joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4042bb
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x41207c]
jne 0x4042c5
repz ret
jmp fcn.00405285

Function at 0x40b84b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41207c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00407daf
and dword [ebp - 0x14], 0
cmp dword [0x413c54], 0
mov dword [ebp - 0x18], eax
jne 0x40b8fe
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x40b9a6
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x40b9a6
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x413c54], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x413c58], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x413c5c], eax
call edi
push eax
call esi
mov dword [0x413c64], eax
test eax, eax
je 0x40b8fe
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x413c60], eax
mov eax, dword [0x413c60]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x40b957
cmp dword [0x413c64], ecx
je 0x40b957
push eax
call esi
push dword [0x413c64]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x40b957
test ebx, ebx
je 0x40b957
call edi
test eax, eax
je 0x40b94e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40b94e
test byte [ebp - 8], 1
jne 0x40b957
or dword [ebp + 0x10], 0x200000
jmp 0x40b98a
mov eax, dword [0x413c58]
cmp eax, dword [ebp - 0x18]
je 0x40b98a
push eax
call esi
test eax, eax
je 0x40b98a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40b98a
mov eax, dword [0x413c5c]
cmp eax, dword [ebp - 0x18]
je 0x40b98a
push eax
call esi
test eax, eax
je 0x40b98a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x413c54]
call esi
test eax, eax
je 0x40b9a6
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x40b9a8
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004042bb
leave
ret
Function at 0x403200
Capabilities:
Enumerate gui resources
Get disk information

Disassembly:
mov eax, dword [0x2b8167c]
mov ecx, dword [0x2b7e588]
sub esp, 0x824
push ebx
push ebp
shr eax, 3
push esi
push edi
test eax, eax
jbe 0x4032f5
mov esi, dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, dword [sym.imp.KERNEL32.dll_FindNextVolumeW]
mov ebx, dword [sym.imp.KERNEL32.dll_WriteProfileSectionW]
mov ebp, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], eax
cmp dword [0x2b8167c], 0x959
jne 0x4032db
call esi
push 0
lea eax, [esp + 0x34]
push eax
push 0
call edi
push 0
push 0
call ebx
push 0
call ebp
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoExA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesA]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_AddConsoleAliasA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteProfileSectionA]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesA]
xor eax, eax
lea ecx, [esp + 0x1c]
push ecx
push eax
push eax
push eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
call dword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_BeginUpdateResourceA]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenEventA]
mov edx, dword [esp + 0x14]
push edx
call fcn.00403040
add dword [esp + 0x14], 8
sub dword [esp + 0x18], 1
jne 0x403240
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x824
ret
Function at 0x408d80
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42ac30]
jne 0x408d8a
repz ret
jmp fcn.0040b89c

Function at 0x40b067
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00405217
and dword [ebp - 4], 0
cmp dword [0x42bfc4], 0
mov ebx, eax
jne 0x40b118
push 0x402ac4
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40b1c9
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x402ab8
push edi
call esi
test eax, eax
je 0x40b1c9
push eax
call fcn.004051a5
mov dword [esp], 0x402aa8
push edi
mov dword [0x42bfc4], eax
call esi
push eax
call fcn.004051a5
mov dword [esp], 0x402a94
push edi
mov dword [0x42bfc8], eax
call esi
push eax
call fcn.004051a5
mov dword [esp], 0x402a78
push edi
mov dword [0x42bfcc], eax
call esi
push eax
call fcn.004051a5
pop ecx
mov dword [0x42bfd4], eax
test eax, eax
je 0x40b118
push 0x402a60
push edi
call esi
push eax
call fcn.004051a5
pop ecx
mov dword [0x42bfd0], eax
mov eax, dword [0x42bfd0]
cmp eax, ebx
je 0x40b170
cmp dword [0x42bfd4], ebx
je 0x40b170
push eax
call fcn.00405220
push dword [0x42bfd4]
mov esi, eax
call fcn.00405220
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40b170
test edi, edi
je 0x40b170
call esi
test eax, eax
je 0x40b167
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40b167
test byte [ebp - 0xc], 1
jne 0x40b170
or dword [ebp + 0x10], 0x200000
jmp 0x40b1a9
mov eax, dword [0x42bfc8]
cmp eax, ebx
je 0x40b1a9
push eax
call fcn.00405220
pop ecx
test eax, eax
je 0x40b1a9
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40b1a9
mov eax, dword [0x42bfcc]
cmp eax, ebx
je 0x40b1a9
push eax
call fcn.00405220
pop ecx
test eax, eax
je 0x40b1a9
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x42bfc4]
call fcn.00405220
pop ecx
test eax, eax
je 0x40b1c9
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40b1cb
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x42e003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
call 0x42e00c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x403ac5
sub eax, 0x403a6b
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x42e030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x42e01e
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp fcn.00401219
Function at 0x1000177c
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x30
mov esi, dword [0x1005c044]
test esi, esi
je 0x10001826
dec esi
push esi
call sub.KERNEL32.dll_TlsGetValue
mov edi, eax
cmp eax, 1
ja 0x1000181c
je 0x1000181a
xorps xmm0, xmm0
lea edi, [esp + 0x10]
movaps xmmword [edi], xmm0
push 0x10
push edi
call dword [sym.imp.bcryptprimitives.dll_ProcessPrng]
mov eax, dword [edi]
mov ebx, dword [edi + 8]
mov dword [esp + 8], eax
mov eax, dword [edi + 4]
mov dword [esp + 4], eax
mov eax, dword [edi + 0xc]
mov dword [esp + 0xc], eax
push 8
pop ecx
push 0x18
pop edx
call fcn.100024bb
test eax, eax
je 0x10001837
mov edi, eax
mov eax, dword [esp + 8]
mov dword [edi], eax
mov eax, dword [esp + 4]
mov dword [edi + 4], eax
mov eax, dword [esp + 0xc]
mov dword [edi + 8], ebx
mov dword [edi + 0xc], eax
mov dword [edi + 0x10], esi
push esi
call sub.KERNEL32.dll_TlsGetValue
mov ebx, eax
push edi
push esi
call sub.KERNEL32.dll_TlsSetValue
test ebx, ebx
je 0x1000181c
push 8
pop edx
mov ecx, ebx
call fcn.10006c20
jmp 0x1000181c
xor edi, edi
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, 0x1005c044
call fcn.10015a00
mov esi, eax
jmp 0x10001797
push 8
pop ecx
push 0x18
pop edx
call fcn.10007010
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
xor edx, edx
mov edi, str.attempt_to_add_with_overflow
inc edx
mov ebx, dword [ecx + 0x1c]
mov eax, dword [eax]
and ebx, 1
mov esi, dword [eax + 4]
cmove edi, edx
mov edx, dword [eax]
mov eax, dword [eax + 8]
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], edx
or edx, esi
je 0x1000188d
mov edx, dword [ebp - 0x10]
push 1
push 0x1007c31a
push ebx
push edi
push 0x5f5e100
push eax
push dword [ebp - 0x14]
jmp 0x100018e4
cmp eax, 0xf423f
jbe 0x100018b1
mov esi, 0xf4240
xor edx, edx
div esi
mov esi, edx
mov edx, eax
push 2
push 0x100797fd
push ebx
push edi
push 0x186a0
jmp 0x100018d0
cmp eax, 0x3e7
jbe 0x100018d3
mov esi, 0x3e8
xor edx, edx
div esi
mov esi, edx
mov edx, eax
push 3
push 0x100797fa
push ebx
push edi
push 0x64
push esi
jmp 0x100018e2
mov edx, eax
push 2
push str.nssmslibrarycore_src_time.rs
push ebx
push edi
push 1
push 0
push 0
call fcn.1000ad90
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x10006bcf
Capabilities:
Delete file
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.100031b9
Function at 0x1000a0f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, ecx
xor edx, edx
mov esi, 0x21
mov edi, 0x21
shl eax, 0xb
nop word [eax + eax]
shr esi, 1
add esi, edx
mov ebx, dword [esi*4 + 0x10079ee8]
shl ebx, 0xb
cmp ebx, eax
je 0x1000a135
cmp ebx, eax
cmova edi, esi
lea esi, [esi + 1]
cmovb edx, esi
mov esi, edi
sub esi, edx
ja 0x1000a110
jmp 0x1000a138
inc esi
mov edx, esi
cmp edx, 0x20
ja 0x1000a1c4
mov eax, dword [edx*4 + 0x10079ee8]
mov esi, 0x2d7
shr eax, 0x15
cmp edx, 0x20
je 0x1000a163
mov esi, dword [edx*4 + 0x10079eec]
shr esi, 0x15
test edx, edx
je 0x1000a1af
mov edi, 0x1fffff
and edi, dword [edx*4 + 0x10079ee4]
mov edx, eax
not edx
add edx, esi
je 0x1000a1a8
sub ecx, edi
cmp eax, 0x2d8
mov edx, 0x2d7
cmovae edx, eax
dec esi
xor edi, edi
nop dword [eax]
cmp edx, eax
je 0x1000a1b3
movzx ebx, byte [eax + 0x10079f6c]
add edi, ebx
cmp edi, ecx
ja 0x1000a1a8
inc eax
cmp esi, eax
jne 0x1000a190
mov eax, esi
and al, 1
pop esi
pop edi
pop ebx
pop ebp
ret
xor edi, edi
jmp 0x1000a16f
mov ecx, edx
mov edx, 0x2d7
push 0x10079e70
call fcn.10007930
mov ecx, 0x21
mov edx, 0x21
push 0x10079e60
call fcn.10007930
nop dword [eax + eax]

Function at 0x1000a1e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0x14]
xor esi, esi
lea eax, [edx + eax*2]
mov dword [ebp - 0x10], eax
movzx eax, byte [edx + 1]
cmp byte [edx], ch
lea edx, [edx + 2]
lea edi, [esi + eax]
jne 0x1000a230
cmp edi, esi
jb 0x1000a29b
cmp edi, dword [ebp + 0x10]
ja 0x1000a2a9
add esi, dword [ebp + 0xc]
nop word [eax + eax]
test eax, eax
je 0x1000a232
dec eax
cmp byte [esi], cl
lea esi, [esi + 1]
jne 0x1000a220
jmp 0x1000a28f
ja 0x1000a239
cmp edx, dword [ebp - 0x10]
mov esi, edi
jne 0x1000a1f5
mov edi, dword [ebp + 0x18]
movzx ecx, cx
mov al, 1
add edi, ebx
nop word cs:[eax + eax]
nop dword [eax]
movzx edx, byte [ebx]
lea esi, [ebx + 1]
test dl, dl
js 0x1000a270
mov ebx, esi
sub ecx, edx
jns 0x1000a287
jmp 0x1000a291
cmp esi, edi
je 0x1000a2b8
movzx esi, byte [ebx + 1]
and edx, 0x7f
add ebx, 2
shl edx, 8
or edx, esi
sub ecx, edx
js 0x1000a291
xor al, 1
cmp ebx, edi
jne 0x1000a250
jmp 0x1000a291
xor eax, eax
and al, 1
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, esi
mov edx, edi
push 0x100798ac
call fcn.10009010
mov edx, dword [ebp + 0x10]
mov ecx, edi
push 0x100798ac
call fcn.10007fd0
mov ecx, 0x1007989c
call fcn.10009070
nop word cs:[eax + eax]
nop dword [eax]
Function at 0x10014ee0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x34
mov eax, dword [ebp + 8]
mov esi, ecx
mov ecx, dword [ebp + 0xc]
mov edi, edx
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0x103
lea edx, [ebp - 0x18]
push 0
push 0
push ecx
push eax
push edx
push 0
push 0
push 0
push edi
call sub.ntdll.dll_NtWriteFile
cmp eax, 0x103
jne 0x10014f30
push 0xffffffffffffffff
push edi
call sub.KERNEL32.dll_WaitForSingleObject
mov eax, dword [ebp - 0x18]
cmp eax, 0x103
je 0x10014f50
test eax, eax
js 0x10014f3b
mov eax, dword [ebp - 0x14]
mov bl, 4
jmp 0x10014f43
xor ebx, ebx
push eax
call sub.ntdll.dll_RtlNtStatusToDosError
mov dword [esi + 4], eax
mov byte [esi], bl
add esp, 0x34
pop esi
pop edi
pop ebx
pop ebp
ret
lea eax, [ebp - 0x10]
mov dword [ebp - 0x38], 0x1007cb2c
mov dword [ebp - 0x34], 1
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x20], 0
mov byte [ebp - 0x1c], 0
lea ecx, [ebp - 0x20]
lea esi, [ebp - 0x40]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x38]
mov dword [ebp - 0x2c], 0
push eax
push ecx
push esi
call fcn.10014770
add esp, 0xc
mov ecx, esi
call fcn.10014880
mov ecx, 7
int 0x29
ud2
Function at 0x10015790
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, dword [0x1005c054]
mov edi, ecx
test esi, esi
je 0x10015834
dec esi
push esi
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
ja 0x1001582c
je 0x100157de
test edi, edi
je 0x100157e2
mov eax, dword [edi]
xor ecx, ecx
mov ebx, 0
mov dword [edi], 0
or eax, dword [edi + 4]
mov dword [edi + 4], 0
je 0x100157da
mov ecx, dword [edi + 0xc]
mov ebx, dword [edi + 8]
mov edi, ecx
jmp 0x100157e6
xor eax, eax
jmp 0x1001582c
xor ebx, ebx
xor edi, edi
movzx eax, byte [0x1008b0d4]
xor ecx, ecx
mov edx, 0x10
call fcn.10045ab0
test eax, eax
je 0x10015845
mov dword [eax], ebx
mov dword [eax + 4], edi
mov dword [eax + 8], esi
push esi
mov ebx, eax
call sub.KERNEL32.dll_TlsGetValue
mov edi, eax
mov dword [ebp - 0x10], ebx
push ebx
push esi
call sub.KERNEL32.dll_TlsSetValue
test edi, edi
je 0x10015829
mov ecx, edi
mov edx, 8
call fcn.10006c20
mov eax, dword [ebp - 0x10]
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, 0x1005c054
call fcn.10015a00
mov esi, eax
jmp 0x100157a8
mov ecx, 8
mov edx, 0x10
call fcn.10007010
nop word cs:[eax + eax]
nop

Function at 0x10015860
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, dword [0x1005c064]
test esi, esi
je 0x100158e4
dec esi
push esi
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
ja 0x100158dc
je 0x100158da
movzx eax, byte [0x1008b0d4]
xor ecx, ecx
mov edx, 8
call fcn.10045ab0
test eax, eax
je 0x100158f2
mov dword [eax], 0
mov dword [eax + 4], esi
push esi
mov ebx, eax
call sub.KERNEL32.dll_TlsGetValue
mov edi, eax
mov dword [ebp - 0x10], ebx
push ebx
push esi
call sub.KERNEL32.dll_TlsSetValue
test edi, edi
je 0x100158d5
mov eax, dword [edi]
test eax, eax
je 0x100158c9
lock dec dword [eax]
jne 0x100158c9
mov ecx, dword [edi]
call fcn.100142a0
mov ecx, edi
mov edx, 4
call fcn.10006c20
mov eax, dword [ebp - 0x10]
jmp 0x100158dc
xor eax, eax
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, 0x1005c064
call fcn.10015a00
mov esi, eax
jmp 0x10015872
mov ecx, 4
mov edx, 8
call fcn.10007010
nop word cs:[eax + eax]
nop dword [eax + eax]
Function at 0x10015a00
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
cmp dword [ecx + 4], 0
mov esi, ecx
je 0x10015a6e
lea ebx, [esi + 0xc]
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x14]
push 0
push eax
push 0
push ebx
call sub.KERNEL32.dll_InitOnceBeginInitialize
cmp eax, 1
mov dword [ebp - 0x30], eax
jne 0x10015aa4
cmp dword [ebp - 0x14], 0
je 0x10015a8b
call sub.KERNEL32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x10015ab6
mov edi, eax
mov eax, dword [entry1]
mov eax, dword [0x1008b0a4]
nop dword [eax]
mov dword [esi + 8], eax
lock cmpxchg dword [0x1008b0a4], esi
jne 0x10015a50
mov eax, edi
inc eax
mov dword [esi], eax
push 0
push 0
push ebx
call sub.KERNEL32.dll_InitOnceComplete
jmp 0x10015a9a
call sub.KERNEL32.dll_TlsAlloc
cmp eax, 0xffffffff
mov dword [ebp - 0x10], eax
je 0x10015af0
mov ecx, eax
xor eax, eax
inc ecx
lock cmpxchg dword [esi], ecx
jne 0x10015a8f
mov edi, dword [ebp - 0x10]
jmp 0x10015a9a
mov edi, dword [esi]
jmp 0x10015a99
mov edi, eax
push dword [ebp - 0x10]
call sub.KERNEL32.dll_TlsFree
dec edi
mov eax, edi
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
lea ecx, [ebp - 0x30]
lea edx, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0
call 0x10015b20
push 0
push 4
push ebx
call sub.KERNEL32.dll_InitOnceComplete
lea ecx, [ebp - 0x2c]
mov edx, 0x1007d35c
mov dword [ebp - 0x2c], 0x1007d324
mov dword [ebp - 0x28], 1
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x24], 4
mov dword [ebp - 0x20], 0
call fcn.10007890
lea ecx, [ebp - 0x10]
lea edx, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0x1007d324
mov dword [ebp - 0x28], 1
mov dword [ebp - 0x24], 4
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
call 0x10015b60
nop
push ebp
mov ebp, esp
push esi
sub esp, 8
mov eax, edx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], 0x1007ccb0
lea esi, [ebp - 0xc]
lea edx, [ebp - 8]
xor ecx, ecx
push 0x1007d36c
push eax
push 0x1007b078
push esi
push 0x1007b078
call fcn.10008270
nop word cs:[eax + eax]
nop dword [eax + eax]
push ebp
mov ebp, esp
push esi
sub esp, 8
mov eax, edx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], 0x1007d37c
lea esi, [ebp - 0xc]
lea edx, [ebp - 8]
mov ecx, 1
push 0x1007d380
push eax
push 0x1007b068
push esi
push 0x1007b068
call fcn.10008270
nop word cs:[eax + eax]
nop
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov ecx, dword [edx + 0x1c]
mov eax, dword [eax]
test cl, 0x10
jne 0x10015bc4
test cl, 0x20
jne 0x10015bcd
push edx
push eax
call fcn.10007990
add esp, 8
pop ebp
ret
mov ecx, dword [eax]
call fcn.100091d0
pop ebp
ret
mov ecx, dword [eax]
call fcn.1000b880
pop ebp
ret
Function at 0x10015be0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov eax, dword [ebp + 0xc]
cmp eax, 3
je 0x10015bf7
test eax, eax
jne 0x10015d5e
mov al, 1
mov dword [ebp - 0x10], eax
mov esi, dword [0x1008b0a4]
nop word cs:[eax + eax]
nop dword [eax]
test esi, esi
je 0x10015c4c
mov ebx, dword [esi]
mov edi, dword [esi + 4]
test edi, edi
je 0x10015da1
mov esi, dword [esi + 8]
test ebx, ebx
je 0x10015c10
dec ebx
push ebx
call sub.KERNEL32.dll_TlsGetValue
test eax, eax
je 0x10015c10
push 0
push ebx
mov ebx, eax
call sub.KERNEL32.dll_TlsSetValue
push ebx
call edi
add esp, 4
mov dword [ebp - 0x10], 0
jmp 0x10015c10
test byte [ebp - 0x10], 1
jne 0x10015d5e
mov al, 1
mov dword [ebp - 0x10], eax
mov esi, dword [0x1008b0a4]
nop word cs:[eax + eax]
nop dword [eax + eax]
test esi, esi
je 0x10015cac
mov ebx, dword [esi]
mov edi, dword [esi + 4]
test edi, edi
je 0x10015da1
mov esi, dword [esi + 8]
test ebx, ebx
je 0x10015c70
dec ebx
push ebx
call sub.KERNEL32.dll_TlsGetValue
test eax, eax
je 0x10015c70
push 0
push ebx
mov ebx, eax
call sub.KERNEL32.dll_TlsSetValue
push ebx
call edi
add esp, 4
mov dword [ebp - 0x10], 0
jmp 0x10015c70
test byte [ebp - 0x10], 1
jne 0x10015d5e
mov al, 1
mov dword [ebp - 0x10], eax
mov esi, dword [0x1008b0a4]
nop word cs:[eax + eax]
nop dword [eax + eax]
test esi, esi
je 0x10015d0c
mov ebx, dword [esi]
mov edi, dword [esi + 4]
test edi, edi
je 0x10015da1
mov esi, dword [esi + 8]
test ebx, ebx
je 0x10015cd0
dec ebx
push ebx
call sub.KERNEL32.dll_TlsGetValue
test eax, eax
je 0x10015cd0
push 0
push ebx
mov ebx, eax
call sub.KERNEL32.dll_TlsSetValue
push ebx
call edi
add esp, 4
mov dword [ebp - 0x10], 0
jmp 0x10015cd0
test byte [ebp - 0x10], 1
jne 0x10015d5e
mov al, 1
mov dword [ebp - 0x10], eax
mov esi, dword [0x1008b0a4]
nop dword [eax]
test esi, esi
je 0x10015d58
mov ebx, dword [esi]
mov edi, dword [esi + 4]
test edi, edi
je 0x10015da1
mov esi, dword [esi + 8]
test ebx, ebx
je 0x10015d20
dec ebx
push ebx
call sub.KERNEL32.dll_TlsGetValue
test eax, eax
je 0x10015d20
push 0
push ebx
mov ebx, eax
call sub.KERNEL32.dll_TlsSetValue
push ebx
call edi
add esp, 4
mov dword [ebp - 0x10], 0
jmp 0x10015d20
test byte [ebp - 0x10], 1
je 0x10015d68
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
mov edi, dword [0x1008b0a4]
nop
test edi, edi
je 0x10015d5e
mov esi, dword [edi]
mov ebx, dword [edi + 4]
test ebx, ebx
je 0x10015da1
mov edi, dword [edi + 8]
test esi, esi
je 0x10015d70
dec esi
push esi
call sub.KERNEL32.dll_TlsGetValue
test eax, eax
je 0x10015d70
push 0
push esi
mov esi, eax
call sub.KERNEL32.dll_TlsSetValue
push esi
call ebx
add esp, 4
jmp 0x10015d70
mov ecx, 0x1007d390
call fcn.10009070
ud2
Function at 0x10016000
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, dword [0x1005c024]
test esi, esi
je 0x10016076
dec esi
push esi
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
ja 0x1001606e
je 0x1001606c
movzx eax, byte [0x1008b0d4]
xor ecx, ecx
mov edx, 0xc
call fcn.10045ab0
test eax, eax
je 0x10016084
mov dword [eax], 0
mov byte [eax + 4], 0
mov dword [eax + 8], esi
push esi
mov ebx, eax
call sub.KERNEL32.dll_TlsGetValue
mov edi, eax
mov dword [ebp - 0x10], ebx
push ebx
push esi
call sub.KERNEL32.dll_TlsSetValue
test edi, edi
je 0x10016067
mov ecx, edi
mov edx, 4
call fcn.10006c20
mov eax, dword [ebp - 0x10]
jmp 0x1001606e
xor eax, eax
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, 0x1005c024
call fcn.10015a00
mov esi, eax
jmp 0x10016012
mov ecx, 4
mov edx, 0xc
call fcn.10007010
nop word cs:[eax + eax]
nop dword [eax]
push ebp
mov ebp, esp
push edi
push esi
mov esi, dword [ebp + 8]
mov edi, dword [esi + 8]
push 1
push edi
call sub.KERNEL32.dll_TlsSetValue
mov ecx, esi
mov edx, 4
call fcn.10006c20
push 0
push edi
call sub.KERNEL32.dll_TlsSetValue
pop esi
pop edi
pop ebp
ret