joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1016a830
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
mov esi, ecx
mov ecx, dword [ebp + 0xc]
cmp dword [ebp + 0x10], 0
mov edi, edx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x103
je 0x1016a874
mov eax, dword [ebp + 0x1c]
mov ebx, dword [ebp + 0x18]
lea edx, [esp + 0x20]
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], eax
xor eax, eax
mov ebx, 1
jmp 0x1016a87a
xor ebx, ebx
xor eax, eax
xor edx, edx
mov dword [esp + 0x1c], eax
lea eax, [esp + 8]
mov dword [esp + 0x18], ebx
push 0
push edx
push ecx
push dword [ebp + 8]
push eax
push 0
push 0
push 0
push edi
call dword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x1016a8b6
push 0xffffffffffffffff
push edi
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
mov eax, dword [esp + 8]
cmp eax, 0x103
je 0x1016a8db
test eax, eax
js 0x1016a8c5
mov eax, dword [esp + 0xc]
mov dword [esi + 4], eax
mov al, 4
jmp 0x1016a8d1
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov dword [esi + 4], eax
xor eax, eax
mov byte [esi], al
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
lea eax, [esp + 4]
mov dword [esp + 0x18], 0x1023c07c
mov dword [esp + 0x1c], 1
mov dword [esp + 0x28], 0
lea esi, [esp + 0x34]
mov dword [esp + 0x10], 0
mov byte [esp + 0x14], 0
lea ecx, [esp + 0x10]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x18]
mov dword [esp + 0x24], 0
push eax
push ecx
push esi
call fcn.101612b0
add esp, 0xc
cmp byte [esp + 0x34], 4
je 0x1016a937
push esi
call fcn.1015d060
add esp, 4
mov ecx, 7
int 0x29
ud2

Function at 0x1016a9d0
Capabilities:
Create udp socket

Disassembly:
push ebx
push edi
push esi
mov eax, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
mov edi, dword [esp + 0x18]
mov ebx, 0x17
cmp word [eax], 0
mov eax, 2
cmove ebx, eax
push 0x81
push 0
push 0
push 0
push edi
push ebx
call dword [sym.imp.ws2_32.dll_WSASocketW]
cmp eax, 0xffffffff
je 0x1016aa14
mov dword [esi + 4], eax
mov byte [esi], 4
mov eax, esi
pop esi
pop edi
pop ebx
ret
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
cmp eax, 0x2726
je 0x1016aa28
cmp eax, 0x2739
jne 0x1016aa53
push 1
push 0
push 0
push 0
push edi
push ebx
call dword [sym.imp.ws2_32.dll_WSASocketW]
cmp eax, 0xffffffff
je 0x1016aa5b
mov edi, eax
push 0
push 1
push eax
call dword [sym.imp.kernel32.dll_SetHandleInformation]
test eax, eax
je 0x1016aa6c
mov dword [esi + 4], edi
jmp 0x1016aa0b
mov byte [esi], 0
mov dword [esi + 4], eax
jmp 0x1016aa0e
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
mov dword [esi + 4], eax
mov dword [esi], 0
jmp 0x1016aa0e
call dword [sym.imp.kernel32.dll_GetLastError]
mov ecx, eax
mov edx, eax
shr eax, 0x18
mov byte [esi], 0
shr ecx, 8
shl edx, 0x18
mov byte [esi + 7], al
mov dword [esi + 1], edx
mov word [esi + 5], cx
push edi
call dword [sym.imp.ws2_32.dll_closesocket]
jmp 0x1016aa0e
Function at 0x1016c130
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov esi, esp
mov dword [esi + 0x48], ebp
mov dword [esi + 0x4c], esp
mov dword [esi + 0x58], 0xffffffff
mov dword [esi + 0x54], 0x1016fe20
mov edi, ecx
lea eax, [esi + 0x50]
xorps xmm0, xmm0
mov ecx, dword fs:[0]
mov dword [esi + 0x50], ecx
mov dword fs:[0], eax
movaps xmmword [esi + 0x10], xmm0
lea eax, [esi + 0x10]
push 0x10
push eax
call dword [sym.imp.advapi32.dll_SystemFunction036]
test al, al
je 0x1016c1ae
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
mov edx, dword [esi + 0x18]
mov ebx, dword [esi + 0x1c]
mov dword [esi + 4], eax
mov eax, dword [esi + 0x50]
mov dword fs:[0], eax
mov dword [edi + 0xc], ebx
mov dword [edi + 8], edx
mov dword [edi + 4], ecx
mov eax, dword [esi + 4]
mov dword [edi], eax
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
call dword [sym.imp.kernel32.dll_GetLastError]
mov byte [esi + 8], 0
mov dword [esi + 0xc], eax
lea eax, [esi + 8]
mov dword [esi + 0x30], 0x1023c288
mov dword [esi + 0x34], 1
mov dword [esi + 0x40], 0
mov dword [esi + 0x58], 0
mov dword [esi + 0x28], eax
lea eax, [esi + 0x28]
mov dword [esi + 0x2c], fcn.1015ff80
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], 1
lea eax, [esi + 0x30]
push 0x1023c2b4
push eax
call fcn.101af120
add esp, 8
ud2
Function at 0x1016c970
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x1016fe40
mov esi, dword [ebp + 0x14]
mov edi, dword [ebp + 0x10]
lea eax, [ebp - 0x18]
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], esi
push 4
push 8
call fcn.100985b0
add esp, 8
test eax, eax
je 0x1016ca4f
mov ebx, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov dword [eax], edi
mov dword [eax + 4], esi
push 0
push 0x10000
mov dword [ebp - 0x20], eax
push eax
push 0x1016cac0
push ecx
push 0
call dword [sym.imp.kernel32.dll_CreateThread]
test eax, eax
je 0x1016c9ed
mov dword [ebx + 4], eax
mov byte [ebx], 4
jmp 0x1016ca3c
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x10], 1
mov eax, dword [ecx]
mov ecx, dword [ecx + 4]
push eax
call dword [ecx]
add esp, 4
mov edx, dword [ebp - 0x20]
mov ebx, dword [ebp + 8]
mov ecx, dword [edx + 4]
mov eax, dword [ecx + 4]
test eax, eax
je 0x1016ca23
push dword [ecx + 8]
push eax
push dword [edx]
call fcn.100985c0
mov edx, dword [ebp - 0x20]
add esp, 0xc
push 4
push 8
push edx
call fcn.100985c0
add esp, 0xc
call dword [sym.imp.kernel32.dll_GetLastError]
mov byte [ebx], 0
mov dword [ebx + 4], eax
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, ebx
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x10], 0
push 8
push 4
call fcn.101aefe0
add esp, 8
ud2
Function at 0x1016cd00
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x1016fe70
lea ecx, [ebp - 0x18]
mov edx, dword fs:[0]
cmp eax, 3
mov dword [ebp - 0x18], edx
mov dword fs:[0], ecx
je 0x1016cd3e
test eax, eax
jne 0x1016ceba
mov ebx, dword [0x10262c5c]
test ebx, ebx
je 0x1016ceba
mov dword [ebp - 0x20], 0
jmp 0x1016cd67
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x1016cd98
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x1016cf0b
dec esi
push esi
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x1016cd60
push 0
push esi
mov esi, eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x1016cd60
test byte [ebp - 0x20], 1
je 0x1016ceba
mov ebx, dword [0x10262c5c]
test ebx, ebx
je 0x1016ceba
mov dword [ebp - 0x20], 0
jmp 0x1016cdc7
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x1016cdf8
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x1016cf0b
dec esi
push esi
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x1016cdc0
push 0
push esi
mov esi, eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x1016cdc0
test byte [ebp - 0x20], 1
je 0x1016ceba
mov ebx, dword [0x10262c5c]
test ebx, ebx
je 0x1016ceba
mov dword [ebp - 0x20], 0
jmp 0x1016ce27
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x1016ce58
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x1016cf0b
dec esi
push esi
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x1016ce20
push 0
push esi
mov esi, eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x1016ce20
test byte [ebp - 0x20], 1
je 0x1016ceba
mov ebx, dword [0x10262c5c]
test ebx, ebx
je 0x1016ceba
mov dword [ebp - 0x20], 0
jmp 0x1016ce87
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x1016ceb4
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x1016cf0b
dec esi
push esi
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x1016ce80
push 0
push esi
mov esi, eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x1016ce80
test byte [ebp - 0x20], 1
jne 0x1016ced4
movzx eax, byte [0x1024b980]
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
mov ebx, dword [0x10262c5c]
jmp 0x1016cedf
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x1016ceba
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x1016cf0b
dec esi
push esi
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x1016cedc
push 0
push esi
mov esi, eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
push esi
call edi
add esp, 4
jmp 0x1016cedc
mov dword [ebp - 0x10], 0
push 0x1023c5dc
push 0x2b
push 0x1023a800
call fcn.101af1e0
add esp, 0xc
ud2
Function at 0x1016e090
Capabilities:
Resolve dns

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1b4
mov eax, dword [esp + 0x1cc]
mov esi, dword [esp + 0x1c8]
mov edi, dword [eax]
mov ebp, dword [eax + 4]
movzx ebx, word [eax + 8]
mov eax, dword [0x10262c54]
cmp eax, 3
jne 0x1016e17b
cmp ebp, 0x17f
ja 0x1016e18c
mov dword [esp + 4], ebx
lea ebx, [esp + 0x34]
push ebp
push edi
push ebx
call fcn.10193640
add esp, 0xc
mov byte [esp + ebp + 0x34], 0
inc ebp
lea eax, [esp + 8]
push ebp
push ebx
push eax
call fcn.1017d600
add esp, 0xc
cmp dword [esp + 8], 0
je 0x1016e116
mov eax, dword [0x1023b600]
mov ecx, dword [0x1023b604]
mov dword [esi + 8], ecx
mov dword [esi + 4], eax
mov dword [esi], 1
jmp 0x1016e19a
mov eax, dword [esp + 0xc]
xorps xmm0, xmm0
mov ecx, esp
mov dword [esp], 0
lea edx, [esp + 0x14]
movups xmmword [esp + 0x14], xmm0
movups xmmword [esp + 0x24], xmm0
mov dword [esp + 0x1c], 1
push ecx
push edx
push 0
push eax
call dword [sym.imp.ws2_32.dll_getaddrinfo]
test eax, eax
je 0x1016e164
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
mov ecx, 1
mov dword [esi + 8], eax
mov dword [esi + 4], 0
mov dword [esi], ecx
jmp 0x1016e19a
mov eax, dword [esp]
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov eax, dword [esp + 4]
mov word [esi + 0xc], ax
xor eax, eax
mov dword [esi], eax
jmp 0x1016e19a
call fcn.101ae350
cmp ebp, 0x17f
jbe 0x1016e0cb
mov ecx, esi
mov edx, edi
push ebx
push ebp
call fcn.101ae3a0
add esp, 8
mov eax, esi
add esp, 0x1b4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1016e1b0
Capabilities:
Connect socket

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov eax, dword [esp + 0x34]
mov esi, dword [esp + 0x30]
movzx ecx, byte [eax]
cmp cl, 4
jne 0x1016e211
mov ebp, dword [eax + 4]
mov eax, dword [0x10262c54]
cmp eax, 3
jne 0x1016e2bc
mov eax, esp
push 1
push ebp
push eax
call fcn.1016a9d0
add esp, 0xc
movzx eax, byte [esp]
cmp al, 4
jne 0x1016e22d
mov edi, dword [esp + 4]
cmp word [ebp], 0
je 0x1016e249
movups xmm0, xmmword [ebp + 4]
mov edx, dword [ebp + 0x18]
lea eax, [ebp + 0x14]
add ebp, 0x1c
mov ecx, 0x1c
mov bx, 0x17
jmp 0x1016e25b
movzx edx, byte [eax + 3]
movzx edi, word [eax + 1]
mov eax, dword [eax + 4]
mov byte [esi + 3], dl
mov word [esi + 1], di
mov byte [esi], cl
mov dword [esi + 4], eax
jmp 0x1016e2b2
movzx ecx, byte [esp + 3]
movzx edi, word [esp + 1]
mov edx, dword [esp + 4]
mov byte [esi + 3], cl
mov word [esi + 1], di
mov byte [esi], al
mov dword [esi + 4], edx
jmp 0x1016e2b2
lea eax, [ebp + 2]
add ebp, 6
xorps xmm0, xmm0
mov ecx, 0x10
mov bx, 2
movzx ebp, word [ebp]
mov eax, dword [eax]
mov word [esp], bx
rol bp, 8
mov word [esp + 2], bp
mov dword [esp + 4], eax
movups xmmword [esp + 8], xmm0
mov dword [esp + 0x18], edx
push ecx
lea eax, [esp + 4]
push eax
push edi
call dword [sym.imp.ws2_32.dll_connect]
cmp eax, 0xffffffff
je 0x1016e295
mov dword [esi + 4], edi
mov byte [esi], 4
jmp 0x1016e2b2
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
mov byte [esi], 0
mov byte [esi + 3], 0
mov word [esi + 1], 0
mov dword [esi + 4], eax
push edi
call dword [sym.imp.ws2_32.dll_closesocket]
mov eax, esi
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.101ae350
jmp 0x1016e1d8
Function at 0x1016e6b0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xa0
xorps xmm0, xmm0
mov esi, ecx
lea eax, [esp + 8]
mov dword [esp + 8], 0x80
lea ecx, [esp + 0x20]
movaps xmmword [esp + 0x90], xmm0
movaps xmmword [esp + 0x80], xmm0
movaps xmmword [esp + 0x70], xmm0
movaps xmmword [esp + 0x60], xmm0
movaps xmmword [esp + 0x50], xmm0
movaps xmmword [esp + 0x40], xmm0
movaps xmmword [esp + 0x30], xmm0
movaps xmmword [esp + 0x20], xmm0
push eax
push ecx
push edx
call dword [sym.imp.ws2_32.dll_getsockname]
cmp eax, 0xffffffff
je 0x1016e78c
movzx ecx, word [esp + 0x20]
mov eax, dword [esp + 8]
cmp ecx, 2
je 0x1016e7a5
cmp ecx, 0x17
jne 0x1016e7c5
cmp eax, 0x1c
jb 0x1016e7dc
movsd xmm0, qword [esp + 0x28]
movzx eax, word [esp + 0x22]
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x38]
mov word [esi], 1
movsd qword [esp + 0x10], xmm0
movsd xmm0, qword [esp + 0x30]
rol ax, 8
movsd qword [esp + 0x18], xmm0
movsd xmm0, qword [esp + 0xe]
movsd xmm1, qword [esp + 0x16]
movzx edi, word [esp + 0x1e]
movsd qword [esi + 2], xmm0
movsd qword [esi + 0xa], xmm1
mov word [esi + 0x12], di
mov dword [esi + 0x14], ecx
mov dword [esi + 0x18], edx
mov word [esi + 0x1c], ax
jmp 0x1016e7d5
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
mov byte [esi + 4], 0
mov byte [esi + 7], 0
mov word [esi + 5], 0
mov dword [esi + 8], eax
jmp 0x1016e7d0
cmp eax, 0x10
jb 0x1016e7ea
movzx ecx, word [esp + 0x22]
mov eax, dword [esp + 0x24]
mov word [esi], 0
rol cx, 8
mov dword [esi + 2], eax
mov word [esi + 6], cx
jmp 0x1016e7d5
mov byte [esi + 4], 2
mov dword [esi + 8], 0x1023c934
mov word [esi], 2
lea esp, [ebp - 8]
pop esi
pop edi
pop ebp
ret
push 0x1023c9a4
push 0x43
push str.assertion_failed:_len_as_usize___mem::size_of::_c::sockaddr_in6___library_std_src_sys_common_net.rs
jmp 0x1016e7f6
push 0x1023c9f8
push 0x42
push 0x1023c9b4
call fcn.101af1e0
add esp, 0xc
ud2
Function at 0x1016f1c0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
mov eax, dword [0x10262098]
mov esi, ecx
test eax, eax
je 0x1016f1e6
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jbe 0x1016f1ff
cmp dword [eax + 4], 0
je 0x1016f1ff
add eax, 8
pop esi
pop edi
ret
push 0x10262098
call fcn.101ae580
add esp, 4
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
ja 0x1016f1da
mov eax, dword [0x10262098]
test eax, eax
je 0x1016f273
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x1016f28c
mov edi, eax
test eax, eax
jne 0x1016f24c
push 4
push 0xc
call fcn.100985b0
add esp, 8
test eax, eax
je 0x1016f2a0
mov dword [eax], 0x10262098
mov dword [eax + 4], 0
mov edi, eax
mov eax, dword [0x10262098]
test eax, eax
je 0x1016f291
dec eax
push edi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
test esi, esi
je 0x1016f261
mov ecx, dword [esi]
mov dword [esi], 0
test ecx, ecx
je 0x1016f263
mov ecx, dword [esi + 4]
jmp 0x1016f263
xor ecx, ecx
mov dword [edi + 4], 1
lea eax, [edi + 8]
mov dword [edi + 8], ecx
pop esi
pop edi
ret
push 0x10262098
call fcn.101ae580
add esp, 4
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jne 0x1016f215
xor eax, eax
pop esi
pop edi
ret
push 0x10262098
call fcn.101ae580
add esp, 4
jmp 0x1016f244
push 0xc
push 4
call fcn.101aefe0
add esp, 8
ud2
Function at 0x1016f2b0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x1016ff10
mov esi, ecx
lea eax, [ebp - 0x18]
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
mov eax, dword [0x102620a8]
test eax, eax
je 0x1016f305
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jbe 0x1016f31e
cmp dword [eax + 4], 0
mov ebx, eax
je 0x1016f31e
add ebx, 8
jmp 0x1016f3f5
push 0x102620a8
call fcn.101ae580
add esp, 4
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
ja 0x1016f2f5
mov eax, dword [0x102620a8]
test eax, eax
je 0x1016f3d6
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x1016f3f3
mov edi, eax
test eax, eax
jne 0x1016f38f
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x2c], 0x102620a8
push 4
push 0x10
call fcn.100985b0
add esp, 8
test eax, eax
je 0x1016f41a
movsd xmm0, qword [ebp - 0x2c]
movsd xmm1, qword [ebp - 0x24]
mov edi, eax
movsd qword [eax + 8], xmm1
movsd qword [eax], xmm0
mov eax, dword [0x102620a8]
test eax, eax
je 0x1016f408
dec eax
push edi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
test esi, esi
je 0x1016f3a9
mov eax, dword [esi]
mov dword [esi], 0
test eax, eax
mov edx, eax
je 0x1016f3ad
mov eax, dword [esi + 4]
mov edx, dword [esi + 8]
jmp 0x1016f3ad
xor eax, eax
xor edx, edx
mov ecx, dword [edi + 0xc]
cmp dword [edi + 4], 0
lea ebx, [edi + 8]
mov dword [edi + 4], 1
mov dword [edi + 8], eax
mov dword [edi + 0xc], edx
je 0x1016f3f5
test ecx, ecx
je 0x1016f3f5
lock dec dword [ecx]
jne 0x1016f3f5
call fcn.1015dcc0
jmp 0x1016f3f5
push 0x102620a8
call fcn.101ae580
add esp, 4
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jne 0x1016f33c
xor ebx, ebx
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, ebx
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x102620a8
call fcn.101ae580
add esp, 4
jmp 0x1016f387
mov dword [ebp - 0x10], 0
push 0x10
push 4
call fcn.101aefe0
add esp, 8
ud2
Function at 0x1016f450
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
mov eax, dword [0x102620b8]
test eax, eax
je 0x1016f472
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jbe 0x1016f48b
cmp byte [eax + 4], 0
je 0x1016f48b
add eax, 5
pop esi
ret
push 0x102620b8
call fcn.101ae580
add esp, 4
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
ja 0x1016f467
mov eax, dword [0x102620b8]
test eax, eax
je 0x1016f4fa
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x1016f513
mov esi, eax
test eax, eax
jne 0x1016f4d5
push 4
push 8
call fcn.100985b0
add esp, 8
test eax, eax
je 0x1016f526
mov dword [eax], 0x102620b8
mov byte [eax + 4], 0
mov esi, eax
mov eax, dword [0x102620b8]
test eax, eax
je 0x1016f517
dec eax
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov eax, dword [esp + 8]
xor ecx, ecx
test eax, eax
je 0x1016f4ee
cmp byte [eax], 0
mov byte [eax], 0
movzx eax, byte [eax + 1]
cmove eax, ecx
mov ecx, eax
mov byte [esi + 4], 1
lea eax, [esi + 5]
mov byte [esi + 5], cl
pop esi
ret
push 0x102620b8
call fcn.101ae580
add esp, 4
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jne 0x1016f4a1
xor eax, eax
pop esi
ret
push 0x102620b8
call fcn.101ae580
add esp, 4
jmp 0x1016f4cd
push 8
push 4
call fcn.101aefe0
add esp, 8
ud2
Function at 0x1016f540
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x1016ff20
lea eax, [ebp - 0x18]
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
mov eax, dword [0x102620c8]
test eax, eax
je 0x1016f593
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jbe 0x1016f5ac
cmp dword [eax + 4], 0
mov edi, eax
je 0x1016f5ac
add edi, 8
jmp 0x1016f676
push 0x102620c8
call fcn.101ae580
add esp, 4
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
ja 0x1016f583
mov eax, dword [0x102620c8]
test eax, eax
je 0x1016f657
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x1016f674
mov esi, eax
test eax, eax
jne 0x1016f615
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x28], 0x102620c8
push 4
push 0xc
call fcn.100985b0
add esp, 8
test eax, eax
je 0x1016f69b
mov esi, eax
mov eax, dword [ebp - 0x20]
movsd xmm0, qword [ebp - 0x28]
mov dword [esi + 8], eax
movsd qword [esi], xmm0
mov eax, dword [0x102620c8]
test eax, eax
je 0x1016f689
dec eax
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x1016f650
mov eax, dword [ecx + 4]
cmp dword [ecx], 0
mov dword [ecx], 0
je 0x1016f650
mov ecx, dword [esi + 8]
cmp dword [esi + 4], 0
lea edi, [esi + 8]
mov dword [esi + 4], 1
mov dword [esi + 8], eax
je 0x1016f676
test ecx, ecx
je 0x1016f676
lock dec dword [ecx]
jne 0x1016f676
call fcn.1015dd40
jmp 0x1016f676
call fcn.101ae240
jmp 0x1016f62a
push 0x102620c8
call fcn.101ae580
add esp, 4
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jne 0x1016f5ca
xor edi, edi
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, edi
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x102620c8
call fcn.101ae580
add esp, 4
jmp 0x1016f60d
mov dword [ebp - 0x10], 0
push 0xc
push 4
call fcn.101aefe0
add esp, 8
ud2
Function at 0x1016f6d0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x1016ff30
mov esi, ecx
lea eax, [ebp - 0x18]
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
mov eax, dword [0x102620d8]
test eax, eax
je 0x1016f725
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jbe 0x1016f73e
cmp dword [eax + 4], 0
mov ebx, eax
je 0x1016f73e
add ebx, 8
jmp 0x1016f803
push 0x102620d8
call fcn.101ae580
add esp, 4
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
ja 0x1016f715
mov eax, dword [0x102620d8]
test eax, eax
je 0x1016f7e4
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x1016f801
mov edi, eax
test eax, eax
jne 0x1016f7a7
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x28], 0x102620d8
push 4
push 0xc
call fcn.100985b0
add esp, 8
test eax, eax
je 0x1016f828
mov edi, eax
mov eax, dword [ebp - 0x20]
movsd xmm0, qword [ebp - 0x28]
mov dword [edi + 8], eax
movsd qword [edi], xmm0
mov eax, dword [0x102620d8]
test eax, eax
je 0x1016f816
dec eax
push edi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
test esi, esi
je 0x1016f7bc
mov eax, dword [esi]
mov dword [esi], 0
test eax, eax
je 0x1016f7be
mov eax, dword [esi + 4]
jmp 0x1016f7be
xor eax, eax
mov ecx, dword [edi + 8]
cmp dword [edi + 4], 0
lea ebx, [edi + 8]
mov dword [edi + 4], 1
mov dword [edi + 8], eax
je 0x1016f803
test ecx, ecx
je 0x1016f803
lock dec dword [ecx]
jne 0x1016f803
call fcn.1015dd00
jmp 0x1016f803
push 0x102620d8
call fcn.101ae580
add esp, 4
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jne 0x1016f75c
xor ebx, ebx
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, ebx
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x102620d8
call fcn.101ae580
add esp, 4
jmp 0x1016f79f
mov dword [ebp - 0x10], 0
push 0xc
push 4
call fcn.101aefe0
add esp, 8
ud2