joyce8/EMBER2024-capa huggingface dataset:
Function at 0xee550
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebx
mov ebx, dword [0x1aa224]
push edi
push ebx
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0xee590
push esi
push 0xc08
call fcn.0015c8ae
push 0xc08
mov esi, eax
push 0
push esi
call fcn.00153d90
add esp, 0x10
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [esi], edi
pop esi
pop edi
pop ebx
ret
mov dword [eax], edi
pop edi
pop ebx
ret

Function at 0xee5a0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
mov edi, dword [0x1aa224]
push edi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0xee5dd
push esi
push 0xc08
call fcn.0015c8ae
push 0xc08
mov esi, eax
push 0
push esi
call fcn.00153d90
add esp, 0x10
push esi
push edi
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
lea eax, [esi + 4]
pop esi
pop edi
ret
add eax, 4
pop edi
ret

Function at 0xee5f0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, dword [0x1aa224]
push edi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0xee630
push 0xc08
call fcn.0015c8ae
add esp, 4
mov esi, eax
push 0xc08
push 0
push esi
call fcn.00153d90
add esp, 0xc
push esi
push edi
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
lea eax, [ebp + 0xc]
mov edx, 0x400
push eax
push dword [ebp + 8]
lea ecx, [esi + 4]
call fcn.000b2470
add esp, 8
pop edi
pop esi
pop ecx
pop ebp
ret

Function at 0xee650
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push esi
push edi
mov edi, dword [0x1aa224]
push edi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0xee692
push 0xc08
call fcn.0015c8ae
add esp, 4
mov esi, eax
push 0xc08
push 0
push esi
call fcn.00153d90
add esp, 0xc
push esi
push edi
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
lea eax, [ebp + 0xc]
push eax
push 0
push dword [ebp + 8]
lea eax, [esi + 0x405]
push 0x400
push eax
call fcn.000a1850
mov ecx, dword [eax]
push dword [eax + 4]
or ecx, 2
push ecx
call fcn.00158a01
add esp, 0x1c
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0xee6d0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push esi
push edi
mov edi, dword [0x1aa224]
push edi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0xee712
push 0xc08
call fcn.0015c8ae
add esp, 4
mov esi, eax
push 0xc08
push 0
push esi
call fcn.00153d90
add esp, 0xc
push esi
push edi
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
add esi, 0x405
mov ecx, esi
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0xee720
sub ecx, edx
lea edx, [ecx + 1]
test edx, edx
jle 0xee760
lea eax, [ebp + 0xc]
mov byte [edx + esi - 1], 0x20
push eax
lea ecx, [edx + esi]
mov eax, 0x400
push 0
push dword [ebp + 8]
sub eax, edx
push eax
push ecx
call fcn.000a1850
mov ecx, dword [eax]
push dword [eax + 4]
or ecx, 2
push ecx
call fcn.00158a01
add esp, 0x1c
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0xee770
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebx
mov ebx, dword [0x1aa224]
push esi
push edi
push ebx
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0xee7af
push 0xc08
call fcn.0015c8ae
add esp, 4
mov esi, eax
push 0xc08
push 0
push esi
call fcn.00153d90
add esp, 0xc
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
cmp dword [esi], 0
je 0xee7e4
call fcn.000ee340
test eax, eax
je 0xee7d0
push eax
push 0x18ea94
push edi
call fcn.000f0dc0
add esp, 0xc
pop edi
pop esi
pop ebx
ret
call fcn.000ee510
push eax
push str.Error_creating_Sleuth_Kit_error_string__Errno:__d__n
push edi
call fcn.000f0dc0
add esp, 0xc
pop edi
pop esi
pop ebx
ret

Function at 0xee7f0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
push edi
mov edi, dword [0x1aa224]
push edi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0xee82d
push 0xc08
call fcn.0015c8ae
push 0xc08
mov esi, eax
push 0
push esi
call fcn.00153d90
add esp, 0x10
push esi
push edi
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test esi, esi
je 0xee845
mov dword [esi], 0
mov byte [esi + 4], 0
mov byte [esi + 0x405], 0
mov byte [esi + 0x806], 0
pop edi
pop esi
ret

Function at 0xee880
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ecx
push esi
push edi
mov esi, edx
call fcn.000ee7f0
mov eax, dword [esi]
test eax, eax
je 0xee8c5
cmp dword [0x1aa220], 0
je 0xee8b6
push eax
push 1
push 1
push str.tsk_img_open:_Type:__d___NumImg:__d__Img1:__s_n
push 2
call fcn.00158e14
add esp, 4
push eax
call fcn.000ee850
add esp, 0x14
push ecx
mov edx, esi
call fcn.000f1960
add esp, 4
pop edi
pop esi
pop ecx
ret
call fcn.000ee7f0
mov edi, dword [0x1aa224]
push edi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0xee904
push 0xc08
call fcn.0015c8ae
add esp, 4
mov esi, eax
push 0xc08
push 0
push esi
call fcn.00153d90
add esp, 0xc
push esi
push edi
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push str.tsk_img_open
mov dword [esi], 0x2000000
call fcn.000ee5f0
add esp, 4
xor eax, eax
pop edi
pop esi
pop ecx
ret
Function at 0xee920
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, edx
mov ecx, 4
push edi
mov dword [ebp - 0x14], esi
call fcn.000f2310
mov dword [ebp - 4], eax
test eax, eax
jne 0xee946
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor ebx, ebx
mov edi, esi
sub eax, esi
mov dword [ebp - 0xc], eax
nop
mov esi, dword [edi]
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0xee955
sub esi, ecx
lea ecx, [esi*2 + 2]
call fcn.000f2310
mov ecx, dword [ebp - 0xc]
mov dword [ecx + edi], eax
test eax, eax
je 0xeea19
mov ecx, dword [edi]
mov dword [ebp - 8], eax
lea eax, [eax + esi*2]
push ecx
push eax
lea eax, [ebp - 8]
mov dword [ebp - 0x10], ecx
lea edx, [ecx + esi]
push eax
lea ecx, [ebp - 0x10]
call fcn.000f20a0
add esp, 0xc
mov dword [ebp - 0x10], eax
test eax, eax
jne 0xee9c3
mov eax, dword [ebp - 8]
xor ecx, ecx
inc ebx
add edi, 4
mov word [eax], cx
cmp ebx, 1
jl 0xee950
mov esi, dword [ebp - 4]
sub esp, 8
mov edx, esi
call fcn.000ee880
add esp, 8
mov ebx, eax
jmp 0xeea1e
mov edi, dword [0x1aa224]
push edi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0xee9fd
push 0xc08
call fcn.0015c8ae
add esp, 4
mov esi, eax
push 0xc08
push 0
push esi
call fcn.00153d90
add esp, 0xc
push esi
push edi
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [ebp - 0x14]
push dword [ebp - 0x10]
mov dword [esi], 0x200000c
push dword [eax + ebx*4]
push str.tsk_img_open_utf8:_Error_converting_image__s__d
call fcn.000ee5f0
add esp, 0xc
mov esi, dword [ebp - 4]
xor ebx, ebx
mov eax, dword [esi]
test eax, eax
je 0xeea2d
push eax
call fcn.00158d47
add esp, 4
push esi
call fcn.00158d47
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0xeea40
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ecx
push esi
push edi
test ecx, ecx
jne 0xeea9f
call fcn.000ee7f0
mov edi, dword [0x1aa224]
push edi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0xeea86
push 0xc08
call fcn.0015c8ae
add esp, 4
mov esi, eax
push 0xc08
push 0
push esi
call fcn.00153d90
add esp, 0xc
push esi
push edi
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push str.tsk_img_get_names:_IMG_INFO_is_NULL
mov dword [esi], 0x2000009
call fcn.000ee5f0
add esp, 4
xor eax, eax
pop edi
pop esi
pop ecx
ret
test edx, edx
jne 0xeeafb
call fcn.000ee7f0
mov edi, dword [0x1aa224]
push edi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0xeeae2
push 0xc08
call fcn.0015c8ae
add esp, 4
mov esi, eax
push 0xc08
push 0
push esi
call fcn.00153d90
add esp, 0xc
push esi
push edi
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push str.tsk_img_get_names:_a_num_imgs_is_NULL
mov dword [esi], 0x2000009
call fcn.000ee5f0
add esp, 4
xor eax, eax
pop edi
pop esi
pop ecx
ret
mov dword [edx], 0
mov eax, dword [ecx + 4]
sub eax, 1
jne 0xeea99
mov eax, dword [ecx + 0x40088]
pop edi
mov dword [edx], eax
mov eax, dword [ecx + 0x40090]
pop esi
pop ecx
ret
Function at 0xeef60
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, ecx
test edi, edi
je 0xeefbc
cmp dword [edi], 0x10101010
jne 0xeefbc
mov ecx, 0x10
call fcn.000f2310
mov esi, eax
test esi, esi
je 0xef009
push dword [ebp + 0xc]
mov dword [esi + 0xc], edi
push dword [ebp + 8]
mov dword [esi], 0x11212212
mov eax, dword [edi + 0xe0]
push esi
push edi
call eax
add esp, 0x10
test al, al
je 0xeefb6
push esi
call fcn.00158d47
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
ret
mov eax, esi
pop edi
pop esi
pop ebp
ret
mov edi, dword [0x1aa224]
push edi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0xeeff6
push 0xc08
call fcn.0015c8ae
add esp, 4
mov esi, eax
push 0xc08
push 0
push esi
call fcn.00153d90
add esp, 0xc
push esi
push edi
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push str.tsk_fs_file_open_meta:_called_with_NULL_or_unallocated_structures
mov dword [esi], 0x8000006
call fcn.000ee5f0
add esp, 4
pop edi
xor eax, eax
pop esi
pop ebp
ret

Function at 0xef010
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebx
push esi
push edi
mov edi, edx
test ecx, ecx
je 0xef0a2
mov eax, dword [ecx + 8]
test eax, eax
je 0xef0a2
mov edx, dword [ecx + 0xc]
test edx, edx
je 0xef0a2
cmp dword [eax], 0x13524635
je 0xef054
mov ecx, 0x8000006
call fcn.000ee550
push edi
push str._s:_called_with_unallocated_structures
call fcn.000ee5f0
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebx
ret
mov esi, dword [eax + 0xcc]
cmp esi, 2
jne 0xef07e
mov ecx, 0x8000009
call fcn.000ee550
push edi
push str._s:_called_for_file_with_corrupt_data
call fcn.000ee5f0
add esp, 8
lea eax, [esi - 1]
pop edi
pop esi
pop ebx
ret
cmp esi, 1
jne 0xef08c
cmp dword [eax + 0xc8], 0
jne 0xef09c
mov eax, dword [edx + 0xe8]
push ecx
call eax
add esp, 4
test al, al
jne 0xef0f0
xor eax, eax
pop edi
pop esi
pop ebx
ret
mov ebx, dword [0x1aa224]
push ebx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0xef0dc
push 0xc08
call fcn.0015c8ae
add esp, 4
mov esi, eax
push 0xc08
push 0
push esi
call fcn.00153d90
add esp, 0xc
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push edi
push str._s:_called_with_NULL_pointers
mov dword [esi], 0x8000006
call fcn.000ee5f0
add esp, 8
pop edi
pop esi
mov eax, 1
pop ebx
ret

Function at 0xef100
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
mov edx, str.tsk_fs_file_attr_getsize
mov esi, ecx
call fcn.000ef010
test eax, eax
je 0xef11a
call fcn.000ee7f0
xor eax, eax
pop esi
ret
mov ecx, dword [esi + 8]
pop esi
mov ecx, dword [ecx + 0xc8]
jmp fcn.00132080

Function at 0xef130
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
mov edx, str.tsk_fs_file_attr_get
mov esi, ecx
call fcn.000ef010
test eax, eax
je 0xef145
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0xc]
push esi
mov eax, dword [eax + 0xe4]
call eax
mov ecx, dword [esi + 8]
add esp, 4
mov edx, eax
mov ecx, dword [ecx + 0xc8]
pop esi
jmp fcn.00131c60
Function at 0xef170
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, edx
mov esi, ecx
mov edx, str.tsk_fs_file_attr_get_type
call fcn.000ef010
test eax, eax
je 0xef18d
xor eax, eax
pop edi
pop esi
pop ebp
ret
cmp byte [ebp + 0xc], 0
mov edx, edi
mov ecx, dword [esi + 8]
mov ecx, dword [ecx + 0xc8]
je 0xef1ad
push dword [ebp + 8]
call fcn.00131d70
add esp, 4
pop edi
pop esi
pop ebp
ret
pop edi
pop esi
pop ebp
jmp fcn.00131c60

Function at 0xef1c0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov bx, dx
mov edx, str.tsk_fs_file_attr_get_type
push esi
push edi
mov word [ebp - 2], bx
mov edi, ecx
call fcn.000ef010
test eax, eax
jne 0xef2a1
mov edx, str.tsk_fs_file_attr_getsize
mov ecx, edi
call fcn.000ef010
test eax, eax
je 0xef1f9
call fcn.000ee7f0
jmp 0xef250
mov ecx, dword [edi + 8]
mov ecx, dword [ecx + 0xc8]
call fcn.00132080
mov ebx, eax
xor esi, esi
test ebx, ebx
jle 0xef24c
nop
mov edx, str.tsk_fs_file_attr_get_idx
mov ecx, edi
call fcn.000ef010
test eax, eax
jne 0xef2a1
mov ecx, dword [edi + 8]
mov edx, esi
mov ecx, dword [ecx + 0xc8]
call fcn.00131fa0
test eax, eax
je 0xef2a1
mov cx, word [ebp - 2]
cmp word [eax + 0x18], cx
je 0xef2a3
inc esi
cmp esi, ebx
jl 0xef210
mov bx, cx
jmp 0xef250
mov bx, word [ebp - 2]
mov edi, dword [0x1aa224]
push edi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0xef28a
push 0xc08
call fcn.0015c8ae
add esp, 4
mov esi, eax
push 0xc08
push 0
push esi
call fcn.00153d90
add esp, 0xc
push esi
push edi
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
movzx eax, bx
push eax
push str.tsk_fs_attr_get_id:_Attribute_ID__d_not_found
mov dword [esi], 0x8000011
call fcn.000ee5f0
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0xef2b0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, edx
mov esi, ecx
call fcn.000ee7f0
test esi, esi
je 0xef372
mov eax, dword [esi + 8]
test eax, eax
je 0xef372
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0xef372
cmp dword [ecx], 0x10101010
jne 0xef353
cmp dword [eax], 0x13524635
jne 0xef353
cmp dword [0x1aa220], 0
je 0xef315
push dword [eax + 0xc]
push dword [eax + 8]
push str.tsk_fs_file_walk:_Processing_file__llu_n
push 2
call fcn.00158e14
add esp, 4
push eax
call fcn.000f0dc0
add esp, 0x10
mov edi, dword [ebp + 0xc]
mov edx, ebx
mov eax, edi
mov ecx, esi
shr eax, 1
not al
and al, 1
movzx eax, al
push eax
push dword [ebp + 8]
call fcn.000ef170
add esp, 8
test eax, eax
je 0xef3bf
push dword [ebp + 0x14]
mov edx, edi
mov ecx, eax
push dword [ebp + 0x10]
call fcn.001313c0
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
mov ecx, 0x8000006
call fcn.000ee550
push str.tsk_fs_file_walk:_called_with_unallocated_structures
call fcn.000ee5f0
add esp, 4
mov al, 1
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
mov edi, dword [0x1aa224]
push edi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0xef3ac
push 0xc08
call fcn.0015c8ae
add esp, 4
mov esi, eax
push 0xc08
push 0
push esi
call fcn.00153d90
add esp, 0xc
push esi
push edi
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push str.tsk_fs_file_walk:_called_with_NULL_pointers
mov dword [esi], 0x8000006
call fcn.000ee5f0
add esp, 4
pop edi
pop esi
mov al, 1
pop ebx
pop ecx
pop ebp
ret

Function at 0xef3d0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push esi
push edi
mov edi, edx
mov esi, ecx
call fcn.000ee7f0
test esi, esi
je 0xef478
mov eax, dword [esi + 8]
test eax, eax
je 0xef478
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0xef478
cmp dword [ecx], 0x10101010
jne 0xef459
cmp dword [eax], 0x13524635
jne 0xef459
cmp dword [0x1aa220], 0
je 0xef432
push dword [eax + 0xc]
push dword [eax + 8]
push str.tsk_fs_file_walk:_Processing_file__llu_n
push 2
call fcn.00158e14
add esp, 4
push eax
call fcn.000f0dc0
add esp, 0x10
mov ecx, esi
call fcn.000ef130
test eax, eax
je 0xef4c5
push dword [ebp + 0xc]
mov edx, edi
mov ecx, eax
push dword [ebp + 8]
call fcn.001313c0
add esp, 8
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, 0x8000006
call fcn.000ee550
push str.tsk_fs_file_walk:_called_with_unallocated_structures
call fcn.000ee5f0
add esp, 4
mov al, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov edi, dword [0x1aa224]
push edi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0xef4b2
push 0xc08
call fcn.0015c8ae
add esp, 4
mov esi, eax
push 0xc08
push 0
push esi
call fcn.00153d90
add esp, 0xc
push esi
push edi
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push str.tsk_fs_file_walk:_called_with_NULL_pointers
mov dword [esi], 0x8000006
call fcn.000ee5f0
add esp, 4
pop edi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0xef4d0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, edx
mov esi, ecx
call fcn.000ee7f0
test esi, esi
je 0xef552
mov eax, dword [esi + 8]
test eax, eax
je 0xef552
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0xef552
cmp dword [ecx], 0x10101010
jne 0xef534
cmp dword [eax], 0x13524635
jne 0xef534
push 1
push dword [ebp + 8]
mov edx, edi
mov ecx, esi
call fcn.000ef170
add esp, 8
test eax, eax
je 0xef59f
mov edx, dword [ebp + 0x14]
push ecx
push dword [ebp + 0x18]
mov ecx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.00131530
add esp, 0x10
pop edi
pop esi
pop ebp
ret
mov ecx, 0x8000006
call fcn.000ee550
push str.tsk_fs_file_read:_called_with_unallocated_structures
call fcn.000ee5f0
add esp, 4
or eax, 0xffffffff
pop edi
pop esi
pop ebp
ret
mov edi, dword [0x1aa224]
push edi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0xef58c
push 0xc08
call fcn.0015c8ae
add esp, 4
mov esi, eax
push 0xc08
push 0
push esi
call fcn.00153d90
add esp, 0xc
push esi
push edi
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push str.tsk_fs_file_read:_called_with_NULL_pointers
mov dword [esi], 0x8000006
call fcn.000ee5f0
add esp, 4
pop edi
or eax, 0xffffffff
pop esi
pop ebp
ret

Function at 0xef5b0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push edi
mov edi, edx
test esi, esi
je 0xef612
cmp dword [esi + 0xc], 0
je 0xef612
mov edx, str.tsk_fs_file_attr_get
call fcn.000ef010
test eax, eax
jne 0xef65f
mov eax, dword [esi + 0xc]
push esi
mov eax, dword [eax + 0xe4]
call eax
mov ecx, dword [esi + 8]
add esp, 4
mov edx, eax
mov ecx, dword [ecx + 0xc8]
call fcn.00131c60
test eax, eax
je 0xef65f
push ecx
push dword [ebp + 0x10]
mov edx, edi
mov ecx, eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00131530
add esp, 0x10
pop edi
pop esi
pop ebp
ret
mov edi, dword [0x1aa224]
push edi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0xef64c
push 0xc08
call fcn.0015c8ae
add esp, 4
mov esi, eax
push 0xc08
push 0
push esi
call fcn.00153d90
add esp, 0xc
push esi
push edi
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push str.tsk_fs_file_read:_fs_info_is_NULL
mov dword [esi], 0x8000006
call fcn.000ee5f0
add esp, 4
pop edi
or eax, 0xffffffff
pop esi
pop ebp
ret
Function at 0xef9e0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
push esi
push edi
test ecx, ecx
je 0xefa32
cmp dword [ecx], 0x10101010
jne 0xefa32
mov eax, dword [ecx + 0xf0]
test eax, eax
je 0xefa32
push dword [ebp + 0xc]
lea edx, [ebp - 4]
push dword [ebp + 8]
push edx
push ecx
call eax
add esp, 0x10
test eax, eax
je 0xefa29
mov ecx, dword [ebp - 4]
call fcn.000efa90
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov edi, dword [0x1aa224]
push edi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0xefa6c
push 0xc08
call fcn.0015c8ae
add esp, 4
mov esi, eax
push 0xc08
push 0
push esi
call fcn.00153d90
add esp, 0xc
push esi
push edi
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push str.tsk_fs_dir_open_meta:_called_with_NULL_or_unallocated_structures
mov dword [esi], 0x8000006
call fcn.000ee5f0
add esp, 4
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0xefb80
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ecx
push esi
push edi
test ecx, ecx
je 0xefb96
cmp dword [ecx], 0x97531246
jne 0xefb96
mov eax, dword [ecx + 0xc]
pop edi
pop esi
pop ecx
ret
mov edi, dword [0x1aa224]
push edi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0xefbd0
push 0xc08
call fcn.0015c8ae
add esp, 4
mov esi, eax
push 0xc08
push 0
push esi
call fcn.00153d90
add esp, 0xc
push esi
push edi
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push str.tsk_fs_dir_getsize:_called_with_NULL_or_unallocated_structures
mov dword [esi], 0x8000006
call fcn.000ee5f0
add esp, 4
xor eax, eax
pop edi
pop esi
pop ecx
ret
Function at 0xefbf0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
test edi, edi
je 0xefd31
cmp dword [edi], 0x97531246
jne 0xefd31
mov eax, dword [edi + 0x24]
mov dword [ebp - 4], eax
test eax, eax
je 0xefd31
cmp dword [edi + 0xc], esi
ja 0xefc46
mov ecx, 0x8000006
call fcn.000ee550
push dword [edi + 0xc]
push esi
push str.tsk_fs_dir_get:_Index___Iu__too_large___Iu_
call fcn.000ee5f0
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, 0x10
call fcn.000f2310
mov ebx, eax
test ebx, ebx
je 0xefd7e
mov eax, dword [ebp - 4]
shl esi, 6
mov dword [ebx + 0xc], eax
mov dword [ebx], 0x11212212
add esi, dword [edi + 8]
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0xefc84
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0xefc76
sub ecx, edx
lea edx, [ecx + 1]
jmp 0xefc86
xor edx, edx
mov ecx, dword [esi + 4]
test ecx, ecx
je 0xefca0
lea eax, [ecx + 1]
mov dword [ebp - 4], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0xefc93
sub ecx, dword [ebp - 4]
inc ecx
jmp 0xefca2
xor ecx, ecx
call fcn.00132100
mov dword [ebx + 4], eax
test eax, eax
je 0xefd7e
mov edx, esi
mov ecx, eax
call fcn.001321d0
test al, al
jne 0xefd7e
mov edx, dword [esi + 0x18]
mov eax, edx
mov ecx, dword [esi + 0x1c]
or eax, ecx
jne 0xefcd5
test byte [esi + 0x38], 1
je 0xefd28
mov eax, dword [edi + 0x24]
push ecx
push edx
push ebx
push eax
mov eax, dword [eax + 0xe0]
call eax
add esp, 0x10
test al, al
je 0xefd0a
cmp dword [0x1aa220], 0
je 0xefd05
push 2
call fcn.00158e14
add esp, 4
mov ecx, eax
call fcn.000ee770
call fcn.000ee7f0
mov ecx, dword [ebx + 8]
test ecx, ecx
je 0xefd28
mov eax, dword [ecx + 0xc4]
cmp eax, dword [esi + 0x20]
je 0xefd28
call fcn.00132560
mov dword [ebx + 8], 0
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, dword [0x1aa224]
push edi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0xefd6b
push 0xc08
call fcn.0015c8ae
add esp, 4
mov esi, eax
push 0xc08
push 0
push esi
call fcn.00153d90
add esp, 0xc
push esi
push edi
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push str.tsk_fs_dir_get:_called_with_NULL_or_unallocated_structures
mov dword [esi], 0x8000006
call fcn.000ee5f0
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret