joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003a720
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 0x30
push esi
mov esi, dword [esp + 0x38]
mov eax, dword [esi + 8]
push str.CreateIndex
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], vtable.CDAOContext.0
mov dword [esp + 0x10], eax
call fcn.10009750
lea ecx, [esp + 0x1c]
mov dword [esp + 8], vtable.CDAOVARGContext.0
mov word [esp + 0x18], 0
mov dword [esp + 0x14], 1
call fcn.10013930
mov edx, dword [esp + 0x3c]
push 0
lea ecx, [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x48]
sub esp, 0x10
mov eax, esp
mov dword [eax], edx
mov edx, dword [esp + 0x5c]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x60]
mov dword [eax + 8], edx
mov dword [eax + 0xc], ecx
lea ecx, [esp + 0x20]
call fcn.1000a260
mov eax, dword [esp + 0x10]
test eax, eax
jl 0x1003a7ea
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
push edx
mov edx, dword [esp + 0x24]
sub esp, 0x14
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [esp + 0x3c]
mov dword [eax + 4], edx
mov edx, dword [esp + 0x40]
mov dword [eax + 8], ecx
mov ecx, dword [esp + 0x44]
mov dword [eax + 0xc], edx
mov edx, dword [esi + 8]
mov dword [eax + 0x10], ecx
mov eax, dword [edx + 8]
push eax
lea ecx, [esp + 0x54]
push ecx
call fcn.10067910
test eax, eax
je 0x1003a7f1
movzx eax, ax
or eax, 0x800a0000
mov dword [esp + 0x10], eax
mov esi, eax
jmp 0x1003a89d
call fcn.10020d20
test eax, eax
jl 0x1003a820
mov edx, dword [0x1007eed0]
push 0x10c
push edx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push eax
call fcn.10069dc0
test eax, eax
jne 0x1003a876
push 0x100202e0
call fcn.1005ad10
xor eax, eax
mov ecx, dword [esp + 0x38]
mov edx, dword [esi + 8]
push ecx
mov ecx, dword [edx + 0x28]
push ecx
lea edx, [esp + 0xc]
push edx
push 0x10070348
push 0
push eax
call fcn.10005db0
mov esi, eax
test esi, esi
mov dword [esp + 0x10], esi
jge 0x1003a893
mov eax, dword [esp + 0xc]
test eax, eax
je 0x1003a87f
mov eax, dword [eax + 8]
test eax, eax
je 0x1003a87f
push 2
push esi
push eax
call fcn.10019ba0
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x38]
push eax
call fcn.100573a0
mov esi, dword [esp + 0x10]
jmp 0x1003a89d
mov ecx, eax
call fcn.10005240
jmp 0x1003a822
mov eax, dword [esp + 0x38]
push eax
mov dword [esp + 0x14], esi
call fcn.100573a0
mov esi, dword [esp + 0x10]
jmp 0x1003a89d
mov ecx, dword [esp + 0x4c]
mov edx, dword [esp + 4]
mov dword [ecx], edx
lea ecx, [esp + 0x1c]
call fcn.10013940
lea ecx, [esp + 8]
call fcn.100097c0
mov eax, esi
pop esi
add esp, 0x30
ret 0x18

Function at 0x1003abb0
Capabilities:
Get thread local storage value

Disassembly:
push esi
mov esi, ecx
call fcn.10020d20
test eax, eax
jl 0x1003abe1
mov eax, dword [0x1007eed0]
push 0xe4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push eax
call fcn.10069dc0
test eax, eax
jne 0x1003ac05
push 0x100202e0
call fcn.1005ad10
xor eax, eax
mov ecx, dword [esp + 8]
mov edx, dword [esi + 0xc]
push ecx
mov ecx, dword [edx + 0x28]
mov edx, dword [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x14]
push edx
push ecx
push 0
push eax
call fcn.10005db0
pop esi
ret 0xc
mov ecx, eax
call fcn.10004a40
jmp 0x1003abe3
Function at 0x1003b450
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x60
push esi
lea ecx, [esp + 0x44]
call fcn.100139b0
mov esi, vtable.CVarConvW.0
lea ecx, [esp + 0x24]
mov dword [esp + 0x44], esi
call fcn.100139b0
lea ecx, [esp + 4]
mov dword [esp + 0x24], esi
call fcn.100139b0
mov eax, dword [esp + 0x6c]
push eax
lea ecx, [esp + 0x48]
mov dword [esp + 8], esi
call fcn.100152f0
mov esi, eax
test esi, esi
jl 0x1003b54b
mov ecx, dword [esp + 0x70]
push ecx
lea ecx, [esp + 0x28]
call fcn.100152f0
mov esi, eax
test esi, esi
lea ecx, [esp + 4]
jl 0x1003b54f
mov edx, dword [esp + 0x78]
push edx
call fcn.100152f0
mov esi, eax
test esi, esi
jl 0x1003b54b
mov eax, dword [esp + 0x14]
movzx ecx, ax
and ecx, 0xffffbfff
cmp ecx, 8
jne 0x1003b4e9
test eax, 0x4000
mov edx, dword [esp + 0x1c]
je 0x1003b4eb
mov edx, dword [edx]
jmp 0x1003b4eb
xor edx, edx
mov eax, dword [esp + 0x34]
movzx ecx, ax
and ecx, 0xffffbfff
cmp ecx, 8
jne 0x1003b512
test eax, 0x4000
je 0x1003b50c
mov eax, dword [esp + 0x3c]
mov ecx, dword [eax]
jmp 0x1003b514
mov ecx, dword [esp + 0x3c]
jmp 0x1003b514
xor ecx, ecx
mov eax, dword [esp + 0x54]
movzx esi, ax
and esi, 0xffffbfff
cmp esi, 8
jne 0x1003b535
test eax, 0x4000
mov eax, dword [esp + 0x5c]
je 0x1003b537
mov eax, dword [eax]
jmp 0x1003b537
xor eax, eax
push edx
mov edx, dword [esp + 0x78]
push edx
push ecx
push eax
mov eax, dword [esp + 0x78]
push eax
call fcn.10018130
mov esi, eax
lea ecx, [esp + 4]
call fcn.10014290
lea ecx, [esp + 0x24]
call fcn.10014290
lea ecx, [esp + 0x44]
call fcn.10014290
mov eax, esi
pop esi
add esp, 0x60
ret 0x14
Function at 0x1003c520
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x60
push esi
lea ecx, [esp + 0x44]
call fcn.100139b0
mov esi, vtable.CVarConvW.0
lea ecx, [esp + 0x24]
mov dword [esp + 0x44], esi
call fcn.100139b0
lea ecx, [esp + 4]
mov dword [esp + 0x24], esi
call fcn.100139b0
mov eax, dword [esp + 0x6c]
push eax
lea ecx, [esp + 0x48]
mov dword [esp + 8], esi
call fcn.100152f0
mov esi, eax
test esi, esi
jl 0x1003c63e
mov ecx, dword [esp + 0x70]
push ecx
lea ecx, [esp + 0x28]
call fcn.100152f0
mov esi, eax
test esi, esi
jl 0x1003c63e
mov edx, dword [esp + 0x74]
mov ecx, dword [esp + 0x78]
push 0
sub esp, 0x10
mov eax, esp
mov dword [eax], edx
mov edx, dword [esp + 0x90]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x94]
mov dword [eax + 8], edx
mov dword [eax + 0xc], ecx
lea ecx, [esp + 0x18]
call fcn.10015330
mov esi, eax
test esi, esi
jl 0x1003c63e
mov eax, dword [esp + 0x34]
movzx edx, ax
and edx, 0xffffbfff
cmp edx, 8
jne 0x1003c5e2
test eax, 0x4000
je 0x1003c5dc
mov eax, dword [esp + 0x3c]
mov edx, dword [eax]
jmp 0x1003c5e4
mov edx, dword [esp + 0x3c]
jmp 0x1003c5e4
xor edx, edx
mov eax, dword [esp + 0x54]
movzx ecx, ax
and ecx, 0xffffbfff
cmp ecx, 8
jne 0x1003c60b
test eax, 0x4000
je 0x1003c605
mov eax, dword [esp + 0x5c]
mov ecx, dword [eax]
jmp 0x1003c60d
mov ecx, dword [esp + 0x5c]
jmp 0x1003c60d
xor ecx, ecx
mov esi, dword [esp + 0x14]
sub esp, 0x10
mov eax, esp
mov dword [eax], esi
mov esi, dword [esp + 0x28]
mov dword [eax + 4], esi
mov esi, dword [esp + 0x2c]
push edx
push ecx
mov ecx, dword [esp + 0x80]
mov dword [eax + 8], esi
mov esi, dword [esp + 0x38]
push ecx
mov dword [eax + 0xc], esi
call fcn.1000bb70
mov esi, eax
lea ecx, [esp + 4]
call fcn.10014290
lea ecx, [esp + 0x24]
call fcn.10014290
lea ecx, [esp + 0x44]
call fcn.10014290
mov eax, esi
pop esi
add esp, 0x60
ret 0x1c
Function at 0x100402b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x60
push esi
lea ecx, [esp + 0x44]
call fcn.100139b0
mov esi, vtable.CVarConvW.0
lea ecx, [esp + 0x24]
mov dword [esp + 0x44], esi
call fcn.100139b0
lea ecx, [esp + 4]
mov dword [esp + 0x24], esi
call fcn.100139b0
mov eax, dword [esp + 0x6c]
push eax
lea ecx, [esp + 0x48]
mov dword [esp + 8], esi
call fcn.100152f0
mov esi, eax
test esi, esi
jge 0x10040318
lea ecx, [esp + 4]
call fcn.10014290
lea ecx, [esp + 0x24]
call fcn.10014290
lea ecx, [esp + 0x44]
call fcn.10014290
mov eax, esi
pop esi
add esp, 0x60
ret 0x14
mov ecx, dword [esp + 0x70]
push ecx
lea ecx, [esp + 0x28]
call fcn.100152f0
mov esi, eax
test esi, esi
lea ecx, [esp + 4]
jl 0x100402f8
mov edx, dword [esp + 0x74]
push edx
call fcn.100152f0
mov esi, eax
test esi, esi
jl 0x100402f4
mov eax, dword [esp + 0x14]
movzx ecx, ax
and ecx, 0xffffbfff
cmp ecx, 8
jne 0x10040361
test eax, 0x4000
mov edx, dword [esp + 0x1c]
je 0x10040363
mov edx, dword [edx]
jmp 0x10040363
xor edx, edx
mov eax, dword [esp + 0x34]
movzx ecx, ax
and ecx, 0xffffbfff
cmp ecx, 8
jne 0x1004038a
test eax, 0x4000
je 0x10040384
mov eax, dword [esp + 0x3c]
mov ecx, dword [eax]
jmp 0x1004038c
mov ecx, dword [esp + 0x3c]
jmp 0x1004038c
xor ecx, ecx
mov eax, dword [esp + 0x54]
movzx esi, ax
and esi, 0xffffbfff
cmp esi, 8
jne 0x100403ad
test eax, 0x4000
mov eax, dword [esp + 0x5c]
je 0x100403af
mov eax, dword [eax]
jmp 0x100403af
xor eax, eax
push edi
mov edi, dword [esp + 0x7c]
push edi
push edx
push ecx
mov ecx, dword [esp + 0x78]
push eax
push ecx
call fcn.10019080
mov esi, eax
test esi, esi
jge 0x100403ed
lea ecx, [esp + 8]
call fcn.10014290
lea ecx, [esp + 0x28]
call fcn.10014290
lea ecx, [esp + 0x48]
call fcn.10014290
pop edi
mov eax, esi
pop esi
add esp, 0x60
ret 0x14
push 0x10070238
push edi
call fcn.100400b0
lea ecx, [esp + 8]
call fcn.10014290
lea ecx, [esp + 0x28]
call fcn.10014290
lea ecx, [esp + 0x48]
call fcn.10014290
pop edi
xor eax, eax
pop esi
add esp, 0x60
ret 0x14
Function at 0x1004a230
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 0x18
push esi
push edi
mov edi, dword [esp + 0x24]
push str.CreateDatabase
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], vtable.CDAOContext.0
mov dword [esp + 0x14], edi
call fcn.10009750
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x34]
push 0
lea eax, [esp + 0x34]
push eax
sub esp, 0x10
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [esp + 0x50]
mov dword [eax + 4], edx
mov edx, dword [esp + 0x54]
mov dword [eax + 8], ecx
lea ecx, [esp + 0x24]
mov dword [esp + 0x24], vtable.CDAOVARGContext.0
mov dword [esp + 0x30], 1
mov dword [esp + 0x20], 0
mov word [esp + 0x34], 2
mov dword [eax + 0xc], edx
call fcn.1000a010
mov eax, dword [esp + 0x14]
test eax, eax
jl 0x1004a2dc
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
push eax
mov eax, dword [esp + 0x2c]
push ecx
mov ecx, dword [edi + 8]
push edx
push eax
push ecx
lea edx, [esp + 0x38]
push edx
call fcn.10069540
test eax, eax
je 0x1004a2f1
movzx eax, ax
or eax, 0x800a0000
mov dword [esp + 0x14], eax
lea ecx, [esp + 0xc]
mov esi, eax
call fcn.100097c0
mov eax, esi
pop edi
pop esi
add esp, 0x18
ret 0x20
call fcn.10020d20
test eax, eax
jl 0x1004a321
mov eax, dword [0x1007eed0]
push 0x284
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push eax
call fcn.10069dc0
mov esi, eax
test esi, esi
jne 0x1004a385
push 0x100202e0
call fcn.1005ad10
xor esi, esi
mov ecx, dword [esp + 0x24]
mov edx, dword [edi + 0x28]
push ecx
push edx
lea eax, [esp + 0x10]
push eax
push 0x10070428
push 0
push esi
call fcn.10005db0
mov esi, eax
test esi, esi
mov dword [esp + 0x14], esi
jge 0x1004a3b9
mov eax, dword [esp + 0x10]
test eax, eax
je 0x1004a394
mov eax, dword [eax + 8]
test eax, eax
je 0x1004a394
push 2
push esi
push eax
call fcn.10019ba0
mov ecx, dword [esp + 0x24]
push ecx
mov dword [esp + 0x18], eax
call fcn.100573a0
mov esi, dword [esp + 0x14]
lea ecx, [esp + 0xc]
call fcn.100097c0
mov eax, esi
pop edi
pop esi
add esp, 0x18
ret 0x20
mov ecx, esi
call fcn.10011540
mov dword [esi], vtable.CDAODatabase.0
jmp 0x1004a323
mov ecx, dword [esp + 0x24]
push ecx
mov dword [esp + 0x18], esi
call fcn.100573a0
mov esi, dword [esp + 0x14]
lea ecx, [esp + 0xc]
call fcn.100097c0
mov eax, esi
pop edi
pop esi
add esp, 0x18
ret 0x20
mov edx, dword [esp + 0x40]
mov eax, dword [esp + 8]
lea ecx, [esp + 0xc]
mov dword [edx], eax
call fcn.100097c0
pop edi
mov eax, esi
pop esi
add esp, 0x18
ret 0x20
Function at 0x1004a3e0
Capabilities:
Get thread local storage value
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x48
push esi
mov esi, dword [esp + 0x50]
push str.CreateGroup
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], vtable.CDAOContext.0
mov dword [esp + 0x10], esi
call fcn.10009750
lea ecx, [esp + 0x34]
mov dword [esp + 8], vtable.CDAOVARGContext.0
mov word [esp + 0x18], 0
mov dword [esp + 0x14], 1
call fcn.10013930
lea ecx, [esp + 0x1c]
call fcn.10013930
mov ecx, dword [esp + 0x54]
mov edx, dword [esp + 0x58]
push 0
lea eax, [esp + 0x38]
push eax
sub esp, 0x10
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [esp + 0x74]
mov dword [eax + 4], edx
mov edx, dword [esp + 0x78]
mov dword [eax + 8], ecx
lea ecx, [esp + 0x20]
mov dword [eax + 0xc], edx
call fcn.1000a260
mov ecx, dword [esp + 0x64]
mov edx, dword [esp + 0x68]
push 0
lea eax, [esp + 0x20]
push eax
sub esp, 0x10
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [esp + 0x84]
mov dword [eax + 4], edx
mov edx, dword [esp + 0x88]
mov dword [eax + 8], ecx
lea ecx, [esp + 0x20]
mov dword [eax + 0xc], edx
call fcn.1000a260
mov eax, dword [esp + 0x10]
test eax, eax
jl 0x1004a50d
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
push eax
sub esp, 0x14
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [esp + 0x3c]
mov dword [eax + 4], edx
mov edx, dword [esp + 0x40]
mov dword [eax + 8], ecx
mov ecx, dword [esp + 0x44]
mov dword [eax + 0xc], edx
mov edx, dword [esp + 0x4c]
mov dword [eax + 0x10], ecx
mov ecx, dword [esp + 0x50]
sub esp, 0x14
mov eax, esp
mov dword [eax], edx
mov edx, dword [esp + 0x68]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x6c]
mov dword [eax + 8], edx
mov edx, dword [esp + 0x70]
mov dword [eax + 0xc], ecx
mov dword [eax + 0x10], edx
mov eax, dword [esi + 8]
push eax
lea ecx, [esp + 0x80]
push ecx
call fcn.10069650
test eax, eax
je 0x1004a514
movzx eax, ax
or eax, 0x800a0000
mov dword [esp + 0x10], eax
mov esi, eax
jmp 0x1004a5bd
call fcn.10020d20
test eax, eax
jl 0x1004a543
mov edx, dword [0x1007eed0]
push 0xe4
push edx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push eax
call fcn.10069dc0
test eax, eax
jne 0x1004a596
push 0x100202e0
call fcn.1005ad10
xor eax, eax
mov ecx, dword [esp + 0x50]
mov edx, dword [esi + 0x28]
push ecx
push edx
lea ecx, [esp + 0xc]
push ecx
push 0x100703a8
push 0
push eax
call fcn.10005db0
mov esi, eax
test esi, esi
mov dword [esp + 0x10], esi
jge 0x1004a5b3
mov eax, dword [esp + 0xc]
test eax, eax
je 0x1004a59f
mov eax, dword [eax + 8]
test eax, eax
je 0x1004a59f
push 2
push esi
push eax
call fcn.10019ba0
mov edx, dword [esp + 0x50]
push edx
mov dword [esp + 0x14], eax
call fcn.100573a0
mov esi, dword [esp + 0x10]
jmp 0x1004a5bd
mov ecx, eax
call fcn.100054a0
jmp 0x1004a545
mov edx, dword [esp + 0x50]
push edx
mov dword [esp + 0x14], esi
call fcn.100573a0
mov esi, dword [esp + 0x10]
jmp 0x1004a5bd
mov eax, dword [esp + 0x74]
mov ecx, dword [esp + 4]
mov dword [eax], ecx
lea ecx, [esp + 0x1c]
call fcn.10013940
lea ecx, [esp + 0x34]
call fcn.10013940
lea ecx, [esp + 8]
call fcn.100097c0
mov eax, esi
pop esi
add esp, 0x48
ret 0x28
Function at 0x1004af50
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x1007eed0]
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push eax
call esi
cmp dword [eax + 0x38], 0
jne 0x1004afbc
mov edi, dword [esp + 0x1c]
cmp edi, 0x400
ja 0x1004af79
mov edi, 0x400
mov ecx, dword [0x1007eed0]
push ecx
call esi
mov ebx, dword [esp + 0x14]
push edi
push ebx
lea esi, [eax + 0x38]
call fcn.10069dc0
test eax, eax
mov dword [esi], eax
jne 0x1004afaf
mov edx, dword [esp + 0x18]
push 1
push eax
push edx
push 0xfffffc0d
call fcn.1005a550
pop edi
pop esi
pop ebp
pop ebx
ret 0xc
mov word [ebx + 0x34], di
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 0xc
mov ebp, dword [esp + 0x14]
movzx eax, word [ebp + 0x34]
mov esi, dword [esp + 0x1c]
movzx ebx, ax
cmp ebx, esi
jae 0x1004b04b
mov eax, esi
sub eax, ebx
cmp eax, 0x400
ja 0x1004afe0
lea esi, [ebx + 0x400]
push esi
push ebp
call fcn.10069dc0
mov edi, eax
test edi, edi
jne 0x1004b006
mov ecx, dword [esp + 0x18]
push 1
push eax
push ecx
push 0xfffffc0d
call fcn.1005a550
pop edi
pop esi
pop ebp
pop ebx
ret 0xc
cmp esi, ebx
jae 0x1004b00c
mov ebx, esi
mov edx, dword [0x1007eed0]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edx
call ebx
mov eax, dword [eax + 0x38]
push eax
push edi
call sub.msvcrt.dll_memcpy
mov ecx, dword [0x1007eed0]
add esp, 0xc
push ecx
call ebx
mov edx, dword [eax + 0x38]
push edx
push ebp
call fcn.1006a020
mov eax, dword [0x1007eed0]
push eax
call ebx
mov dword [eax + 0x38], edi
mov word [ebp + 0x34], si
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 0xc

Function at 0x1004b060
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x1007eed0]
push ebx
push esi
mov esi, dword [esp + 0xc]
movzx ebx, word [esi + 0x34]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
push eax
call edi
cmp dword [eax + 0x38], 0
je 0x1004b0b0
cmp bx, 0x400
jbe 0x1004b0b0
mov ecx, dword [0x1007eed0]
push ecx
call edi
mov edx, dword [eax + 0x38]
push edx
push esi
call fcn.1006a020
push 0
push 0
push esi
mov dword [esi + 0x38], 0
mov word [esi + 0x34], 0
call fcn.1004af50
pop edi
pop esi
pop ebx
ret 4
Function at 0x1004d6d0
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 8
push ebp
push esi
mov esi, dword [esp + 0x18]
mov eax, dword [esi + 0x1c]
mov ebp, dword [esi + 0x18]
push edi
xor edi, edi
cmp eax, edi
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], edi
jne 0x1004d711
push 0x11
push esi
call fcn.10055ad0
cmp eax, edi
jne 0x1004d711
push 1
push edi
push esi
push 0xfffffbfb
call fcn.1005a550
pop edi
pop esi
pop ebp
add esp, 8
ret 0x10
cmp dword [esi + 0x10], 0x25
jge 0x1004d7e0
cmp dword [esi + 0x30], edi
jne 0x1004d72d
cmp dword [esi + 0xe8], 0xffffffff
je 0x1004d7e0
mov eax, dword [esi + 0xf8]
cmp eax, edi
je 0x1004d774
cmp word [eax + 0x2c], di
je 0x1004d774
lea eax, [esp + 0xc]
push eax
push esi
push ebp
call fcn.1004b7f0
cmp eax, edi
jge 0x1004d760
push 1
push edi
push esi
push eax
call fcn.1005a550
pop edi
pop esi
pop ebp
add esp, 8
ret 0x10
mov ecx, dword [0x1007eed0]
push ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edx, dword [eax + 0x38]
mov dword [esp + 0x10], edx
cmp dword [esi + 0xe8], 0xffffffff
je 0x1004d785
mov edi, dword [esi + 0xec]
jmp 0x1004d78b
mov eax, dword [esi + 0x30]
mov edi, dword [eax + 0x34]
push ebx
push edi
call fcn.1005e5f0
mov ebx, eax
test ebx, ebx
jne 0x1004d7ce
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x28]
push ecx
mov ecx, dword [esp + 0x28]
push edx
mov edx, dword [esi + 0xe8]
push eax
mov eax, dword [esp + 0x28]
push 0xffffffffffffffff
push ecx
mov ecx, dword [edi + 0x4a0]
push edx
add esi, 0x3a
push esi
push edi
push eax
push ecx
push ebp
call fcn.10053540
mov ebx, eax
push ebp
call fcn.1004b060
mov eax, ebx
pop ebx
pop edi
pop esi
pop ebp
add esp, 8
ret 0x10
push 1
push edi
push esi
push 0xffff8abf
call fcn.1005a550
pop edi
pop esi
pop ebp
add esp, 8
ret 0x10
Function at 0x100513c0
Capabilities:
Get thread local storage value

Disassembly:
or dword [esp + 0x10], 2
push ebx
push esi
mov esi, dword [esp + 0xc]
cmp dword [esi + 0x10], 0x25
mov ebx, dword [esi + 0x18]
mov dword [esp + 0xc], ebx
jge 0x10051520
cmp dword [esi + 0x2a0], 0xffffffff
je 0x10051520
push ebp
mov ebp, dword [esp + 0x14]
push edi
push ebp
call fcn.10020570
mov edi, eax
add edi, 1
lea eax, [edi + edi]
push eax
push esi
push ebx
call fcn.1004af50
mov ebx, eax
test ebx, ebx
je 0x1005141e
push 0
push 0
push ebp
call fcn.100205a0
pop edi
pop ebp
pop esi
mov eax, ebx
pop ebx
ret 0x14
mov ecx, dword [0x1007eed0]
mov ebx, dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push ecx
call ebx
mov edx, dword [eax + 0x38]
push edx
push ebp
call fcn.100205a0
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x1005145d
mov ecx, dword [esi + 0x298]
push 0
push eax
mov eax, dword [esi + 0x2a0]
push eax
push ecx
call dword [0x1007efe4]
mov edi, eax
test edi, edi
jne 0x1005148c
mov eax, dword [esp + 0x20]
mov ecx, dword [0x1007eed0]
lea edx, [esp + 0x18]
push edx
push eax
push ecx
call ebx
mov edx, dword [eax + 0x38]
mov eax, dword [esi + 0x2a0]
mov ecx, dword [esi + 0x298]
push edx
push eax
push 0xffffffffffffffff
push ecx
call dword [0x1007ef70]
mov edi, eax
mov edx, dword [esp + 0x14]
push edx
call fcn.1004b060
test edi, edi
jge 0x100514ca
cmp edi, 0xfffff9bf
je 0x100514c1
cmp edi, 0xfffff9bd
je 0x100514c1
mov eax, dword [esi + 0x298]
push 0
push eax
push esi
push edi
call fcn.1005a1e0
pop edi
pop ebp
pop esi
pop ebx
ret 0x14
or dword [esi + 0x274], 4
jmp 0x100514d1
and dword [esi + 0x274], 8
cmp dword [esi + 0x2f0], 0
je 0x1005150d
mov ecx, dword [esi + 0x2a0]
mov edx, dword [esi + 0x298]
push 2
push 0
push ecx
push edx
call dword [0x1007efe4]
test eax, eax
jge 0x1005150d
mov ecx, dword [esi + 0x298]
push 0
push ecx
push esi
push eax
call fcn.1005a1e0
pop edi
pop ebp
pop esi
pop ebx
ret 0x14
and dword [esi + 0x274], 0xffffff1f
pop edi
pop ebp
pop esi
xor eax, eax
pop ebx
ret 0x14
mov edx, dword [esp + 0x10]
push edx
push ebx
call fcn.1004ae90
push 1
push 0
push esi
push 0xffff8abf
call fcn.1005a550
pop esi
pop ebx
ret 0x14
Function at 0x100516c0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push esi
mov esi, dword [esp + 0xc]
mov ebp, dword [esi + 0x18]
push edi
mov dword [esp + 0x10], 0
call fcn.10057e50
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x10]
push eax
push ecx
push ebp
call fcn.1004b7f0
test eax, eax
jge 0x10051706
push 1
push 0
push esi
push eax
call fcn.1005a550
push ebp
mov esi, eax
call fcn.1004b060
pop edi
mov eax, esi
pop esi
pop ebp
ret 8
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x10051780
push ecx
push ebp
call fcn.10069dc0
mov edi, eax
test edi, edi
jne 0x10051739
push 1
push eax
push esi
push 0xfffffc0d
call fcn.1005a550
push ebp
mov esi, eax
call fcn.1004b060
pop edi
mov eax, esi
pop esi
pop ebp
ret 8
mov eax, dword [esi + 0x2f8]
test eax, eax
je 0x1005174d
mov edx, dword [esi + 0x18]
push eax
push edx
call fcn.1006a020
mov eax, dword [esp + 0x10]
mov ecx, dword [0x1007eed0]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edx, dword [eax + 0x38]
push edx
push edi
call sub.msvcrt.dll_memcpy
mov ax, word [esp + 0x1c]
add esp, 0xc
mov dword [esi + 0x2f8], edi
mov word [esi + 0x2fc], ax
jmp 0x100517a9
mov eax, dword [esi + 0x2f8]
test eax, eax
je 0x10051798
mov ecx, dword [esi + 0x18]
push eax
push ecx
call fcn.1006a020
mov ecx, dword [esp + 0x10]
mov dword [esi + 0x2f8], 0
mov word [esi + 0x2fc], cx
push 0
push esi
call fcn.100515c0
push ebp
mov esi, eax
call fcn.1004b060
pop edi
mov eax, esi
pop esi
pop ebp
ret 8