joyce8/EMBER2024-capa huggingface dataset:
Function at 0x642e8013
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0
push ecx
xor ecx, ecx
jne 0x642e805d
mov ecx, esp
xor dword [ecx - 0x55], edi
pop ecx
call 0x642e8004
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
call 0x642e8013
cld
test edx, ebx
or ebp, eax
add dword [esi - 0x7cc26b19], esp
les ecx, [eax]
or dword [esp], ebp
mov ebp, esp
sub esp, 0x100
push ebx
push edx
push ecx
push edi
push esi
mov ebx, dword [ebp + 8]
mov edx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
lea ebx, [ebx + edx]
mov eax, dword [ebx + 0x24]
add eax, edx
xor edi, edi
jne 0x646edcb6
or edi, dword [ebx + 0x20]
add edi, edx
mov ecx, dword [ebx + 0x18]
mov esi, dword [edi]
add esi, edx
push 0
push ecx
mov ecx, esp
push 0x55d34c8a
call 0x642e8064
sti
sbb byte [ecx + 0x56], dh
xlatb
les ebp, [ebp + 0x8c483e2]
xchg dword [ecx + 4], eax
xor eax, edx
shl eax, 3
xor ecx, 0
shl eax, 0x1d
add eax, dword [ecx + 4]
pop ecx
push esi
call fcn.642ceeda
cmp eax, dword [ebp + 0xc]
pop eax
je 0x642e8103
add edi, 4
add eax, 2
dec ecx
jne 0x642e8049
call 0x642e80b0
loope 0x642e80a6
invalid
sbb esi, ebx
mov edi, 0xdbead58c
js 0x642e8100
mov dh, 0xe8
or byte [eax], al
add byte [eax], al
mov bh, 0x24
lea eax, [edx + 0x53]
nop
mov dword [esi + 0x2308c483], ecx
sal byte [ecx], 0xc0
fsub st(7)
int 0xf
mov bh, 0
movzx eax, word [eax]
jmp 0x642e8111
shl eax, 2
add eax, dword [ebx + 0x1c]
add eax, edx
mov eax, dword [eax]
add eax, edx
mov ebx, edx
add ebx, dword [edx + 0x3c]
mov ecx, dword [ebx + 0x7c]
mov ebx, dword [ebx + 0x78]
add ebx, edx
add ecx, ebx
cmp eax, ebx
jb 0x642e80c4
cmp eax, ecx
ja 0x642e80c4
mov esi, eax
lea edi, [ebp - 0x100]
mov al, byte [esi]
mov byte [edi], al
inc edi
inc esi
js 0x642e814e
or ecx, ecx
xor dword [esp - 0x6b], eax
cmp al, 0x2e
jne 0x642e8144
lea edi, [ebp - 0x100]
push 0x100
push edi
push esi
call fcn.642cf3b9
lea esp, [esp - 0x60]
mov dword [esp + 0x5c], edi
lea esp, [esp + 0x5c]
Function at 0x4072ad
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x46bc7c], 0
jne 0x4072eb
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4072c1
mov dword [ecx*4 + 0x46bc78], eax
inc ecx
cmp ecx, 0x100
jl 0x4072bc
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x407318
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x46bc78]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x4072f9
not eax
pop ebp
ret 0xc

Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
je 0x430072
nop
nop
nop
nop
mov ebx, 0x408ecc
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x4fed22d3
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x430060
nop
nop
nop
mov eax, section..rsrc
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4300d2
nop
nop
nop
mov ebx, 0x42e1d0
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x43000e0
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x1003a975
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b3d10
mov eax, dword fs:[0]
push eax
sub esp, 0x660
mov eax, dword [0x100dd3e0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x664], ecx
or dword [ebp - 0x10], 0xffffffff
and dword [ebp - 0x43c], 0
push 0x424
push 0
lea eax, [ebp - 0x438]
push eax
call fcn.10070cb0
add esp, 0xc
and dword [ebp - 0x658], 0
and word [ebp - 0x654], 0
push 0x208
push 0
lea eax, [ebp - 0x652]
push eax
call fcn.10070cb0
add esp, 0xc
lea ecx, [ebp - 0x440]
call fcn.10003b07
and dword [ebp - 4], 0
push 0x104
lea eax, [ebp - 0x654]
push eax
call fcn.10099bb7
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jbe 0x1003aa8c
lea eax, [ebp - 0x654]
push eax
lea ecx, [ebp - 0x440]
call fcn.10003bbe
lea ecx, [ebp - 0x440]
call fcn.10010553
push eax
push 0x5c
lea ecx, [ebp - 0x440]
call fcn.10003bf0
inc eax
push eax
lea eax, [ebp - 0x65c]
push eax
lea ecx, [ebp - 0x440]
call fcn.10010642
mov dword [ebp - 0x668], eax
mov eax, dword [ebp - 0x668]
mov dword [ebp - 0x66c], eax
mov byte [ebp - 4], 1
push dword [ebp - 0x66c]
lea ecx, [ebp - 0x440]
call fcn.10003ba5
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x65c]
call fcn.100104e6
mov eax, dword [ebp - 0x664]
push dword [eax + 8]
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x1003aaa7
jmp 0x1003aafb
mov dword [ebp - 0x43c], 0x428
lea eax, [ebp - 0x43c]
push eax
push dword [ebp - 0x10]
call sub.KERNEL32.dll_Module32FirstW
test eax, eax
jne 0x1003aac6
jmp 0x1003aafb
lea eax, [ebp - 0x41c]
push eax
lea ecx, [ebp - 0x440]
call fcn.1003b53b
test eax, eax
jne 0x1003aae8
mov dword [ebp - 0x658], 1
jmp 0x1003aafb
lea eax, [ebp - 0x43c]
push eax
push dword [ebp - 0x10]
call sub.KERNEL32.dll_Module32NextW
test eax, eax
jne 0x1003aac6
cmp dword [ebp - 0x10], 0xffffffff
je 0x1003ab0a
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x658]
mov dword [ebp - 0x660], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x440]
call fcn.100104e6
mov eax, dword [ebp - 0x660]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1006e011
leave
ret

Function at 0x1003ab42
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
push 0
push 0x100c35d0
call dword [sym.imp.USER32.dll_FindWindowW]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xc], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0xc], 0
je 0x1003ab7e
mov eax, dword [ebp - 4]
add eax, 8
push eax
mov eax, dword [ebp - 4]
push dword [eax + 0xc]
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ecx, dword [ebp - 4]
mov dword [ecx + 4], eax
leave
ret
Function at 0x1003adfd
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
push 0
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowW]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xc], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0xc], 0
je 0x1003ae39
mov eax, dword [ebp - 4]
add eax, 8
push eax
mov eax, dword [ebp - 4]
push dword [eax + 0xc]
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ecx, dword [ebp - 4]
mov dword [ecx + 4], eax
leave
ret

Function at 0x1003cb23
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b3cdf
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x100dd3e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
call fcn.1003c872
and dword [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
add ecx, 4
call fcn.1003cc83
mov eax, dword [ebp - 0x10]
mov dword [eax], vtable.CQQChannelDownload.0
mov eax, dword [ebp - 0x10]
mov dword [eax + 4], vtable.CQQChannelDownload.1.0
mov ecx, dword [ebp - 0x10]
add ecx, 0x14
call fcn.100016d0
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x10]
and dword [eax + 0xc], 0
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov ecx, dword [ebp + 8]
call dword [eax + 8]
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 8], eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 0xc]
mov dword [eax + 0xc], ecx
mov eax, dword [ebp - 0x10]
and dword [eax + 0x10], 0
mov eax, dword [ebp - 0x10]
and dword [eax + 0x30], 0
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
leave
ret 8
Function at 0x10046628
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x60
mov eax, dword [0x100dd3e0]
xor eax, esp
mov dword [esp + 0x5c], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, ecx
xor ecx, ecx
cmp eax, ecx
push edi
je 0x10046695
cmp dword [ebp + 0xc], ecx
jle 0x10046695
cmp ebx, ecx
je 0x10046695
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], ecx
push eax
mov eax, dword [ebp + 0xc]
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0x67452301
mov dword [esp + 0x10], 0xefcdab89
mov dword [esp + 0x14], 0x98badcfe
mov dword [esp + 0x18], 0x10325476
call fcn.10046753
pop ecx
lea edi, [esp + 8]
call fcn.100467fa
mov al, 1
jmp 0x10046697
xor al, al
mov ecx, dword [esp + 0x64]
pop edi
pop ebx
xor ecx, esp
call fcn.1006e011
mov esp, ebp
pop ebp
ret

Function at 0x1004e831
Capabilities:
Create thread

Disassembly:
push 0x10
mov eax, 0x100b7026
call fcn.10075f38
mov esi, ecx
push str.CDownload::Init__
push 3
call fcn.100515ea
xor edi, edi
cmp dword [esi + 0xc], edi
pop ecx
pop ecx
je 0x1004e85c
xor eax, eax
inc eax
jmp 0x1004e8e6
cmp dword [esi + 0x64], edi
mov dword [esi + 0xb8], 0x5dc
jne 0x1004e8a4
mov ebx, dword [sym.imp.KERNEL32.dll_CreateEventW]
push edi
push edi
push edi
push edi
call ebx
push edi
push edi
push edi
push edi
mov dword [esi + 0x68], eax
call ebx
push edi
push edi
push edi
push edi
mov dword [esi + 0x6c], eax
call ebx
mov dword [esi + 0x70], eax
lea eax, [esi + 0x74]
push eax
push edi
push esi
push 0x1004ff67
push edi
push edi
call fcn.100717ac
add esp, 0x18
mov dword [esi + 0x64], eax
lea eax, [esi + 0x8c]
mov dword [ebp - 0x10], eax
add eax, 4
push eax
mov dword [ebp - 0x14], vtable.QQDectector::fund::lock::scoped_lock_class_QQDectector::fund::lock::critical_section_.0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [ebp - 4], edi
lea eax, [ebp - 0x1c]
xor edi, edi
push eax
inc edi
lea eax, [esi + 0x78]
mov dword [ebp - 0x1c], edi
call fcn.1005059e
push dword [esi + 0x70]
call dword [sym.imp.KERNEL32.dll_SetEvent]
lea esi, [ebp - 0x14]
call fcn.10050ab4
mov eax, edi
call fcn.10075fd7
ret
Function at 0x1004e967
Capabilities:
Print debug messages
Terminate thread

Disassembly:
push 0x10
mov eax, 0x100b7026
call fcn.10075f38
push str.CDownload::Uninit__
push 3
call fcn.100515ea
pop ecx
lea eax, [edi + 0x8c]
mov dword [ebp - 0x10], eax
pop ecx
add eax, 4
push eax
mov dword [ebp - 0x14], vtable.QQDectector::fund::lock::scoped_lock_class_QQDectector::fund::lock::critical_section_.0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
and dword [ebp - 4], 0
lea eax, [ebp - 0x1c]
push eax
lea eax, [edi + 0x78]
mov dword [ebp - 0x1c], 2
call fcn.1005059e
push dword [edi + 0x70]
mov ebx, dword [sym.imp.KERNEL32.dll_SetEvent]
call ebx
lea esi, [ebp - 0x14]
call fcn.10050ab4
push dword [edi + 0x68]
call ebx
push dword [edi + 0x70]
call ebx
cmp dword [edi + 0x64], 0
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x1004ea0f
push 0x7530
push dword [edi + 0x6c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x1004ea06
push 0x3ff
push dword [edi + 0x64]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push str.Uninit::TerminateThread
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push dword [edi + 0x64]
call esi
and dword [edi + 0x64], 0
push dword [edi + 0x70]
call esi
push dword [edi + 0x68]
call esi
push dword [edi + 0x6c]
call esi
call fcn.10075fd7
ret

Function at 0x1005027f
Capabilities:
Check if file exists

Disassembly:
push ebp
sub esp, 0x238
lea ebp, [esp - 4]
mov eax, dword [0x100dd3e0]
xor eax, ebp
mov dword [ebp + 0x238], eax
push 0x20
mov eax, 0x100b5ae7
call fcn.10075f38
and word [ebp + 0x2c], 0
push 0x208
lea eax, [ebp + 0x2e]
push 0
push eax
call fcn.10070cb0
add esp, 0xc
lea eax, [ebp]
push eax
push str.DownloadProxy.Downloader.1
call dword [sym.imp.ole32.dll_CLSIDFromProgID]
sub esp, 0x10
lea esi, [ebp]
mov edi, esp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea ebx, [ebp + 0x2c]
movsd dword es:[edi], dword [esi]
call fcn.10055b0a
add esp, 0x10
test eax, eax
je 0x1005037e
lea ecx, [ebp + 0x10]
call fcn.100016d0
and dword [ebp - 4], 0
lea eax, [ebp + 0x2c]
push eax
lea ecx, [ebp + 0x10]
call fcn.10009f34
lea edi, [ebp + 0x10]
call fcn.100503a1
push eax
push 0
mov ecx, edi
call fcn.100017a8
push 0xffffffffffffffff
mov ebx, edi
call fcn.10050402
inc eax
push eax
mov ecx, edi
call fcn.100017a8
lea eax, [ebp - 0x2c]
push eax
mov ecx, edi
call fcn.10001841
mov esi, eax
lea eax, [ebp - 0x24]
push eax
mov ecx, edi
call fcn.10001863
mov edi, eax
lea eax, [ebp - 0x1c]
push eax
mov ecx, ebx
call fcn.10001841
push dword [esi + 4]
push dword [esi]
push dword [edi + 4]
push dword [edi]
push dword [eax + 4]
push dword [eax]
lea eax, [ebp - 0x14]
push eax
call fcn.100513ae
add esp, 0x1c
mov ecx, ebx
call fcn.10004d1a
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ecx, ebx
mov esi, eax
call fcn.10001767
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x238]
xor ecx, ebp
call fcn.1006e011
add ebp, 0x23c
leave
ret
Function at 0x100531fe
Capabilities:
Print debug messages

Disassembly:
push 0x58
mov eax, 0x100b6236
call fcn.10075f38
xor esi, esi
cmp dword [ebx + 0x70], esi
je 0x10053218
xor eax, eax
jmp 0x10053364
mov eax, ebx
call fcn.10051f9e
cmp byte [ebp + 8], 0
jne 0x1005323e
lea eax, [ebx + 0x84]
mov ecx, dword [eax]
cmp ecx, 1
ja 0x1005323e
inc ecx
mov dword [eax], ecx
mov ecx, ebx
call fcn.10051da4
jmp 0x1005324b
mov edi, ebx
call fcn.1005392c
mov dword [ebx + 0x70], eax
mov dword [ebx + 0x18], eax
push dword [ebx + 0x88]
mov eax, ebx
call fcn.10052ec5
push dword [ebx + 0x8c]
mov eax, ebx
call fcn.10052f82
cmp dword [ebx + 0x98], esi
je 0x1005327b
lea eax, [ebx + 0x9c]
push eax
mov eax, ebx
call fcn.1005310c
cmp dword [ebx + 0x90], esi
je 0x10053290
push dword [ebx + 0x94]
mov eax, ebx
call fcn.10053040
push 0x100cb25c
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea eax, [ebp - 0x2c]
lea ecx, [ebx + 0x11e8]
push eax
call fcn.10053fd4
lea edi, [ebx + 0x11f4]
mov dword [ebp - 4], esi
call fcn.100512c2
mov eax, dword [ebp - 0x28]
mov esi, dword [eax]
lea ecx, [ebp - 0x18]
call fcn.1001dd66
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], eax
mov esi, dword [ebp - 0x28]
lea ecx, [ebp - 0x20]
call fcn.1001dd66
cmp dword [ebp - 0x18], 0
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], eax
je 0x100532ed
cmp dword [ebp - 0x18], eax
je 0x100532f2
call fcn.1006df11
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x14], eax
je 0x1005334a
lea esi, [ebp - 0x18]
call fcn.100547ad
push dword [eax]
push 0
call fcn.100547ad
add eax, 4
push eax
push ebx
call fcn.10052060
test eax, eax
jne 0x10053340
push 0x38
push eax
lea eax, [ebp - 0x64]
push eax
call fcn.10070cb0
or dword [ebp - 0x64], 0xffffffff
add esp, 0xc
call fcn.100547ad
push dword [eax]
mov ecx, dword [ebx + 0x7c]
push 0x59
lea edx, [ebp - 0x64]
call fcn.1004f84c
lea esi, [ebp - 0x18]
call fcn.10054e6b
jmp 0x100532ce
push str.ReloadDownloadtask_end
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x2c]
call fcn.10054c25
xor eax, eax
inc eax
call fcn.10075fd7
ret 4
Function at 0x10055fd0
Capabilities:
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0x100b4d63
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push ebp
push esi
push edi
mov eax, dword [0x100dd3e0]
xor eax, esp
push eax
lea eax, [esp + 0x34]
mov dword fs:[0], eax
mov esi, 0x100f9408
mov ebp, 0x100f4e6c
mov dword [esp + 0x14], 3
lea esp, [esp]
push 0x44
call fcn.1006dd7d
add esp, 4
mov dword [esp + 0x1c], eax
xor ebx, ebx
cmp eax, ebx
mov dword [esp + 0x3c], ebx
je 0x1005603e
mov ecx, dword [ebp + 4]
mov edx, dword [ebp]
push ecx
mov ecx, dword [ebp - 4]
push edx
push ecx
push eax
call fcn.10056a40
mov edi, eax
jmp 0x10056040
xor edi, edi
mov dword [esp + 0x3c], 0xffffffff
mov ecx, dword [esi]
cmp edi, ecx
je 0x1005605c
cmp ecx, ebx
je 0x1005605a
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
mov dword [esi], edi
mov ecx, dword [esi]
xor eax, eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x20], ebx
mov edx, dword [ecx]
mov edx, dword [edx + 0xc]
lea eax, [esp + 0x20]
push eax
call edx
test al, al
je 0x100560cc
mov eax, dword [esi]
lea ecx, [esp + 0x18]
call fcn.10055d70
mov dword [esp + 0x3c], 1
mov edi, dword [eax]
cmp edi, ebx
je 0x100560a7
lea eax, [edi + 4]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov eax, dword [esi + 0x10]
cmp eax, ebx
je 0x100560b6
lea ecx, [eax + 4]
call fcn.10034d9c
lea ecx, [esp + 0x18]
mov dword [esi + 0x10], edi
mov dword [esp + 0x3c], 0xffffffff
call fcn.10034c56
jmp 0x100560fd
call fcn.1005aaab
test al, al
je 0x100560ee
mov ecx, dword [esp + 0x2c]
push ecx
push str.CreateThread_Failed__last_error_d
push 2
mov ebx, str.D:jenkins_TrunkworkspaceCEN_Hive_QQPCDownload_ForDComqqpcmgr_projAsyncFrame_asyncframertapi.cpp
call fcn.1005a87b
add esp, 0xc
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
add ebp, 0xc
add esi, 4
sub dword [esp + 0x14], 1
jne 0x10056010
mov eax, 1
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret
Function at 0x100571c0
Capabilities:
Set thread local storage value

Disassembly:
push 0xffffffffffffffff
push 0x100b61dd
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x100dd3e0]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, dword [esp + 0x28]
xor edi, edi
mov dword [esi], vtable.qmbase::MessageLoop.0
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esp + 0x20], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
lea eax, [esi + 0x2c]
push 0x7d0
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x58], edi
mov dword [esi + 0x5c], edi
mov dword [esi + 0x64], edi
mov dword [esi + 0x68], edi
mov dword [esi + 0x6c], edi
mov dword [esi + 0x70], edi
mov dword [esi + 0x78], edi
mov dword [esi + 0x7c], edi
mov dword [esi + 0x80], edi
mov dword [esi + 0x84], edi
mov byte [esp + 0x20], 5
mov dword [esi + 0x88], edi
call fcn.100570c0
mov ebx, dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
push eax
call ebx
call fcn.100570c0
mov eax, dword [eax + 4]
cmp eax, 0xffffffff
je 0x10057277
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push 0x24
call fcn.1006dd7d
add esp, 4
mov dword [esp + 0x14], eax
cmp eax, edi
mov byte [esp + 0x20], 6
je 0x10057298
push eax
call fcn.10059d80
mov ebp, eax
jmp 0x1005729a
xor ebp, ebp
cmp ebp, edi
mov byte [esp + 0x20], 5
je 0x100572a9
lea eax, [ebp + 4]
push eax
call ebx
mov eax, dword [esi + 0x70]
cmp eax, edi
je 0x100572b8
lea ecx, [eax + 4]
call fcn.10034d9c
mov eax, esi
mov dword [esi + 0x70], ebp
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 4
Function at 0x10059c20
Capabilities:
Get thread local storage value

Disassembly:
push 0xffffffffffffffff
push 0x100b6108
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x100dd3e0]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
lea edi, [esi + 8]
push edi
mov dword [esp + 0x14], edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor ebx, ebx
mov dword [esp + 0x1c], ebx
cmp dword [esi + 0x20], ebx
je 0x10059c75
call fcn.100570c0
mov eax, dword [eax + 4]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, dword [esi + 0x20]
jne 0x10059c75
mov bl, 1
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, bl
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret

Function at 0x10059cc0
Capabilities:
Get thread local storage value

Disassembly:
push 0xffffffffffffffff
push 0x100b6a30
mov eax, dword fs:[0]
push eax
sub esp, 0x40
push ebx
push esi
push edi
mov eax, dword [0x100dd3e0]
xor eax, esp
push eax
lea eax, [esp + 0x50]
mov dword fs:[0], eax
mov esi, ecx
lea edi, [esi + 8]
push edi
xor bl, bl
mov dword [esp + 0x14], edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [esp + 0x58], 0
cmp dword [esi + 0x20], 0
je 0x10059d4a
call fcn.100570c0
mov eax, dword [eax + 4]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, dword [esi + 0x20]
je 0x10059d4a
push 0x38
push str.D:jenkins_TrunkworkspaceCEN_Hive_QQPCDownload_ForDComqqpcmgr_projAsyncFrameMessageLoopProxyImpl.cpp
push str.qmbase::MessageLoopProxyImpl::OnDestruct
lea ecx, [esp + 0x20]
call fcn.100349ea
push esi
mov byte [esp + 0x5c], 1
mov ecx, dword [esi + 0x20]
push eax
push ecx
call fcn.10059ea0
lea ecx, [esp + 0x14]
call fcn.10034b4c
mov bl, 1
push edi
mov dword [esp + 0x5c], 0xffffffff
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test bl, bl
jne 0x10059d68
mov edx, dword [esi]
mov eax, dword [edx + 0x14]
push 1
mov ecx, esi
call eax
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x4c
ret

Function at 0x10059d80
Capabilities:
Get thread local storage value

Disassembly:
push 0xffffffffffffffff
push 0x100b60e3
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x100dd3e0]
xor eax, esp
push eax
lea eax, [esp + 8]
mov dword fs:[0], eax
mov esi, dword [esp + 0x18]
xor eax, eax
mov dword [esi + 4], eax
mov dword [esp + 0x10], eax
lea eax, [esi + 8]
push 0x7d0
push eax
mov dword [esi], vtable.qmbase::MessageLoopProxyImpl.0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
mov byte [esp + 0x10], 1
call fcn.100570c0
mov eax, dword [eax + 4]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [esi + 0x20], eax
mov eax, esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0xc
ret 4