joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100142e0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push esi
push edi
mov ecx, 8
mov esi, edx
call fcn.1002fe00
push 0
mov edi, eax
push 0
push edi
push 0x100141f0
mov dword [edi], esi
mov esi, dword [ebp + 8]
test esi, esi
push 0
setne cl
push 0
mov byte [edi + 4], cl
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x10014350
mov eax, dword [0x10310174]
test eax, eax
je 0x10014341
dec eax
cmp eax, 1
ja 0x10014348
push edi
push 0
push dword [0x10310170]
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor al, al
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, edi
call fcn.1002f460
xor al, al
pop edi
pop esi
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x10014365
mov dword [esi], eax
mov al, 1
mov dword [esi + 4], 0
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10015150
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc8
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push eax
mov dword [esp + 0x10], ebx
mov dword [esi], eax
push dword [eax]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x100151b5
cmp dword [0x1030f270], 3
jg 0x100151a7
push 3
push 0x23
push str.e:_trunk_v39_97_src_base_threading_thread_local_win.cc
lea ecx, [esp + 0x1c]
lea ebx, [eax + 2]
call fcn.10012e10
add eax, 8
push str.Failed_to_TlsSetValue__.
push eax
call fcn.10006d00
add esp, 8
test bl, 2
je 0x100151b5
lea ecx, [esp + 0x10]
call fcn.10012e80
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x100151c0
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc4
mov eax, dword [ecx]
push ebx
xor ebx, ebx
push ebx
push dword [eax]
mov dword [esp + 0xc], ebx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x1001521f
cmp dword [0x1030f270], 3
jg 0x10015211
push 3
push 0x23
push str.e:_trunk_v39_97_src_base_threading_thread_local_win.cc
lea ecx, [esp + 0x14]
lea ebx, [eax + 1]
call fcn.10012e10
add eax, 8
push str.Failed_to_TlsSetValue__.
push eax
call fcn.10006d00
add esp, 8
test bl, 1
je 0x1001521f
lea ecx, [esp + 8]
call fcn.10012e80
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100161e0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 8], 0
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 8]
mov dword [esi], 0x10104e14
mov dword [esi + 4], edi
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov eax, dword [edi + 0x204]
mov dword [esi + 0x20], eax
call fcn.10028480
push dword [eax]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 8], eax
mov dword [ebp + 8], esi
mov edx, dword [eax + 0x5c]
lea ecx, [eax + 0x58]
mov eax, dword [ecx]
cmp eax, edx
je 0x10016257
cmp dword [eax], esi
je 0x10016253
add eax, 4
cmp eax, edx
jne 0x10016248
cmp eax, edx
jne 0x10016260
lea eax, [ebp + 8]
push eax
call fcn.10021a50
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
movzx eax, byte [0x1031efd9]
lea ecx, [edi + 0x1d0]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.1001bb90
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x100162f0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xdc
push ebx
mov ebx, ecx
mov dword [esp + 4], 0
push esi
push edi
mov dword [ebx], 0x10104e14
call fcn.10028480
mov edi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
push dword [eax]
call edi
push ebx
lea ecx, [eax + 0x54]
call fcn.10028730
mov esi, dword [ebx + 0x10]
test esi, esi
je 0x10016392
mov ecx, dword [ebx + 0x18]
mov edx, dword [ebx + 0x1c]
cmp ecx, 0xffffffff
jne 0x1001634b
cmp edx, 0x7fffffff
jne 0x1001634b
movsd xmm0, qword [0x1010b388]
jmp 0x10016358
call fcn.1009536f
divsd xmm0, qword [0x101074f0]
movd xmm1, esi
cvtdq2pd xmm1, xmm1
divsd xmm0, xmm1
movsd qword [esp + 0x10], xmm0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov esi, eax
mov ecx, ebx
lea eax, [esp + 0x10]
push eax
sub esp, 0xc
push 0
call fcn.100164a0
add esp, 4
mov edx, esi
mov ecx, eax
call fcn.1001b940
add esp, 0xc
mov esi, dword [ebx + 4]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [ebx + 8], 0
je 0x100163cd
mov eax, dword [ebx + 4]
mov eax, dword [eax + 0x204]
cmp dword [ebx + 0x20], eax
jne 0x100163cd
mov eax, dword [ebx + 4]
mov edx, dword [ebx + 8]
mov ecx, dword [eax + 0x3c]
push ecx
mov eax, esp
mov dword [ebx + 8], 0
mov dword [eax], edx
mov eax, dword [ecx]
push dword [ebx + 0xc]
call dword [eax + 8]
call fcn.10028480
push dword [eax]
call edi
mov dword [esp + 0x18], eax
lea ecx, [esp + 0x18]
mov eax, dword [ebx + 4]
push ecx
add eax, 0x1d0
lea ecx, [esp + 0x20]
push ecx
mov ecx, eax
mov dword [esp + 0x18], eax
call fcn.1001a810
mov edi, dword [esp + 0x1c]
mov eax, edi
mov edx, dword [esp + 0x20]
cmp edi, edx
je 0x1001640b
mov eax, dword [eax]
cmp eax, edx
jne 0x10016405
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x24]
push edx
push edi
push eax
call fcn.1001a780
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebx + 4]
push 0
push dword [eax + 0x1c4]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x1001647b
cmp dword [0x1030f270], 3
jg 0x1001646b
push 3
push 0x23
push str.e:_trunk_v39_97_src_base_threading_thread_local_win.cc
lea ecx, [esp + 0x34]
mov dword [esp + 0x18], 2
call fcn.10012e10
add eax, 8
push str.Failed_to_TlsSetValue__.
push eax
call fcn.10006d00
add esp, 8
test byte [esp + 0xc], 2
je 0x1001647b
lea ecx, [esp + 0x28]
call fcn.10012e80
mov ecx, dword [ebx + 8]
test ecx, ecx
je 0x10016488
push ecx
call fcn.1001aeb0
pop edi
pop esi
mov dword [ebx], method.std::error_category.virtual_4
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100185c0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x124
mov eax, dword [0x1010b520]
xor eax, esp
mov dword [esp + 0x120], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov dword [esp + 0x28], eax
mov esi, ecx
mov eax, dword [ebp + 0x10]
xor ebx, ebx
push edi
mov edi, dword [ebp + 8]
mov dword [esp + 0x30], eax
mov eax, dword [ebp + 0x14]
mov dword [esp + 0xc], ebx
push dword [esi + 0x1cc]
mov dword [esp + 0x2c], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0x10018791
lea eax, [esi + 0x1cc]
push eax
lea ecx, [esp + 0x10]
call fcn.10015150
lea ecx, [esp + 0x10]
call fcn.10013fc0
mov eax, dword [esp + 0x10]
sub eax, dword [esi + 0x128]
mov ecx, dword [esp + 0x14]
sbb ecx, dword [esi + 0x12c]
test byte [edi], 1
mov dword [esp + 0x34], eax
mov dword [esp + 0x10], ecx
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x110], 0xf
mov dword [esp + 0x10c], ebx
mov byte [esp + 0xfc], bl
je 0x1001874e
push dword [esp + 0x28]
lea eax, [esp + 0x24]
mov dword [esp + 0x24], esi
push dword [esp + 0x34]
mov ecx, esi
mov byte [esp + 0x2c], bl
push eax
call fcn.10018d40
mov edx, eax
test edx, edx
je 0x100186b7
mov eax, dword [esp + 0x34]
sub eax, dword [edx]
mov ecx, dword [esp + 0x10]
sbb ecx, dword [edx + 4]
mov dword [edx + 0x10], eax
mov dword [edx + 0x14], ecx
mov ecx, dword [edx + 8]
mov eax, dword [edx + 0xc]
neg ecx
mov dword [edx + 0x18], ecx
adc eax, ebx
neg eax
mov dword [edx + 0x1c], eax
mov eax, dword [esi + 0x154]
test al, 8
je 0x100186f1
push edx
lea eax, [esp + 0x1c]
mov ecx, esi
push eax
push 0x45
lea eax, [esp + 0x120]
push eax
call fcn.10018220
push eax
lea ecx, [esp + 0x100]
call fcn.10001fe0
lea ecx, [esp + 0x114]
call fcn.10002040
cmp byte [esp + 0x24], bl
je 0x10018701
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [esp + 0x10c], ebx
je 0x1001874e
cmp dword [0x1030f270], 2
jg 0x10018740
mov ebx, 2
lea ecx, [esp + 0x38]
push ebx
push 0x863
push str.e:_trunk_v39_97_src_basedebug_trace_event_impl.cc
call fcn.10012e10
lea ecx, [esp + 0xfc]
add eax, 8
push ecx
push eax
call fcn.1000aad0
add esp, 8
test bl, 2
je 0x1001874e
lea ecx, [esp + 0x38]
call fcn.10012e80
test byte [edi], 4
je 0x1001877c
mov eax, dword [esi + 0x40]
test eax, eax
je 0x1001877c
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push dword [esp + 0x48]
push edi
push 0x45
push dword [esp + 0x44]
push dword [esp + 0x44]
call eax
add esp, 0x30
lea ecx, [esp + 0xfc]
call fcn.10002040
lea ecx, [esp + 0xc]
call fcn.100151c0
mov ecx, dword [esp + 0x12c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10041ad4
mov esp, ebp
pop ebp
ret 0x10
Function at 0x10018d40
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 8
cmp dword [ebp + 0xc], 0
push esi
push edi
mov edi, ecx
mov dword [esp + 0xc], 0
jne 0x10018d65
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
push dword [edi + 0x1c4]
mov esi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
call esi
test eax, eax
je 0x10018d90
push dword [edi + 0x1c4]
call esi
push dword [ebp + 0x10]
mov ecx, eax
push dword [ebp + 0xc]
call fcn.10016190
test eax, eax
jne 0x10018df1
mov esi, dword [ebp + 8]
test esi, esi
je 0x10018da9
cmp byte [esi + 4], 0
jne 0x10018da9
push dword [esi]
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [esi + 4], 1
mov ecx, dword [edi + 0x1f0]
mov edx, dword [ebp + 0x10]
test ecx, ecx
je 0x10018de5
movzx eax, dx
cmp eax, dword [edi + 0x1f4]
jne 0x10018de5
mov eax, dword [ebp + 0xc]
cmp eax, dword [ecx + 0x1808]
jne 0x10018d5b
mov eax, dword [ebp + 0x12]
movzx eax, ax
lea eax, [eax + eax*2]
shl eax, 5
add eax, 8
add eax, ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [edi + 0x3c]
push edx
push dword [ebp + 0xc]
mov eax, dword [ecx]
call dword [eax + 0x18]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x10019ef0
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc4
push ebx
push dword [ebp + 8]
xor ebx, ebx
push dword [ecx]
mov dword [esp + 0xc], ebx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x10019f4f
cmp dword [0x1030f270], 3
jg 0x10019f41
push 3
push 0x23
push str.e:_trunk_v39_97_src_base_threading_thread_local_win.cc
lea ecx, [esp + 0x14]
lea ebx, [eax + 1]
call fcn.10012e10
add eax, 8
push str.Failed_to_TlsSetValue__.
push eax
call fcn.10006d00
add esp, 8
test bl, 1
je 0x10019f4f
lea ecx, [esp + 8]
call fcn.10012e80
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x1001a940
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 8
mov eax, dword [0x1030f34c]
mov dword [esp + 4], 0
test eax, 0xfffffffe
jne 0x1001a9a1
push 0x1030f34c
call fcn.1001d2b0
add esp, 4
test al, al
je 0x1001a9a1
mov dword [0x1030f350], 0
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x1030f350], eax
cmp eax, 0xffffffff
je 0x1001a9aa
push 0
push 0x1030f34c
push 0x1030f350
push 0x1030f34c
call fcn.1001d300
add esp, 0x10
mov eax, dword [0x1030f34c]
mov esp, ebp
pop ebp
ret
call fcn.1001fee0
int3

Function at 0x1001b4e0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push esi
push edi
cmp dword [edx + 0x14], 0x10
mov edi, dword [edx + 0x10]
jb 0x1001b4f3
mov edx, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
test edi, edi
je 0x1001b511
mov edi, edi
movzx eax, byte [edx + ecx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edi
jb 0x1001b500
push 0x1f31d
and esi, 0x7fffffff
push esi
call fcn.10044a49
imul ecx, eax, 0xb14
add esp, 8
imul edx, edx, 0x41a7
sub edx, ecx
lea eax, [edx + 0x7fffffff]
js 0x1001b53d
mov eax, edx
pop edi
pop esi
pop ebp
ret 4
Function at 0x10022240
Capabilities:
Get geographical location
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1010b520]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, edx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], 0
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx edi, ax
mov eax, 0x1400
cmp ax, di
je 0x100222ef
push 9
lea eax, [ebp - 0x18]
mov ebx, edi
push eax
push 0x59
push ebx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
cmp eax, 1
jle 0x100222ef
mov ecx, dword [ebp - 0x1c]
dec eax
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.10002790
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], 0
jb 0x100222a7
mov eax, dword [esi]
jmp 0x100222a9
mov eax, esi
xor ecx, ecx
and edi, 0xfc00
mov word [eax], cx
xor eax, eax
cmp ax, di
je 0x100222dc
push 9
lea eax, [ebp - 0x18]
push eax
push 0x5a
push ebx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
cmp eax, 1
jle 0x100222dc
dec eax
mov ecx, esi
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.10002790
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10041ad4
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10041ad4
mov esp, ebp
pop ebp
ret
Function at 0x10023bf0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
mov eax, dword [0x1010b520]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x40], 0
je 0x10023d4f
cmp byte [ebx + 0x45], 0
je 0x10023d4f
mov eax, dword [ebx]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x10023c3d
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.10041ad4
mov esp, ebp
pop ebp
ret
mov ecx, 0xf
mov byte [esp + 0x14], 0
xorps xmm0, xmm0
mov dword [esp + 0x28], ecx
cmp ecx, 0x10
movq qword [esp + 0x14], xmm0
lea eax, [esp + 0x14]
mov dword [esp + 0x24], 8
cmovae eax, dword [esp + 0x14]
mov byte [eax + 8], 0
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x28]
cmp ecx, 0x10
lea eax, [esp + 0x10]
mov ecx, dword [ebx + 0x40]
lea edi, [esp + 0x14]
push eax
mov eax, dword [esp + 0x28]
lea esi, [esp + 0x18]
cmovae edi, edx
cmovae esi, edx
mov edx, dword [ecx]
add eax, edi
push eax
push esi
lea eax, [ebx + 0x48]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x10023cce
dec eax
je 0x10023cd2
sub eax, 2
je 0x10023d30
lea ecx, [esp + 0x14]
xor bl, bl
call fcn.10002040
mov al, bl
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.10041ad4
mov esp, ebp
pop ebp
ret
mov byte [ebx + 0x45], 0
mov ecx, dword [esp + 0x28]
lea eax, [esp + 0x14]
mov edx, dword [esp + 0x14]
cmp ecx, 0x10
mov esi, dword [esp + 0x10]
cmovae eax, edx
sub esi, eax
je 0x10023d11
push dword [ebx + 0x50]
cmp ecx, 0x10
lea eax, [esp + 0x18]
push esi
cmovae eax, edx
push 1
push eax
call fcn.10045a05
add esp, 0x10
cmp esi, eax
jne 0x10023caf
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x14]
cmp byte [ebx + 0x45], 0
je 0x10023d30
test esi, esi
jne 0x10023c74
push esi
push 8
lea ecx, [esp + 0x1c]
call fcn.1000b910
jmp 0x10023c6c
lea ecx, [esp + 0x14]
mov bl, 1
call fcn.10002040
mov al, bl
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.10041ad4
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x2c]
mov al, 1
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10041ad4
mov esp, ebp
pop ebp
ret

Function at 0x10027d20
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 8
mov dword [esp + 4], 0
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
cmp eax, 0xffffffff
je 0x10027d45
mov esp, ebp
pop ebp
ret
call fcn.1001fee0
int3

Function at 0x10028480
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 8
mov eax, dword [0x1030f3f4]
mov dword [esp + 4], 0
test eax, 0xfffffffe
jne 0x100284e1
push 0x1030f3f4
call fcn.1001d2b0
add esp, 4
test al, al
je 0x100284e1
mov dword [0x1030f3f8], 0
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x1030f3f8], eax
cmp eax, 0xffffffff
je 0x100284ea
push 0
push 0x1030f3f4
push 0x1030f3f8
push 0x1030f3f4
call fcn.1001d300
add esp, 0x10
mov eax, dword [0x1030f3f4]
mov esp, ebp
pop ebp
ret
call fcn.1001fee0
int3
Function at 0x10029b00
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [ecx]
mov ecx, dword [ecx + 4]
sub ecx, edi
sar ecx, 2
test ecx, ecx
je 0x10029b6e
push ebx
push esi
mov ebx, ecx
mov eax, dword [edi]
lea edi, [edi + 4]
movzx esi, cl
movzx edx, al
xor esi, edx
shr ecx, 8
mov dword [ebp - 4], eax
movzx eax, ah
xor ecx, dword [esi*4 + 0x100f3300]
movzx edx, cl
xor edx, eax
shr ecx, 8
movzx eax, byte [ebp - 2]
xor ecx, dword [edx*4 + 0x100f3300]
movzx edx, cl
xor edx, eax
shr ecx, 8
movzx eax, byte [ebp - 1]
xor ecx, dword [edx*4 + 0x100f3300]
movzx edx, cl
xor edx, eax
shr ecx, 8
xor ecx, dword [edx*4 + 0x100f3300]
dec ebx
jne 0x10029b17
pop esi
pop ebx
mov eax, ecx
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x1002b700
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x40c
mov eax, dword [0x1010b520]
xor eax, esp
mov dword [esp + 0x408], eax
push ebx
mov ebx, dword [0x1010cb68]
mov dword [esp + 4], 0
mov dword [esp + 4], ebx
push esi
push edi
cmp ebx, 0xffffffff
jne 0x1002b76d
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov ebx, eax
mov dword [esp + 0xc], ebx
cmp ebx, 0xffffffff
je 0x1002b7d2
mov ecx, ebx
mov edx, 0x1010cb68
or eax, 0xffffffff
lock cmpxchg dword [edx], ecx
cmp eax, 0xffffffff
je 0x1002b76d
push ebx
call dword [sym.imp.KERNEL32.dll_TlsFree]
mov ebx, dword [0x1010cb68]
mov dword [esp + 0xc], ebx
push ebx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0x1002b7d2
push 0x400
push eax
lea eax, [esp + 0x18]
push eax
call fcn.100438b0
add esp, 0xc
lea eax, [esp + 0x10]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, 0x400
call fcn.1002fe00
mov ebx, eax
lea esi, [esp + 0x10]
push ebx
push dword [esp + 0x10]
mov ecx, 0x100
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [esp + 0x414]
mov eax, ebx
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10041ad4
mov esp, ebp
pop ebp
ret
call fcn.1001fee0
int3
Function at 0x1002b7e0
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x40c
mov eax, dword [0x1010b520]
xor eax, esp
mov dword [esp + 0x408], eax
mov eax, dword [0x1010cb68]
push ebx
push esi
mov ebx, ecx
mov dword [esp + 8], 0
push edi
mov ecx, 0x100
mov dword [esp + 0xc], eax
mov esi, ebx
lea edi, [esp + 0x10]
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x10]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [0x10310174]
test eax, eax
je 0x1002b849
dec eax
cmp eax, 1
ja 0x1002b850
push ebx
push 0
push dword [0x10310170]
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1002b850
mov ecx, ebx
call fcn.1002f460
mov edi, 0x100
mov esi, dword [0x1030fd54]
xor dl, dl
test esi, esi
jle 0x1002b889
mov ecx, dword [esp + esi*4 + 0x10]
test ecx, ecx
je 0x1002b884
mov eax, dword [esi*4 + 0x1030fd60]
test eax, eax
je 0x1002b884
push ecx
mov dword [esp + esi*4 + 0x14], 0
call eax
add esp, 4
mov dl, 1
dec esi
test esi, esi
jg 0x1002b861
dec edi
test edi, edi
jle 0x1002b892
test dl, dl
jne 0x1002b855
push 0
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [esp + 0x414]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10041ad4
mov esp, ebp
pop ebp
ret
Function at 0x1002edb0
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [0x10310164]
mov edx, eax
push esi
inc eax
mov dword [0x10310164], eax
push edi
mov edi, ecx
test edx, edx
jne 0x1002ef20
lea ecx, [edx + 1]
cmp dword [0x10310168], edx
je 0x1002ede1
call fcn.1002f8c0
jmp 0x1002ede6
call fcn.1002f300
mov esi, eax
mov eax, dword [0x1010cb80]
test eax, eax
je 0x1002edfd
mov edx, 1
mov ecx, esi
call fcn.100312a0
mov eax, dword [0x10310178]
test eax, eax
je 0x1002ee0e
push 1
push esi
call eax
add esp, 8
mov eax, dword [0x10310180]
test eax, eax
je 0x1002ee1e
mov ecx, esi
call fcn.10031320
mov eax, dword [0x1031017c]
test eax, eax
je 0x1002ee2d
push esi
call eax
add esp, 4
mov ecx, esi
call fcn.1002f460
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov ecx, 0x100328e0
test ecx, ecx
je 0x1002ee52
mov dword [0x1031f104], 0x100328e0
mov dword [0x1031f108], eax
cmp eax, 0xffffffff
je 0x1002ee5e
mov dword [0x103122f8], eax
jmp 0x1002ee64
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [0x10310168], 0
mov ecx, 1
mov byte [0x1030fd4a], 1
je 0x1002ee80
call fcn.1002f8c0
jmp 0x1002ee85
call fcn.1002f300
mov esi, eax
mov eax, dword [0x1010cb80]
test eax, eax
je 0x1002ee9c
mov edx, 1
mov ecx, esi
call fcn.100312a0
mov eax, dword [0x10310178]
test eax, eax
je 0x1002eead
push 1
push esi
call eax
add esp, 8
mov eax, dword [0x10310180]
test eax, eax
je 0x1002eebd
mov ecx, esi
call fcn.10031320
mov eax, dword [0x1031017c]
test eax, eax
je 0x1002eecc
push esi
call eax
add esp, 4
mov ecx, esi
call fcn.1002f460
call fcn.1005db27
test eax, eax
jne 0x1002ef20
lea ecx, [eax + 8]
call fcn.1002fe00
mov esi, eax
test esi, esi
je 0x1002eef9
mov dword [esi], 0x10106298
mov dword [esi + 4], 0
jmp 0x1002eefb
xor esi, esi
mov edx, 0x10034e20
mov ecx, 0x103122fc
call fcn.10031700
call fcn.1005db27
mov ecx, dword [0x10316310]
test eax, eax
cmove ecx, esi
mov dword [0x10316310], ecx
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1002f300
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor edi, edi
mov ebx, ecx
cmp byte [0x1030fd4a], 0
jne 0x1002f31b
call fcn.100326e0
jmp 0x1002f345
mov esi, dword [0x103122f8]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x1002f341
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
jne 0x1002f34c
call fcn.10032770
mov esi, eax
cmp ebx, 0x8000
ja 0x1002f3ec
cmp ebx, 0x400
mov ecx, 0x3c7f
mov edx, 7
setg al
test al, al
cmovne edx, ecx
xor ecx, ecx
add edx, ebx
test al, al
setne cl
lea ecx, [ecx*4 + 3]
sar edx, cl
movzx ecx, byte [edx + 0x10316558]
mov edi, dword [ecx*4 + 0x103166d4]
add dword [esi + 0x10], edi
cmp dword [0x103102dc], 0
jl 0x1002f3c7
jg 0x1002f3a7
cmp dword [0x103102d8], 0
jbe 0x1002f3c7
mov eax, dword [esi + 0x18]
cmp eax, edi
jae 0x1002f3c2
lea ecx, [esi + 0x18]
call fcn.10032030
mov ecx, edi
mov dword [esi + 0x18], eax
call fcn.1002ef40
jmp 0x1002f3fd
sub eax, edi
mov dword [esi + 0x18], eax
lea eax, [ecx + ecx*2]
cmp dword [esi + eax*4 + 0x28], 0
lea eax, [esi + eax*4]
jne 0x1002f3df
push edi
push ecx
mov ecx, esi
call fcn.10032340
jmp 0x1002f3fd
sub dword [esi + 8], edi
lea ecx, [eax + 0x28]
call fcn.1002cb90
jmp 0x1002f3fd
cmp ebx, 0x7fffefff
ja 0x1002f403
mov edx, ebx
mov ecx, esi
call fcn.1002f1d0
mov edi, eax
test edi, edi
jne 0x1002f40e
call fcn.1004688e
mov dword [eax], 0xc
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret