]
mov eax, dword [esi + 0x20]
lea eax, [eax + esi + 0x38]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x72a1410c
movzx eax, word [ebp + 0xc]
mov esi, dword [esi]
mov ecx, esi
or ecx, eax
cmp ecx, 1
je 0x72a1410c
or esi, eax
or esi, 0x24
cmp esi, 0x24
jne 0x72a1411d
xor eax, eax
test eax, eax
jne 0x72a1411d
add edi, 0xc
inc dword [ebp - 4]
cmp dword [ebp - 4], ebx
jl 0x72a140d5
xor eax, eax
cmp dword [ebp - 4], ebx
pop edi
pop esi
setne al
pop ebx
leave
ret 8

Function at 0x72a14275
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
push dword [0x72a4ef9c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, dword [eax + 0x18]
lea eax, [ebp - 8]
push eax
call fcn.72a1de2a
test eax, eax
je 0x72a1429f
push eax
call fcn.72a0e22c
mov eax, dword [ebp + 8]
cmp word [eax], 0xa
jne 0x72a14302
cmp dword [eax + 8], 0x80020004
jne 0x72a14302
and dword [ebp - 4], 0
cmp word [ebp - 4], 0
mov ebx, dword [esi + 8]
movsx edx, word [esi + 0xc]
jne 0x72a1430d
push 1
mov dword [ebp + 8], 0xff
pop edi
test ebx, ebx
je 0x72a1431b
cmp di, word [ebp + 8]
jg 0x72a14321
xor esi, esi
mov ecx, ebx
test edx, edx
jle 0x72a142fb
cmp word [ebp - 4], 0
jne 0x72a142ee
mov eax, dword [ebp - 8]
cmp eax, dword [ecx + 4]
jne 0x72a142f3
cmp di, word [ecx]
je 0x72a142fb
add ecx, 0xc
inc esi
cmp esi, edx
jl 0x72a142df
cmp esi, edx
je 0x72a1431b
inc edi
jmp 0x72a142d1
push eax
call fcn.72a20050
mov dword [ebp - 4], eax
jmp 0x72a142b5
mov edi, 0x100
mov dword [ebp + 8], 0x200
jmp 0x72a142cd
cmp di, word [ebp + 8]
jle 0x72a14328
push 0x43
call fcn.72a0e22c
mov ax, di
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x72a143e9
Capabilities:
Get thread local storage value

Disassembly:
push ebx
mov bx, word [esp + 0xc]
push esi
cmp bx, 0x100
push edi
jl 0x72a14408
call fcn.7294a1dd
test eax, eax
je 0x72a14408
push 5
call fcn.72a0e22c
push dword [0x72a4ef9c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, dword [eax + 0x18]
xor edi, edi
movsx ecx, word [esi + 0xc]
mov edx, dword [esi + 8]
test ecx, ecx
mov eax, edx
jle 0x72a14434
cmp word [eax], 0
je 0x72a14434
add eax, 0xc
inc edi
cmp edi, ecx
jl 0x72a14426
cmp edi, ecx
jne 0x72a14477
lea eax, [ecx + 8]
lea eax, [eax + eax*2]
shl eax, 2
push eax
push edx
call fcn.72a1186f
test eax, eax
mov dword [esi + 8], eax
je 0x72a1448b
add word [esi + 0xc], 8
mov si, word [esi + 0xc]
lea ecx, [edi + edi*2]
lea eax, [eax + ecx*4]
movsx ecx, si
mov esi, edi
inc edi
cmp esi, ecx
mov edx, eax
jge 0x72a14477
sub ecx, edi
inc ecx
and word [edx], 0
add edx, 0xc
dec ecx
jne 0x72a1446d
mov ecx, dword [esp + 0x10]
push 1
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x1c]
mov word [eax], bx
mov dword [eax + 8], ecx
pop eax
pop edi
pop esi
pop ebx
ret 0xc

Function at 0x72a14622
Capabilities:
Get thread local storage value

Disassembly:
push esi
push dword [0x72a4ef9c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, dword [eax + 0x18]
movsx eax, word [esp + 8]
push eax
call fcn.72a144f6
test byte [eax], 0x25
mov dword [esi], eax
je 0x72a1464b
push 0x36
call fcn.72a0e22c
mov dword [esi + 4], 2
pop esi
ret 4

Function at 0x72a146b7
Capabilities:
Get thread local storage value

Disassembly:
push dword [0x72a4ef9c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov eax, dword [eax + 0x18]
push 2
push dword [esp + 8]
push dword [eax + 4]
push dword [eax]
call fcn.72a147cf
call fcn.72a14722
ret 4
Function at 0x72a152b6
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
push edi
push dword [0x72a4ef9c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
and word [ebp - 0x20], 0
lea edi, [eax + 0x50]
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 0xc]
call fcn.72a218ab
mov esi, eax
mov ax, word [esi]
cmp ax, 0xa
jne 0x72a15321
cmp dword [esi + 8], 0x80020004
jne 0x72a15321
or ecx, 0xffffffff
test cx, cx
je 0x72a15325
call fcn.72a16518
mov ecx, edi
mov dword [ebp - 8], eax
mov word [ebp - 0x10], 8
call sym.MSVBVM60.DLL___vbaFreeVar
mov eax, dword [ebp + 8]
lea esi, [ebp - 0x10]
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
leave
ret 8
xor ecx, ecx
jmp 0x72a152f5
cmp ax, 8
je 0x72a15355
movzx ecx, ax
test ecx, ecx
jl 0x72a1533c
cmp ecx, 0xe
jle 0x72a15351
cmp ecx, 0x11
je 0x72a15351
test ah, 0x20
jne 0x72a15351
cmp ax, 0x24
je 0x72a15351
push 0x1ca
call fcn.72a0e22c
push 0xd
jmp 0x72a1534c
push dword [esi + 8]
call fcn.72a16520
jmp 0x72a152ff

Function at 0x72a1535f
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
push dword [0x72a4ef9c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
and word [ebp - 0x10], 0
lea edi, [eax + 0x50]
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
call fcn.72a218ab
mov esi, eax
mov ax, word [esi]
cmp ax, 0xa
jne 0x72a153b9
cmp dword [esi + 8], 0x80020004
jne 0x72a153b9
or ecx, 0xffffffff
test cx, cx
je 0x72a153bd
call fcn.72a16518
mov ecx, edi
mov esi, eax
call sym.MSVBVM60.DLL___vbaFreeVar
mov eax, esi
pop edi
pop esi
leave
ret 4
xor ecx, ecx
jmp 0x72a1539e
cmp ax, 8
je 0x72a153ed
movzx ecx, ax
test ecx, ecx
jl 0x72a153d4
cmp ecx, 0xe
jle 0x72a153e9
cmp ecx, 0x11
je 0x72a153e9
test ah, 0x20
jne 0x72a153e9
cmp ax, 0x24
je 0x72a153e9
push 0x1ca
call fcn.72a0e22c
push 0xd
jmp 0x72a153e4
push dword [esi + 8]
call fcn.72a16520
jmp 0x72a153a8

Function at 0x72a153f7
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
push dword [0x72a4ef9c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
and word [ebp - 0x10], 0
lea edi, [eax + 0x50]
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
call fcn.72a218ab
mov esi, eax
mov ax, word [esi]
cmp ax, 0xa
jne 0x72a1544d
cmp dword [esi + 8], 0x80020004
jne 0x72a1544d
or ecx, 0xffffffff
test cx, cx
je 0x72a15451
mov ecx, edi
call sym.MSVBVM60.DLL___vbaFreeVar
call fcn.72a15b53
pop edi
pop esi
leave
ret 8
xor ecx, ecx
jmp 0x72a15436
cmp ax, 8
je 0x72a15481
movzx ecx, ax
test ecx, ecx
jl 0x72a15468
cmp ecx, 0xe
jle 0x72a1547d
cmp ecx, 0x11
je 0x72a1547d
test ah, 0x20
jne 0x72a1547d
cmp ax, 0x24
je 0x72a1547d
push 0x1ca
call fcn.72a0e22c
push 0xd
jmp 0x72a15478
push dword [esi + 8]
push dword [ebp + 0xc]
call fcn.72a15499
mov ecx, edi
mov esi, eax
call sym.MSVBVM60.DLL___vbaFreeVar
mov eax, esi
jmp 0x72a15447
Function at 0x72a15d41
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x234
push ebx
push esi
push edi
push dword [0x72a4ef9c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
add eax, 0x50
and word [ebp - 0x14], 0
mov dword [ebp - 4], eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 8]
call fcn.72a218ab
mov esi, eax
cmp word [esi], 1
jne 0x72a15d7f
push 0x5e
call fcn.72a0e22c
mov cx, word [esi]
cmp cx, 8
je 0x72a15db2
movzx eax, cx
test eax, eax
jl 0x72a15d99
cmp eax, 0xe
jle 0x72a15dae
cmp eax, 0x11
je 0x72a15dae
test ch, 0x20
jne 0x72a15dae
cmp cx, 0x24
je 0x72a15dae
push 0x1ca
call fcn.72a0e22c
push 0xd
jmp 0x72a15da9
push dword [esi + 8]
lea eax, [ebp - 0x234]
push eax
call fcn.72a165fa
lea eax, [ebp - 0x12c]
push eax
lea eax, [ebp - 0x234]
push eax
call fcn.72a2c65e
mov ebx, eax
pop ecx
cmp ebx, 0xffffffff
pop ecx
jne 0x72a15de4
push 0x35
call fcn.72a0e22c
test byte [ebp - 0x12c], 0x16
je 0x72a15e09
lea eax, [ebp - 0x12c]
push eax
push ebx
call fcn.72a2c781
pop ecx
test eax, eax
pop ecx
je 0x72a15de4
push ebx
call fcn.72a2c89d
pop ecx
jmp 0x72a15ddd
lea eax, [ebp - 0x234]
push 0x5c
push eax
call fcn.72a1e449
pop ecx
mov esi, eax
pop ecx
inc esi
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
mov dword [ebp + 8], esi
repne scasb al, byte es:[edi]
not ecx
dec ecx
jne 0x72a15e3e
push ebx
call fcn.72a2c89d
pop ecx
push 0x35
call fcn.72a0e22c
mov esi, dword [ebp + 8]
test byte [ebp - 0x12c], 0x16
jne 0x72a15ee0
lea edi, [ebp - 0x118]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [ebp - 0x130]
add ecx, esi
cmp ecx, eax
jbe 0x72a15e75
push ebx
call fcn.72a2c89d
pop ecx
push 0x35
call fcn.72a0e22c
lea edi, [ebp - 0x118]
or ecx, 0xffffffff
xor eax, eax
push 7
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, dword [ebp + 8]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0x234]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call fcn.72a140b0
test eax, eax
je 0x72a15eb9
push ebx
call fcn.72a2c89d
pop ecx
push 0x37
call fcn.72a0e22c
lea eax, [ebp - 0x234]
push eax
call fcn.72a2cd87
test eax, eax
pop ecx
je 0x72a15ee0
push ebx
call fcn.72a2c89d
pop ecx
call fcn.72a14491
test eax, eax
je 0x72a15ee0
push eax
call fcn.72a0e22c
lea eax, [ebp - 0x12c]
push eax
push ebx
call fcn.72a2c781
pop ecx
test eax, eax
pop ecx
je 0x72a15e3b
push ebx
call fcn.72a2c89d
pop ecx
mov ecx, dword [ebp - 4]
call sym.MSVBVM60.DLL___vbaFreeVar
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x72a16083
Capabilities:
Timestomp file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
push edi
xor eax, eax
mov edi, pe_nt_image_headers32
push eax
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileA]
push edi
push 3
push eax
push 3
push 0x80000000
mov dword [ebp - 4], eax
push dword [ebp + 8]
call esi
cmp eax, 0xffffffff
mov dword [ebp + 8], eax
je 0x72a160d7
push 0
push edi
push 3
push 0
push 3
push 0x40000000
push dword [ebp + 0xc]
call esi
mov edi, eax
cmp edi, 0xffffffff
jne 0x72a160e2
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.72a14491
pop edi
pop esi
leave
ret 8
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1c]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
je 0x72a16112
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
test eax, eax
jne 0x72a1611a
call fcn.72a14491
mov dword [ebp - 4], eax
push dword [ebp + 8]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push edi
call esi
mov eax, dword [ebp - 4]
jmp 0x72a160dc

Function at 0x72a1624d
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push esi
mov esi, dword [ebp + 8]
test esi, esi
push edi
je 0x72a16279
cmp word [esi], 0
je 0x72a16279
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 0x104
jbe 0x72a16280
push 0x35
call fcn.72a0e22c
push 1
lea eax, [ebp - 0x108]
push esi
push eax
call fcn.72a1647b
mov esi, dword [ebp + 0xc]
mov eax, esi
or al, 0x27
cmp eax, 0x27
je 0x72a162a2
push 5
call fcn.72a0e22c
test esi, esi
jne 0x72a162ab
mov esi, pe_nt_image_headers32
lea eax, [ebp - 0x108]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
jne 0x72a162f3
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 5
je 0x72a162ef
call esi
cmp eax, 0x35
je 0x72a162ef
call esi
cmp eax, 0x57
je 0x72a162ef
call esi
cmp eax, 0x13
je 0x72a162ef
push 0x35
pop eax
movzx eax, ax
test eax, eax
je 0x72a162f3
push eax
call fcn.72a0e22c
push 0x4b
jmp 0x72a162e1
pop edi
pop esi
leave
ret 8

Function at 0x72a1637c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [ebp + 8]
test eax, eax
je 0x72a163fe
cmp word [eax], 0
je 0x72a163fe
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.72a16614
test eax, eax
jne 0x72a163fa
lea eax, [ebp - 0x108]
push 0x7296f0e2
push eax
call fcn.72a1e4e6
pop ecx
test eax, eax
pop ecx
je 0x72a163bf
push 0x34
pop eax
jmp 0x72a163fa
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ecx, dword [ebp + 0xc]
cmp eax, 0xffffffff
mov dword [ecx], eax
jne 0x72a163f8
call dword [sym.imp.KERNEL32.dll_GetLastError]
dec eax
dec eax
je 0x72a163fe
dec eax
je 0x72a163f4
dec eax
dec eax
je 0x72a163f0
sub eax, 0x30
je 0x72a163fe
push 5
jmp 0x72a163bc
push 0x4b
jmp 0x72a163bc
push 0x4c
jmp 0x72a163bc
xor eax, eax
leave
ret 8
push 0x35
jmp 0x72a163bc
Function at 0x72a16807
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
push edi
mov edi, dword [esp + 0x10]
push dword [0x72a4ef9c]
mov esi, dword [edi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov eax, dword [esi + 4]
mov eax, dword [eax + 0x14]
push dword [eax + 8]
push dword [ebx + 0x18]
call fcn.7294b405
mov ecx, dword [eax + 0xc]
mov edx, dword [esp + 0x18]
mov ecx, dword [ecx + 0xc]
mov dword [edx], ecx
mov edx, dword [esp + 0x1c]
movzx ecx, word [esi + 2]
lea ecx, [ecx + ecx*4]
lea eax, [eax + ecx*4]
mov ecx, dword [eax + 0x18]
mov dword [edx], ecx
mov ecx, dword [edi]
mov ecx, dword [ecx + 0x18]
test byte [ecx + 0x28], 2
jne 0x72a16862
mov ecx, dword [esp + 0x14]
mov eax, dword [eax + 0x24]
mov dword [ecx], eax
pop edi
mov eax, ebx
pop esi
pop ebx
ret 0x10

Function at 0x72a18b0f
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
push edi
call fcn.72949696
mov esi, eax
lea ecx, [esi + 0x4c]
mov eax, dword [ecx]
test eax, eax
je 0x72a18b40
cmp dword [eax], 0
jne 0x72a18b3b
mov edx, dword [eax + 0xc]
inc word [esi + 0x44]
mov dword [ecx], edx
mov edx, dword [esi + 0x48]
mov dword [eax + 0xc], edx
mov dword [esi + 0x48], eax
jmp 0x72a18b1c
lea ecx, [eax + 0xc]
jmp 0x72a18b1c
mov ax, word [esi + 0x44]
cmp ax, word [esi + 0x46]
jae 0x72a18bda
call fcn.72a18bde
mov edi, eax
test edi, edi
je 0x72a18ba5
push dword [0x72a4ef9c]
mov ebx, dword [edi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov eax, dword [eax + 0x18]
mov dword [eax + 0x18], ebx
lea eax, [edi + 4]
movzx ebx, word [eax]
mov ecx, dword [esi + 0x50]
mov ax, word [eax]
add word [esi + 0x44], ax
mov dword [esi + 0x50], edi
mov dword [ecx], edi
mov edi, dword [edi + 8]
test ebx, ebx
jbe 0x72a18b40
mov eax, ebx
shl eax, 4
add eax, edi
and dword [eax - 0x10], 0
mov ecx, dword [esi + 0x48]
sub eax, 0x10
dec ebx
mov dword [esi + 0x48], eax
mov dword [eax + 0xc], ecx
je 0x72a18b40
jmp 0x72a18b90
mov eax, dword [esi + 0x50]
movzx ebx, word [eax + 4]
shl ebx, 1
mov eax, ebx
shl eax, 4
add eax, 0xc
push eax
call fcn.72945484
mov edi, eax
test edi, edi
jne 0x72a18bcc
push 0x8007000e
call fcn.72a18c72
lea eax, [edi + 4]
lea ecx, [edi + 0xc]
mov dword [edi + 8], ecx
mov word [eax], bx
jmp 0x72a18b73
pop edi
pop esi
pop ebx
ret
Function at 0x72a193d1
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
push dword [0x72a4ef9c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test byte [eax + 0x76], 2
mov esi, dword [ebp + 0xc]
je 0x72a19403
test esi, esi
je 0x72a193f9
push esi
call fcn.7294e4c8
push 0x9c68
call fcn.72a0e22c
mov eax, dword [ebp + 8]
xor edi, edi
cmp eax, edi
mov dword [ebp + 0xc], eax
jge 0x72a194f7
cmp eax, 0x80020009
mov ebx, 0x1b8
jne 0x72a194b2
cmp esi, edi
jne 0x72a19444
push 8
xor eax, eax
pop ecx
lea edi, [ebp - 0x20]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x20]
lea esi, [ebp - 0x20]
push eax
call fcn.72a1876f
mov dword [ebp - 4], 0x800a01b8
cmp dword [esi + 0x1c], 0x800a9c68
jne 0x72a19454
mov dword [esi + 0x1c], 0x800a01b8
xor edi, edi
cmp word [esi], di
jne 0x72a19460
cmp dword [esi + 0x1c], edi
jge 0x72a194a6
mov eax, dword [esi + 0x1c]
cmp eax, edi
jge 0x72a194a0
mov ecx, eax
and ecx, 0x1fff0000
cmp ecx, 0xa0000
je 0x72a194a0
push eax
call fcn.72a0be99
cmp eax, ebx
je 0x72a194a0
cmp dword [esi + 8], edi
jne 0x72a194a0
cmp dword [esi + 0xc], edi
jne 0x72a194a0
cmp dword [esi + 0x10], edi
jne 0x72a194a0
mov ecx, eax
or eax, 0x800a0000
neg ecx
sbb ecx, ecx
and ecx, eax
mov dword [esi + 0x1c], ecx
push esi
call fcn.72a0e1ae
push esi
call fcn.7294e4c8
push ebx
call fcn.72a0e22c
cmp esi, edi
je 0x72a194bc
push esi
call fcn.7294e4c8
push dword [ebp + 8]
call fcn.72a0be99
cmp eax, 0x9c68
jne 0x72a194d4
mov eax, ebx
mov dword [ebp + 0xc], 0x800a01b8
cmp eax, ebx
je 0x72a194de
push eax
call fcn.72a0e22c
push 8
xor eax, eax
pop ecx
lea edi, [ebp - 0x20]
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x20]
push eax
call fcn.72a0e1ae
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x72a1a274
Capabilities:
Get thread local storage value

Disassembly:
push dword [0x72a4ef9c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test byte [eax + 0x76], 2
je 0x72a1a290
push 0x9c68
call fcn.72a0e22c
mov eax, dword [esp + 4]
test eax, eax
jge 0x72a1a2b6
cmp eax, 0x800a9c68
jne 0x72a1a2a4
mov eax, 0x800a01b8
push dword [esp + 0x10]
push dword [esp + 0x10]
push dword [esp + 0x10]
push eax
call fcn.72a192e7
ret 0x10
Function at 0x72a1a77c
Capabilities:
Get thread local storage value

Disassembly:
push ecx
push dword [0x72a4ef9c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov eax, dword [eax + 0x70]
lea ecx, [esp + 3]
sub eax, 0x8000
cmp ecx, eax
sbb eax, eax
and eax, 0x800a001c
pop ecx
ret
Function at 0x72a1de2a
Capabilities:
Get thread local storage value

Disassembly:
push dword [0x72a4ef9c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push eax
call fcn.7294a203
test eax, eax
je 0x72a1de63
cmp dword [0x72a4efa0], 0
jne 0x72a1de5a
mov eax, dword [eax + 0x14]
mov ecx, dword [esp + 4]
mov eax, dword [eax + 0xc]
mov dword [ecx], eax
xor eax, eax
ret 4
mov ecx, eax
call fcn.72a168b9
jmp 0x72a1de4c
mov eax, dword [esp + 4]
and dword [eax], 0
jmp 0x72a1de55
Function at 0x72a1f6dc
Capabilities:
Get thread local storage value

Disassembly:
push esi
mov esi, ecx
push dword [0x72a4ef9c]
xor eax, eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x50], eax
mov dword [esi + 0x54], eax
mov dword [esi + 0x58], eax
mov dword [esi + 0x40], eax
mov dword [esi + 4], 0x7295a2b8
lea eax, [esi + 0x30]
mov dword [esi + 8], 0x7295a2a0
mov dword [esi], 0x7296f5d0
mov dword [esi + 4], 0x7296f5c0
mov dword [esi + 8], 0x7296f5a8
mov dword [esi + 0x5c], 1
mov dword [esi + 0x28], eax
mov dword [esi + 0x24], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [esi + 0x60], eax
mov eax, esi
pop esi
ret

Function at 0x72a1fe11
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
xor eax, eax
cmp dword [0x72a4f448], eax
je 0x72a1fe62
cmp dword [ebp + 8], eax
jne 0x72a1fe2a
push 3
pop eax
jmp 0x72a1fe65
push eax
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push eax
call dword [0x72a50bcc]
test eax, eax
je 0x72a1fe49
push dword [ebp + 8]
call dword [0x72a50bc0]
test eax, eax
jne 0x72a1fe4d
push 2
jmp 0x72a1fe27
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call dword [0x72a50be4]
test eax, eax
jne 0x72a1fe69
or eax, 0xffffffff
leave
ret 4
mov eax, dword [ebp - 4]
test al, 1
je 0x72a1fe83
test al, 2
je 0x72a1fe7f
and al, 8
neg al
sbb eax, eax
add eax, 6
jmp 0x72a1fe65
push 4
jmp 0x72a1fe27
and al, 8
neg al
sbb eax, eax
add eax, 8
jmp 0x72a1fe65

Function at 0x72a1fe8e
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
xor eax, eax
cmp dword [0x72a4f448], eax
je 0x72a1fedd
cmp dword [ebp + 8], eax
je 0x72a1fedd
push eax
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push eax
call dword [0x72a50bcc]
test eax, eax
je 0x72a1fec1
push dword [ebp + 8]
call dword [0x72a50bc0]
test eax, eax
jne 0x72a1fec8
push 8
pop eax
leave
ret 4
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call dword [0x72a50be4]
test eax, eax
jne 0x72a1fee2
or eax, 0xffffffff
jmp 0x72a1fec4
mov eax, dword [ebp - 4]
test al, 1
je 0x72a1fef4
and al, 8
neg al
sbb eax, eax
add eax, 0xa
jmp 0x72a1fec4
and al, 8
neg al
sbb eax, eax
add eax, 8
jmp 0x72a1fec4

Function at 0x72a1feff
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
xor eax, eax
cmp dword [0x72a4f448], eax
je 0x72a1ff4e
cmp dword [ebp + 8], eax
je 0x72a1ff4e
push eax
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push eax
call dword [0x72a50bcc]
test eax, eax
je 0x72a1ff32
push dword [ebp + 8]
call dword [0x72a50bc0]
test eax, eax
jne 0x72a1ff39
push 2
pop eax
leave
ret 4
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call dword [0x72a50be4]
test eax, eax
jne 0x72a1ff53
or eax, 0xffffffff
jmp 0x72a1ff35
mov eax, dword [ebp - 4]
and al, 1
neg al
sbb eax, eax
inc eax
inc eax
jmp 0x72a1ff35