joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6d71d340
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0x24c
call fcn.6d71c250
and byte [ebp - 4], 0
and byte [ebp - 3], 0
and byte [ebp - 2], 0
and byte [ebp - 1], 0
mov ebx, eax
pop ecx
test ebx, ebx
jne 0x6d71d379
call dword [sym.imp.MSVCRT.dll__errno]
mov dword [eax], 0xc
jmp 0x6d71d500
mov esi, dword [ebp + 8]
cmp byte [esi + 1], 0
jne 0x6d71d3a1
cmp byte [esi], 0x5c
jne 0x6d71d3a1
call dword [sym.imp.MSVCRT.dll__getdrive]
add al, 0x40
and byte [ebp - 1], 0
mov byte [ebp - 4], al
mov byte [ebp - 3], 0x3a
mov byte [ebp - 2], 0x5c
lea esi, [ebp - 4]
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
add ecx, 4
push ecx
call fcn.6d71c250
mov edx, eax
pop ecx
test edx, edx
mov dword [ebx + 0x104], edx
jne 0x6d71d3cb
push ebx
call fcn.6d71c29c
pop ecx
jmp 0x6d71d368
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push dword [ebx + 0x104]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
or ecx, 0xffffffff
cmp eax, ecx
jne 0x6d71d421
push dword [ebx + 0x104]
call fcn.6d71c29c
push ebx
call fcn.6d71c29c
pop ecx
pop ecx
call dword [sym.imp.MSVCRT.dll__errno]
mov dword [eax], 2
jmp 0x6d71d500
test al, 0x10
jne 0x6d71d449
push dword [ebx + 0x104]
call fcn.6d71c29c
push ebx
call fcn.6d71c29c
pop ecx
pop ecx
call dword [sym.imp.MSVCRT.dll__errno]
mov dword [eax], 0x14
jmp 0x6d71d500
mov edx, dword [ebx + 0x104]
cmp byte [edx + 1], 0x3a
jne 0x6d71d489
mov al, byte [edx + 2]
test al, al
je 0x6d71d466
cmp al, 0x5c
jne 0x6d71d489
cmp byte [edx + 3], 0
jne 0x6d71d489
mov edi, 0x6d79d274
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov dword [ebp + 8], eax
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov eax, dword [ebp + 8]
dec edi
jmp 0x6d71d4aa
mov edi, str..
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov dword [ebp + 8], eax
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov eax, dword [ebp + 8]
dec edi
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebx + 0x10c]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
push dword [ebx + 0x104]
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebx + 0x108], eax
jne 0x6d71d504
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x6d71d504
push dword [ebx + 0x104]
call fcn.6d71c29c
push ebx
call fcn.6d71c29c
pop ecx
pop ecx
call dword [sym.imp.MSVCRT.dll__errno]
mov dword [eax], 0xd
xor eax, eax
jmp 0x6d71d506
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x6d71d8cc
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
xor ebx, ebx
cmp eax, ebx
jne 0x6d71da14
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7e
jne 0x6d71d914
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
lea eax, [esi - 1]
push eax
push str.Cant_find_dependent_libraries
push edi
call dword [sym.imp.MSVCRT.dll_strncpy]
add esp, 0xc
mov byte [edi + esi - 1], bl
jmp 0x6d71da12
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
push edi
push esi
call fcn.6d71f837
push 0x8000
mov byte [esi + edi - 1], bl
push dword [ebp + 8]
call dword [sym.imp.MSVCRT.dll__open]
mov esi, eax
add esp, 0x10
cmp esi, ebx
jl 0x6d71da12
push ebx
push ebx
push 0x3c
push esi
mov dword [ebp - 4], ebx
call fcn.6d6e62eb
add esp, 0x10
cmp edx, ebx
jl 0x6d71d9a9
jg 0x6d71d95a
cmp eax, ebx
jb 0x6d71d9a9
mov edi, dword [sym.imp.MSVCRT.dll__read]
lea eax, [ebp - 8]
push 4
push eax
push esi
call edi
add esp, 0xc
cmp eax, 4
jne 0x6d71d9a6
mov eax, dword [ebp - 8]
push ebx
add eax, 4
push ebx
push eax
push esi
call fcn.6d6e62eb
add esp, 0x10
cmp edx, ebx
jl 0x6d71d9a6
jg 0x6d71d98d
cmp eax, ebx
jb 0x6d71d9a6
lea eax, [ebp - 4]
push 2
push eax
push esi
call edi
add esp, 0xc
cmp eax, 2
jne 0x6d71d9a6
mov edi, dword [ebp + 0x10]
mov dword [ebp + 8], ebx
jmp 0x6d71d9b0
mov edi, dword [ebp + 0x10]
mov dword [ebp + 8], 1
push esi
call dword [sym.imp.MSVCRT.dll__close]
cmp dword [ebp + 8], ebx
pop ecx
jne 0x6d71da12
xor edx, edx
xor esi, esi
mov eax, 0x6d7779ac
mov cx, word [eax - 4]
cmp word [ebp - 4], cx
jne 0x6d71d9d2
mov esi, dword [eax]
cmp cx, 0x14c
jne 0x6d71d9db
mov edx, dword [eax]
add eax, 8
cmp eax, 0x6d7779c4
jb 0x6d71d9c6
cmp word [ebp - 4], 0x14c
je 0x6d71da12
cmp esi, ebx
push edx
je 0x6d71d9fa
push esi
push str.Cant_load__s_bit_.dll_on_a__s_bit_platform
jmp 0x6d71da04
movzx eax, word [ebp - 4]
push eax
push str.Cant_load_this_.dll__machine_code0x_x__on_a__s_bit_platform
dec edi
push edi
push dword [ebp + 0xc]
call dword [sym.imp.MSVCRT.dll__snprintf]
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x6d71dbba
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
push edi
mov edi, dword [ebp + 8]
push str.Memory:
push edi
call fcn.6d71fd90
call fcn.6d71e790
sar eax, 0xa
push eax
push str.__dk_page
push edi
call fcn.6d71fd90
add esp, 0x14
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
call fcn.6d71d141
push 0xa
pop ecx
call fcn.6d76da50
push edx
push eax
push str.__physical__uk
push edi
call fcn.6d71fd90
add esp, 0x10
call fcn.6d71d125
push 0xa
pop ecx
call fcn.6d76da50
push edx
mov esi, str.__uk_free_
push eax
push esi
push edi
call fcn.6d71fd90
mov eax, dword [ebp - 0x10]
shr eax, 0xa
push eax
push str.__swap__uk
push edi
call fcn.6d71fd90
mov eax, dword [ebp - 0xc]
shr eax, 0xa
push eax
push esi
push edi
call fcn.6d71fd90
add esp, 0x28
mov ecx, edi
call fcn.6d71febc
pop edi
pop esi
leave
ret
Function at 0x6d71dec4
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push edi
and dword [ebp - 4], 0
mov esi, 0x6d7be278
mov edi, dword [esi]
mov dword [ebp - 0xc], edi
test edi, edi
jle 0x6d71df06
lea eax, [edi - 1]
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], eax
call fcn.6d71d118
mov dword [ebp - 8], eax
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 8], 0
je 0x6d71deff
lock cmpxchg dword [edx], ecx
cmpxchg dword [edx], ecx
cmp edi, eax
je 0x6d71df83
inc dword [ebp - 4]
add esi, 4
cmp esi, 0x6d7be2d8
jl 0x6d71ded5
cmp dword [ebp + 8], 0
je 0x6d71df88
push dword [0x6d7a23c4]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
push 0xa
push 6
push esi
call fcn.6d681d7e
add esp, 0xc
push 0xffffffffffffffff
mov dword [esi + 0xf8], 1
push dword [0x6d7be040]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, esi
call fcn.6d715d80
test eax, eax
je 0x6d71df71
push 0
push 1
push dword [0x6d7be040]
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
mov ecx, esi
call fcn.6d751ae3
jmp 0x6d71df35
push 6
push 0xa
push esi
call fcn.6d681d7e
add esp, 0xc
jmp 0x6d71decc
mov eax, dword [ebp - 4]
jmp 0x6d71df8b
or eax, 0xffffffff
pop edi
pop esi
leave
ret

Function at 0x6d71ea66
Capabilities:
Allocate or change rwx memory

Disassembly:
cmp dword [esp + 8], 0
jne 0x6d71ea71
push 1
pop eax
ret
push 0x40
push 0x1000
push dword [esp + 0x10]
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
neg eax
sbb eax, eax
neg eax
ret

Function at 0x6d71eaff
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
lea eax, [ebp + 0xc]
push eax
push 0x40
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop ebp
ret

Function at 0x6d71eb16
Capabilities:
Resume thread

Disassembly:
mov eax, dword [esp + 4]
mov eax, dword [eax + 0x88]
push dword [eax + 0x10]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
ret

Function at 0x6d71eb69
Capabilities:
Suspend thread

Disassembly:
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SuspendThread]
push edi
xor edi, edi
push dword [esp + 0xc]
call esi
cmp eax, 0xffffffff
jne 0x6d71eb99
mov eax, edi
inc edi
cmp eax, 0x64
jge 0x6d71eb94
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
push dword [esp + 0xc]
jmp 0x6d71eb77
or eax, 0xffffffff
jmp 0x6d71eb9b
xor eax, eax
pop edi
pop esi
ret

Function at 0x6d71eb9e
Capabilities:
Resume thread

Disassembly:
mov eax, dword [esp + 4]
mov eax, dword [eax + 0x88]
push dword [eax + 0x10]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
dec ecx
mov eax, ecx
ret

Function at 0x6d71ebd0
Capabilities:
Read file on windows

Disassembly:
push dword [esp + 0xc]
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [sym.imp.MSVCRT.dll__read]
add esp, 0xc
ret
Function at 0x6d71ef82
Capabilities:
Get memory capacity
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd8
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x20]
mov dword [0x6d7be2e0], eax
mov eax, dword [ebp - 8]
mov dword [0x6d7be2e4], eax
mov eax, dword [ebp - 0xc]
mov dword [0x6d7be2e8], eax
movzx eax, word [ebp - 4]
mov dword [0x6d7be2ec], eax
mov eax, dword [ebp - 0x10]
mov dword [0x6d7be2f0], eax
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov eax, dword [ebp - 0x3c]
and dword [0x6d7be2fc], 0
mov dword [0x6d7be2f8], eax
lea eax, [ebp - 0xd8]
push eax
mov dword [ebp - 0xd8], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [ebp - 0xc8]
dec eax
je 0x6d71f020
dec eax
je 0x6d71f014
push str.Unknown_platform
push 0xb4c
push str.C:_BUILD_AREA_jdk1.5.0_13_hotspot_srcoswin32_vmos_win32.cpp
call fcn.6d6a372c
add esp, 0xc
int3
mov dword [0x6d7be30c], 1
jmp 0x6d71f027
and dword [0x6d7be30c], 0
call fcn.6d71cca5
mov dword [0x6d7be300], eax
call fcn.6d71f04b
cmp dword [0x6d7be30c], 0
jne 0x6d71f049
mov dword [0x6d79210c], 0x1770
leave
ret
Function at 0x6d71f1bb
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x6d791d84], 0
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push edi
mov edi, 0x2000
mov ebx, 0x1000
je 0x6d71f239
push 2
push edi
call fcn.6d71e790
push eax
push 0
call esi
test eax, eax
mov dword [ebp - 4], eax
jne 0x6d71f207
push str.Reserve_Failed_for_polling_page
push 0xbc2
push str.C:_BUILD_AREA_jdk1.5.0_13_hotspot_srcoswin32_vmos_win32.cpp
call fcn.6d6a372c
add esp, 0xc
int3
push 2
push ebx
call fcn.6d71e790
push eax
push dword [ebp - 4]
call esi
test eax, eax
jne 0x6d71f231
push str.Commit_Failed_for_polling_page
push 0xbc5
push str.C:_BUILD_AREA_jdk1.5.0_13_hotspot_srcoswin32_vmos_win32.cpp
call fcn.6d6a372c
add esp, 0xc
int3
mov eax, dword [ebp - 4]
mov dword [0x6d7bdc74], eax
cmp dword [0x6d791d78], 0
jne 0x6d71f29c
push 0x40
push edi
call fcn.6d71e790
push eax
push 0
call esi
mov edi, eax
test edi, edi
jne 0x6d71f26d
push str.Reserve_Failed_for_memory_serialize_page
push 0xbd1
push str.C:_BUILD_AREA_jdk1.5.0_13_hotspot_srcoswin32_vmos_win32.cpp
call fcn.6d6a372c
add esp, 0xc
int3
push 0x40
push ebx
call fcn.6d71e790
push eax
push edi
call esi
test eax, eax
jne 0x6d71f295
push str.Commit_Failed_for_memory_serialize_page
push 0xbd4
push str.C:_BUILD_AREA_jdk1.5.0_13_hotspot_srcoswin32_vmos_win32.cpp
call fcn.6d6a372c
add esp, 0xc
int3
push edi
call fcn.6d71c5f4
pop ecx
call fcn.6d71e79c
mov dword [0x6d7b59f0], eax
call fcn.6d6b812b
test eax, eax
jne 0x6d71f324
call fcn.6d71e790
mov ecx, dword [0x6d7b5bd4]
dec eax
shl ecx, 0xa
add ecx, eax
not eax
and ecx, eax
mov eax, dword [0x6d7be300]
cmp ecx, eax
mov esi, ecx
jae 0x6d71f2d1
mov esi, eax
mov eax, 0x73800000
xor edx, edx
div esi
cmp dword [0x6d7b5c00], 0
mov dword [0x6d7c1d88], ecx
mov dword [0x6d7be304], eax
je 0x6d71f308
push 0x6d71f416
call fcn.6d76daa8
test eax, eax
pop ecx
je 0x6d71f308
push str.os::init_2_atexit_perfMemory_exit_helper__failed
call fcn.6d6a36ee
pop ecx
cmp dword [0x6d7be30c], 0
je 0x6d71f318
call fcn.6d71f329
jmp 0x6d71f31d
call fcn.6d71f390
call fcn.6d71f3f7
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x6d71f6cf
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
xor esi, esi
push edi
push esi
push 0x80
push 3
push esi
push 1
push 0x80000000
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, esi
mov dword [ebp + 0xc], eax
jne 0x6d71f701
xor eax, eax
jmp 0x6d71f7e0
cmp dword [ebp + 0x20], esi
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x6d71f760
push 4
push 0x3000
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
cmp edi, esi
je 0x6d71f755
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp + 0x14]
push eax
mov dword [ebp - 4], esi
push dword [ebp + 0x18]
push edi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x6d71f7af
push dword [ebp + 0x18]
push edi
call fcn.6d71eabc
pop ecx
pop ecx
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x6d71f6fa
push esi
push esi
push esi
push 8
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
cmp eax, esi
mov dword [ebp + 0x20], eax
je 0x6d71f7a6
push dword [ebp + 0x14]
mov ecx, dword [ebp + 0x1c]
neg ecx
push dword [ebp + 0x18]
sbb ecx, ecx
push dword [ebp + 0x10]
and ecx, 3
inc ecx
push esi
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFileEx]
push dword [ebp + 0x20]
mov edi, eax
cmp edi, esi
jne 0x6d71f79e
call ebx
jmp 0x6d71f7a6
call ebx
test eax, eax
jne 0x6d71f7d9
mov esi, edi
push dword [ebp + 0xc]
call ebx
mov eax, esi
jmp 0x6d71f7e0
lea eax, [ebp + 0x18]
push eax
mov eax, dword [ebp + 0x1c]
neg eax
sbb eax, eax
and al, 0xe0
add eax, 0x40
push eax
push dword [ebp + 0x18]
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x6d71f7d9
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x6d71f7de
push dword [ebp + 0xc]
call ebx
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x6d71f95e
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x40
push 0x2000
push dword [ebp + 8]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
je 0x6d71f9a0
call fcn.6d71f9a3
xor eax, esi
test eax, 0xff000000
jne 0x6d71f99e
push str.high_half_of_address_must_not_be_all_ones
push 0x4d
push 0x6d79d85c
call fcn.6d6a372c
add esp, 0xc
int3
mov eax, esi
pop esi
pop ebp
ret
Function at 0x6d720603
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push ebp
push esi
push edi
mov esi, ecx
call fcn.6d72018f
mov edi, dword [esp + 0x14]
mov ebp, eax
cmp edi, 0xffffffff
je 0x6d7206ac
cmp dword [0x6d791fa4], 0
je 0x6d7206ac
call fcn.6d6a39bd
test eax, eax
jne 0x6d7206ac
cmp dword [0x6d7bf5cc], 1
mov ebx, dword [sym.imp.KERNEL32.dll_TlsGetValue]
jne 0x6d720655
push dword [0x6d7a23c4]
call ebx
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
test eax, eax
jne 0x6d7206ac
cmp dword [0x6d7bdc28], 0
je 0x6d7206ac
push dword [0x6d7a23c4]
call ebx
test eax, eax
je 0x6d7206ac
cmp dword [esi + 0x38], edi
je 0x6d7206ac
mov ecx, dword [0x6d7bdc28]
call fcn.6d714bb6
cmp edi, dword [esi + 0x3c]
je 0x6d7206a5
test ebp, ebp
je 0x6d7206a2
mov ecx, dword [esi + 0x34]
cmp dword [ecx + 0x10], 0
jle 0x6d720691
call fcn.6d71febc
push edi
push str._writer_thread_d__
push dword [esi + 0x34]
call fcn.6d71fdc8
add esp, 0xc
mov dword [esi + 0x3c], edi
mov dword [esi + 0x38], edi
mov eax, edi
jmp 0x6d7206af
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
ret 4
Function at 0x6d723197
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push edi
call fcn.6d6aa75f
push 6
mov esi, eax
pop ebx
push ebx
push esi
call fcn.6d681e40
and dword [ebp - 8], 0
and dword [ebp - 4], 0
add esp, 0xc
push dword [0x6d7a23c4]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push eax
lea ecx, [ebp - 0x18]
call fcn.6d64bc19
push esi
lea ecx, [ebp + 8]
call fcn.6d68f19c
cmp dword [ebp + 0x10], 0
jne 0x6d7231ea
and dword [ebp + 0x10], 0
jmp 0x6d7231fa
push esi
push dword [ebp + 0x10]
push edi
call fcn.6d7232c9
add esp, 0xc
mov dword [ebp + 0x10], eax
cmp dword [esi + 4], 0
push ebx
push dword [ebp + 8]
je 0x6d72322e
call fcn.6d681e40
pop ecx
pop ecx
lea ecx, [ebp - 0x18]
call fcn.6d6a63ec
mov ecx, dword [esi + 0x2c]
call fcn.6d67a7cf
push 4
push ebx
push esi
call fcn.6d681d7e
add esp, 0xc
xor eax, eax
jmp 0x6d7232c2
call fcn.6d681e40
cmp dword [ebp + 0x18], 0
pop ecx
pop ecx
je 0x6d72325b
cmp dword [ebp + 0x18], 1
je 0x6d72325b
push 0
push dword [0x6d7c30f8]
push 0x3f
push str.C:_BUILD_AREA_jdk1.5.0_13_hotspot_src_share_vmprimsperf.cpp
push esi
call fcn.6d6a8f0c
add esp, 0x14
jmp 0x6d72320b
lea eax, [ebp - 4]
push esi
push eax
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.6d725090
add esp, 0x18
cmp dword [esi + 4], 0
jne 0x6d72320b
push esi
lea ecx, [ebp + 0x18]
call fcn.6d68f19c
mov eax, dword [ebp - 4]
mov edx, dword [edi]
xor ecx, ecx
push ecx
push eax
push dword [ebp - 8]
push edi
call dword [edx + 0x394]
push ebx
mov edi, eax
push dword [ebp + 0x18]
call fcn.6d681e40
pop ecx
pop ecx
lea ecx, [ebp - 0x18]
call fcn.6d6a63ec
mov ecx, dword [esi + 0x2c]
call fcn.6d67a7cf
push 4
push ebx
push esi
call fcn.6d681d7e
add esp, 0xc
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 0x14
Function at 0x6d7233ad
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push dword [ebp + 8]
call fcn.6d6aa75f
mov esi, eax
push 6
push esi
call fcn.6d681e40
xor ebx, ebx
add esp, 0xc
cmp dword [ebp + 0x18], ebx
jle 0x6d72350a
cmp dword [ebp + 0x18], 6
jg 0x6d72350a
push dword [0x6d7a23c4]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push eax
lea ecx, [ebp - 0x14]
call fcn.6d64bc19
push esi
lea ecx, [ebp - 4]
call fcn.6d68f19c
push esi
push dword [ebp + 0x10]
push dword [ebp + 8]
call fcn.6d7232c9
add esp, 0xc
cmp dword [esi + 4], ebx
mov edi, eax
push 6
push dword [ebp - 4]
je 0x6d723425
call fcn.6d681e40
pop ecx
pop ecx
jmp 0x6d7234b5
call fcn.6d681e40
pop ecx
pop ecx
mov ecx, dword [0x6d7bf360]
push edi
call fcn.6d72425e
test eax, eax
je 0x6d723459
push str.PerfLong_name_already_exists
push dword [0x6d7c30f8]
push 0x77
push str.C:_BUILD_AREA_jdk1.5.0_13_hotspot_src_share_vmprimsperf.cpp
push esi
call fcn.6d6a8f0c
add esp, 0x14
jmp 0x6d7234b5
mov eax, dword [ebp + 0x14]
dec eax
je 0x6d72349b
dec eax
je 0x6d723487
dec eax
je 0x6d723473
push ebx
push dword [0x6d7c30f8]
push 0x8f
jmp 0x6d723449
push esi
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push edi
push 0x18
call fcn.6d724092
jmp 0x6d7234ad
push esi
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push edi
push 0x18
call fcn.6d723f82
jmp 0x6d7234ad
push esi
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push edi
push 0x18
call fcn.6d723e50
add esp, 0x18
cmp dword [esi + 4], ebx
je 0x6d7234bf
lea ecx, [ebp - 0x14]
call fcn.6d6a63ec
jmp 0x6d723521
mov edi, dword [eax + 0x1c]
push esi
lea ecx, [ebp + 0x18]
call fcn.6d68f19c
mov eax, dword [ebp + 8]
push ebx
push 8
push edi
mov ecx, dword [eax]
push eax
call dword [ecx + 0x394]
push 6
mov edi, eax
push dword [ebp + 0x18]
call fcn.6d681e40
pop ecx
pop ecx
lea ecx, [ebp - 0x14]
call fcn.6d6a63ec
mov ecx, dword [esi + 0x2c]
call fcn.6d67a7cf
push 4
push 6
push esi
call fcn.6d681d7e
add esp, 0xc
mov eax, edi
jmp 0x6d723538
push ebx
push dword [0x6d7c30f8]
push 0x68
push str.C:_BUILD_AREA_jdk1.5.0_13_hotspot_src_share_vmprimsperf.cpp
push esi
call fcn.6d6a8f0c
add esp, 0x14
mov ecx, dword [esi + 0x2c]
call fcn.6d67a7cf
push 4
push 6
push esi
call fcn.6d681d7e
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0x1c
Function at 0x6d72353f
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push edi
call fcn.6d6aa75f
mov esi, eax
push 6
push esi
call fcn.6d681e40
xor ebx, ebx
add esp, 0xc
cmp dword [ebp + 0x10], ebx
je 0x6d7236dd
cmp dword [ebp + 0x1c], ebx
je 0x6d7236dd
cmp dword [ebp + 0x14], 1
je 0x6d72358f
cmp dword [ebp + 0x14], 3
je 0x6d72358f
push ebx
push dword [0x6d7c30f8]
push 0xac
jmp 0x6d7236e9
cmp dword [ebp + 0x18], 5
je 0x6d7235a6
push ebx
push dword [0x6d7c30f8]
push 0xb3
jmp 0x6d7236e9
push dword [0x6d7a23c4]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push eax
lea ecx, [ebp - 0x10]
call fcn.6d64bc19
push esi
lea ecx, [ebp + 8]
call fcn.6d68f19c
push esi
push dword [ebp + 0x10]
push edi
call fcn.6d7232c9
add esp, 0xc
cmp dword [esi + 4], ebx
mov dword [ebp + 0x10], eax
je 0x6d7235ea
push 6
push dword [ebp + 8]
call fcn.6d681e40
pop ecx
pop ecx
jmp 0x6d723683
push dword [ebp + 0x1c]
mov eax, dword [edi]
push edi
call dword [eax + 0x2ac]
mov ebx, eax
lea eax, [ebx + 1]
push eax
call fcn.6d735879
pop ecx
mov dword [ebp + 0x18], eax
mov ecx, dword [edi]
push eax
push ebx
push 0
push dword [ebp + 0x1c]
push edi
call dword [ecx + 0x320]
push 6
push dword [ebp + 8]
call fcn.6d681e40
pop ecx
pop ecx
push dword [ebp + 0x10]
mov ecx, dword [0x6d7bf360]
call fcn.6d72425e
test eax, eax
je 0x6d723653
push str.PerfByteArray_name_already_exists
push dword [0x6d7c30f8]
push 0xca
push str.C:_BUILD_AREA_jdk1.5.0_13_hotspot_src_share_vmprimsperf.cpp
push esi
call fcn.6d6a8f0c
add esp, 0x14
jmp 0x6d723683
cmp dword [ebp + 0x14], 1
push esi
push dword [ebp + 0x18]
jne 0x6d72366c
push dword [ebp + 0x10]
push 0x18
call fcn.6d723de2
add esp, 0x10
jmp 0x6d72367d
mov ebx, dword [ebp + 0x20]
push ebx
push dword [ebp + 0x10]
push 0x18
call fcn.6d723ed8
add esp, 0x14
cmp dword [esi + 4], 0
je 0x6d72368d
lea ecx, [ebp - 0x10]
call fcn.6d6a63ec
jmp 0x6d7236f7
mov eax, dword [eax + 0x1c]
push esi
lea ecx, [ebp + 0x14]
mov dword [ebp + 0x1c], eax
call fcn.6d68f19c
lea eax, [ebx + 1]
mov ecx, dword [edi]
cdq
push edx
push eax
push dword [ebp + 0x1c]
push edi
call dword [ecx + 0x394]
push 6
mov edi, eax
push dword [ebp + 0x14]
call fcn.6d681e40
pop ecx
pop ecx
lea ecx, [ebp - 0x10]
call fcn.6d6a63ec
mov ecx, dword [esi + 0x2c]
call fcn.6d67a7cf
push 4
push 6
push esi
call fcn.6d681d7e
add esp, 0xc
mov eax, edi
jmp 0x6d72370e
push ebx
push dword [0x6d7c3124]
push 0xa5
push str.C:_BUILD_AREA_jdk1.5.0_13_hotspot_src_share_vmprimsperf.cpp
push esi
call fcn.6d6a8f0c
add esp, 0x14
mov ecx, dword [esi + 0x2c]
call fcn.6d67a7cf
push 4
push 6
push esi
call fcn.6d681d7e
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0x1c