joyce8/EMBER2024-capa huggingface dataset:
Function at 0x3015fa4a
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push edi
push dword [0x3026b738]
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, ebx
je 0x3015fa6c
mov edi, dword [eax + 0x16c]
jmp 0x3015fa6e
xor edi, edi
cmp edi, ebx
jne 0x3015fa7f
push 0x80040014
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x3015faf0
push edi
push ebx
push 1
lea ecx, [ebp - 0xc]
mov dword [ebp - 0xc], ebx
call fcn.301b2a98
test eax, eax
jne 0x3015fa9f
push 0x80070057
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x3015fae8
push esi
mov esi, dword [ebp + 8]
cmp esi, ebx
je 0x3015fab9
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x14]
shr eax, 2
test al, 1
je 0x3015fab9
mov eax, esi
jmp 0x3015fabb
xor eax, eax
test eax, eax
pop esi
je 0x3015fa92
cmp edi, dword [eax + 8]
je 0x3015facc
push 0x8004001e
jmp 0x3015fa97
mov ecx, dword [ebp + 0x14]
and ecx, 7
cmp ecx, dword [ebp + 0x14]
jne 0x3015fa92
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
call fcn.301b579b
mov ebx, eax
lea ecx, [ebp - 0xc]
call fcn.301b2a51
pop edi
mov eax, ebx
pop ebx
leave
ret 0x10

Function at 0x3015faf8
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
and dword [ebp - 4], 0
push esi
push dword [0x3026b738]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x3015fb1b
mov esi, dword [eax + 0x16c]
jmp 0x3015fb1d
xor esi, esi
test esi, esi
jne 0x3015fb2e
push 0x80040014
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x3015fb91
and dword [ebp - 0x10], 0
push esi
push 0
push 0
lea ecx, [ebp - 0x10]
call fcn.301b2a98
test eax, eax
jne 0x3015fb50
push 0x80070057
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x3015fb89
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x3015fb6a
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x14]
shr eax, 2
test al, 1
je 0x3015fb6a
mov eax, edi
jmp 0x3015fb6c
xor eax, eax
test eax, eax
pop edi
je 0x3015fb43
cmp esi, dword [eax + 8]
je 0x3015fb7d
push 0x8004001e
jmp 0x3015fb48
push dword [ebp + 0xc]
push eax
call fcn.301b7ea2
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x10]
call fcn.301b2a51
mov eax, dword [ebp - 4]
pop esi
leave
ret 8
Function at 0x3015fb99
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
and dword [ebp - 4], 0
push esi
push dword [0x3026b738]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x3015fbbc
mov esi, dword [eax + 0x16c]
jmp 0x3015fbbe
xor esi, esi
test esi, esi
jne 0x3015fbcf
push 0x80040014
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x3015fc32
and dword [ebp - 0x10], 0
push esi
push 0
push 0
lea ecx, [ebp - 0x10]
call fcn.301b2a98
test eax, eax
jne 0x3015fbf1
push 0x80070057
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x3015fc2a
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x3015fc0b
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x14]
shr eax, 2
test al, 1
je 0x3015fc0b
mov eax, edi
jmp 0x3015fc0d
xor eax, eax
test eax, eax
pop edi
je 0x3015fbe4
cmp esi, dword [eax + 8]
je 0x3015fc1e
push 0x8004001e
jmp 0x3015fbe9
push dword [ebp + 0xc]
push eax
call fcn.301b7f28
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x10]
call fcn.301b2a51
mov eax, dword [ebp - 4]
pop esi
leave
ret 8

Function at 0x3015fc3a
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push dword [0x3026b738]
xor esi, esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, esi
je 0x3015fc5b
mov eax, dword [eax + 0x16c]
jmp 0x3015fc5d
xor eax, eax
cmp eax, esi
jne 0x3015fc6e
push 0x80040014
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x3015fca9
push eax
push esi
push esi
lea ecx, [ebp - 0xc]
mov dword [ebp - 0xc], esi
call fcn.301b2a98
test eax, eax
je 0x3015fc96
mov eax, dword [ebp + 8]
cmp eax, esi
je 0x3015fc96
cmp dword [eax], 0x20
jne 0x3015fc96
push eax
call fcn.301b8b64
mov esi, eax
jmp 0x3015fca1
push 0x80070057
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea ecx, [ebp - 0xc]
call fcn.301b2a51
mov eax, esi
pop esi
leave
ret 4

Function at 0x3015fcdb
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push dword [0x3026b738]
xor esi, esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, esi
je 0x3015fcfc
mov eax, dword [eax + 0x16c]
jmp 0x3015fcfe
xor eax, eax
cmp eax, esi
jne 0x3015fd0f
push 0x80040014
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x3015fd53
push eax
push esi
push esi
lea ecx, [ebp - 0xc]
mov dword [ebp - 0xc], esi
call fcn.301b2a98
test eax, eax
je 0x3015fd40
cmp dword [ebp + 8], 0x8b
ja 0x3015fd40
call fcn.3015eaf8
mov eax, dword [eax + 0x24]
push dword [ebp + 8]
mov ecx, eax
call fcn.3015ec36
mov esi, eax
jmp 0x3015fd4b
push 0x80070057
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea ecx, [ebp - 0xc]
call fcn.301b2a51
mov eax, esi
pop esi
leave
ret 4
Function at 0x3015fd85
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
and dword [ebp - 4], 0
push esi
push dword [0x3026b738]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x3015fda8
mov esi, dword [eax + 0x16c]
jmp 0x3015fdaa
xor esi, esi
test esi, esi
jne 0x3015fdbb
push 0x80040014
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x3015fe28
and dword [ebp - 0x14], 0
push esi
push 0
push 0
lea ecx, [ebp - 0x14]
call fcn.301b2a98
test eax, eax
jne 0x3015fdd7
push 0x80070057
jmp 0x3015fe1a
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x3015fdf1
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x14]
shr eax, 2
test al, 1
je 0x3015fdf1
mov ecx, edi
jmp 0x3015fdf3
xor ecx, ecx
test ecx, ecx
pop edi
je 0x3015fdd0
cmp esi, dword [ecx + 8]
je 0x3015fe04
push 0x8004001e
jmp 0x3015fe1a
lea eax, [ebp - 8]
push eax
call fcn.301b61e2
test eax, eax
jl 0x3015fe19
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
jmp 0x3015fe20
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea ecx, [ebp - 0x14]
call fcn.301b2a51
mov eax, dword [ebp - 4]
pop esi
leave
ret 4

Function at 0x3015fe30
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push dword [0x3026b738]
xor esi, esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, esi
je 0x3015fe51
mov eax, dword [eax + 0x16c]
jmp 0x3015fe53
xor eax, eax
cmp eax, esi
jne 0x3015fe64
push 0x80040014
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x3015fe95
push eax
push esi
push esi
lea ecx, [ebp - 0xc]
mov dword [ebp - 0xc], esi
call fcn.301b2a98
test eax, eax
jne 0x3015fe83
push 0x80070057
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x3015fe8d
push dword [ebp + 8]
call fcn.301b6460
mov esi, eax
lea ecx, [ebp - 0xc]
call fcn.301b2a51
mov eax, esi
pop esi
leave
ret 4
Function at 0x3015ffae
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push edi
push dword [0x3026b738]
xor edi, edi
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, edi
je 0x3015ffd3
mov ebx, dword [eax + 0x16c]
jmp 0x3015ffd5
xor ebx, ebx
cmp ebx, edi
jne 0x3015ffe9
push 0x80040014
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x3016018e
push ebx
push edi
push 1
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], edi
call fcn.301b2a98
test eax, eax
jne 0x3016000c
push 0x80070057
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x30160186
push esi
mov esi, dword [ebp + 0x10]
cmp esi, edi
je 0x3016017a
mov ecx, dword [esi + 0x10]
mov edx, ecx
mov eax, 0xfffff
and edx, eax
cmp edx, ecx
jne 0x3016017a
mov ecx, dword [esi + 0x14]
mov edx, ecx
and edx, eax
cmp edx, ecx
jne 0x3016017a
mov eax, dword [esi + 8]
movzx ecx, al
cmp ecx, eax
jne 0x3016017a
mov eax, dword [esi + 4]
mov ecx, dword [esi]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
and eax, 0xf
dec eax
mov dword [ebp - 0xc], ecx
je 0x30160114
sub eax, 4
je 0x301600a1
dec eax
dec eax
jne 0x3016017a
cmp dword [ebp + 8], edi
jne 0x3016017a
cmp ecx, edi
je 0x3016017a
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.301b917c
cmp eax, edi
jl 0x3016009b
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
jmp 0x30160185
push eax
jmp 0x3016017f
mov edi, dword [ebp + 8]
test edi, edi
je 0x301600d1
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x14]
shr eax, 2
and al, 1
neg al
sbb eax, eax
and eax, edi
test eax, eax
je 0x3016017a
cmp ebx, dword [eax + 8]
je 0x301600ed
push 0x8004001e
jmp 0x3016017f
call fcn.3015eaf8
test eax, eax
je 0x301600dd
mov eax, dword [eax + 0x20]
mov ecx, dword [eax + 8]
call sym.OFFDIAG.exe_public:_unsigned_long_int___thiscall_NetUI::CloneTreeInfo::GetCloneFlags_void_const
test eax, eax
je 0x3016017a
lea ecx, [ebp + 8]
push ecx
lea ecx, [ebp - 0xc]
push ecx
mov ecx, eax
call fcn.301b6f55
test eax, eax
jl 0x30160108
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
jmp 0x3016010f
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [ebp + 8]
jmp 0x3016014c
cmp dword [ebp + 8], edi
je 0x3016017a
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x3016017a
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
call fcn.301b8ebf
cmp eax, edi
jl 0x30160142
mov eax, dword [ebp + 0x10]
mov dword [ebp - 4], eax
jmp 0x30160149
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [ebp + 0x10]
test edi, edi
je 0x30160185
mov eax, dword [esi + 0xc]
test eax, eax
je 0x30160162
mov edx, dword [edi]
push eax
push dword [esi + 8]
mov ecx, edi
call dword [edx + 0x18]
mov eax, dword [esi + 0x14]
test eax, eax
je 0x30160185
push 0
push eax
push dword [esi + 0x10]
mov ecx, edi
call fcn.301b67d3
test eax, eax
jge 0x30160185
push 0x80070057
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop esi
lea ecx, [ebp - 0x18]
call fcn.301b2a51
mov eax, dword [ebp - 4]
pop edi
pop ebx
leave
ret 0xc
Function at 0x30160197
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push dword [0x3026b738]
xor esi, esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, esi
je 0x301601b8
mov eax, dword [eax + 0x16c]
jmp 0x301601ba
xor eax, eax
cmp eax, esi
jne 0x301601cb
push 0x80040014
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x301601f9
push eax
push esi
push esi
lea ecx, [ebp - 0xc]
mov dword [ebp - 0xc], esi
call fcn.301b2a98
test eax, eax
jne 0x301601ea
push 0x80070057
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x301601f1
call fcn.301b4eef
mov esi, eax
lea ecx, [ebp - 0xc]
call fcn.301b2a51
mov eax, esi
pop esi
leave
ret

Function at 0x301601fe
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push edi
push dword [0x3026b738]
xor ebx, ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, ebx
je 0x30160223
mov edi, dword [eax + 0x16c]
jmp 0x30160225
xor edi, edi
cmp edi, ebx
jne 0x30160239
push 0x80040014
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x301602f9
push edi
push ebx
push 1
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x10], ebx
call fcn.301b2a98
test eax, eax
jne 0x3016025c
push 0x80070057
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x301602f1
push esi
mov esi, dword [ebp + 8]
cmp esi, ebx
je 0x30160274
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x14]
shr eax, 2
test al, 1
je 0x30160274
mov ebx, esi
test ebx, ebx
jne 0x3016027f
push 0x80070057
jmp 0x30160289
cmp edi, dword [ebx + 8]
je 0x30160291
push 0x8004001e
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x301602f0
mov ecx, ebx
call fcn.3015fefc
mov esi, eax
test esi, esi
je 0x301602f0
call fcn.301b4eef
and dword [ebp + 8], 0
mov edi, eax
test edi, edi
je 0x301602c6
mov ecx, edi
call fcn.3015fefc
cmp eax, esi
mov dword [ebp + 8], eax
jne 0x301602c6
push edi
mov ecx, ebx
call fcn.301b63ea
mov dword [ebp - 4], eax
cmp byte [ebp + 0xc], 0
je 0x301602f0
cmp dword [ebp - 4], 0
jne 0x301602f0
test edi, edi
je 0x301602db
cmp dword [ebp + 8], esi
je 0x301602f0
mov eax, dword [esi + 0xe0]
test eax, eax
je 0x301602f0
push eax
mov ecx, ebx
call fcn.301b63ea
mov dword [ebp - 4], eax
pop esi
lea ecx, [ebp - 0x10]
call fcn.301b2a51
mov eax, dword [ebp - 4]
pop edi
pop ebx
leave
ret 8
Function at 0x30160302
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
and dword [ebp - 4], 0
push edi
push dword [0x3026b738]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x30160325
mov edi, dword [eax + 0x16c]
jmp 0x30160327
xor edi, edi
test edi, edi
jne 0x3016033b
push 0x80040014
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x301603dc
and dword [ebp - 0x10], 0
push edi
push 0
push 1
lea ecx, [ebp - 0x10]
call fcn.301b2a98
test eax, eax
jne 0x3016035d
push 0x80070057
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x301603d4
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x30160373
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x14]
shr eax, 2
test al, 1
jne 0x30160375
xor esi, esi
test esi, esi
jne 0x30160380
push 0x80070057
jmp 0x301603af
cmp edi, dword [esi + 8]
je 0x3016038c
push 0x8004001e
jmp 0x301603af
cmp dword [edi + 0x10], 0
je 0x301603b7
mov ecx, esi
call fcn.3015fefc
test eax, eax
je 0x301603b7
mov ecx, esi
call fcn.3015fefc
test byte [eax + 0x54], 0x20
je 0x301603b7
push 0x8004001f
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x301603d3
mov ecx, esi
call fcn.3015fefc
test eax, eax
je 0x301603d3
push dword [ebp + 0x10]
mov ecx, eax
push dword [ebp + 0xc]
push esi
call fcn.301b22fb
mov dword [ebp - 4], eax
pop esi
lea ecx, [ebp - 0x10]
call fcn.301b2a51
mov eax, dword [ebp - 4]
pop edi
leave
ret 0xc

Function at 0x301603e4
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
and dword [ebp - 4], 0
push edi
push dword [0x3026b738]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x30160407
mov edi, dword [eax + 0x16c]
jmp 0x30160409
xor edi, edi
test edi, edi
jne 0x3016041d
push 0x80040014
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x301604c1
and dword [ebp - 0x10], 0
push edi
push 0
push 1
lea ecx, [ebp - 0x10]
call fcn.301b2a98
test eax, eax
jne 0x3016043f
push 0x80070057
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x301604b9
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x30160455
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x14]
shr eax, 2
test al, 1
jne 0x30160457
xor esi, esi
test esi, esi
jne 0x30160462
push 0x80070057
jmp 0x30160491
cmp edi, dword [esi + 8]
je 0x3016046e
push 0x8004001e
jmp 0x30160491
cmp dword [edi + 0x10], 0
je 0x30160499
mov ecx, esi
call fcn.3015fefc
test eax, eax
je 0x30160499
mov ecx, esi
call fcn.3015fefc
test byte [eax + 0x54], 0x20
je 0x30160499
push 0x8004001f
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x301604b8
mov ecx, esi
call fcn.3015fefc
test eax, eax
je 0x301604b8
mov ecx, dword [ebp + 0xc]
neg ecx
sbb ecx, ecx
and ecx, esi
push ecx
mov ecx, eax
call fcn.301b2297
mov dword [ebp - 4], eax
pop esi
lea ecx, [ebp - 0x10]
call fcn.301b2a51
mov eax, dword [ebp - 4]
pop edi
leave
ret 8
Function at 0x301604c9
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push dword [0x3026b738]
xor esi, esi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, esi
je 0x301604ee
mov ebx, dword [eax + 0x16c]
jmp 0x301604f0
xor ebx, ebx
cmp ebx, esi
jne 0x30160504
push 0x80040014
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x301605b5
push ebx
push esi
push esi
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x10], esi
call fcn.301b2a98
test eax, eax
jne 0x30160526
push 0x80070057
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x301605ad
push edi
mov edi, dword [ebp + 8]
cmp edi, esi
je 0x3016053c
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x14]
shr eax, 2
test al, 1
jne 0x3016053e
xor edi, edi
cmp edi, esi
je 0x301605a1
cmp ebx, dword [edi + 8]
je 0x3016054e
push 0x8004001e
jmp 0x301605a6
cmp dword [ebp + 0x14], esi
jne 0x301605a1
mov eax, dword [ebp + 0xc]
and eax, 0xfffff
cmp eax, dword [ebp + 0xc]
jne 0x301605a1
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x301605a1
cmp dword [ebx + 0x10], 0
je 0x3016058c
mov ecx, edi
call fcn.3015fefc
test eax, eax
je 0x3016058c
mov ecx, edi
call fcn.3015fefc
test byte [eax + 0x54], 0x20
je 0x3016058c
push 0x8004001f
jmp 0x301605a6
push dword [ebp + 0xc]
mov ecx, edi
call fcn.3015ff2d
mov dword [esi], eax
mov dword [ebp - 4], 1
jmp 0x301605ac
push 0x80070057
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
lea ecx, [ebp - 0x10]
call fcn.301b2a51
mov eax, dword [ebp - 4]
pop esi
pop ebx
leave
ret 0x10

Function at 0x301605be
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
and dword [ebp - 4], 0
push edi
push dword [0x3026b738]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x301605e1
mov edi, dword [eax + 0x16c]
jmp 0x301605e3
xor edi, edi
test edi, edi
jne 0x301605f7
push 0x80040014
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x301606a0
and dword [ebp - 0x10], 0
push edi
push 0
push 1
lea ecx, [ebp - 0x10]
call fcn.301b2a98
test eax, eax
jne 0x30160619
push 0x80070057
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x30160698
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x3016062f
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x14]
shr eax, 2
test al, 1
jne 0x30160631
xor esi, esi
test esi, esi
jne 0x3016063c
push 0x80070057
jmp 0x30160691
cmp edi, dword [esi + 8]
je 0x30160648
push 0x8004001e
jmp 0x30160691
cmp dword [edi + 0x10], 0
je 0x3016066d
mov ecx, esi
call fcn.3015fefc
test eax, eax
je 0x3016066d
mov ecx, esi
call fcn.3015fefc
test byte [eax + 0x54], 0x20
je 0x3016066d
push 0x8004001f
jmp 0x30160691
fld dword [ebp + 0x10]
push ecx
push ecx
fstp dword [esp + 4]
mov ecx, esi
fld dword [ebp + 0xc]
fstp dword [esp]
call fcn.301b35f2
test eax, eax
jl 0x30160690
mov dword [ebp - 4], 1
jmp 0x30160697
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop esi
lea ecx, [ebp - 0x10]
call fcn.301b2a51
mov eax, dword [ebp - 4]
pop edi
leave
ret 0xc
Function at 0x301606a8
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
and dword [ebp - 4], 0
push edi
push dword [0x3026b738]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x301606cb
mov edi, dword [eax + 0x16c]
jmp 0x301606cd
xor edi, edi
test edi, edi
jne 0x301606e1
push 0x80040014
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x30160782
and dword [ebp - 0x10], 0
push edi
push 0
push 1
lea ecx, [ebp - 0x10]
call fcn.301b2a98
test eax, eax
jne 0x30160703
push 0x80070057
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x3016077a
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x30160719
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x14]
shr eax, 2
test al, 1
jne 0x3016071b
xor esi, esi
test esi, esi
jne 0x30160726
push 0x80070057
jmp 0x30160773
cmp edi, dword [esi + 8]
je 0x30160732
push 0x8004001e
jmp 0x30160773
cmp dword [edi + 0x10], 0
je 0x30160757
mov ecx, esi
call fcn.3015fefc
test eax, eax
je 0x30160757
mov ecx, esi
call fcn.3015fefc
test byte [eax + 0x54], 0x20
je 0x30160757
push 0x8004001f
jmp 0x30160773
fld dword [ebp + 0xc]
push ecx
mov ecx, esi
fstp dword [esp]
call fcn.301b36fa
test eax, eax
jl 0x30160772
mov dword [ebp - 4], 1
jmp 0x30160779
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop esi
lea ecx, [ebp - 0x10]
call fcn.301b2a51
mov eax, dword [ebp - 4]
pop edi
leave
ret 8

Function at 0x3016078a
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push dword [0x3026b738]
xor ebx, ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, ebx
je 0x301607af
mov esi, dword [eax + 0x16c]
jmp 0x301607b1
xor esi, esi
cmp esi, ebx
jne 0x301607c5
push 0x80040014
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x3016089d
push esi
push ebx
push 1
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x14], ebx
call fcn.301b2a98
test eax, eax
jne 0x301607e8
push 0x80070057
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x30160895
push edi
mov edi, dword [ebp + 8]
push edi
call fcn.3015ebb0
cmp eax, ebx
mov dword [ebp - 8], eax
jne 0x30160803
push 0x80070057
jmp 0x3016088e
cmp esi, dword [eax + 8]
je 0x3016080f
push 0x8004001e
jmp 0x3016088e
push dword [ebp + 0x10]
call fcn.3015ebb0
cmp eax, ebx
mov dword [ebp + 8], eax
je 0x301607f9
cmp esi, dword [eax + 8]
jne 0x30160808
mov ebx, dword [ebp + 0xc]
cmp ebx, 1
jge 0x3016082f
test ebx, ebx
jg 0x30160894
test ebx, ebx
jl 0x30160894
cmp dword [esi + 0x10], 0
je 0x30160874
test edi, edi
je 0x3016084f
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x14]
shr eax, 2
test al, 1
je 0x3016084f
mov esi, edi
jmp 0x30160851
xor esi, esi
test esi, esi
je 0x3016086d
mov ecx, esi
call fcn.3015fefc
test eax, eax
je 0x30160874
mov ecx, esi
call fcn.3015fefc
test byte [eax + 0x54], 0x20
je 0x30160874
push 0x8004001f
jmp 0x3016088e
push dword [ebp + 8]
mov ecx, dword [ebp - 8]
push ebx
call fcn.301b940b
test eax, eax
jl 0x3016088d
mov dword [ebp - 4], 1
jmp 0x30160894
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
lea ecx, [ebp - 0x14]
call fcn.301b2a51
mov eax, dword [ebp - 4]
pop esi
pop ebx
leave
ret 0xc
Function at 0x301608a6
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
and dword [ebp - 4], 0
push esi
push dword [0x3026b738]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x301608c9
mov esi, dword [eax + 0x16c]
jmp 0x301608cb
xor esi, esi
test esi, esi
jne 0x301608dc
push 0x80040014
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x30160949
and dword [ebp - 0x10], 0
push esi
push 0
push 0
lea ecx, [ebp - 0x10]
call fcn.301b2a98
test eax, eax
jne 0x301608fe
push 0x80070057
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x30160941
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x30160918
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x14]
shr eax, 2
test al, 1
je 0x30160918
mov ecx, edi
jmp 0x3016091a
xor ecx, ecx
test ecx, ecx
pop edi
je 0x301608f1
cmp esi, dword [ecx + 8]
je 0x3016092b
push 0x8004001e
jmp 0x301608f6
call fcn.3015fefc
mov eax, dword [eax + 0x50]
test eax, eax
je 0x30160941
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x34]
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x10]
call fcn.301b2a51
mov eax, dword [ebp - 4]
pop esi
leave
ret 4

Function at 0x30160951
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push dword [0x3026b738]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x30160970
mov esi, dword [eax + 0x16c]
jmp 0x30160972
xor esi, esi
test esi, esi
jne 0x30160983
push 0x80040014
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x301609f3
and dword [ebp - 0xc], 0
push esi
push 0
push 0
lea ecx, [ebp - 0xc]
call fcn.301b2a98
test eax, eax
jne 0x301609a5
push 0x80070057
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x301609eb
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x301609bf
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x14]
shr eax, 2
test al, 1
je 0x301609bf
mov ecx, edi
jmp 0x301609c1
xor ecx, ecx
test ecx, ecx
pop edi
je 0x30160998
cmp esi, dword [ecx + 8]
je 0x301609d2
push 0x8004001e
jmp 0x3016099d
call fcn.3015fefc
mov eax, dword [eax + 0x50]
test eax, eax
je 0x301609eb
push dword [ebp + 0x10]
mov edx, dword [eax]
push dword [ebp + 0xc]
mov ecx, eax
call dword [edx + 0x3c]
lea ecx, [ebp - 0xc]
call fcn.301b2a51
pop esi
leave
ret 0xc