joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100052c0
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 4
mov eax, dword [0x1002b150]
push ebx
push esi
push edi
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edx, dword [esp + 0x1c]
mov eax, dword [eax + 0x7b8]
cmp eax, 1
jne 0x10005318
mov esi, dword [esp + 0x18]
mov ecx, 8
mov eax, dword [esi]
mov edi, 8
xor ebx, ebx
inc eax
add edx, 4
mov bl, byte [eax - 1]
sub ebx, 0x80
shl ebx, 7
dec edi
mov dword [edx - 4], ebx
jne 0x100052f2
add esi, 4
dec ecx
jne 0x100052eb
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
cmp eax, 2
jle 0x1000538a
sub eax, 4
mov edi, dword [esp + 0x18]
mov dword [esp + 0x10], 8
cmp eax, 1
sbb ecx, ecx
neg ecx
mov eax, dword [edi]
mov esi, 8
xor ebx, ebx
inc eax
inc eax
add edx, 4
mov bl, byte [eax - 2]
inc eax
movsx ebp, word [ebx*8 + 0x1002db60]
xor ebx, ebx
mov dword [edx - 4], ebp
mov bl, byte [eax - 2]
movsx ebx, word [ebx*8 + 0x1002e360]
add ebp, ebx
xor ebx, ebx
mov dword [edx - 4], ebp
mov bl, byte [eax - 1]
add eax, ecx
movsx ebx, word [ebx*8 + 0x1002eb60]
add ebx, ebp
dec esi
mov dword [edx - 4], ebx
jne 0x1000533a
add edi, 4
dec dword [esp + 0x10]
jne 0x10005333
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
mov dword [esp + 0x10], 8
mov ecx, dword [esp + 0x18]
mov edi, dword [ecx]
mov esi, 8
xor ebx, ebx
add edi, 2
mov bx, word [edi - 2]
add edx, 4
mov eax, ebx
mov ebp, ebx
and eax, 0x1f
and ebp, 0x3e0
shl eax, 6
and ebx, 0x7c00
movsx eax, word [eax + 0x1002db60]
shr ebx, 4
mov dword [edx - 4], eax
movsx ebp, word [ebp*2 + 0x1002e360]
add ebp, eax
mov dword [edx - 4], ebp
movsx eax, word [ebx + 0x1002eb60]
add eax, ebp
dec esi
mov dword [edx - 4], eax
jne 0x1000539d
add ecx, 4
dec dword [esp + 0x10]
jne 0x10005396
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
Function at 0x10005400
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 0x10
mov eax, dword [0x1002b150]
push ebx
push esi
push edi
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
lea ebp, [eax + 0x7e8]
mov ecx, dword [eax + 0x7b8]
cmp ecx, 1
jne 0x10005481
mov esi, dword [esp + 0x24]
mov ecx, 8
mov eax, dword [esi]
mov edi, 8
mov edx, dword [ebp]
add ebp, 4
movsx ebx, word [0x1002f360]
xor edx, 0xffff8003
and edx, 0xfffc
shr edx, 2
add edx, ebx
test dh, 0xc0
je 0x1000546a
and edx, 0x8000
cmp edx, 1
sbb edx, edx
and edx, 0xff
jmp 0x1000546d
sar edx, 6
mov byte [eax], dl
inc eax
dec edi
jne 0x10005434
add esi, 4
dec ecx
jne 0x1000542d
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x10
ret
sub ecx, 4
mov dword [esp + 0x14], 0x1002d668
cmp ecx, 1
sbb ecx, ecx
neg ecx
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x1c]
xor edi, edi
mov esi, dword [ecx]
mov ecx, dword [ebp]
add ebp, 4
movsx edx, word [0x1002f360]
xor ecx, 0xffff8003
and ecx, 0xfffc
shr ecx, 2
add ecx, edx
test ch, 0xc0
je 0x100054dd
and ecx, 0x8000
cmp ecx, 1
sbb ecx, ecx
and ecx, 0xff
jmp 0x100054e0
sar ecx, 6
mov edx, dword [eax + 0x7b8]
cmp edx, 2
je 0x10005500
cmp edx, 0xa
je 0x10005526
mov byte [esi], cl
inc esi
inc esi
mov byte [esi - 1], cl
mov byte [esi], cl
inc esi
add esi, dword [esp + 0x18]
jmp 0x10005570
mov edx, ecx
mov ebx, ecx
sar ebx, 3
and dl, 0x38
shl dl, 2
inc esi
or dl, bl
mov byte [esi - 1], dl
inc esi
mov edx, ecx
shr edx, 1
sar ecx, 6
and dl, 0x7c
or dl, cl
mov byte [esi - 1], dl
jmp 0x10005570
mov ebx, edi
mov edx, dword [esp + 0x14]
and ebx, 7
mov ebx, dword [edx + ebx*4]
mov dl, 4
cmp ecx, ebx
jg 0x1000553a
xor dl, dl
mov byte [esp + 0x10], 2
cmp ecx, ebx
jg 0x10005548
mov byte [esp + 0x10], 0
or dl, byte [esp + 0x10]
cmp ecx, ebx
setg cl
or dl, cl
xor ecx, ecx
mov cl, dl
test ecx, ecx
je 0x1000555e
or ecx, 8
test edi, 1
je 0x1000556e
shl cl, 4
or byte [esi], cl
inc esi
jmp 0x10005570
mov byte [esi], cl
inc edi
cmp edi, 8
jl 0x100054a7
add dword [esp + 0x1c], 4
add dword [esp + 0x14], 0x20
cmp dword [esp + 0x14], 0x1002d768
jb 0x1000549f
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x1000dfa0
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 0x18
mov eax, dword [0x1002b150]
push ebx
push esi
push edi
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
xor ecx, ecx
mov edi, dword [esp + 0x2c]
mov dword [esp + 0x14], eax
mov dword [esp + 0x24], ecx
mov eax, dword [edi + 0x114]
test eax, eax
je 0x1000dfe0
cmp ecx, 1
je 0x1000dfda
cmp dword [eax + ecx*4], 0
je 0x1000dfda
inc dword [esp + 0x24]
inc ecx
cmp ecx, 0x43
jle 0x1000dfcb
movsx ecx, word [0x10033b00]
mov eax, dword [edi + 0x74]
mov dword [esp + 0x20], ecx
mov dword [esp + 0x1c], eax
cmp eax, 1
jne 0x1000e018
mov eax, dword [edi + 0x11c]
mov ecx, 8
test eax, eax
je 0x1000e008
mov ecx, eax
mov eax, dword [esp + 0x24]
lea edx, [eax + eax*2]
lea ebp, [ecx + edx*4 + 0xb2]
jmp 0x1000e022
mov ecx, dword [esp + 0x14]
mov ebp, dword [ecx + 0x6f0]
xor esi, esi
mov dword [esp + 0x18], esi
cmp dword [esp + 0x1c], esi
jle 0x1000e0bd
cmp dword [edi + 0x120], 0x4949
mov eax, dword [edi + 0x70]
jne 0x1000e04a
mov ecx, dword [eax + esi]
mov dword [esp + 0x10], ecx
jmp 0x1000e080
mov eax, dword [eax + esi]
xor edx, edx
mov ecx, eax
mov dl, ah
shr ecx, 0x10
xor ebx, ebx
shl edx, 0x10
mov bl, al
shl ebx, 0x18
xor eax, eax
or edx, ebx
mov al, cl
shl eax, 8
and edx, 0xffff0000
xor ebx, ebx
mov bl, ch
or eax, ebx
and eax, 0xffff
or edx, eax
mov dword [esp + 0x10], edx
lea eax, [esp + 0x20]
push 2
lea ecx, [esp + 0x14]
push eax
push ebp
push ecx
call fcn.1000e380
mov ecx, dword [esp + 0x24]
add esp, 0x10
test eax, eax
mov dword [ecx + 0x5d84], eax
jne 0x1000e0f0
mov ebp, 0xffffffff
add esi, 4
inc dword [esp + 0x18]
mov eax, dword [esp + 0x18]
cmp eax, dword [esp + 0x1c]
jl 0x1000e032
cmp dword [esp + 0x1c], 1
movsx eax, word [0x10033b00]
mov dword [esp + 0x20], eax
jne 0x1000e102
mov eax, dword [edi + 0x11c]
mov ecx, 8
test eax, eax
je 0x1000e0e0
mov ecx, eax
mov eax, dword [esp + 0x24]
lea edx, [eax + eax*2]
lea ebp, [ecx + edx*4 + 0xbe]
jmp 0x1000e10c
mov ecx, dword [esp + 0x14]
pop ebp
pop edi
pop esi
mov eax, dword [ecx + 0x5d84]
pop ebx
add esp, 0x18
ret
mov ecx, dword [esp + 0x14]
mov ebp, dword [ecx + 0x6f4]
xor esi, esi
mov dword [esp + 0x18], esi
cmp dword [esp + 0x1c], esi
jle 0x1000e1a7
cmp dword [edi + 0x120], 0x4949
mov eax, dword [edi + 0x6c]
jne 0x1000e134
mov ecx, dword [eax + esi]
mov dword [esp + 0x10], ecx
jmp 0x1000e16a
mov eax, dword [eax + esi]
xor edx, edx
mov ecx, eax
mov dl, ah
shr ecx, 0x10
xor ebx, ebx
shl edx, 0x10
mov bl, al
shl ebx, 0x18
xor eax, eax
or edx, ebx
mov al, cl
shl eax, 8
and edx, 0xffff0000
xor ebx, ebx
mov bl, ch
or eax, ebx
and eax, 0xffff
or edx, eax
mov dword [esp + 0x10], edx
lea eax, [esp + 0x20]
push 2
lea ecx, [esp + 0x14]
push eax
push ebp
push ecx
call fcn.1000e380
mov ecx, dword [esp + 0x24]
add esp, 0x10
test eax, eax
mov dword [ecx + 0x5d84], eax
jne 0x1000e1b1
mov ebp, 0xffffffff
add esi, 4
inc dword [esp + 0x18]
mov eax, dword [esp + 0x18]
cmp eax, dword [esp + 0x1c]
jl 0x1000e11c
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x18
ret
mov ecx, dword [esp + 0x14]
pop ebp
pop edi
pop esi
mov eax, dword [ecx + 0x5d84]
pop ebx
add esp, 0x18
ret
Function at 0x1000e1d0
Capabilities:
Get thread local storage value

Disassembly:
push ebx
mov eax, dword [0x1002b150]
push esi
mov ebx, dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push ebp
push eax
call ebx
lea ebp, [eax + 0x5e80]
mov edi, eax
mov ecx, dword [ebp]
test ecx, ecx
jne 0x1000e20f
mov esi, dword [esp + 0x14]
cmp esi, 0xffffffff
jne 0x1000e2aa
mov eax, dword [edi + 0x5e74]
sub eax, dword [edi + 0x5e84]
lea esi, [eax + ecx]
jmp 0x1000e22a
mov eax, dword [edi + 0x5e74]
mov esi, dword [esp + 0x14]
sub eax, dword [edi + 0x5e84]
add eax, ecx
cmp eax, esi
jne 0x1000e22a
mov esi, 0xffffffff
cmp esi, 0xffffffff
jne 0x1000e2aa
cmp dword [edi + 0x5e84], 0
jne 0x1000e35b
mov eax, dword [0x1002b150]
push eax
call ebx
mov ecx, dword [eax + 0x5e84]
lea edi, [eax + 0x5e80]
mov esi, eax
mov eax, dword [edi]
cmp ecx, eax
jae 0x1000e294
sub eax, ecx
lea ebx, [esi + 0x5e78]
push 0
mov dword [edi], eax
push edi
add dword [esi + 0x5e74], eax
push 0xffffffffffffffff
push ebx
call dword [esi + 0x5d18]
add esp, 0x10
test eax, eax
jne 0x1000e29e
cmp dword [ebx], 0
je 0x1000e2a3
mov eax, dword [edi]
test eax, eax
je 0x1000e2a3
mov dword [esi + 0x5e84], eax
mov eax, dword [ebx]
mov dword [esi + 0x5e7c], eax
xor eax, eax
test eax, eax
je 0x1000e35b
pop ebp
pop edi
pop esi
pop ebx
ret
mov eax, 0xffffffde
jmp 0x1000e296
mov eax, dword [0x1002b150]
push eax
call ebx
mov ecx, dword [eax + 0x5e84]
mov ebx, eax
mov eax, dword [eax + 0x5e80]
cmp ecx, eax
jae 0x1000e316
sub eax, ecx
push 0
lea ecx, [ebx + 0x5e80]
lea edx, [ebx + 0x5e78]
push ecx
mov dword [ebx + 0x5e80], eax
push 0xffffffffffffffff
add dword [ebx + 0x5e74], eax
push edx
call dword [ebx + 0x5d18]
add esp, 0x10
test eax, eax
jne 0x1000e36e
cmp dword [ebx + 0x5e78], 0
je 0x1000e362
mov eax, dword [ebx + 0x5e80]
test eax, eax
je 0x1000e362
mov dword [ebx + 0x5e84], eax
mov eax, dword [ebx + 0x5e78]
mov dword [ebx + 0x5e7c], eax
xor eax, eax
test eax, eax
jne 0x1000e36e
lea ebx, [edi + 0x5e78]
push 0
push ebp
mov dword [ebp], 0
push esi
push ebx
call dword [edi + 0x5d18]
add esp, 0x10
test eax, eax
jne 0x1000e36e
cmp dword [ebx], 0
je 0x1000e369
mov eax, dword [ebp]
test eax, eax
je 0x1000e369
mov dword [edi + 0x5e84], eax
mov eax, dword [ebx]
mov dword [edi + 0x5e7c], eax
mov dword [edi + 0x5e74], esi
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
ret
mov eax, 0xffffffde
jmp 0x1000e318
mov eax, 0xffffffde
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x1000f1a0
Capabilities:
Get thread local storage value

Disassembly:
push ebx
mov eax, dword [0x1002b150]
push esi
push edi
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x14]
mov cl, byte [edx + 0x20]
mov ax, word [eax]
sar ax, cl
movsx ebp, ax
mov ebx, ebp
mov eax, dword [esp + 0x18]
sub ebx, dword [eax]
jne 0x1000f1d4
xor edi, edi
jmp 0x1000f1f4
mov eax, ebx
test ebx, ebx
jge 0x1000f1df
mov eax, ebx
dec ebx
neg eax
push eax
call fcn.10010240
add esp, 4
mov edi, eax
cmp edi, 0xc
jbe 0x1000f1f4
mov edi, 0xc
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov dword [eax], ebp
cmp dword [edx + 0x24], 0
je 0x1000f233
cmp dword [esp + 0x28], 0
jne 0x1000f21f
mov eax, dword [esi + 0x9908]
lea ecx, [edi + edi*2]
pop ebp
pop edi
pop esi
inc dword [eax + ecx*8 + 0xc]
xor eax, eax
pop ebx
ret
lea ecx, [edi + edi*2]
mov eax, dword [esi + 0x990c]
pop ebp
pop edi
pop esi
inc dword [eax + ecx*8 + 0xc]
xor eax, eax
pop ebx
ret
xor eax, eax
mov ecx, dword [esp + 0x1c]
mov al, byte [ecx + edi]
mov edx, dword [ecx + edi*4 + 0x10]
push eax
push edx
call fcn.10010820
add esp, 8
mov dword [esi + 0x5d84], eax
test eax, eax
jne 0x1000f26e
test edi, edi
je 0x1000f26c
push edi
push ebx
call fcn.10010820
add esp, 8
mov dword [esi + 0x5d84], eax
test eax, eax
jne 0x1000f26e
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x100103b0
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 4
mov eax, dword [0x1002b150]
push ebx
push esi
push edi
push ebp
push eax
mov edi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
call edi
cmp dword [eax + 0x798], 0
mov esi, eax
jle 0x100104ff
mov eax, dword [esp + 0x18]
mov edx, dword [0x1002b150]
push edx
mov ebx, dword [eax + 4]
mov eax, dword [esi + ebx*4 + 0x5c40]
mov ecx, dword [esi + eax*8 + 0x5c20]
mov dword [esp + 0x14], ecx
call edi
mov edi, eax
mov eax, dword [eax + 0x798]
cmp eax, 1
jne 0x1001040a
xor ebp, ebp
jmp 0x100104c0
cmp eax, 3
jg 0x10010419
mov ebp, 1
jmp 0x100104c0
cmp eax, 7
jg 0x10010428
mov ebp, 2
jmp 0x100104c0
cmp eax, 0xf
jg 0x10010437
mov ebp, 3
jmp 0x100104c0
cmp eax, 0x1f
jg 0x10010443
mov ebp, 4
jmp 0x100104c0
cmp eax, 0x3f
jg 0x1001044f
mov ebp, 5
jmp 0x100104c0
cmp eax, 0x7f
jg 0x1001045b
mov ebp, 6
jmp 0x100104c0
cmp eax, 0xff
jg 0x10010469
mov ebp, 7
jmp 0x100104c0
cmp eax, 0x1ff
jg 0x10010477
mov ebp, 8
jmp 0x100104c0
cmp eax, 0x3ff
jg 0x10010485
mov ebp, 9
jmp 0x100104c0
cmp eax, 0x7ff
jg 0x10010493
mov ebp, 0xa
jmp 0x100104c0
cmp eax, 0xfff
jg 0x100104a1
mov ebp, 0xb
jmp 0x100104c0
cmp eax, 0x1fff
jg 0x100104af
mov ebp, 0xc
jmp 0x100104c0
mov ebp, 0xd
cmp eax, 0x4257
jle 0x100104c0
mov ebp, 0xe
mov eax, dword [esp + 0x18]
cmp dword [eax + 0x24], 0
je 0x10010511
test ebx, ebx
jne 0x10010509
mov eax, dword [edi + 0x9910]
shl ebp, 7
lea ecx, [ebp + ebp*2]
inc dword [eax + ecx + 0xc]
mov dword [edi + 0x798], 0
mov dword [esi + 0x5d84], 0
add esi, 0x5d84
mov eax, dword [esi]
test eax, eax
jne 0x10010501
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
mov eax, dword [edi + 0x9914]
jmp 0x100104d4
mov edx, ebp
xor eax, eax
shl edx, 4
mov ecx, dword [esp + 0x10]
mov al, byte [edx + ecx]
push eax
mov eax, ebp
shl eax, 6
mov edx, dword [eax + ecx + 0x100]
push edx
call fcn.10010820
add esp, 8
mov dword [edi + 0x5d84], eax
test eax, eax
je 0x1001054d
mov dword [esi + 0x5d84], eax
add esi, 0x5d84
jmp 0x100104f9
push ebp
mov eax, dword [edi + 0x798]
push eax
call fcn.10010820
add esp, 8
mov dword [edi + 0x5d84], eax
test eax, eax
je 0x100104df
mov dword [esi + 0x5d84], eax
add esi, 0x5d84
jmp 0x100104f9
Function at 0x10010580
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 4
mov eax, dword [0x1002b150]
push ebx
push esi
push edi
push ebp
push eax
mov edi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
call edi
cmp dword [eax + 0x798], 0
mov esi, eax
jle 0x1001078c
mov eax, dword [esp + 0x18]
mov edx, dword [0x1002b150]
push edx
mov ebx, dword [eax + 4]
mov eax, dword [esi + ebx*4 + 0x5c40]
mov ecx, dword [esi + eax*8 + 0x5c20]
mov dword [esp + 0x14], ecx
call edi
mov edi, eax
mov eax, dword [eax + 0x798]
cmp eax, 1
jne 0x100105da
xor ebp, ebp
jmp 0x10010690
cmp eax, 3
jg 0x100105e9
mov ebp, 1
jmp 0x10010690
cmp eax, 7
jg 0x100105f8
mov ebp, 2
jmp 0x10010690
cmp eax, 0xf
jg 0x10010607
mov ebp, 3
jmp 0x10010690
cmp eax, 0x1f
jg 0x10010613
mov ebp, 4
jmp 0x10010690
cmp eax, 0x3f
jg 0x1001061f
mov ebp, 5
jmp 0x10010690
cmp eax, 0x7f
jg 0x1001062b
mov ebp, 6
jmp 0x10010690
cmp eax, 0xff
jg 0x10010639
mov ebp, 7
jmp 0x10010690
cmp eax, 0x1ff
jg 0x10010647
mov ebp, 8
jmp 0x10010690
cmp eax, 0x3ff
jg 0x10010655
mov ebp, 9
jmp 0x10010690
cmp eax, 0x7ff
jg 0x10010663
mov ebp, 0xa
jmp 0x10010690
cmp eax, 0xfff
jg 0x10010671
mov ebp, 0xb
jmp 0x10010690
cmp eax, 0x1fff
jg 0x1001067f
mov ebp, 0xc
jmp 0x10010690
mov ebp, 0xd
cmp eax, 0x4257
jle 0x10010690
mov ebp, 0xe
mov eax, dword [esp + 0x18]
cmp dword [eax + 0x24], 0
je 0x10010726
test ebx, ebx
jne 0x10010713
shl ebp, 7
mov eax, dword [edi + 0x9910]
lea ecx, [ebp + ebp*2]
inc dword [ecx + eax + 0xc]
mov dword [edi + 0x798], 0
lea edi, [esi + 0x5d84]
mov dword [edi], 0
mov eax, dword [edi]
test eax, eax
jne 0x1001078e
mov eax, dword [esp + 0x18]
cmp dword [eax + 0x24], 0
jne 0x1001078c
mov ebx, dword [esi + 0x6900]
cmp dword [esi + 0x6904], ebx
jbe 0x1001078c
mov ecx, dword [ebx]
mov eax, ebx
add ebx, 4
push 1
push ecx
call fcn.10010820
add esp, 8
mov dword [edi], eax
test eax, eax
je 0x100106e7
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
shl ebp, 7
mov eax, dword [edi + 0x9914]
lea ecx, [ebp + ebp*2]
inc dword [eax + ecx + 0xc]
jmp 0x100106b3
mov edx, ebp
xor eax, eax
shl edx, 4
mov ecx, dword [esp + 0x10]
mov al, byte [edx + ecx]
push eax
mov eax, ebp
shl eax, 6
mov edx, dword [eax + ecx + 0x100]
push edx
call fcn.10010820
add esp, 8
mov dword [edi + 0x5d84], eax
test eax, eax
je 0x10010761
lea edi, [esi + 0x5d84]
mov dword [edi], eax
jmp 0x100106c9
push ebp
mov eax, dword [edi + 0x798]
push eax
call fcn.10010820
add esp, 8
mov dword [edi + 0x5d84], eax
test eax, eax
je 0x100106b3
lea edi, [esi + 0x5d84]
mov dword [edi], eax
jmp 0x100106c9
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
Function at 0x100107c0
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 4
mov eax, dword [0x1002b150]
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
lea edi, [eax + 0x59e8]
mov esi, eax
lea eax, [esp + 8]
push 0
mov dword [esp + 0xc], 0
push eax
push 0xffffffffffffffff
push edi
call fcn.1000e380
add esp, 0x10
test eax, eax
jne 0x1001081a
mov eax, dword [edi]
mov dword [esi + 0x59ec], eax
mov byte [eax], 0
mov eax, dword [edi]
add eax, dword [esp + 8]
mov dword [esi + 0x59f0], eax
xor eax, eax
mov dword [esi + 0x59f4], 8
pop edi
pop esi
add esp, 4
ret

Function at 0x10010820
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 4
mov eax, dword [0x1002b150]
push ebx
push esi
push edi
push ebp
push eax
xor edi, edi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
mov ebx, dword [esp + 0x1c]
cmp ebx, edi
je 0x1001097c
mov eax, dword [esp + 0x18]
and eax, dword [ebx*4 + 0x1002d7f0]
mov dword [esp + 0x18], eax
mov eax, dword [esi + 0x59f4]
cmp eax, ebx
jg 0x10010986
sub ebx, eax
mov edx, dword [esi + 0x59ec]
mov eax, dword [esp + 0x18]
mov cl, bl
shr eax, cl
or byte [edx], al
mov eax, dword [esi + 0x59ec]
inc eax
mov dword [esi + 0x59ec], eax
cmp dword [esi + 0x59f8], 0
je 0x10010893
cmp byte [eax - 1], 0xff
jne 0x10010893
mov edi, 1
mov ecx, dword [esi + 0x59f0]
cmp eax, ecx
jne 0x100108c6
lea ebp, [esi + 0x59e8]
push 0
sub ecx, dword [ebp]
mov dword [esp + 0x14], ecx
lea ecx, [esp + 0x14]
push ecx
push 0xffffffffffffffff
push ebp
call fcn.1000e380
add esp, 0x10
test eax, eax
jne 0x1001097e
jmp 0x100108ef
jb 0x10010905
lea ebp, [esi + 0x59e8]
push 0
sub ecx, dword [ebp]
mov dword [esp + 0x14], ecx
lea ecx, [esp + 0x14]
push ecx
push 0xffffffffffffffff
push ebp
call fcn.1000e380
add esp, 0x10
test eax, eax
jne 0x1001097e
mov eax, dword [ebp]
mov dword [esi + 0x59ec], eax
mov eax, dword [ebp]
add eax, dword [esp + 0x10]
mov dword [esi + 0x59f0], eax
mov dword [esi + 0x59f4], 8
mov eax, dword [esi + 0x59ec]
test edi, edi
mov byte [eax], 0
je 0x10010974
mov eax, dword [esi + 0x59ec]
inc eax
mov dword [esi + 0x59ec], eax
mov ecx, dword [esi + 0x59f0]
cmp eax, ecx
jb 0x10010969
lea edi, [esi + 0x59e8]
push 0
sub ecx, dword [edi]
mov dword [esp + 0x14], ecx
lea ecx, [esp + 0x14]
push ecx
push 0xffffffffffffffff
push edi
call fcn.1000e380
add esp, 0x10
test eax, eax
jne 0x1001097e
mov eax, dword [edi]
mov dword [esi + 0x59ec], eax
mov eax, dword [edi]
add eax, dword [esp + 0x10]
mov dword [esi + 0x59f0], eax
mov eax, dword [esi + 0x59ec]
xor edi, edi
mov byte [eax], 0
test ebx, ebx
jne 0x10010843
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
mov ecx, dword [esi + 0x59f4]
mov edx, dword [esp + 0x18]
sub ecx, ebx
pop ebp
pop edi
mov dword [esi + 0x59f4], ecx
shl dl, cl
mov eax, dword [esi + 0x59ec]
pop esi
pop ebx
or byte [eax], dl
xor eax, eax
add esp, 4
ret
Function at 0x100109b0
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 4
mov eax, dword [0x1002b150]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
lea edx, [eax + 0x59e8]
mov ecx, dword [eax + 0x59f4]
sub ecx, 8
push 1
cmp ecx, 1
sbb ecx, ecx
inc ecx
sub ecx, dword [edx]
add ecx, dword [eax + 0x59ec]
mov dword [esp + 4], ecx
lea ecx, [esp + 4]
push ecx
push 0xffffffffffffffff
push edx
call fcn.1000e380
add esp, 0x14
ret

Function at 0x10010a00
Capabilities:
Get thread local storage value

Disassembly:
push esi
mov eax, dword [0x1002b150]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
mov eax, dword [eax + 0x59f4]
cmp eax, 8
jge 0x10010a2d
push eax
push 0xff
call fcn.10010820
add esp, 8
test eax, eax
jne 0x10010a6b
mov esi, dword [edi + 0x59f8]
push 8
mov dword [edi + 0x59f8], 0
push 0xff
call fcn.10010820
add esp, 8
test eax, eax
jne 0x10010a6b
mov eax, dword [esp + 0xc]
push 8
push eax
call fcn.10010820
add esp, 8
test eax, eax
jne 0x10010a6b
xor eax, eax
mov dword [edi + 0x59f8], esi
pop edi
pop esi
ret
Function at 0x10012830
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 4
mov eax, dword [0x1002b150]
push ebx
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
lea ebx, [eax + 0x59fc]
lea edi, [eax + 0x59e8]
mov esi, eax
push ebx
lea eax, [esp + 0x10]
mov dword [ebx], 0
push eax
push 0xffffffffffffffff
push edi
call fcn.1000e960
add esp, 0x10
test eax, eax
jne 0x100128a3
cmp dword [ebx], 1
jne 0x10012883
cmp dword [esp + 0xc], 4
jae 0x10012883
mov eax, 0xffffffc2
pop edi
pop esi
pop ebx
add esp, 4
ret
mov eax, dword [edi]
mov dword [esi + 0x59ec], eax
mov eax, dword [edi]
add eax, dword [esp + 0xc]
mov dword [esi + 0x59f0], eax
xor eax, eax
mov dword [esi + 0x59f4], 8
pop edi
pop esi
pop ebx
add esp, 4
ret
Function at 0x10012fc0
Capabilities:
Get thread local storage value

Disassembly:
push ebx
mov eax, dword [0x1002b150]
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
push 0x134
mov esi, dword [esp + 0x14]
push 0x10031360
push esi
call fcn.1000eef0
mov eax, dword [esp + 0x20]
add esp, 0xc
cmp eax, 5
ja case.0x10012ff1.1
jmp dword [eax*4 + 0x100130a8]
lea eax, [esi + 0x18]
mov dword [eax], 1
jmp 0x1001304e
lea eax, [esi + 0x18]
lea ebx, [esi + 0xa0]
mov dword [esi + 0xe4], 1
mov dword [eax], 0
mov dword [ebx], 0
jmp 0x10013064
lea eax, [esi + 0x18]
mov dword [eax], 2
jmp 0x1001304e
lea eax, [esi + 0x18]
mov dword [eax], 3
jmp 0x1001304e
lea eax, [esi + 0x18]
mov dword [eax], 4
jmp 0x1001304e
lea eax, [esi + 0x18]
mov dword [eax], 5
lea ebx, [esi + 0xa0]
mov dword [esi + 0xe4], 3
mov dword [ebx], 2
push 0x20
mov eax, dword [eax]
mov ecx, eax
lea edx, [eax + eax*4]
lea eax, [edx + edx*8]
sub eax, ecx
lea ecx, [esi + 0x1c]
add eax, edi
add eax, 0x5a18
push eax
push ecx
call fcn.1000eef0
add esp, 0xc
mov ecx, dword [ebx]
lea edx, [ecx + ecx*4]
add esi, 0xa4
push 0x20
lea eax, [edx*8 + 0x1002d0c0]
push eax
push esi
call fcn.1000eef0
add esp, 0xc
pop edi
pop esi
pop ebx
ret

Function at 0x10013ed0
Capabilities:
Get thread local storage value

Disassembly:
push ebx
mov eax, dword [0x1002b150]
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp dword [eax + 0x5d88], 0
mov ebx, eax
je 0x10013ef3
mov eax, 0xffffffe1
pop edi
pop esi
pop ebx
ret
mov edi, dword [esp + 0x10]
cmp dword [edi + 0x8c], 0
jne 0x10013f09
mov eax, 0xffffffcb
pop edi
pop esi
pop ebx
ret
xor eax, eax
lea esi, [ebx + 0x5c50]
push 0x134
mov dword [ebx + 0x5e74], eax
push edi
mov dword [ebx + 0x5e80], eax
push esi
mov dword [ebx + 0x5e84], eax
mov dword [ebx + 0x5ea4], 0xffff
call fcn.1000eef0
add esp, 0xc
lea edx, [ebx + 0x5ea8]
lea ecx, [ebx + 0x5c8c]
mov eax, 4
mov dword [ecx], edx
add ecx, 4
add edx, 0x100
dec eax
jne 0x10013f4d
lea ecx, [ebx + 0x62a8]
lea eax, [ebx + 0x5c9c]
mov edx, 4
mov dword [eax], ecx
add eax, 4
add ecx, 0x21
dec edx
jne 0x10013f6c
lea ecx, [ebx + 0x632c]
add ebx, 0x5cac
mov eax, 4
mov dword [ebx], ecx
add ebx, 4
add ecx, 0x110
dec eax
jne 0x10013f88
mov eax, dword [edi + 0x14]
test eax, eax
je 0x10013fb0
cmp eax, 1
je 0x10013fb8
cmp eax, 2
je 0x10013fc0
mov eax, 0xfffffff7
pop edi
pop esi
pop ebx
ret
push esi
call fcn.1001fa90
jmp 0x10013fc6
push esi
call fcn.10001a40
jmp 0x10013fc6
push esi
call fcn.10016ef0
add esp, 4
mov ebx, eax
test ebx, ebx
jne 0x10013fde
push 0x134
push esi
push edi
call fcn.1000eef0
add esp, 0xc
mov eax, ebx
pop edi
pop esi
pop ebx
ret