joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10161ee0
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1dc
mov ecx, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, eax
push edi
mov dword [ebp - 4], 0
call fcn.1017c720
test al, al
jne 0x10161f15
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push 0x80
lea eax, [ebp - 0xd8]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x80
lea ecx, [ebp - 0x158]
push 0
push ecx
call sub.msvcrt.dll_memset
mov ebx, dword [ebp + 0x10]
add esp, 0xc
lea edx, [ebp - 0x58]
push edx
lea eax, [ebp - 0x1d8]
push eax
mov eax, dword [ebx]
lea ecx, [ebp - 4]
push ecx
mov ecx, dword [ebp + 8]
lea edx, [ebp - 0xd8]
push edx
push eax
push edi
call fcn.10161a80
mov edi, eax
test edi, edi
jne 0x10161ffd
mov eax, dword [ebp + 0xc]
inc dword [esi + 4]
mov ecx, dword [eax + 0x88]
lea edx, [ebp - 0xd8]
push edx
push eax
mov eax, dword [ebp + 8]
push ebx
push eax
lea esi, [ebp - 0x30]
mov dword [ebp - 8], ecx
call fcn.1015fa10
mov edi, eax
test edi, edi
jl 0x10161ffd
xor esi, esi
mov byte [ebp + 0xf], 0
cmp dword [ebx + 4], esi
jbe 0x10161ff3
lea ecx, [ebp - 0x158]
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp - 4]
push edx
push eax
lea ecx, [ebp - 0xd8]
push ecx
lea edx, [ebp - 0x58]
push edx
mov edx, dword [ebp - 8]
lea eax, [ebp - 0x30]
push eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x1d8]
push ecx
push edx
push eax
mov ecx, esi
mov eax, ebx
call fcn.101606a0
mov edi, eax
test edi, edi
jl 0x10161ffd
jne 0x10161fe9
mov byte [ebp + 0xf], 1
add dword [ebp - 4], 4
inc esi
cmp esi, dword [ebx + 4]
jb 0x10161fae
xor ecx, ecx
cmp byte [ebp + 0xf], cl
sete cl
mov edi, ecx
xor eax, eax
mov dword [ebp + 8], eax
cmp dword [ebx + 4], eax
jbe 0x10162063
mov esi, dword [ebp + eax*4 - 0x158]
test esi, esi
je 0x10162057
call fcn.10171ee0
mov eax, dword [0x101e316c]
test eax, eax
jl 0x10162057
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test ebx, ebx
je 0x10162054
push 0x44
push 0xfe
push esi
call sub.msvcrt.dll_memset
mov dword [esi], 0
mov eax, dword [ebx + 0x1c]
add esp, 0xc
test eax, eax
je 0x1016204e
mov dword [eax], esi
jmp 0x10162051
mov dword [ebx + 0x18], esi
mov dword [ebx + 0x1c], esi
mov ebx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
inc eax
mov dword [ebp + 8], eax
cmp eax, dword [ebx + 4]
jb 0x10162007
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x101627d0
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebx
push esi
mov ebx, ecx
mov esi, dword [ebx + 0x8128]
push edi
xor edi, edi
mov dword [ebx], 0x1008fd60
cmp esi, edi
je 0x10162808
mov eax, dword [0x101e316c]
cmp eax, edi
jge 0x101627f6
xor eax, eax
jmp 0x101627fd
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov eax, dword [eax]
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [ebx + 0x8134]
cmp ecx, edi
je 0x1016281a
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
mov ecx, dword [ebx + 0x8138]
mov dword [ebx + 0x8134], edi
cmp ecx, edi
je 0x10162832
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
test byte [ebx + 0x7fd1], 0x80
mov dword [ebx + 0x8138], edi
jne 0x1016285f
mov esi, dword [ebx + 0x8130]
cmp esi, edi
je 0x10162859
call fcn.10100050
push esi
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [ebx + 0x8130], edi
cmp byte [ebx + 0x826c], 0
mov dword [ebx + 0x8268], edi
je 0x1016289e
mov esi, dword [ebx + 0x8260]
cmp esi, edi
je 0x10162897
mov eax, dword [0x101e316c]
cmp eax, edi
jge 0x10162885
xor eax, eax
jmp 0x1016288c
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [eax]
push esi
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov byte [ebx + 0x826c], 0
mov dword [ebx + 0x8260], edi
mov dword [ebx + 0x8264], edi
cmp byte [ebx + 0x825c], 0
mov dword [ebx + 0x8258], edi
je 0x101628e9
mov esi, dword [ebx + 0x8250]
cmp esi, edi
je 0x101628e2
mov eax, dword [0x101e316c]
cmp eax, edi
jge 0x101628d0
xor eax, eax
jmp 0x101628d7
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edx, dword [eax]
push esi
push edi
push edx
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov byte [ebx + 0x825c], 0
mov dword [ebx + 0x8250], edi
mov dword [ebx + 0x8254], edi
cmp byte [ebx + 0x824c], 0
mov dword [ebx + 0x8248], edi
je 0x10162934
mov esi, dword [ebx + 0x8240]
cmp esi, edi
je 0x1016292d
mov eax, dword [0x101e316c]
cmp eax, edi
jge 0x1016291b
xor eax, eax
jmp 0x10162922
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov eax, dword [eax]
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov byte [ebx + 0x824c], 0
mov dword [ebx + 0x8240], edi
mov dword [ebx + 0x8244], edi
cmp byte [ebx + 0x823c], 0
mov dword [ebx + 0x8238], edi
je 0x1016297f
mov esi, dword [ebx + 0x8230]
cmp esi, edi
je 0x10162978
mov eax, dword [0x101e316c]
cmp eax, edi
jge 0x10162966
xor eax, eax
jmp 0x1016296d
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [eax]
push esi
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov byte [ebx + 0x823c], 0
mov dword [ebx + 0x8230], edi
mov dword [ebx + 0x8234], edi
lea edi, [ebx + 0x8230]
mov esi, 0x13
sub edi, 0xc
call fcn.10164ff0
sub esi, 1
jns 0x10162996
pop edi
pop esi
mov ecx, ebx
pop ebx
jmp fcn.10168fa0
Function at 0x10163f40
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, eax
xor esi, esi
push edi
test ebx, ebx
je 0x10163fa1
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10163f53
sub eax, edx
lea edi, [eax + 1]
cmp edi, 0xffffffff
ja 0x10163f8a
mov eax, dword [0x101e316c]
test eax, eax
jge 0x10163f71
xor eax, eax
jmp 0x10163f78
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov eax, dword [eax]
push edi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
jne 0x10163f96
pop edi
pop esi
mov eax, 0x8007000e
pop ebx
pop ebp
ret 4
push edi
push ebx
push esi
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov ebx, dword [ebp + 8]
mov edi, dword [ebx + 0x8128]
test edi, edi
je 0x10163fce
mov eax, dword [0x101e316c]
test eax, eax
jge 0x10163fbb
xor eax, eax
jmp 0x10163fc2
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [eax]
push edi
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
mov dword [ebx + 0x8128], esi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 4

Function at 0x10165510
Capabilities:
Get thread local storage value

Disassembly:
cmp byte [esi + 0xc], 0
mov dword [esi + 8], 0
je 0x10165549
push edi
mov edi, dword [esi]
test edi, edi
je 0x10165544
mov eax, dword [0x101e316c]
test eax, eax
jge 0x10165531
xor eax, eax
jmp 0x10165538
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov eax, dword [eax]
push edi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov byte [esi + 0xc], 0
pop edi
push esi
mov dword [esi], 0
mov dword [esi + 4], 0
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
add esp, 4
mov eax, esi
ret

Function at 0x10168cd0
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [0x101e316c]
test eax, eax
jge 0x10168ce2
xor eax, eax
jmp 0x10168ce9
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [ebp + 8]
mov dword [eax + 8], ecx
mov dword [eax + 0xc], 0
mov dword [eax + 0x10], 0
pop ebp
ret 4

Function at 0x10168d10
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x101e316c]
test eax, eax
jge 0x10168d1d
xor eax, eax
jmp 0x10168d24
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp dword [eax + 0xc], 0
je 0x10168d49
mov ecx, dword [eax + 0xc]
test ecx, ecx
jne 0x10168d34
xor eax, eax
ret
mov edx, dword [ecx]
mov dword [eax + 0xc], edx
test edx, edx
jne 0x10168d40
mov dword [eax + 0x10], edx
mov dword [ecx], 0xfefefefe
mov eax, ecx
ret
mov ecx, dword [eax + 8]
push 0x10
push pe_nt_image_headers32
call fcn.101d8457
ret
Function at 0x10168d60
Capabilities:
Get thread local storage value

Disassembly:
test esi, esi
je 0x10168da9
mov eax, dword [0x101e316c]
push edi
test eax, eax
jge 0x10168d72
xor edi, edi
jmp 0x10168d7b
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
push pe_nt_image_headers32
push 0xfe
push esi
call sub.msvcrt.dll_memset
mov dword [esi], 0
mov eax, dword [edi + 0x10]
add esp, 0xc
test eax, eax
je 0x10168da2
mov dword [eax], esi
mov dword [edi + 0x10], esi
pop edi
ret
mov dword [edi + 0xc], esi
mov dword [edi + 0x10], esi
pop edi
ret
Function at 0x10169740
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [edi + 0x7f28]
push ebx
push esi
cmp dword [edi + 8], eax
jne 0x101697f9
lea ebx, [eax + eax]
test eax, eax
jne 0x10169763
mov ebx, 0x10
cmp ebx, eax
jae 0x10169774
pop esi
mov eax, 0x80070216
pop ebx
mov esp, ebp
pop ebp
ret 4
mov esi, ebx
call fcn.1016a960
mov esi, eax
test esi, esi
jne 0x1016978e
pop esi
mov eax, 0x8007000e
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [edi + 8]
mov ecx, dword [edi + 0x7f2c]
add eax, eax
add eax, eax
push eax
push ecx
push esi
call sub.msvcrt.dll_memcpy
mov eax, dword [edi + 8]
mov edx, ebx
sub edx, eax
add edx, edx
add edx, edx
push edx
lea eax, [esi + eax*4]
push 0
push eax
call sub.msvcrt.dll_memset
mov ecx, dword [edi + 0x7f2c]
add esp, 0x18
mov dword [ebp - 4], ecx
test ecx, ecx
je 0x101697ed
mov eax, dword [0x101e316c]
test eax, eax
jge 0x101697d7
xor eax, eax
jmp 0x101697e1
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [ebp - 4]
push ecx
mov ecx, dword [eax]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 0x7f2c], esi
mov dword [edi + 0x7f28], ebx
mov edx, dword [edi + 8]
mov eax, dword [ebp + 8]
mov ecx, dword [edi + 0x7f2c]
mov dword [ecx + edx*4], eax
mov edx, dword [edi + 8]
mov dword [eax], edx
inc dword [edi + 8]
or dword [edi + 0x18], 4
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10169830
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [edi + 0x7f30]
sub esp, 0xc
push esi
cmp dword [edi + 0xc], eax
jne 0x101698fe
test eax, eax
je 0x10169858
lea esi, [eax + eax]
mov dword [esp + 4], esi
jmp 0x10169864
mov dword [esp + 4], 0x400
mov esi, dword [esp + 4]
cmp esi, eax
jae 0x10169874
mov eax, 0x80070216
pop esi
mov esp, ebp
pop ebp
ret 4
call fcn.1016a960
mov esi, eax
test esi, esi
jne 0x1016988b
mov eax, 0x8007000e
pop esi
mov esp, ebp
pop ebp
ret 4
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 0x7f34]
add eax, eax
add eax, eax
push eax
push ecx
push esi
call sub.msvcrt.dll_memcpy
mov eax, dword [edi + 0xc]
mov edx, dword [esp + 0x10]
sub edx, eax
add edx, edx
add edx, edx
push edx
lea eax, [esi + eax*4]
push 0
push eax
call sub.msvcrt.dll_memset
mov ecx, dword [edi + 0x7f34]
add esp, 0x18
mov dword [esp + 8], ecx
test ecx, ecx
je 0x101698ee
mov eax, dword [0x101e316c]
test eax, eax
jge 0x101698d7
xor eax, eax
jmp 0x101698e2
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [esp + 8]
push ecx
mov ecx, dword [eax]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edx, dword [esp + 4]
mov dword [edi + 0x7f34], esi
mov dword [edi + 0x7f30], edx
cmp byte [ebp + 8], 0
je 0x10169962
mov eax, dword [ebx + 0x50]
mov eax, dword [eax + 8]
and eax, 0x100
xor ecx, ecx
or eax, ecx
je 0x10169962
or eax, 0xffffffff
cmp dword [ebx + 0x5c], eax
jne 0x10169962
cmp dword [ebx + 0x58], eax
jne 0x10169962
mov eax, dword [ebx + 0x44]
fld qword [ebx + 0xb8]
or dword [ebx + 0x40], 0x800010
fld st(0)
mov dword [ebx + 0x44], eax
call fcn.101dc8f9
mov dword [esp + 8], eax
fild dword [esp + 8]
fsubp st(1)
fabs
fcomp qword [0x100a3010]
fnstsw ax
test ah, 5
jp 0x10169962
mov ecx, dword [ebx + 0x44]
or dword [ebx + 0x40], 0x100000
mov dword [ebx + 0x44], ecx
mov eax, dword [ebx + 0x50]
mov edx, dword [eax + 0xc]
mov ecx, dword [eax + 8]
mov eax, ecx
mov dword [esp + 0xc], edx
and eax, 0x10
xor edx, edx
or eax, edx
je 0x10169990
and ecx, 0x200000
xor eax, eax
or ecx, eax
je 0x10169990
mov eax, dword [ebx + 0x44]
or dword [ebx + 0x40], 0x10
mov dword [ebx + 0x44], eax
mov eax, dword [edi + 0xc]
mov dword [ebx + 0x48], eax
mov ecx, dword [edi + 0x7f34]
mov dword [ecx + eax*4], ebx
inc dword [edi + 0xc]
or dword [edi + 0x18], 4
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x101699c0
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [edi + 0x7f38]
push ebx
push esi
cmp dword [edi + 0x10], eax
jne 0x10169a70
lea ebx, [eax + eax]
test eax, eax
jne 0x101699e3
mov ebx, pe_nt_image_headers32
cmp ebx, eax
jae 0x101699f4
pop esi
mov eax, 0x80070216
pop ebx
mov esp, ebp
pop ebp
ret 4
mov esi, ebx
call fcn.1016a960
mov esi, eax
test esi, esi
jne 0x10169a0e
pop esi
mov eax, 0x8007000e
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [edi + 0x10]
mov ecx, dword [edi + 0x14]
add eax, eax
add eax, eax
push eax
push ecx
push esi
call sub.msvcrt.dll_memcpy
mov eax, dword [edi + 0x10]
mov edx, ebx
sub edx, eax
add edx, edx
add edx, edx
push edx
lea eax, [esi + eax*4]
push 0
push eax
call sub.msvcrt.dll_memset
mov ecx, dword [edi + 0x14]
add esp, 0x18
mov dword [ebp - 4], ecx
test ecx, ecx
je 0x10169a67
mov eax, dword [0x101e316c]
test eax, eax
jge 0x10169a51
xor eax, eax
jmp 0x10169a5b
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [ebp - 4]
push ecx
mov ecx, dword [eax]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 0x14], esi
mov dword [edi + 0x7f38], ebx
mov edx, dword [edi + 0x10]
mov eax, dword [ebp + 8]
mov dword [eax + 0x10], edx
mov ecx, dword [edi + 0x10]
mov edx, dword [edi + 0x14]
mov dword [edx + ecx*4], eax
inc dword [edi + 0x10]
or dword [edi + 0x18], 4
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x10169e20
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [0x101e316c]
push ebx
xor ebx, ebx
cmp eax, ebx
push esi
jge 0x10169e36
xor eax, eax
jmp 0x10169e3d
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp dword [eax + 0x18], ebx
je 0x10169e65
mov ecx, dword [eax + 0x18]
cmp ecx, ebx
jne 0x10169e4f
xor ecx, ecx
mov esi, ecx
jmp 0x10169e73
mov edx, dword [ecx]
mov dword [eax + 0x18], edx
cmp edx, ebx
jne 0x10169e5b
mov dword [eax + 0x1c], ebx
mov dword [ecx], 0xfefefefe
mov esi, ecx
jmp 0x10169e73
mov ecx, dword [eax + 0x14]
push 0x10
push 0x44
call fcn.101d8457
mov esi, eax
cmp esi, ebx
je 0x10169ee0
or eax, 0xffffffff
push edi
xor ecx, ecx
xor edx, edx
push ebx
mov dword [esi + 0x10], eax
mov word [esi + 0x40], cx
mov ecx, dword [ebp + 0x14]
mov word [esi + 0x42], dx
mov edx, dword [ebp + 0x18]
mov dword [esi + 0x20], eax
mov eax, dword [ebp + 0x10]
push esi
mov dword [esi], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 4], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
call fcn.10172020
mov edi, eax
cmp edi, ebx
jl 0x10169eeb
mov edi, dword [ebp + 8]
push esi
call fcn.101699c0
mov edi, eax
cmp edi, ebx
jl 0x10169eeb
mov ecx, dword [ebp + 0xc]
pop edi
mov dword [ecx], esi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 0x14
pop esi
mov eax, 0x8007000e
pop ebx
pop ebp
ret 0x14
call fcn.10171ee0
call fcn.101751f0
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 0x14
Function at 0x1016a100
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [0x101e316c]
push ebx
xor ebx, ebx
cmp eax, ebx
push esi
jge 0x1016a116
xor eax, eax
jmp 0x1016a11d
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp dword [eax + 0x18], ebx
je 0x1016a145
mov ecx, dword [eax + 0x18]
cmp ecx, ebx
jne 0x1016a12f
xor ecx, ecx
mov esi, ecx
jmp 0x1016a153
mov edx, dword [ecx]
mov dword [eax + 0x18], edx
cmp edx, ebx
jne 0x1016a13b
mov dword [eax + 0x1c], ebx
mov dword [ecx], 0xfefefefe
mov esi, ecx
jmp 0x1016a153
mov ecx, dword [eax + 0x14]
push 0x10
push 0x44
call fcn.101d8457
mov esi, eax
cmp esi, ebx
je 0x1016a1be
or eax, 0xffffffff
mov dword [esi + 0x10], eax
mov dword [esi + 0x20], eax
mov eax, dword [ebp + 0xc]
push edi
push eax
xor ecx, ecx
xor edx, edx
push esi
mov dword [esi], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 4], ebx
mov word [esi + 0x40], cx
mov dword [esi + 0xc], ebx
mov word [esi + 0x42], dx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
call fcn.10172c80
mov edi, eax
cmp edi, ebx
jl 0x1016a1c9
mov edi, dword [ebp + 8]
push esi
call fcn.101699c0
mov edi, eax
cmp edi, ebx
jl 0x1016a1c9
mov ecx, dword [ebp + 0x10]
xor eax, eax
cmp ecx, ebx
je 0x1016a1d5
pop edi
mov dword [ecx], esi
pop esi
pop ebx
pop ebp
ret 0xc
pop esi
mov eax, 0x8007000e
pop ebx
pop ebp
ret 0xc
call fcn.10171ee0
call fcn.101751f0
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x1016a4a0
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
cmp ebx, dword [esi + 0xc]
jae 0x1016a51e
jmp 0x1016a4c0
mov eax, dword [esi + 0x7f34]
mov edi, dword [eax + ebx*4]
test edi, edi
je 0x1016a515
call fcn.101654a0
mov eax, dword [0x101e316c]
test eax, eax
jge 0x1016a4df
xor esi, esi
jmp 0x1016a4e8
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
push pe_nt_image_headers32
push 0xfe
push edi
call sub.msvcrt.dll_memset
mov dword [edi], 0
mov eax, dword [esi + 0x10]
add esp, 0xc
test eax, eax
je 0x1016a50c
mov dword [eax], edi
jmp 0x1016a50f
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov esi, dword [ebp + 8]
inc ebx
cmp ebx, dword [esi + 0xc]
jb 0x1016a4c0
mov ebx, dword [ebp + 0xc]
mov eax, dword [esi + 8]
mov dword [esi + 0xc], ebx
test eax, eax
jbe 0x1016a532
mov ecx, dword [esi + 0x7f2c]
mov ecx, dword [ecx]
jmp 0x1016a534
xor ecx, ecx
xor edi, edi
mov dword [ebp - 4], edi
test eax, eax
jbe 0x1016a62a
mov eax, dword [ecx + 8]
and eax, 0x28001028
xor edx, edx
or eax, edx
je 0x1016a604
mov ebx, dword [ecx + 0x24]
test ebx, ebx
je 0x1016a604
mov edi, edi
mov esi, dword [ebx + 0x94]
test esi, esi
je 0x1016a5aa
mov ecx, dword [esi + 8]
xor edi, edi
test ecx, ecx
jbe 0x1016a5aa
cmp edi, ecx
jae 0x1016a57e
mov edx, dword [esi]
lea eax, [edx + edi*4]
jmp 0x1016a580
xor eax, eax
mov eax, dword [eax]
mov edx, dword [eax + 0x48]
cmp edx, dword [ebp + 0xc]
jae 0x1016a591
inc edi
cmp edi, ecx
jb 0x1016a577
jmp 0x1016a5aa
cmp edi, dword [esi + 4]
jbe 0x1016a5a7
cmp byte [esi + 0xd], 0
je 0x1016a5aa
mov ecx, edi
call fcn.100da6b0
test eax, eax
jne 0x1016a5aa
mov dword [esi + 8], edi
mov esi, dword [ebx + 0x98]
test esi, esi
je 0x1016a5f4
mov ecx, dword [esi + 8]
xor edi, edi
test ecx, ecx
jbe 0x1016a5f4
mov edx, dword [ebp + 0xc]
cmp edi, ecx
jae 0x1016a5cb
mov eax, dword [esi]
lea eax, [eax + edi*4]
jmp 0x1016a5cd
xor eax, eax
mov eax, dword [eax]
cmp dword [eax + 0x48], edx
jae 0x1016a5db
inc edi
cmp edi, ecx
jb 0x1016a5c4
jmp 0x1016a5f4
cmp edi, dword [esi + 4]
jbe 0x1016a5f1
cmp byte [esi + 0xd], 0
je 0x1016a5f4
mov ecx, edi
call fcn.100da6b0
test eax, eax
jne 0x1016a5f4
mov dword [esi + 8], edi
mov ebx, dword [ebx]
test ebx, ebx
jne 0x1016a560
mov esi, dword [ebp + 8]
mov edi, dword [ebp - 4]
mov eax, dword [esi + 8]
inc edi
mov dword [ebp - 4], edi
cmp edi, eax
jb 0x1016a616
xor ecx, ecx
mov dword [ebp - 4], eax
jmp 0x1016a61f
mov ecx, dword [esi + 0x7f2c]
mov ecx, dword [ecx + edi*4]
mov edi, dword [ebp - 4]
cmp edi, eax
jb 0x1016a541
or dword [esi + 0x18], 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1016a6f0
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 4], eax
cmp eax, dword [ebx + 0x10]
jae 0x1016a75e
mov ecx, dword [ebx + 0x14]
mov esi, dword [ecx + eax*4]
test esi, esi
je 0x1016a74f
call fcn.10171ee0
mov eax, dword [0x101e316c]
test eax, eax
jl 0x1016a74f
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
test edi, edi
je 0x1016a74f
push 0x44
push 0xfe
push esi
call sub.msvcrt.dll_memset
mov dword [esi], 0
mov eax, dword [edi + 0x1c]
add esp, 0xc
test eax, eax
je 0x1016a749
mov dword [eax], esi
jmp 0x1016a74c
mov dword [edi + 0x18], esi
mov dword [edi + 0x1c], esi
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp eax, dword [ebx + 0x10]
jb 0x1016a703
mov eax, dword [ebp + 8]
or dword [ebx + 0x18], 7
mov dword [ebx + 0x10], eax
mov eax, dword [ebx + 8]
test eax, eax
jbe 0x1016a776
mov edx, dword [ebx + 0x7f2c]
mov ecx, dword [edx]
jmp 0x1016a778
xor ecx, ecx
xor edi, edi
test eax, eax
jbe 0x1016a7de
mov eax, dword [ecx + 8]
and eax, 0x28001028
xor edx, edx
or eax, edx
je 0x1016a7c2
mov esi, dword [ecx + 0x24]
test esi, esi
je 0x1016a7c2
jmp 0x1016a7a0
mov edx, dword [ebp + 8]
mov eax, dword [esi + 0x94]
call fcn.1016a440
mov edx, dword [ebp + 8]
mov eax, dword [esi + 0x98]
call fcn.1016a440
mov esi, dword [esi]
test esi, esi
jne 0x1016a7a0
mov eax, dword [ebx + 8]
inc edi
cmp edi, eax
jb 0x1016a7d0
xor ecx, ecx
mov edi, eax
jmp 0x1016a7d9
mov eax, dword [ebx + 0x7f2c]
mov ecx, dword [eax + edi*4]
cmp edi, dword [ebx + 8]
jb 0x1016a77e
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x10171ee0
Capabilities:
Get thread local storage value

Disassembly:
cmp word [esi + 0x40], 0
push edi
mov edi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
je 0x10171f2f
mov eax, dword [0x101e316c]
test eax, eax
jge 0x10171efb
xor eax, eax
jmp 0x10171efe
push eax
call edi
movzx ecx, word [esi + 0x40]
cmp ecx, dword [eax + 0x128]
ja 0x10171f26
mov edx, dword [esi + 4]
mov eax, dword [eax + 0x124]
shl ecx, 4
lea eax, [ecx + eax - 0x10]
test edx, edx
je 0x10171f26
mov ecx, dword [eax + 4]
mov dword [edx], ecx
mov dword [eax + 4], edx
xor edx, edx
mov word [esi + 0x40], dx
mov dword [esi + 4], edx
cmp word [esi + 0x42], 0
je 0x10171f77
mov eax, dword [0x101e316c]
test eax, eax
jge 0x10171f43
xor eax, eax
jmp 0x10171f46
push eax
call edi
movzx ecx, word [esi + 0x42]
cmp ecx, dword [eax + 0x128]
ja 0x10171f6e
mov edx, dword [esi + 0xc]
mov eax, dword [eax + 0x124]
shl ecx, 4
lea eax, [ecx + eax - 0x10]
test edx, edx
je 0x10171f6e
mov ecx, dword [eax + 4]
mov dword [edx], ecx
mov dword [eax + 4], edx
xor edx, edx
mov word [esi + 0x42], dx
mov dword [esi + 0xc], edx
pop edi
ret

Function at 0x101751f0
Capabilities:
Get thread local storage value

Disassembly:
test esi, esi
je 0x10175236
mov eax, dword [0x101e316c]
test eax, eax
jl 0x10175236
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
test edi, edi
je 0x10175235
push 0x44
push 0xfe
push esi
call sub.msvcrt.dll_memset
mov dword [esi], 0
mov eax, dword [edi + 0x1c]
add esp, 0xc
test eax, eax
je 0x1017522f
mov dword [eax], esi
mov dword [edi + 0x1c], esi
pop edi
ret
mov dword [edi + 0x18], esi
mov dword [edi + 0x1c], esi
pop edi
ret