joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10218d93
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp byte [ebp + 0xc], 0
push ebx
push esi
mov esi, ecx
jne 0x10218e0d
cmp byte [ebp + 8], 0
jne 0x10218e0d
xor ebx, ebx
test byte [esi + 0x32], 2
je 0x10218e04
test byte [esi + 0x7e], 1
je 0x10218dc4
cmp dword [esi + 0x3c], ebx
je 0x10218dc4
xor eax, eax
inc eax
jmp 0x10218f0c
push 1
call fcn.1021e824
mov eax, dword [esi + 0x3c]
cmp eax, ebx
je 0x10218e04
mov dword [ebp - 8], eax
push 4
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 0x10], 0x10
mov dword [ebp - 0xc], 0x83ff
call fcn.10262cbc
mov ecx, dword [esi + 4]
cmp ecx, ebx
je 0x10218f0a
push esi
call fcn.10217578
jmp 0x10218f0a
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x1c]
jmp 0x10218e0f
xor ebx, ebx
push edi
mov edi, dword [esi + 4]
cmp edi, ebx
je 0x10218e32
mov ecx, esi
call fcn.1021766c
mov eax, dword [edi]
push esi
mov ecx, edi
call dword [eax + 0x2c]
jmp 0x10218e32
mov ecx, dword [esi + 8]
push ebx
push ebx
call fcn.10218d93
cmp dword [esi + 8], ebx
jne 0x10218e28
lea ecx, [esi + 0x14]
call fcn.10208c89
mov ecx, dword [esi + 0x2c]
cmp ecx, ebx
je 0x10218e54
test byte [esi + 0x32], 0x40
jne 0x10218e51
call fcn.1025f5ca
mov dword [esi + 0x2c], ebx
call fcn.10208976
mov edi, eax
cmp edi, ebx
je 0x10218ed6
cmp dword [edi], ebx
jle 0x10218ed6
test byte [esi + 0x32], 2
je 0x10218e81
push 1
push ebx
push esi
lea ecx, [edi + 0x64]
call fcn.10283904
push 1
push ebx
push esi
lea ecx, [edi + 0x58]
call fcn.10283904
mov eax, dword [esi + 0x1c]
or ecx, 0xffffffff
cmp eax, ecx
je 0x10218e94
mov edx, dword [edi + 0x10]
mov dword [edx + eax*8], ebx
mov dword [esi + 0x1c], ecx
mov eax, dword [esi + 0x20]
cmp eax, ecx
je 0x10218ea4
mov edx, dword [edi + 0x20]
mov dword [edx + eax*8], ebx
mov dword [esi + 0x20], ecx
mov eax, dword [esi + 0x24]
cmp eax, ecx
je 0x10218ed6
cmp eax, dword [edi + 0x78]
jl 0x10218ed2
imul eax, eax, 0x1c
add eax, dword [edi + 0x30]
mov ebx, eax
cmp byte [ebx], 0
jne 0x10218ec4
mov ecx, ebx
call fcn.1021356a
mov eax, dword [ebx + 0x18]
and dword [ebx + 4], 0
cmp eax, dword [edi + 0x78]
jge 0x10218eb0
xor ebx, ebx
or dword [esi + 0x24], 0xffffffff
or byte [esi + 0x32], 0x20
mov al, byte [esi + 0x32]
pop edi
test al, 8
jne 0x10218f05
mov ecx, dword [esi + 0x28]
cmp ecx, ebx
je 0x10218efc
test byte [ecx + 0xc], 4
jne 0x10218f05
cmp ecx, ebx
je 0x10218efc
push ecx
call fcn.102ba069
mov dword [esi + 0x28], ebx
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x20]
jmp 0x10218f0a
or al, 0x10
mov byte [esi + 0x32], al
xor eax, eax
pop esi
pop ebx
leave
ret 8
Function at 0x1022565b
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x1039fb98]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
cmp dword [esi + 0x60], ebx
jne 0x102256c2
push 0x105
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x107
lea eax, [ebp - 0x214]
push eax
push 0x10085d34
call fcn.101ef613
lea eax, [ebp - 0x214]
push eax
call fcn.102254c9
mov dword [esi + 0x60], eax
cmp eax, ebx
jne 0x102256c2
push 0x10085d20
call fcn.102254c9
mov dword [esi + 0x60], eax
mov esi, dword [esi + 0x60]
mov edi, dword [sym.imp.USER32.dll_LoadCursorW]
cmp esi, ebx
je 0x102256f8
mov eax, dword [ebp + 8]
sub eax, ebx
je 0x102256ea
dec eax
dec eax
je 0x102256e6
dec eax
je 0x102256e2
push 2
pop eax
jmp 0x102256ed
push 4
jmp 0x102256df
push 3
jmp 0x102256df
xor eax, eax
inc eax
movzx eax, ax
push eax
push esi
call edi
cmp eax, ebx
jne 0x1022570c
cmp dword [ebp + 8], ebx
je 0x10225704
push 0x7f00
jmp 0x10225709
push 0x7f88
push ebx
call edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.102f77a6
leave
ret 4

Function at 0x1022ca88
Capabilities:
Hide graphical window

Disassembly:
push esi
push edi
mov edi, ecx
lea esi, [edi + 0xa0]
push dword [esi]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x1022caa8
push 0
push dword [esi]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, edi
pop edi
pop esi
jmp fcn.1021c845

Function at 0x1022d267
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
push 0
lea ecx, [esi + 0x94]
call fcn.10208ce0
mov ecx, esi
pop esi
jmp fcn.1022ccc2
Function at 0x1022dd47
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
mov eax, dword [0x1039fb98]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
mov eax, dword [esi + 0x9c]
test eax, eax
je 0x1022de75
test byte [esi + 0x32], 4
jne 0x1022de75
test byte [esi + 0xc4], 8
je 0x1022de75
push ebx
push edi
push eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov edi, eax
cmp edi, 0x40
lea ebx, [ebp - 0x84]
jl 0x1022ddaa
push 2
push edi
call fcn.102116e7
mov ebx, eax
test ebx, ebx
je 0x1022de73
test edi, edi
jle 0x1022ddbf
inc edi
push edi
push ebx
push dword [esi + 0x9c]
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x1022ddc4
xor eax, eax
mov word [ebx], ax
lea eax, [ebp - 0x8c]
push eax
mov ecx, esi
call fcn.10204532
mov edi, eax
test edi, edi
jne 0x1022dddd
mov edi, 0x100054f8
push edi
push ebx
call fcn.101ef07e
test eax, eax
je 0x1022de58
push edi
push dword [esi + 0x9c]
call dword [sym.imp.USER32.dll_SetWindowTextW]
push esi
call fcn.1022d118
mov esi, eax
xor edi, edi
cmp esi, edi
je 0x1022de58
mov eax, dword [0x1008745c]
mov cx, word [eax + 4]
and cx, 3
movzx ecx, cx
movzx ecx, cx
push edi
push ecx
push eax
mov ecx, esi
mov dword [ebp - 0x88], edi
call fcn.1021511f
push eax
lea ecx, [ebp - 0x88]
call fcn.101ff9c6
push dword [ebp - 0x88]
call fcn.101ff986
test al, al
jne 0x1022de49
push edi
mov ecx, esi
call fcn.1022f940
mov ecx, dword [ebp - 0x88]
cmp ecx, edi
je 0x1022de58
call sym.osetup.dll_public:_void___thiscall_NetUI::BaseValue::Release_void_
mov ecx, dword [ebp - 0x8c]
call sym.osetup.dll_public:_void___thiscall_NetUI::BaseValue::Release_void_
lea eax, [ebp - 0x84]
cmp ebx, eax
je 0x1022de73
push ebx
call sym.osetup.dll_void___stdcall_NetUI::HFree_void__
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.102f77a6
leave
ret
Function at 0x10252224
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0x14]
xor ebx, ebx
cmp edi, ebx
je 0x10252235
mov dword [edi], ebx
push dword [0x1039b850]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
cmp esi, ebx
jne 0x102522ed
mov esi, dword [ebp + 8]
cmp esi, ebx
jne 0x102522d1
mov eax, dword [ebp + 0x10]
sub eax, ebx
je 0x1025225f
dec eax
je 0x1025227b
dec eax
jne 0x10252274
push 8
push ebx
push dword [0x103a5dac]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
cmp esi, ebx
jne 0x1025227f
mov eax, 0x8007000e
jmp 0x102522f5
push 0x10
jmp 0x10252261
mov eax, dword [ebp + 0x10]
sub eax, ebx
mov edi, 0x80004005
je 0x10252291
dec eax
je 0x102522af
dec eax
jne 0x102522a4
mov dword [esi + 4], 1
mov dword [esi], 0x1008ee28
xor edi, edi
cmp edi, ebx
jge 0x102522dd
mov ecx, esi
call fcn.10252094
mov eax, edi
jmp 0x102522f5
push dword [ebp + 0xc]
and dword [esi + 0xc], 0xfffffffc
mov ecx, esi
mov dword [esi + 4], 1
mov dword [esi], 0x1008ee10
mov dword [esi + 8], ebx
call fcn.10251ef2
mov edi, eax
jmp 0x102522a0
xor ecx, ecx
lea eax, [esi + 4]
inc ecx
lock xadd dword [eax], ecx
jmp 0x102522e0
mov edi, dword [ebp + 0x14]
push esi
push dword [0x1039b850]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
cmp edi, ebx
je 0x102522f3
mov dword [edi], esi
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x10254c14
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
inc ebp
or al, 0x66
cmp eax, dword [edi + 6]
inc ebp
or al, 0x66
cmp eax, dword [edi + 6]
jne 0x10254c2b
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x10254c49
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x10254ca7
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x10254c8e
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x10254c97
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x10254ca1
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x10254c83
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x10254c0d
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x10254cf4
dec eax
je 0x10254ceb
sub eax, 3
je 0x10254ce2
mov dword [ebp - 4], 0x40
jmp 0x10254d11
mov dword [ebp - 4], 4
jmp 0x10254cf7
mov dword [ebp - 4], 0x20
jmp 0x10254cf7
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x10254d43
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x10254cc3
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.10254554
outsd dx, dword [esi]
push ds
sbb byte [eax - 1], 0x75
adc al, 0x6a
add dword [esi - 1], edx
xlatb
mov eax, esi
jmp 0x10254d4f
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x10259693
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x10259716
mov eax, dword [ebx]
push 0x1039be48
mov ecx, ebx
call dword [eax + 0x20]
test al, al
je 0x10259716
push dword [0x1039a750]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x10259716
push esi
lea esi, [eax + 0x38]
movzx eax, word [esi]
push edi
cmp ax, 0x23
jae 0x102596f6
movzx eax, ax
xor edi, edi
mov dword [ebp + 8], eax
test eax, eax
jle 0x10259703
mov edx, dword [esi + 4]
mov ecx, edx
mov eax, dword [ecx]
cmp ebx, eax
je 0x102596f0
jb 0x10259703
inc edi
add ecx, 8
cmp edi, dword [ebp + 8]
jl 0x102596dd
jmp 0x10259703
lea eax, [edx + edi*8 + 4]
jmp 0x102596ff
mov edx, ebx
mov ecx, esi
call fcn.10252e98
test eax, eax
jne 0x10259714
push 0xffffffffffffffff
push dword [ebp + 0xc]
mov ecx, esi
push ebx
call fcn.1021495d
mov byte [ebx + 0x1c], 1
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x1025a909
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push dword [ebp + 0xc]
mov esi, ecx
push dword [ebp + 8]
lea ecx, [ebp - 8]
call fcn.10259e92
push 0xffffffffffffffff
push 0x2e
lea ecx, [ebp - 8]
call fcn.1021ab62
cmp eax, 0xffffffff
jne 0x1025a93c
lea ecx, [ebp - 8]
call fcn.1021a779
xor al, al
jmp 0x1025a96f
push ebx
mov ecx, esi
call fcn.1025a880
xor ebx, ebx
cmp eax, ebx
je 0x1025a974
cmp word [eax], bx
je 0x1025a974
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0xffffffffffffffff
push eax
call fcn.1026abd7
test eax, eax
jge 0x1025a992
lea ecx, [ebp - 8]
call fcn.1021a779
xor al, al
pop ebx
pop esi
leave
ret 0xc
push dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push dword [ebp + 8]
call fcn.1021af60
test eax, eax
jge 0x1025a992
lea ecx, [ebp - 8]
call fcn.1021a779
mov al, bl
jmp 0x1025a96e
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
cmp eax, ebx
jne 0x1025a9a0
mov eax, 0x100054f8
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1025a986
test al, 0x10
jne 0x1025a986
mov bl, 1
jmp 0x1025a986
Function at 0x10262639
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push edi
push dword [0x1039deb8]
xor edi, edi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, edi
je 0x10262657
mov eax, dword [eax + 0x74]
jmp 0x10262659
xor eax, eax
cmp eax, edi
jne 0x1026266a
push 0x80040014
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x102626b8
push eax
push edi
push edi
lea ecx, [ebp - 0xc]
mov dword [ebp - 0xc], edi
call fcn.102bde47
test eax, eax
jne 0x10262689
push 0x80070057
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x102626b0
push esi
mov esi, dword [ebp + 0xc]
cmp esi, edi
je 0x102626a4
mov ecx, dword [ebp + 8]
cmp ecx, edi
je 0x102626a4
mov eax, dword [ecx]
call dword [eax + 0xc]
xor edi, edi
mov dword [esi], eax
inc edi
jmp 0x102626af
push 0x80070057
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop esi
lea ecx, [ebp - 0xc]
call fcn.102bde00
mov eax, edi
pop edi
leave
ret 8

Function at 0x102626bf
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push edi
push dword [0x1039deb8]
xor ebx, ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, ebx
je 0x102626e1
mov edi, dword [eax + 0x74]
jmp 0x102626e3
xor edi, edi
cmp edi, ebx
jne 0x102626f4
push 0x80040014
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x10262764
push edi
push ebx
push ebx
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x10], ebx
call fcn.102bde47
test eax, eax
je 0x10262751
push esi
mov esi, dword [ebp + 8]
cmp esi, ebx
je 0x10262720
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x14]
shr eax, 2
test al, 1
je 0x10262720
mov ecx, esi
jmp 0x10262722
xor ecx, ecx
pop esi
cmp ecx, ebx
je 0x10262751
cmp edi, dword [ecx + 8]
je 0x10262733
push 0x8004001e
jmp 0x10262756
cmp dword [ebp + 0xc], ebx
je 0x10262751
cmp dword [ebp + 0x10], ebx
je 0x10262751
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.102bf17b
mov dword [ebp - 4], 1
jmp 0x1026275c
push 0x80070057
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea ecx, [ebp - 0x10]
call fcn.102bde00
mov eax, dword [ebp - 4]
pop edi
pop ebx
leave
ret 0xc
Function at 0x1026276d
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
and dword [ebp - 4], 0
push edi
push dword [0x1039deb8]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x1026278d
mov edi, dword [eax + 0x74]
jmp 0x1026278f
xor edi, edi
test edi, edi
jne 0x102627a0
push 0x80040014
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x10262819
and dword [ebp - 0x10], 0
push edi
push 0
push 0
lea ecx, [ebp - 0x10]
call fcn.102bde47
test eax, eax
jne 0x102627c2
push 0x80070057
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x10262811
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x102627dc
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x14]
shr eax, 2
test al, 1
je 0x102627dc
mov ecx, esi
jmp 0x102627de
xor ecx, ecx
test ecx, ecx
je 0x10262805
cmp edi, dword [ecx + 8]
je 0x102627ee
push 0x8004001e
jmp 0x1026280a
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x10262805
call fcn.102bf1a8
fstp dword [esi]
mov dword [ebp - 4], 1
jmp 0x10262810
push 0x80070057
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop esi
lea ecx, [ebp - 0x10]
call fcn.102bde00
mov eax, dword [ebp - 4]
pop edi
leave
ret 8

Function at 0x10262821
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
and dword [ebp - 4], 0
push edi
push dword [0x1039deb8]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x10262841
mov edi, dword [eax + 0x74]
jmp 0x10262843
xor edi, edi
test edi, edi
jne 0x10262857
push 0x80040014
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x102628f4
and dword [ebp - 0x10], 0
push edi
push 0
push 0
lea ecx, [ebp - 0x10]
call fcn.102bde47
test eax, eax
jne 0x10262879
push 0x80070057
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x102628ec
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x10262893
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x14]
shr eax, 2
test al, 1
je 0x10262893
mov ecx, esi
jmp 0x10262895
xor ecx, ecx
test ecx, ecx
je 0x102628e0
cmp edi, dword [ecx + 8]
je 0x102628a5
push 0x8004001e
jmp 0x102628e5
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x102628e0
cmp dword [eax], 0x14
jne 0x102628e0
mov edx, dword [eax + 4]
mov esi, edx
and esi, 7
cmp esi, edx
jne 0x102628e0
test byte [ecx + 0x38], 8
jne 0x102628ca
push 0x8004003c
jmp 0x102628e5
push eax
call fcn.102bf8ba
test eax, eax
jl 0x102628dd
mov dword [ebp - 4], 1
jmp 0x102628eb
push eax
jmp 0x102628e5
push 0x80070057
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop esi
lea ecx, [ebp - 0x10]
call fcn.102bde00
mov eax, dword [ebp - 4]
pop edi
leave
ret 8
Function at 0x102628fc
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push edi
push dword [0x1039deb8]
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, ebx
je 0x1026291b
mov edi, dword [eax + 0x74]
jmp 0x1026291d
xor edi, edi
cmp edi, ebx
jne 0x10262931
push 0x80040014
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x102629c8
push edi
push ebx
push 1
lea ecx, [ebp - 0xc]
mov dword [ebp - 0xc], ebx
call fcn.102bde47
test eax, eax
jne 0x10262951
push 0x80070057
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x102629c0
push esi
mov esi, dword [ebp + 8]
cmp esi, ebx
je 0x1026296b
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x14]
shr eax, 2
test al, 1
je 0x1026296b
mov ecx, esi
jmp 0x1026296d
xor ecx, ecx
test ecx, ecx
je 0x102629b4
cmp edi, dword [ecx + 8]
je 0x1026297d
push 0x8004001e
jmp 0x102629b9
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x102629b4
cmp dword [eax], 0x14
jne 0x102629b4
mov edx, dword [eax + 4]
mov esi, edx
and esi, 7
cmp esi, edx
jne 0x102629b4
test byte [ecx + 0x38], 8
jne 0x102629a2
push 0x8004003c
jmp 0x102629b9
push eax
call fcn.102bf8e4
test eax, eax
jl 0x102629b1
xor ebx, ebx
inc ebx
jmp 0x102629bf
push eax
jmp 0x102629b9
push 0x80070057
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop esi
lea ecx, [ebp - 0xc]
call fcn.102bde00
pop edi
mov eax, ebx
pop ebx
leave
ret 8

Function at 0x102629d0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
and dword [ebp - 4], 0
push edi
push dword [0x1039deb8]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x102629f0
mov edi, dword [eax + 0x74]
jmp 0x102629f2
xor edi, edi
test edi, edi
jne 0x10262a03
push 0x80040014
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x10262a70
and dword [ebp - 0x10], 0
push edi
push 0
push 0
lea ecx, [ebp - 0x10]
call fcn.102bde47
test eax, eax
jne 0x10262a1f
push 0x80070057
jmp 0x10262a62
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x10262a39
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x14]
shr eax, 2
test al, 1
je 0x10262a39
mov ecx, esi
jmp 0x10262a3b
xor ecx, ecx
pop esi
test ecx, ecx
je 0x10262a18
cmp edi, dword [ecx + 8]
je 0x10262a4c
push 0x8004001e
jmp 0x10262a62
push dword [ebp + 0xc]
call fcn.102bf924
test eax, eax
jl 0x10262a61
mov dword [ebp - 4], 1
jmp 0x10262a68
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea ecx, [ebp - 0x10]
call fcn.102bde00
mov eax, dword [ebp - 4]
pop edi
leave
ret 8
Function at 0x10262a78
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push edi
push dword [0x1039deb8]
xor ebx, ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, ebx
je 0x10262a9a
mov edi, dword [eax + 0x74]
jmp 0x10262a9c
xor edi, edi
cmp edi, ebx
jne 0x10262ab0
push 0x80040014
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x10262b32
push edi
push ebx
push ebx
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x10], ebx
call fcn.102bde47
test eax, eax
je 0x10262b1f
mov eax, dword [ebp + 0x10]
and eax, 0x11c
cmp eax, dword [ebp + 0x10]
jne 0x10262b1f
push esi
mov esi, dword [ebp + 8]
cmp esi, ebx
je 0x10262ae9
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x14]
shr eax, 2
test al, 1
je 0x10262ae9
mov ecx, esi
jmp 0x10262aeb
xor ecx, ecx
pop esi
cmp ecx, ebx
je 0x10262b1f
cmp edi, dword [ecx + 8]
je 0x10262afc
push 0x8004001e
jmp 0x10262b24
cmp dword [ebp + 0xc], ebx
je 0x10262b1f
mov eax, dword [ebp + 0x10]
shr eax, 8
test al, 1
jne 0x10262b2a
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.102bf72c
mov dword [ebp - 4], 1
jmp 0x10262b2a
push 0x80070057
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea ecx, [ebp - 0x10]
call fcn.102bde00
mov eax, dword [ebp - 4]
pop edi
pop ebx
leave
ret 0xc

Function at 0x10262b3b
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
push dword [0x1039deb8]
xor esi, esi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, esi
je 0x10262b5d
mov edi, dword [eax + 0x74]
jmp 0x10262b5f
xor edi, edi
cmp edi, esi
jne 0x10262b73
push 0x80040014
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x10262c12
push ebx
push edi
xor ebx, ebx
push esi
inc ebx
push ebx
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x10], esi
call fcn.102bde47
test eax, eax
je 0x10262bfe
mov esi, dword [ebp + 8]
test esi, esi
je 0x10262ba2
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x14]
shr eax, 2
test bl, al
je 0x10262ba2
mov ecx, esi
jmp 0x10262ba4
xor ecx, ecx
test ecx, ecx
je 0x10262bfe
test dword [ecx + 0x38], 0x100000
je 0x10262c09
cmp edi, dword [ecx + 8]
je 0x10262bbd
push 0x8004001e
jmp 0x10262c03
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x10262bfe
cmp dword [eax], 0x18
jne 0x10262bfe
mov edx, dword [eax + 4]
mov esi, edx
and esi, 0xf
cmp esi, edx
jne 0x10262bfe
mov edx, dword [eax + 8]
mov esi, edx
and esi, ebx
cmp esi, edx
jne 0x10262bfe
cmp dword [eax + 0xc], 2
ja 0x10262bfe
cmp dword [eax + 0x10], 2
ja 0x10262bfe
push eax
call fcn.1029dff1
test eax, eax
jl 0x10262bfb
mov dword [ebp - 4], ebx
jmp 0x10262c09
push eax
jmp 0x10262c03
push 0x80070057
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea ecx, [ebp - 0x10]
call fcn.102bde00
pop ebx
mov eax, dword [ebp - 4]
pop edi
pop esi
leave
ret 8
Function at 0x10262c1b
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x10262cb1
mov esi, dword [edi + 8]
test esi, esi
je 0x10262cb1
cmp dword [edi + 4], 0x8000
jl 0x10262cb1
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x14]
mov dword [ebp + 8], eax
shr eax, 1
test al, 1
je 0x10262cb1
push dword [0x1039deb8]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x10262c60
mov ecx, dword [eax + 0x74]
jmp 0x10262c62
xor ecx, ecx
cmp byte [ecx + 0x17], 0
mov eax, dword [esi + 8]
jne 0x10262cb1
cmp byte [eax + 0x17], 0
jne 0x10262cb1
cmp ecx, eax
jne 0x10262c9e
test byte [ebp + 0xc], 1
lea ecx, [esi + 0xc]
je 0x10262c93
mov eax, dword [ebp + 8]
shr eax, 2
test al, 1
je 0x10262c93
push 0
push edi
push esi
call fcn.102be5ff
jmp 0x10262cb6
push 0
push edi
push esi
call fcn.102be4b5
jmp 0x10262cb6
push dword [ebp + 0xc]
mov eax, dword [eax + 0x20]
mov ecx, dword [ecx + 0x20]
push esi
push edi
push eax
call fcn.1026248c
jmp 0x10262cb6
mov eax, 0x80070057
pop edi
pop esi
pop ebp
ret 8

Function at 0x10262e6a
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push dword [0x1039deb8]
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, ebx
je 0x10262e89
mov esi, dword [eax + 0x74]
jmp 0x10262e8b
xor esi, esi
cmp esi, ebx
jne 0x10262e9c
push 0x80040014
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x10262ef9
push esi
push ebx
push ebx
lea ecx, [ebp - 0xc]
mov dword [ebp - 0xc], ebx
call fcn.102bde47
test eax, eax
jne 0x10262ebb
push 0x80070057
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x10262ef1
push edi
mov edi, dword [ebp + 8]
cmp edi, ebx
je 0x10262ed5
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x14]
shr eax, 2
test al, 1
je 0x10262ed5
mov eax, edi
jmp 0x10262ed7
xor eax, eax
pop edi
test eax, eax
je 0x10262eae
cmp esi, dword [eax + 8]
je 0x10262ee8
push 0x8004001e
jmp 0x10262eb3
mov ebx, dword [eax + 0x38]
and ebx, 0xfffff
lea ecx, [ebp - 0xc]
call fcn.102bde00
pop esi
mov eax, ebx
pop ebx
leave
ret 4