joyce8/EMBER2024-capa huggingface dataset:
Function at 0xf042b50
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
cmp dword [ebp + 8], 0xffffffff
push ebx
push esi
je 0xf042b9a
mov eax, dword [ebp + 0xc]
xor esi, esi
push esi
lea ecx, [eax + 4]
push ecx
push dword [eax]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0xf042b9a
mov ebx, 0x9000
cmp dword [ebp + 0x10], ebx
ja 0xf042b86
mov ebx, dword [ebp + 0x10]
cmp dword [0xf229d80], esi
je 0xf042ba2
call fcn.0f042a7e
cmp eax, esi
mov dword [ebp + 0xc], eax
jne 0xf042ba8
xor eax, eax
pop esi
pop ebx
leave
ret 0x10
mov eax, dword [ebp + 0x14]
mov dword [ebp + 0xc], eax
cmp dword [ebp + 0x10], esi
mov dword [ebp - 4], esi
je 0xf042c08
push edi
cmp dword [ebp + 0x10], ebx
jae 0xf042bb9
mov ebx, dword [ebp + 0x10]
push esi
lea eax, [ebp - 8]
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0xf042c07
cmp dword [ebp - 8], ebx
jne 0xf042c07
cmp dword [0xf229d80], esi
je 0xf042bf9
mov edi, dword [ebp + 0x14]
mov esi, dword [ebp + 0xc]
add dword [ebp + 0x14], ebx
mov ecx, ebx
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor esi, esi
jmp 0xf042bfc
add dword [ebp + 0xc], ebx
sub dword [ebp + 0x10], ebx
add dword [ebp - 4], ebx
cmp dword [ebp + 0x10], esi
jne 0xf042bb1
pop edi
mov eax, dword [ebp - 4]
jmp 0xf042b9c

Function at 0xf042c12
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
cmp dword [ebp + 8], 0xffffffff
push ebx
push esi
je 0xf042ccc
mov eax, dword [ebp + 0xc]
xor esi, esi
push esi
lea ecx, [eax + 4]
push ecx
push dword [eax]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0xf042ccc
mov ebx, 0x9000
cmp dword [ebp + 0x10], ebx
ja 0xf042c50
mov ebx, dword [ebp + 0x10]
cmp dword [0xf229d80], esi
je 0xf042c64
call fcn.0f042a7e
cmp eax, esi
mov dword [ebp + 0xc], eax
je 0xf042ccc
cmp dword [ebp + 0x10], esi
mov dword [ebp - 4], esi
je 0xf042cc7
push edi
cmp dword [ebp + 0x10], ebx
jae 0xf042c75
mov ebx, dword [ebp + 0x10]
cmp dword [0xf229d80], esi
je 0xf042c97
mov esi, dword [ebp + 0x14]
mov edi, dword [ebp + 0xc]
mov ecx, ebx
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor esi, esi
jmp 0xf042c9d
mov eax, dword [ebp + 0x14]
mov dword [ebp + 0xc], eax
push esi
lea eax, [ebp - 8]
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0xf042cc6
cmp dword [ebp - 8], ebx
jne 0xf042cc6
sub dword [ebp + 0x10], ebx
add dword [ebp + 0x14], ebx
add dword [ebp - 4], ebx
cmp dword [ebp + 0x10], esi
jne 0xf042c6d
pop edi
mov eax, dword [ebp - 4]
jmp 0xf042cce
xor eax, eax
pop esi
pop ebx
leave
ret 0x10
Function at 0xf043e58
Capabilities:
Set thread local storage value
Terminate process

Disassembly:
mov edi, edi
push esi
xor esi, esi
cmp dword [0xf0bd814], esi
je 0xf043e6b
pop esi
jmp fcn.0f03e381
cmp dword [0xf0c2640], esi
jne 0xf043eb8
cmp dword [0xf0b0308], esi
je 0xf043eb8
cmp dword [0xf0c2418], esi
jne 0xf043eb8
push 0xf22a6a8
push dword [0xf22a600]
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
test eax, eax
jne 0xf043eb3
push 0x74b
push 0xf0026dc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x3e9
call fcn.0f03dc3f
call fcn.0f022ab2
call fcn.0f00c3f2
push dword [0xf229d64]
and byte [0xf0c262e], 0xfd
call dword [sym.imp.KERNEL32.dll_ResetEvent]
call fcn.0f0174d0
call fcn.0f03f218
push esi
push dword [0xf22a724]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
call fcn.0f03a316
call fcn.0f03c516
cmp dword [0xf22a630], 2
je 0xf043f0a
call fcn.0f03f46b
push dword [0xf22a69c]
call fcn.0f00c35d
call sym.ntvdm.exe_ResumeTimerThread
cmp dword [0xf0bd814], esi
jne 0xf043f1c
call fcn.0f043373
call fcn.0f0189cd
push dword [0xf229bc8]
call dword [sym.imp.KERNEL32.dll_SetEvent]
pop esi
ret

Function at 0xf0446a1
Capabilities:
Terminate process

Disassembly:
call fcn.0f05ca2b
movzx eax, ax
test eax, eax
je 0xf0446d6
cmp eax, 0xa
ja 0xf0446d6
push esi
push edi
lea esi, [eax*8 - 8]
lea edi, [esi + 0xf229b64]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
and dword [edi], 0
and dword [esi + 0xf229b60], 0
pop edi
pop esi
ret
jmp fcn.0f03e381

Function at 0xf0446e0
Capabilities:
Terminate process

Disassembly:
call fcn.0f05ca2b
movzx eax, ax
test eax, eax
je 0xf0446f8
cmp eax, 0xa
ja 0xf0446f8
jmp dword [eax*8 + 0xf229b58]
jmp fcn.0f03e381

Function at 0xf045174
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0xf0ad034]
push esi
push edi
mov esi, 0xf002afc
lea edi, [ebp - 0x130]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov dword [ebp - 4], eax
push 0x49
pop ecx
xor eax, eax
lea edi, [ebp - 0x12a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
call sub.KERNEL32.dll_IsDebuggerPresent
test eax, eax
je 0xf04521f
inc dword [0xf0c2678]
js 0xf04521f
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.USER32.dll_wvsprintfA]
lea eax, [ebp - 0x230]
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0xf0451d3
lea edi, [ebp - 0x130]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0xf0451e3
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x130]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0xf045202
mov esi, 0xf00173c
movsw word es:[edi], word [esi]
lea eax, [ebp - 0x130]
push eax
movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 4]
pop edi
pop esi
call fcn.0f01dda0
leave
ret
Function at 0xf045b77
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
xor esi, esi
xor eax, eax
lea edi, [ebp - 2]
mov word [ebp - 4], si
stosw word es:[edi], ax
call dword [sym.imp.KERNEL32.dll_GetVersion]
and eax, 0xf
cmp al, 5
mov eax, sub.KERNEL32.dll_RegisterConsoleVDM
jbe 0xf045ba5
mov eax, 0xf045be2
lea ecx, [ebp - 8]
push ecx
push dword [ebp - 4]
push esi
push esi
push ecx
lea ecx, [ebp - 0xc]
push ecx
push esi
push esi
push esi
push esi
push esi
call eax
test eax, eax
pop edi
pop esi
jne 0xf045bdb
push 0xd0
push 0xf002b78
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x3e9
call fcn.0f03dc3f
leave
ret
Function at 0xf049280
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov al, byte [esi + 0xa]
xor ebx, ebx
cmp al, 0xf0
mov byte [ebp + 0xb], al
mov word [esi + 4], 1
mov word [esi + 6], bx
mov dword [esi + 0xc], ebx
jne 0xf0492ad
cmp word [esi + 8], bx
je 0xf0492ad
mov byte [ebp + 0xb], bl
push 1
lea eax, [ebp + 0xb]
push eax
push ebx
push 2
lea eax, [ebp - 4]
push eax
call dword [sym.imp.ntdll.dll_RtlOemToUnicodeN]
test eax, eax
jge 0xf0492cb
xor eax, eax
jmp 0xf049491
mov cl, byte [ebp + 0xb]
cmp cl, bl
push edi
mov edi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
jne 0xf049315
xor eax, eax
mov ax, word [esi + 8]
cmp ax, 0x54
jb 0xf0493c6
cmp ax, 0xa6
ja 0xf0493c6
add eax, 0xffffffac
mov word [esi + 8], ax
movzx eax, ax
shl eax, 3
mov ecx, dword [eax + 0xf0b10f4]
mov dword [esi + 0xc], ecx
mov ax, word [eax + 0xf0b10f0]
jmp 0xf049465
cmp cl, 0xe0
jne 0xf0493c6
mov ax, word [esi + 8]
cmp ax, bx
je 0xf0493c6
movzx ecx, ax
mov eax, 0x84
cmp ecx, eax
mov dword [esi + 0xc], pe_nt_image_headers32
jg 0xf049381
je 0xf049379
sub ecx, 0x73
je 0xf049371
dec ecx
je 0xf049369
dec ecx
je 0xf049361
dec ecx
je 0xf049359
dec ecx
jne 0xf049394
mov word [esi + 8], 0x47
jmp 0xf0493bb
mov word [esi + 8], 0x51
jmp 0xf0493bb
mov word [esi + 8], 0x4f
jmp 0xf0493bb
mov word [esi + 8], 0x4d
jmp 0xf0493bb
mov word [esi + 8], 0x4b
jmp 0xf0493bb
mov word [esi + 8], 0x49
jmp 0xf0493bb
sub ecx, 0x8d
je 0xf0493b5
sub ecx, 4
je 0xf0493ad
dec ecx
je 0xf0493a5
dec ecx
je 0xf04939d
mov dword [esi + 0xc], 0x100
jmp 0xf0493bb
mov word [esi + 8], 0x53
jmp 0xf0493bb
mov word [esi + 8], 0x52
jmp 0xf0493bb
mov word [esi + 8], 0x50
jmp 0xf0493bb
mov word [esi + 8], 0x48
mov byte [ebp + 0xb], bl
mov dword [ebp - 4], ebx
jmp 0xf049469
mov ax, word [esi + 8]
cmp ax, 0xe0
jne 0xf049404
cmp cl, 0x2f
mov dword [esi + 0xc], 0x100
jne 0xf0493ea
mov word [esi + 8], 0x35
mov word [esi + 6], 0x6f
jmp 0xf049469
cmp cl, 0xa
mov word [esi + 8], 0x1c
mov word [esi + 6], 0xd
jne 0xf049469
mov dword [esi + 0xc], pe_nt_image_headers32
jmp 0xf049469
cmp cl, bl
je 0xf049469
cmp ax, 1
je 0xf049469
cmp ax, 0xe
je 0xf049469
cmp ax, 0xf
je 0xf049469
cmp ax, 0x1c
je 0xf049469
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_VkKeyScanW]
cmp ax, 0xffff
jne 0xf04943b
mov word [esi + 8], bx
mov word [esi + 6], 0x12
jmp 0xf049469
test ah, 1
movzx cx, al
mov word [esi + 6], cx
je 0xf04944c
or dword [esi + 0xc], 0x10
test ah, 2
je 0xf049455
or dword [esi + 0xc], 8
test ah, 4
je 0xf04945e
or dword [esi + 0xc], 2
movzx eax, cx
push ebx
push eax
call edi
mov word [esi + 8], ax
cmp word [esi + 6], bx
jne 0xf049485
movzx eax, word [esi + 8]
push 3
push eax
call edi
cmp ax, bx
mov word [esi + 6], ax
jne 0xf049485
xor eax, eax
jmp 0xf049490
mov ax, word [ebp - 4]
mov word [esi + 0xa], ax
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0xf04a25a
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push 0
lea eax, [ebp - 4]
push eax
mov eax, dword [0xf0e0b38]
shl eax, 2
push eax
push 0xf2299a0
push dword [0xf0e0b2c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0xf04a28a
leave
ret
and dword [0xf0e0b38], 0
xor eax, eax
inc eax
leave
ret

Function at 0xf04acdc
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
push esi
xor esi, esi
cmp dword [0xf0e0b54], esi
jne 0xf04ad3c
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x20]
push 0xf229940
mov dword [0xf0e0b54], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
call fcn.0f0a3f13
movzx ecx, word [0xf229ad0]
mov edx, ecx
shr edx, 2
shl edx, 6
add edx, eax
mov dword [0xf229914], eax
mov eax, ecx
mov dword [0xf2298a0], edx
push 4
cdq
pop ecx
idiv ecx
mov word [0xf229924], dx
push 0x3000
mov dword [0xf2298c0], 0x200
call fcn.0f04ab62
test eax, eax
je 0xf04ada8
push edi
push esi
push 0x64
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
mov edi, dword [sym.imp.KERNEL32.dll_CreateEventA]
push esi
push esi
push esi
push esi
mov dword [0xf2298b4], eax
call edi
push esi
push esi
push esi
push esi
mov dword [0xf2298a8], eax
call edi
push esi
push esi
push esi
push esi
mov dword [0xf229904], eax
call edi
push esi
push esi
push esi
push esi
mov dword [0xf2298f4], eax
call edi
push esi
push esi
push esi
push esi
mov dword [0xf22991c], eax
call edi
mov dword [0xf229958], eax
xor eax, eax
inc eax
pop edi
jmp 0xf04adaa
xor eax, eax
pop esi
leave
ret
Function at 0xf04bf5c
Capabilities:
Create thread
Resume thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push edi
xor edi, edi
cmp dword [0xf0e0b5c], edi
mov dword [0xf0e0b68], edi
jne 0xf04bffb
lea eax, [ebp - 4]
push eax
push 4
push edi
push 0xf04bd08
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebx, eax
cmp ebx, edi
jne 0xf04bf99
xor eax, eax
jmp 0xf04c0b8
mov eax, dword [0xf22990c]
push esi
push dword [0xf2298b4]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
dec eax
mov dword [0xf0e0b5c], 1
mov dword [0xf0e0b74], edi
mov dword [0xf229908], eax
mov dword [0xf2298e0], edi
call esi
push edi
push 0x64
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push 2
push ebx
mov dword [0xf2298b4], eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push ebx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push ebx
call esi
push 0xffffffffffffffff
push dword [0xf2298a8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
pop esi
mov eax, dword [0xf229918]
sub eax, dword [0xf2298c0]
mov ecx, dword [0xf0b140c]
inc ecx
cmp ecx, eax
jbe 0xf04c045
cmp dword [0xf0e0b58], edi
je 0xf04c023
call fcn.0f04b4f8
call fcn.0f04b6cf
mov eax, dword [0xf2298c0]
mov ecx, dword [0xf0b140c]
lea eax, [eax + ecx + 1]
push eax
call fcn.0f04ab62
cmp dword [0xf0e0b58], edi
je 0xf04c045
call fcn.0f04b695
cmp dword [ebp + 8], edi
jne 0xf04c08d
cmp dword [0xf0e0b58], edi
je 0xf04c05e
cmp dword [0xf0b1408], 0xffff
je 0xf04c085
call fcn.0f04bb9a
call fcn.0f04b0dd
push edi
call fcn.0f04afce
call fcn.0f04b695
movzx eax, word [0xf229ab0]
push 0xf04bc94
push eax
call fcn.0f00bbac
mov dword [0xf229928], edi
jmp 0xf04c0a4
cmp dword [0xf229928], edi
jne 0xf04c09a
call fcn.0f04bccf
mov dword [0xf229928], 1
push dword [0xf229928]
mov dword [0xf0e0b60], edi
call fcn.0f04b933
xor eax, eax
inc eax
pop edi
pop ebx
leave
ret 4
Function at 0xf04e224
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x38
push ebx
xor ebx, ebx
cmp dword [esi + 0x25c], ebx
jne 0xf04e264
lea eax, [ebp - 0x10]
push eax
push ebx
push esi
push 0xf04e114
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, ebx
mov dword [esi + 0x25c], eax
jne 0xf04e25b
xor eax, eax
jmp 0xf04e3f0
push 2
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
lea eax, [esi + 0x240]
cmp dword [eax], ebx
push edi
mov dword [ebp - 8], eax
jne 0xf04e3ec
xor eax, eax
lea edi, [ebp - 0x24]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
movzx eax, word [esi + 0x23c]
mov dword [ebp - 0x20], eax
add eax, eax
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x24]
push eax
push dword [esi]
mov word [ebp - 0x24], 1
mov word [ebp - 0x22], 2
mov word [ebp - 0x16], 8
mov word [ebp - 0x18], 2
call fcn.0f04e5c6
test eax, eax
jl 0xf04e3f3
xor eax, eax
lea edi, [ebp - 0x38]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [esi + 0x244]
push ebx
push dword [ebp - 8]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 0x38]
push edx
mov dword [ebp - 0x38], 0x14
mov dword [ebp - 0x34], 0x18000
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
test eax, eax
jl 0xf04e3f3
mov ecx, dword [esi + 0x30]
cmp ecx, 1
jae 0xf04e30a
xor ecx, ecx
inc ecx
movzx eax, word [esi + 0x23c]
imul eax, ecx
add eax, 0x3e7
xor edx, edx
mov edi, 0x3b6
div edi
push 0x11
push esi
push dword [esi + 0x260]
push ebx
push ecx
mov dword [esi + 0x280], eax
call dword [0xf229abc]
mov dword [esi + 0x264], eax
lea eax, [esi + 0x268]
push eax
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor eax, eax
mov ecx, 0x80
lea edi, [esi + 0x2495c]
rep stosd dword es:[edi], eax
mov ecx, 0x9144
lea edi, [esi + 0x44c]
rep stosd dword es:[edi], eax
push 0x6c
pop ecx
lea edi, [esi + 0x29c]
rep stosd dword es:[edi], eax
xor edi, edi
mov edx, 0xf002c90
lea ecx, [esi + 0x2a4]
or dword [ecx], 0xffffffff
push 2
pop eax
mov word [ecx - 8], ax
mov dword [ebp - 4], eax
mov eax, dword [edx]
imul eax, eax, 0x1024
add eax, esi
add edx, 4
dec dword [ebp - 4]
mov dword [eax + 0x44c], edi
mov dword [eax + 0x464], 0xffff
mov dword [eax + 0x45c], ebx
mov dword [eax + 0x454], ebx
jne 0xf04e390
inc edi
add ecx, 0x18
cmp edi, 0x12
jb 0xf04e383
push dword [esi + 0x280]
mov eax, esi
call fcn.0f04df30
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov ecx, dword [eax]
push 1
push ebx
push ebx
push eax
call dword [ecx + 0x30]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
inc eax
pop edi
pop ebx
leave
ret
xor eax, eax
jmp 0xf04e3ef
Function at 0xf04e3fc
Capabilities:
Terminate thread

Disassembly:
push 0xc
push 0xf002f18
call fcn.0f0213c8
mov esi, dword [ebp + 8]
xor ebx, ebx
cmp esi, ebx
jne 0xf04e419
mov esi, 0xf0e0b80
mov dword [ebp + 8], esi
mov dword [esi + 0x34], ebx
mov dword [esi + 0x264], ebx
push esi
call fcn.0f04e1a2
mov dword [ebp - 4], ebx
lea edi, [esi + 0x260]
mov eax, dword [edi]
cmp eax, ebx
je 0xf04e440
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi], ebx
mov eax, dword [esi + 0x25c]
cmp eax, ebx
je 0xf04e47f
cmp eax, 0xffffffff
je 0xf04e47f
push 0x64
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0xf04e46d
push 1
push dword [esi + 0x25c]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [esi + 0x25c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x25c], ebx
lea eax, [esi + 0x268]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
or dword [ebp - 4], 0xffffffff
jmp 0xf04e4aa
add esi, 0x18
push esi
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
call fcn.0f021403
ret 4

Function at 0xf04eb49
Capabilities:
Get thread local storage value

Disassembly:
jmp 0xf05d428
mov eax, dword [0xf0b188c]
cmp eax, 0xffffffff
jne 0xf05d44c
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push 0xf005cd0
push 0xf0ad080
call sym.ntvdm.exe_getIntelRegistersPointer
add esp, 0xc
ret
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0xf05d478
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push 0xf005c90
push 0xf0ad080
call sym.ntvdm.exe_getIntelRegistersPointer
add esp, 0x10
ret
mov ecx, dword [eax]
shl ecx, 6
lea eax, [ecx + eax + 0x4c4]
push 1
push eax
call fcn.0f09b22c
pop ecx
pop ecx
ret

Function at 0xf05d119
Capabilities:
Set thread local storage value

Disassembly:
cmp dword [0xf0b188c], 0xffffffff
jne 0xf05d13c
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push 0xf0059fc
push 0xf0ad080
call sym.ntvdm.exe_getIntelRegistersPointer
add esp, 0xc
ret
push esi
mov esi, 0xa04
push esi
call fcn.0f009d40
test eax, eax
pop ecx
jne 0xf05d163
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push 0xf0059c0
jmp 0xf05d190
and dword [eax], 0
push eax
push dword [0xf0b188c]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0xf05d19d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [0xf0b188c]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push 0xf005978
push 0xf0ad080
call sym.ntvdm.exe_getIntelRegistersPointer
add esp, 0x14
pop esi
ret
Function at 0xf05d1b4
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0xf0b188c]
cmp eax, 0xffffffff
jne 0xf05d1d8
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push 0xf005a74
push 0xf0ad080
call sym.ntvdm.exe_getIntelRegistersPointer
add esp, 0xc
ret
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0xf05d20a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [0xf0b188c]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push 0xf005a30
push 0xf0ad080
call sym.ntvdm.exe_getIntelRegistersPointer
add esp, 0x14
ret
push esi
push edi
push eax
call fcn.0f008a60
mov eax, dword [0xf105758]
mov esi, dword [eax + 4]
pop ecx
mov edi, eax
jmp 0xf05d22e
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [esi], eax
je 0xf05d234
mov edi, esi
mov esi, dword [esi + 4]
test esi, esi
jne 0xf05d21f
jmp 0xf05d241
mov eax, dword [esi + 4]
push esi
mov dword [edi + 4], eax
call fcn.0f008a60
pop ecx
pop edi
pop esi
ret

Function at 0xf05d249
Capabilities:
Get thread local storage value

Disassembly:
cmp dword [0xf0b188c], 0xffffffff
jne 0xf05d26e
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push 0xf005b50
push 0xf0ad080
call sym.ntvdm.exe_getIntelRegistersPointer
add esp, 0xc
xor eax, eax
ret
cmp dword [0xf10575c], 0
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
je 0xf05d2d9
mov esi, dword [0xf105758]
test esi, esi
mov ebx, esi
je 0xf05d29f
call edi
cmp dword [esi], eax
je 0xf05d29b
mov ebx, esi
mov esi, dword [esi + 4]
test esi, esi
jne 0xf05d28c
test esi, esi
jne 0xf05d2d9
and dword [0xf10575c], 0
push 8
call fcn.0f009d40
mov esi, eax
test esi, esi
pop ecx
jne 0xf05d2c9
push 0xf005b14
push 0xf0ad080
call sym.ntvdm.exe_getIntelRegistersPointer
pop ecx
pop ecx
xor eax, eax
jmp 0xf05d329
mov dword [ebx + 4], esi
call edi
and dword [esi + 4], 0
mov dword [esi], eax
call fcn.0f05d119
push dword [0xf0b188c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0xf05d30d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [0xf0b188c]
call edi
push eax
push 0xf005ad0
push 0xf0ad080
call sym.ntvdm.exe_getIntelRegistersPointer
add esp, 0x14
jmp 0xf05d2c5
mov ecx, dword [eax]
cmp ecx, 0x14
jl 0xf05d31b
push 0xf005aa4
jmp 0xf05d2b9
mov edx, ecx
shl edx, 6
inc ecx
lea edx, [edx + eax + 4]
mov dword [eax], ecx
mov eax, edx
pop edi
pop esi
pop ebx
ret
Function at 0xf05d332
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0xf0b188c]
cmp eax, 0xffffffff
jne 0xf05d356
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push 0xf005bf4
push 0xf0ad080
call sym.ntvdm.exe_getIntelRegistersPointer
add esp, 0xc
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0xf05d38c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [0xf0b188c]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push 0xf005bb0
push 0xf0ad080
call sym.ntvdm.exe_getIntelRegistersPointer
add esp, 0x14
pop esi
ret
cmp dword [esi], 0
jne 0xf05d3a2
push 0xf005b80
push 0xf0ad080
call sym.ntvdm.exe_getIntelRegistersPointer
pop ecx
pop ecx
xor ecx, ecx
inc ecx
mov dword [0xf232fe0], ecx
dec dword [esi]
mov eax, dword [esi]
shl eax, 6
push ecx
lea eax, [eax + esi + 4]
push eax
call fcn.0f09b22c
pop ecx
pop ecx
pop esi
ret

Function at 0xf05d3c6
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0xf0b188c]
cmp eax, 0xffffffff
jne 0xf05d3ea
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push 0xf005c60
push 0xf0ad080
call sym.ntvdm.exe_getIntelRegistersPointer
add esp, 0xc
ret
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0xf05d416
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push 0xf005c24
push 0xf0ad080
call sym.ntvdm.exe_getIntelRegistersPointer
add esp, 0x10
ret
mov ecx, dword [eax]
shl ecx, 6
lea eax, [ecx + eax + 0x4c4]
ret

Function at 0xf05d494
Capabilities:
Allocate thread local storage
Set thread local storage value

Disassembly:
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [0xf0b188c], eax
jne 0xf05d4b5
push 0xf005d04
push 0xf0ad080
call sym.ntvdm.exe_getIntelRegistersPointer
pop ecx
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
and dword [0xf105754], 0
mov dword [0xf105750], eax
mov dword [0xf105758], 0xf105750
jmp fcn.0f05d119

Function at 0xf05dde2
Capabilities:
Get thread local storage value

Disassembly:
xor eax, eax
cmp dword [0xf232b3c], eax
je 0xf05de0a
mov dword [0xf232b44], eax
mov dword [0xf232b38], eax
mov dword [0xf232b3c], eax
mov dword [0xf232b40], eax
call fcn.0f04e993
jmp fcn.0f04eb49
ret