joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002e410
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
push dword [0x100db8a4]
mov esi, dword [edi + 0x24]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, esi
jne 0x1002e43e
push 0x65b
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
xor eax, eax
pop esi
pop ebp
ret 0x10
push ebx
lea ebx, [edi + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [edi + 8]
test ecx, ecx
jne 0x1002e468
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 6
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop ebx
pop edi
xor eax, eax
pop esi
pop ebp
ret 0x10
mov eax, dword [ecx]
call dword [eax + 0x38]
mov ecx, dword [ebp + 0xc]
cmp ecx, 0x25
jae 0x1002e4ac
mov eax, dword [edi + 8]
mov ecx, dword [eax + ecx*4 + 0xa0]
test ecx, ecx
je 0x1002e4ac
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.10012fe0
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
test esi, esi
pop ebx
pop edi
sete al
pop esi
pop ebp
ret 0x10
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop ebx
pop edi
xor eax, eax
pop esi
pop ebp
ret 0x10

Function at 0x1002e4d0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
push dword [0x100db8a4]
mov esi, dword [edi + 0x24]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, esi
jne 0x1002e4fe
push 0x65b
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
xor eax, eax
pop esi
pop ebp
ret 8
lea esi, [edi + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [edi + 8]
test ecx, ecx
jne 0x1002e526
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 6
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
xor eax, eax
pop esi
pop ebp
ret 8
mov eax, dword [ecx]
call dword [eax + 0x38]
mov ecx, dword [ebp + 0xc]
cmp ecx, 0x25
jae 0x1002e560
mov eax, dword [edi + 8]
mov ecx, dword [eax + ecx*4 + 0xa0]
test ecx, ecx
je 0x1002e560
call fcn.10013280
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
mov eax, 1
pop esi
pop ebp
ret 8
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
xor eax, eax
pop esi
pop ebp
ret 8
Function at 0x1002e580
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
push dword [0x100db8a4]
mov esi, dword [edi + 0x24]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, esi
jne 0x1002e5ae
push 0x65b
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
xor eax, eax
pop esi
pop ebp
ret 8
lea esi, [edi + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [edi + 8]
test ecx, ecx
jne 0x1002e5d6
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 6
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
xor eax, eax
pop esi
pop ebp
ret 8
mov eax, dword [ecx]
call dword [eax + 0x38]
mov ecx, dword [ebp + 0xc]
cmp ecx, 0x25
jae 0x1002e610
mov eax, dword [edi + 8]
mov ecx, dword [eax + ecx*4 + 0xa0]
test ecx, ecx
je 0x1002e610
call fcn.100132d0
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
mov eax, 1
pop esi
pop ebp
ret 8
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
xor eax, eax
pop esi
pop ebp
ret 8

Function at 0x1002e630
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
push dword [0x100db8a4]
mov esi, dword [edi + 0x24]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, esi
jne 0x1002e65e
push 0x65b
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
xor eax, eax
pop esi
pop ebp
ret 8
push ebx
lea ebx, [edi + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [edi + 8]
test ecx, ecx
jne 0x1002e688
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 6
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop ebx
pop edi
xor eax, eax
pop esi
pop ebp
ret 8
mov eax, dword [ecx]
call dword [eax + 0x38]
push dword [ebp + 0xc]
mov ecx, dword [edi + 8]
call fcn.1001f920
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
test esi, esi
pop ebx
pop edi
sete al
pop esi
pop ebp
ret 8
Function at 0x1002e6c0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
push dword [0x100db8a4]
mov esi, dword [edi + 0x24]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, esi
jne 0x1002e6ee
push 0x65b
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
xor eax, eax
pop esi
pop ebp
ret 8
lea esi, [edi + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [edi + 8]
test ecx, ecx
jne 0x1002e716
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 6
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
xor eax, eax
pop esi
pop ebp
ret 8
mov eax, dword [ecx]
call dword [eax + 0x38]
mov ecx, dword [ebp + 0xc]
push esi
test ecx, ecx
jne 0x1002e739
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
xor eax, eax
pop esi
pop ebp
ret 8
mov eax, dword [edi + 8]
mov eax, dword [eax + 0x36c]
mov dword [ecx], eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
mov eax, 1
pop esi
pop ebp
ret 8

Function at 0x1002e760
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
push dword [0x100db8a4]
mov esi, dword [edi + 0x24]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, esi
jne 0x1002e78e
push 0x65b
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
xor eax, eax
pop esi
pop ebp
ret 8
push ebx
lea ebx, [edi + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [edi + 8]
test ecx, ecx
jne 0x1002e7b8
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 6
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop ebx
pop edi
xor eax, eax
pop esi
pop ebp
ret 8
mov eax, dword [ecx]
call dword [eax + 0x38]
cmp dword [ebp + 0xc], 0
mov edi, dword [edi + 8]
setne al
mov byte [ebp + 0xb], al
cmp byte [edi + 0x380], al
jne 0x1002e7d6
xor esi, esi
jmp 0x1002e7f9
mov byte [edi + 0x380], al
mov ecx, edi
mov eax, dword [edi]
call dword [eax + 0x90]
mov esi, eax
test esi, esi
je 0x1002e7f9
cmp byte [ebp + 0xb], 0
sete cl
mov byte [edi + 0x380], cl
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
test esi, esi
pop ebx
pop edi
sete al
pop esi
pop ebp
ret 8
Function at 0x1002e820
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
push dword [0x100db8a4]
mov esi, dword [edi + 0x24]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, esi
jne 0x1002e84e
push 0x65b
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
xor eax, eax
pop esi
pop ebp
ret 8
lea esi, [edi + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [edi + 8]
test ecx, ecx
jne 0x1002e876
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 6
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
xor eax, eax
pop esi
pop ebp
ret 8
mov eax, dword [ecx]
call dword [eax + 0x38]
mov ecx, dword [ebp + 0xc]
push esi
test ecx, ecx
jne 0x1002e899
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
xor eax, eax
pop esi
pop ebp
ret 8
mov eax, dword [edi + 8]
movzx eax, byte [eax + 0x380]
mov dword [ecx], eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
mov eax, 1
pop esi
pop ebp
ret 8

Function at 0x1002e8c0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
push dword [0x100db8a4]
mov esi, dword [edi + 0x24]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, esi
jne 0x1002e8ee
push 0x65b
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
xor eax, eax
pop esi
pop ebp
ret 8
push ebx
lea ebx, [edi + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [edi + 8]
test ecx, ecx
jne 0x1002e918
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 6
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop ebx
pop edi
xor eax, eax
pop esi
pop ebp
ret 8
mov eax, dword [ecx]
call dword [eax + 0x38]
cmp dword [ebp + 0xc], 0
mov ecx, dword [edi + 8]
setne al
movzx eax, al
push eax
call fcn.1001fae0
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
test esi, esi
pop ebx
pop edi
sete al
pop esi
pop ebp
ret 8
Function at 0x1002e950
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
push dword [0x100db8a4]
mov esi, dword [edi + 0x24]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, esi
jne 0x1002e97e
push 0x65b
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
xor eax, eax
pop esi
pop ebp
ret 8
lea esi, [edi + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [edi + 8]
test ecx, ecx
jne 0x1002e9a6
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 6
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
xor eax, eax
pop esi
pop ebp
ret 8
mov eax, dword [ecx]
call dword [eax + 0x38]
mov ecx, dword [ebp + 0xc]
push esi
test ecx, ecx
jne 0x1002e9c9
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
xor eax, eax
pop esi
pop ebp
ret 8
mov eax, dword [edi + 8]
movzx eax, byte [eax + 0x381]
mov dword [ecx], eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
mov eax, 1
pop esi
pop ebp
ret 8

Function at 0x1002e9f0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
push dword [0x100db8a4]
mov esi, dword [edi + 0x24]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, esi
jne 0x1002ea1e
push 0x65b
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
xor eax, eax
pop esi
pop ebp
ret 8
push ebx
lea ebx, [edi + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [edi + 8]
test ecx, ecx
jne 0x1002ea48
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 6
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop ebx
pop edi
xor eax, eax
pop esi
pop ebp
ret 8
mov eax, dword [ecx]
call dword [eax + 0x38]
push dword [ebp + 0xc]
mov ecx, dword [edi + 8]
call fcn.1001fb40
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
test esi, esi
pop ebx
pop edi
sete al
pop esi
pop ebp
ret 8
Function at 0x1002ea80
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
push dword [0x100db8a4]
mov esi, dword [edi + 0x24]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, esi
jne 0x1002eaae
push 0x65b
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
xor eax, eax
pop esi
pop ebp
ret 8
lea esi, [edi + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [edi + 8]
test ecx, ecx
jne 0x1002ead6
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 6
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
xor eax, eax
pop esi
pop ebp
ret 8
mov eax, dword [ecx]
call dword [eax + 0x38]
mov ecx, dword [ebp + 0xc]
push esi
test ecx, ecx
jne 0x1002eaf9
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
xor eax, eax
pop esi
pop ebp
ret 8
mov eax, dword [edi + 8]
mov eax, dword [eax + 0x388]
mov dword [ecx], eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
mov eax, 1
pop esi
pop ebp
ret 8

Function at 0x1002eb20
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
push dword [0x100db8a4]
mov esi, dword [edi + 0x24]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, esi
jne 0x1002eb4e
push 0x65b
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
xor eax, eax
pop esi
pop ebp
ret 0xc
push ebx
lea ebx, [edi + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [edi + 8]
test ecx, ecx
jne 0x1002eb78
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 6
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop ebx
pop edi
xor eax, eax
pop esi
pop ebp
ret 0xc
mov eax, dword [ecx]
call dword [eax + 0x38]
push dword [ebp + 0x10]
mov ecx, dword [edi + 8]
push dword [ebp + 0xc]
call fcn.1001fa20
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
test esi, esi
pop ebx
pop edi
sete al
pop esi
pop ebp
ret 0xc
Function at 0x1002ebb0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
push dword [0x100db8a4]
mov esi, dword [edi + 0x24]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, esi
jne 0x1002ebde
push 0x65b
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
xor eax, eax
pop esi
pop ebp
ret 0xc
lea esi, [edi + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [edi + 8]
test ecx, ecx
jne 0x1002ec06
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 6
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
xor eax, eax
pop esi
pop ebp
ret 0xc
mov eax, dword [ecx]
call dword [eax + 0x38]
mov ecx, dword [ebp + 0xc]
mov edx, dword [edi + 8]
test ecx, ecx
je 0x1002ec1d
mov eax, dword [edx + 0x3a4]
mov dword [ecx], eax
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x1002ec2c
mov eax, dword [edx + 0x3a8]
mov dword [ecx], eax
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
mov eax, 1
pop esi
pop ebp
ret 0xc

Function at 0x1002ec50
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
push dword [0x100db8a4]
mov esi, dword [edi + 0x24]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, esi
jne 0x1002ec7e
push 0x65b
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
xor eax, eax
pop esi
pop ebp
ret 8
push ebx
lea ebx, [edi + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [edi + 8]
test ecx, ecx
jne 0x1002eca8
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 6
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop ebx
pop edi
xor eax, eax
pop esi
pop ebp
ret 8
mov eax, dword [ecx]
call dword [eax + 0x38]
cmp dword [ebp + 0xc], 0
mov edi, dword [edi + 8]
setne al
mov byte [ebp + 0xb], al
cmp byte [edi + 0x38c], al
jne 0x1002ecc6
xor esi, esi
jmp 0x1002ece9
mov byte [edi + 0x38c], al
mov ecx, edi
mov eax, dword [edi]
call dword [eax + 0xa0]
mov esi, eax
test esi, esi
je 0x1002ece9
cmp byte [ebp + 0xb], 0
sete cl
mov byte [edi + 0x38c], cl
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
test esi, esi
pop ebx
pop edi
sete al
pop esi
pop ebp
ret 8
Function at 0x1002ed10
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
push dword [0x100db8a4]
mov esi, dword [edi + 0x24]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, esi
jne 0x1002ed3e
push 0x65b
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
xor eax, eax
pop esi
pop ebp
ret 8
lea esi, [edi + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [edi + 8]
test ecx, ecx
jne 0x1002ed66
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 6
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
xor eax, eax
pop esi
pop ebp
ret 8
mov eax, dword [ecx]
call dword [eax + 0x38]
mov ecx, dword [ebp + 0xc]
push esi
test ecx, ecx
jne 0x1002ed89
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
xor eax, eax
pop esi
pop ebp
ret 8
mov eax, dword [edi + 8]
movzx eax, byte [eax + 0x38c]
mov dword [ecx], eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
mov eax, 1
pop esi
pop ebp
ret 8

Function at 0x1002edb0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
push dword [0x100db8a4]
mov esi, dword [edi + 0x24]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, esi
jne 0x1002edde
push 0x65b
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
xor eax, eax
pop esi
pop ebp
ret 8
push ebx
lea ebx, [edi + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [edi + 8]
test ecx, ecx
jne 0x1002ee08
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 6
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop ebx
pop edi
xor eax, eax
pop esi
pop ebp
ret 8
mov eax, dword [ecx]
call dword [eax + 0x38]
cmp dword [ebp + 0xc], 0
mov esi, dword [edi + 8]
setne al
cmp byte [esi + 0x390], al
jne 0x1002ee23
xor edi, edi
jmp 0x1002ee49
mov byte [esi + 0x390], al
mov ecx, esi
mov eax, dword [esi]
call dword [eax + 0xa4]
mov edi, eax
test edi, edi
je 0x1002ee49
cmp byte [esi + 0x390], 0
sete cl
mov byte [esi + 0x390], cl
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
test edi, edi
pop ebx
pop edi
sete al
pop esi
pop ebp
ret 8
Function at 0x1002ee70
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
push dword [0x100db8a4]
mov esi, dword [edi + 0x24]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, esi
jne 0x1002ee9e
push 0x65b
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
xor eax, eax
pop esi
pop ebp
ret 8
lea esi, [edi + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [edi + 8]
test ecx, ecx
jne 0x1002eec6
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 6
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
xor eax, eax
pop esi
pop ebp
ret 8
mov eax, dword [ecx]
call dword [eax + 0x38]
mov ecx, dword [ebp + 0xc]
push esi
test ecx, ecx
jne 0x1002eee9
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
xor eax, eax
pop esi
pop ebp
ret 8
mov eax, dword [edi + 8]
movzx eax, byte [eax + 0x390]
mov dword [ecx], eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
mov eax, 1
pop esi
pop ebp
ret 8

Function at 0x1002ef10
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
push dword [0x100db8a4]
mov esi, dword [edi + 0x24]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, esi
jne 0x1002ef3e
push 0x65b
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
xor eax, eax
pop esi
pop ebp
ret 8
push ebx
lea ebx, [edi + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [edi + 8]
test ecx, ecx
jne 0x1002ef68
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 6
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop ebx
pop edi
xor eax, eax
pop esi
pop ebp
ret 8
mov eax, dword [ecx]
call dword [eax + 0x38]
cmp dword [ebp + 0xc], 0
mov edi, dword [edi + 8]
setne al
mov byte [ebp + 0xb], al
cmp byte [edi + 0x382], al
jne 0x1002ef86
xor esi, esi
jmp 0x1002efa9
mov byte [edi + 0x382], al
mov ecx, edi
mov eax, dword [edi]
call dword [eax + 0x98]
mov esi, eax
test esi, esi
je 0x1002efa9
cmp byte [ebp + 0xb], 0
sete cl
mov byte [edi + 0x382], cl
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
test esi, esi
pop ebx
pop edi
sete al
pop esi
pop ebp
ret 8
Function at 0x1002efd0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
push dword [0x100db8a4]
mov esi, dword [edi + 0x24]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, esi
jne 0x1002effe
push 0x65b
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
xor eax, eax
pop esi
pop ebp
ret 8
lea esi, [edi + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [edi + 8]
test ecx, ecx
jne 0x1002f026
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 6
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
xor eax, eax
pop esi
pop ebp
ret 8
mov eax, dword [ecx]
call dword [eax + 0x38]
mov ecx, dword [ebp + 0xc]
push esi
test ecx, ecx
jne 0x1002f049
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
xor eax, eax
pop esi
pop ebp
ret 8
mov eax, dword [edi + 8]
movzx eax, byte [eax + 0x382]
mov dword [ecx], eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
mov eax, 1
pop esi
pop ebp
ret 8

Function at 0x1002f070
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push dword [0x100db8a4]
mov edi, ecx
mov esi, dword [edi + 0x24]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, esi
jne 0x1002f09d
push 0x65b
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
xor eax, eax
pop esi
pop ebp
ret 4
lea esi, [edi + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [edi + 8]
test ecx, ecx
jne 0x1002f0c5
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 6
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
xor eax, eax
pop esi
pop ebp
ret 4
mov eax, dword [ecx]
call dword [eax + 0x38]
mov ecx, dword [edi + 8]
cmp byte [ecx + 0x358], 0
je 0x1002f0dd
mov edi, 0x15
jmp 0x1002f0ef
cmp dword [ebp + 8], 0
mov edx, dword [ecx]
setne al
movzx eax, al
push eax
call dword [edx + 0x78]
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
test edi, edi
pop edi
sete al
pop esi
pop ebp
ret 4