joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10112ca0
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [0x101e316c]
push esi
xor esi, esi
cmp eax, esi
jge 0x10112cb5
xor eax, eax
jmp 0x10112cbc
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [eax + 4]
push 0x10
push 0x1c
call fcn.101d8457
cmp eax, esi
je 0x10112cf4
mov dword [eax + 8], esi
mov dword [eax + 0xc], esi
mov dword [eax + 0x10], esi
mov dword [eax + 0x14], 0xffffffff
mov dword [eax], 0x1008b6f0
mov dword [eax + 4], 5
mov dword [eax + 0x18], edi
mov dword [edi + 0x10], eax
pop esi
pop ebp
ret 4
mov eax, dword [ebp + 8]
mov byte [eax + 0x240], 1
xor eax, eax
pop esi
pop ebp
ret 4

Function at 0x10112ee0
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp ebx, esi
je 0x10112f65
mov eax, dword [0x101e316c]
cmp eax, esi
jge 0x10112ef9
xor eax, eax
jmp 0x10112f00
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [eax + 4]
push 0x10
push 0x24
call fcn.101d8457
cmp eax, esi
je 0x10112f5e
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
push eax
push ebx
push edx
mov dword [eax + 8], esi
mov dword [eax + 0xc], esi
mov dword [eax + 0x10], esi
mov dword [eax + 0x14], 0xffffffff
mov dword [eax], 0x1008b78c
mov dword [eax + 4], 3
mov dword [eax + 0x1c], esi
mov dword [eax + 0x20], esi
push edi
mov dword [eax + 0x18], ecx
call fcn.1014f3d0
cmp eax, esi
je 0x10112f5e
mov dword [edi + 4], eax
mov byte [edi + 0x245], 1
mov dword [edi + 0x1dc], eax
pop esi
pop ebp
ret 8
mov byte [edi + 0x240], 1
xor eax, eax
pop esi
pop ebp
ret 8

Function at 0x10113250
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp ebx, esi
je 0x101132d0
mov eax, dword [0x101e316c]
cmp eax, esi
jge 0x10113269
xor eax, eax
jmp 0x10113270
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [eax + 4]
push 0x10
push 0x24
call fcn.101d8457
cmp eax, esi
je 0x101132c9
push eax
mov dword [eax + 8], esi
mov dword [eax + 0xc], esi
mov dword [eax + 0x10], esi
mov dword [eax + 0x14], 0xffffffff
mov dword [eax + 0x1c], esi
mov dword [eax + 0x20], esi
mov dword [eax], 0x1008b78c
mov dword [eax + 4], 4
mov dword [eax + 0x18], 2
mov eax, dword [ebp + 8]
push ebx
push eax
push edi
call fcn.1014f3d0
cmp eax, esi
je 0x101132c9
mov dword [edi + 4], eax
mov byte [edi + 0x245], 1
pop esi
pop ebp
ret 4
mov byte [edi + 0x240], 1
xor eax, eax
pop esi
pop ebp
ret 4
Function at 0x10113360
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x14]
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
mov dword [ebp - 4], ebx
test eax, eax
jne 0x1011338c
cmp byte [ebp + 0x18], bl
jne 0x101133bd
push 0x1008b3f4
mov ecx, 0xc00
jmp 0x101134e1
lea ecx, [ebp - 4]
push ecx
push esi
mov ebx, eax
call fcn.101584f0
test eax, eax
jge 0x101133ab
push 0x1008b420
mov ecx, 0xbf2
jmp 0x101134e1
mov ebx, dword [ebp - 4]
lea edx, [ebx - 1]
cmp edx, 0xffff
ja 0x101134d7
mov eax, dword [0x101e316c]
test eax, eax
jge 0x101133ca
xor eax, eax
jmp 0x101133d1
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [eax + 4]
push 0x10
push 0x24
call fcn.101d8457
mov edi, eax
xor edx, edx
cmp edi, edx
je 0x10113446
mov ecx, dword [ebp + 0x10]
mov dword [edi + 8], edx
mov dword [edi + 0xc], edx
mov dword [edi + 0x10], edx
mov dword [edi + 0x14], 0xffffffff
mov dword [edi], 0x1008b7f4
mov dword [edi + 4], 7
mov dword [edi + 0x20], 0x10
mov dword [edi + 0x18], edx
mov dword [edi + 0x1c], edx
mov dword [edi + 0x1c], ebx
cmp ecx, edx
je 0x10113454
cmp dword [ecx + 4], 0xa
jne 0x10113454
mov eax, dword [ecx + 0x20]
cmp eax, dword [esi + 0x38]
jne 0x10113454
mov dword [edi + 0x18], ecx
mov eax, dword [ebp + 0x1c]
mov dword [eax], edi
cmp ebx, 0x10000
ja 0x101134d7
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov eax, 0x8007000e
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov eax, dword [esi + 0x38]
mov dword [edi + 0x18], eax
mov eax, dword [esi + 0x38]
mov dword [ebp + 0x18], eax
cmp ecx, eax
je 0x1011342a
cmp dword [ebp + 0x14], edx
jne 0x10113475
push 0x1008b480
mov ecx, 0xc01
jmp 0x101134e1
push 5
call fcn.1010b520
test al, al
je 0x1011348c
push 0x1008b4ac
mov ecx, 0xc2f
jmp 0x101134e1
mov ecx, dword [ebp + 0x10]
nop
mov edx, dword [ecx + 0x1c]
mov eax, dword [ecx + 0x18]
imul ebx, edx
test eax, eax
je 0x101134b7
cmp dword [eax + 4], 0xa
jne 0x101134b7
cmp dword [eax + 0x18], 0x20000200
jne 0x101134b7
cmp dword [eax + 0x1c], 0
jne 0x101134b7
mov edx, dword [eax + 0x20]
jmp 0x101134b9
mov edx, eax
cmp edx, dword [ebp + 0x18]
je 0x101134c2
mov ecx, eax
jmp 0x10113490
mov edx, dword [ebp + 0x1c]
mov dword [edi + 0x18], eax
mov dword [ecx + 0x18], edi
mov ecx, dword [ebp + 0x10]
mov dword [edx], ecx
xor edx, edx
jmp 0x1011342f
mov ecx, 0xbf3
push 0x1008b454
mov edx, dword [ebp + 0xc]
call fcn.1010e980
add esp, 4
pop edi
pop esi
mov eax, 0x80070057
pop ebx
mov esp, ebp
pop ebp
ret 0x18
Function at 0x10117350
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebx
push esi
mov esi, eax
xor ebx, ebx
cmp dword [esi + 4], ebx
jbe 0x1011737c
push edi
xor edi, edi
mov eax, dword [esi + 0xc]
mov ecx, dword [eax + edi + 0x10]
test ecx, ecx
je 0x10117372
push 1
call fcn.101047b0
inc ebx
add edi, 0x18
cmp ebx, dword [esi + 4]
jb 0x10117360
pop edi
mov esi, dword [esi + 0xc]
test esi, esi
je 0x101173af
mov eax, dword [0x101e316c]
test eax, eax
jge 0x1011739c
xor eax, eax
mov ecx, dword [eax]
push esi
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop esi
pop ebx
ret
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [eax]
push esi
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop esi
pop ebx
ret

Function at 0x101173c0
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [0x101e316c]
sub esp, 8
push ebx
push esi
xor ebx, ebx
cmp eax, ebx
push edi
mov edi, ecx
jge 0x101173dc
xor eax, eax
jmp 0x101173e3
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov eax, dword [eax]
push 0x14
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
cmp esi, ebx
je 0x101174d0
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0x10], ebx
mov ecx, dword [edi + 8]
mov dword [esi + 8], ecx
mov dword [ebp - 8], ebx
cmp dword [edi + 4], ebx
jbe 0x10117469
mov dword [ebp - 4], ebx
jmp 0x10117422
xor ebx, ebx
mov edx, dword [edi + 0xc]
mov eax, dword [ebp - 4]
mov ecx, dword [eax + edx + 0x10]
cmp ecx, ebx
je 0x10117437
call fcn.101173c0
mov ebx, eax
mov ecx, dword [edi + 0xc]
mov edx, dword [ebp - 4]
lea eax, [edx + ecx]
mov ecx, dword [eax + 0xc]
mov edx, dword [eax + 8]
push ebx
push ecx
mov ecx, dword [eax + 4]
push edx
mov edx, dword [eax]
push ecx
push edx
call fcn.101174e0
test eax, eax
jne 0x10117472
mov eax, dword [ebp - 8]
add dword [ebp - 4], 0x18
inc eax
mov dword [ebp - 8], eax
cmp eax, dword [edi + 4]
jb 0x10117420
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, esi
call fcn.10117350
mov eax, dword [0x101e316c]
test eax, eax
jge 0x10117486
xor eax, eax
jmp 0x1011748d
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov eax, dword [eax]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_HeapFree]
push 0
push eax
call esi
test ebx, ebx
je 0x101174d0
mov eax, ebx
call fcn.10117350
mov eax, dword [0x101e316c]
test eax, eax
jge 0x101174c1
xor eax, eax
mov ecx, dword [eax]
push ebx
push eax
push ecx
call esi
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [eax]
push ebx
push 0
push ecx
call esi
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x101174e0
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [esi]
push edi
cmp eax, dword [esi + 4]
jne 0x10117595
test eax, eax
je 0x10117511
lea edi, [eax + eax]
mov dword [ebp - 4], edi
cmp edi, 0xaaaaaaa
ja 0x1011753f
mov eax, dword [0x101e316c]
test eax, eax
jge 0x1011751d
xor eax, eax
jmp 0x10117524
mov dword [ebp - 4], 0x10
mov edi, dword [ebp - 4]
jmp 0x10117504
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edx, dword [eax]
lea ecx, [edi + edi*2]
add ecx, ecx
add ecx, ecx
add ecx, ecx
push ecx
push 0
push edx
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0x1011754b
mov eax, 0x8007000e
pop edi
mov esp, ebp
pop ebp
ret 0x14
mov eax, dword [esi]
mov ecx, dword [esi + 0xc]
lea eax, [eax + eax*2]
add eax, eax
add eax, eax
push ebx
add eax, eax
push eax
push ecx
push edi
call sub.msvcrt.dll_memcpy
mov ebx, dword [esi + 0xc]
add esp, 0xc
test ebx, ebx
je 0x1011758c
mov eax, dword [0x101e316c]
test eax, eax
jge 0x10117579
xor eax, eax
jmp 0x10117580
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edx, dword [eax]
push ebx
push 0
push edx
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 4]
mov dword [esi], eax
mov dword [esi + 0xc], edi
pop ebx
mov eax, dword [esi + 4]
mov edx, dword [esi + 0xc]
lea ecx, [eax + eax*2]
mov eax, dword [ebp + 8]
mov dword [edx + ecx*8], eax
mov eax, dword [esi + 4]
mov edx, dword [esi + 0xc]
lea ecx, [eax + eax*2]
mov eax, dword [ebp + 0xc]
mov dword [edx + ecx*8 + 4], eax
mov eax, dword [esi + 4]
mov edx, dword [esi + 0xc]
lea ecx, [eax + eax*2]
mov eax, dword [ebp + 0x10]
mov dword [edx + ecx*8 + 8], eax
mov eax, dword [esi + 4]
mov edx, dword [esi + 0xc]
lea ecx, [eax + eax*2]
mov eax, dword [ebp + 0x14]
mov dword [edx + ecx*8 + 0xc], eax
mov eax, dword [esi + 4]
mov edx, dword [esi + 0xc]
lea ecx, [eax + eax*2]
mov eax, dword [ebp + 0x18]
mov dword [edx + ecx*8 + 0x10], eax
mov eax, dword [esi + 4]
mov edx, dword [esi + 0xc]
lea ecx, [eax + eax*2]
mov dword [edx + ecx*8 + 0x14], 0
inc dword [esi + 4]
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret 0x14
Function at 0x101177d0
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp dword [esi], 3
push ebx
push edi
jne 0x10117936
cmp dword [esi + 8], 0
jne 0x10117833
mov eax, dword [0x101e316c]
test eax, eax
jge 0x101177f3
xor eax, eax
jmp 0x101177fa
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov eax, dword [eax]
push 0x80
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [esi + 4], eax
test eax, eax
jne 0x1011781c
pop edi
mov eax, 0x8007000e
pop ebx
pop ebp
ret 0x14
push 0x80
push 0
push eax
mov dword [esi + 8], 0x80
call sub.msvcrt.dll_memset
add esp, 0xc
mov ebx, dword [ebp + 8]
cmp ebx, dword [esi + 8]
jb 0x101178ce
nop
mov edi, dword [esi + 8]
add edi, edi
cmp edi, 0xffffffff
ja 0x10117811
mov eax, dword [0x101e316c]
test eax, eax
jge 0x10117857
xor eax, eax
jmp 0x1011785e
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [eax]
push edi
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x10117811
mov edx, dword [esi + 0xc]
mov eax, dword [esi + 4]
push edx
push eax
push edi
call sub.msvcrt.dll_memcpy
mov eax, dword [esi + 8]
push eax
add eax, edi
push 0
push eax
call sub.msvcrt.dll_memset
mov ebx, dword [esi + 4]
add esp, 0x18
test ebx, ebx
je 0x101178b6
mov eax, dword [0x101e316c]
test eax, eax
jge 0x101178a3
xor eax, eax
jmp 0x101178aa
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [eax]
push ebx
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edx, dword [esi + 8]
mov eax, dword [ebp + 8]
add edx, edx
mov dword [esi + 4], edi
mov dword [esi + 8], edx
cmp eax, edx
jae 0x10117840
mov ebx, eax
mov ecx, dword [ebp + 0x14]
mov eax, ecx
and eax, 0x1000000
xor edi, edi
xor dl, dl
or eax, edi
je 0x101178e2
mov dl, 8
mov eax, ecx
and eax, 0x40000
xor edi, edi
or eax, edi
je 0x101178f2
or dl, 0x10
mov eax, ecx
and eax, 0x100000
xor edi, edi
or eax, edi
je 0x10117902
or dl, 0x20
and ecx, 0x80000
xor eax, eax
or ecx, eax
je 0x10117911
or dl, 0x40
cmp dword [ebp + 0x10], 0
je 0x1011791a
or dl, 0x80
cmp dword [ebp + 0xc], 0
lea eax, [ebx + 1]
sete cl
inc cl
or cl, dl
mov edx, dword [esi + 4]
mov byte [ebx + edx], cl
cmp eax, dword [esi + 0xc]
jbe 0x10117936
mov dword [esi + 0xc], eax
pop edi
xor eax, eax
pop ebx
pop ebp
ret 0x14

Function at 0x10117950
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ecx
push esi
push edi
mov edi, ecx
mov esi, edx
test eax, eax
jne 0x101179af
lea ecx, [ecx]
cmp dword [eax*4 + 0x1006ea30], edi
jae 0x10117971
inc eax
cmp eax, 0x1c
jb 0x10117960
jmp 0x10117978
mov edi, dword [eax*4 + 0x1006ea30]
mov eax, dword [0x101e316c]
test eax, eax
jge 0x10117985
xor eax, eax
jmp 0x1011798c
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edx, dword [eax]
lea ecx, [edi*4]
push ecx
push 0
push edx
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
jne 0x101179ac
mov eax, 0x8007000e
pop edi
pop esi
pop ecx
ret
mov dword [esi + 0x38], eax
mov ecx, eax
neg ecx
sbb ecx, ecx
and ecx, edi
push ecx
mov ecx, eax
add esi, 0x28
mov eax, edi
call fcn.10118f60
pop edi
pop esi
pop ecx
ret
Function at 0x10118120
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
sub esp, 8
test ecx, ecx
je 0x10118264
cmp dword [edx + 0xc], 0
je 0x10118264
mov eax, dword [edx + 4]
push ebx
mov ebx, dword [edx + 0x10]
push esi
shr ebx, 5
push edi
mov edi, dword [ecx + 4]
lea esi, [ebx*4]
add eax, esi
add edi, esi
mov esi, dword [edx + 0x14]
shr esi, 5
sub esi, ebx
add esi, 1
je 0x10118232
jmp 0x10118173
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
mov edx, dword [edi]
add eax, 4
mov dword [ebp - 4], eax
mov eax, edx
xor eax, ebx
dec esi
and eax, ebx
mov dword [ebp - 8], ebx
je 0x10118220
mov ebx, eax
and ebx, 0xf
movzx ebx, byte [ebx + 0x101e0f00]
add dword [ecx + 0xc], ebx
shr eax, 4
mov ebx, eax
and ebx, 0xf
movzx ebx, byte [ebx + 0x101e0f00]
add dword [ecx + 0xc], ebx
shr eax, 4
mov ebx, eax
and ebx, 0xf
movzx ebx, byte [ebx + 0x101e0f00]
add dword [ecx + 0xc], ebx
shr eax, 4
mov ebx, eax
and ebx, 0xf
movzx ebx, byte [ebx + 0x101e0f00]
add dword [ecx + 0xc], ebx
shr eax, 4
mov ebx, eax
and ebx, 0xf
movzx ebx, byte [ebx + 0x101e0f00]
add dword [ecx + 0xc], ebx
shr eax, 4
mov ebx, eax
and ebx, 0xf
movzx ebx, byte [ebx + 0x101e0f00]
add dword [ecx + 0xc], ebx
shr eax, 4
mov ebx, eax
and ebx, 0xf
movzx ebx, byte [ebx + 0x101e0f00]
add dword [ecx + 0xc], ebx
mov ebx, dword [ecx + 0xc]
shr eax, 4
and eax, 0xf
movzx eax, byte [eax + 0x101e0f00]
add eax, ebx
mov ebx, dword [ebp - 8]
mov dword [ecx + 0xc], eax
or edx, ebx
mov dword [edi], edx
add edi, 4
test esi, esi
ja 0x10118170
mov edx, dword [ebp + 8]
mov esi, dword [ecx + 0x10]
mov eax, dword [edx + 0x10]
cmp esi, 0xffffffff
jne 0x1011824f
pop edi
mov dword [ecx + 0x10], eax
mov edx, dword [edx + 0x14]
pop esi
mov dword [ecx + 0x14], edx
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp eax, esi
jae 0x10118256
mov dword [ecx + 0x10], eax
mov edx, dword [edx + 0x14]
cmp edx, dword [ecx + 0x14]
jbe 0x10118261
mov dword [ecx + 0x14], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10127080
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [esi + 0x34]
push ebx
push edi
test eax, eax
je 0x10127213
cmp dword [esi + 0x84], 0
je 0x10127213
cmp dword [esi + 0x94], 0
jne 0x10127213
xor edx, edx
mov dword [esi + 0x90], 0
test eax, eax
jbe 0x101270eb
mov ecx, dword [esi + 0x30]
add ecx, ecx
add ecx, ecx
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x1c]
mov eax, dword [ecx + eax]
mov eax, dword [eax + 0xac]
inc eax
cmp dword [esi + 0x90], eax
jae 0x101270e2
mov dword [esi + 0x90], eax
inc edx
add ecx, 4
cmp edx, dword [esi + 0x34]
jb 0x101270c4
mov edi, dword [esi + 0x90]
mov eax, dword [0x101e316c]
mov ebx, dword [sym.imp.KERNEL32.dll_TlsGetValue]
add edi, edi
add edi, edi
test eax, eax
jl 0x1012710b
push eax
call ebx
test eax, eax
jne 0x1012710f
xor eax, eax
jmp 0x1012711a
mov ecx, dword [eax + 0x20]
push 0x10
push edi
call fcn.101d8457
mov dword [esi + 0x94], eax
test eax, eax
jne 0x10127131
pop edi
mov eax, 0x8007000e
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [0x101e316c]
mov edi, dword [esi + 0x34]
test eax, eax
jl 0x10127144
push eax
call ebx
test eax, eax
jne 0x10127148
xor eax, eax
jmp 0x1012715a
push 0x10
lea ecx, [edi*4]
push ecx
mov ecx, dword [eax + 0x20]
call fcn.101d8457
mov dword [esi + 0x98], eax
test eax, eax
je 0x10127124
mov edx, dword [esi + 0x90]
mov eax, dword [esi + 0x94]
add edx, edx
add edx, edx
push edx
push 0
push eax
call sub.msvcrt.dll_memset
mov ecx, dword [esi + 0x34]
mov edx, dword [esi + 0x98]
add ecx, ecx
add ecx, ecx
push ecx
push 0
push edx
call sub.msvcrt.dll_memset
mov eax, dword [esi + 0x84]
mov ebx, dword [eax + 0x24]
xor edi, edi
add esp, 0x18
mov dword [ebp - 4], ebx
cmp dword [esi + 0x34], edi
jbe 0x10127213
lea esp, [esp]
test ebx, ebx
je 0x10127213
mov edx, dword [ebp + 8]
mov ecx, dword [esi + 0x30]
mov eax, dword [edx + 0x1c]
add ecx, edi
mov edx, dword [eax + ecx*4]
mov ecx, dword [edx + 0x50]
mov eax, dword [ecx + 8]
mov ecx, dword [ecx + 0xc]
and eax, 0x2800080
and ecx, 0x2000
or eax, ecx
jne 0x10127207
mov ecx, dword [ebx + 8]
mov eax, dword [edx + 0xac]
mov ebx, dword [esi + 0x94]
add ecx, 0x18
mov dword [ebx + eax*4], ecx
mov ebx, dword [ebp - 4]
mov ecx, dword [ebx + 8]
mov edx, dword [edx + 0x90]
mov eax, dword [esi + 0x98]
add ecx, 0x18
mov dword [eax + edx*4], ecx
mov ebx, dword [ebx + 0xc]
inc edi
mov dword [ebp - 4], ebx
cmp edi, dword [esi + 0x34]
jb 0x101271b0
pop edi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1012dbb0
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
mov dword [esi + 8], ebx
cmp byte [esi + 0xc], bl
je 0x1012dbea
push edi
mov edi, dword [esi]
cmp edi, ebx
je 0x1012dbe6
mov eax, dword [0x101e316c]
cmp eax, ebx
jge 0x1012dbd4
xor eax, eax
jmp 0x1012dbdb
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov eax, dword [eax]
push edi
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov byte [esi + 0xc], bl
pop edi
mov ecx, dword [ebp + 8]
mov dword [esi + 8], ebx
mov byte [esi + 0xc], bl
mov dword [esi], ecx
mov dword [esi + 4], 4
mov byte [esi + 0xd], 1
pop ebx
pop ebp
ret 4

Function at 0x1012dc70
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
cmp byte [ebx + 0xd], 0
jne 0x1012dc87
mov eax, 0x8000ffff
mov esp, ebp
pop ebp
ret
push esi
push edi
xor edi, edi
cmp ecx, edi
jbe 0x1012dcb8
lea eax, [ebp - 4]
push eax
mov eax, ebx
call fcn.100f8dc0
cmp eax, edi
jne 0x1012dd57
mov esi, dword [ebp - 4]
cmp esi, 0x7ffffff
jbe 0x1012dcd9
pop edi
mov eax, 0x80070216
pop esi
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], edi
mov esi, edi
mov dword [ebp - 8], edi
cmp byte [ebx + 0xc], 0
je 0x1012dd41
mov edi, dword [ebx]
test edi, edi
je 0x1012dd41
mov eax, dword [0x101e316c]
test eax, eax
jge 0x1012dd2e
xor eax, eax
jmp 0x1012dd35
cmp esi, edi
jbe 0x1012dcbd
mov ecx, esi
shl ecx, 5
push ecx
call fcn.10119140
mov dword [ebp - 8], eax
cmp eax, edi
jne 0x1012dcfa
pop edi
mov eax, 0x8007000e
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebx + 8]
mov edx, esi
cmp esi, eax
jbe 0x1012dd05
mov edx, eax
cmp edx, edi
jbe 0x1012dcc0
xor eax, eax
jmp 0x1012dd10
mov esi, dword [ebx]
mov ecx, dword [ebp - 8]
add esi, eax
lea edi, [eax + ecx]
mov ecx, 8
add eax, 0x20
sub edx, 1
rep movsd dword es:[edi], dword [esi]
jne 0x1012dd10
mov esi, dword [ebp - 4]
jmp 0x1012dcc0
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edx, dword [eax]
push edi
push 0
push edx
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 8]
mov dword [ebx], eax
mov dword [ebx + 4], esi
cmp dword [ebx + 8], esi
jbe 0x1012dd51
mov dword [ebx + 8], esi
mov byte [ebx + 0xc], 1
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10151320
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0x1c]
push ebx
push esi
test ecx, ecx
je 0x101513a8
mov esi, edi
call fcn.10115580
mov ebx, eax
test ebx, ebx
je 0x101513a8
test byte [ebx + 0xb4], 8
je 0x101513a8
mov eax, dword [edi + 0x48]
mov ecx, dword [ebx + 0x48]
cmp ecx, eax
je 0x10151382
test ecx, ecx
je 0x10151366
test eax, eax
je 0x10151366
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 0x30]
call eax
test al, al
jne 0x10151382
mov eax, dword [edi + 0xc]
mov esi, dword [ebp + 8]
push eax
push 0x1008ec4c
lea edx, [edi + 0x10]
mov ecx, 0xc25
call fcn.1010e980
add esp, 8
or byte [edi + 0xb4], 8
mov ecx, dword [ebx + 0xb0]
mov dword [edi + 0xb0], ecx
mov ecx, dword [ebp + 0xc]
push edi
push ecx
push ebx
call fcn.10115670
test eax, eax
jl 0x101514fe
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 0x20]
mov dword [ebp - 4], eax
test eax, eax
je 0x101514f4
lea esp, [esp]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
mov ebx, dword [edx + 0x50]
test ebx, ebx
je 0x101514e3
mov ecx, dword [edi + 8]
cmp byte [ecx], 0
mov eax, dword [ebx + 8]
jne 0x101513e3
cmp byte [eax], 0
jmp 0x101513ee
cmp byte [eax], 0
je 0x101514d8
cmp ecx, eax
sete al
test al, al
je 0x101514d8
mov ecx, edi
mov eax, ebx
call fcn.10110580
test al, al
je 0x101514d8
cmp dword [edi + 4], 4
jne 0x101514d8
mov eax, dword [ebx + 0x6c]
test eax, eax
jne 0x10151428
cmp dword [edi + 0x6c], eax
je 0x10151443
test eax, eax
je 0x101514d8
cmp dword [edi + 0x6c], 0
je 0x101514d8
mov eax, dword [ebx + 0x70]
cmp eax, dword [edi + 0x70]
sete al
test al, al
je 0x101514d8
mov eax, dword [edi + 0x48]
mov ecx, dword [ebx + 0x48]
cmp ecx, eax
je 0x10151483
test ecx, ecx
je 0x10151461
test eax, eax
je 0x10151461
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 0x30]
call eax
test al, al
jne 0x10151483
mov ecx, dword [edi + 0xc]
push ecx
push 0x1008ec4c
mov eax, edi
call fcn.100bef50
mov esi, dword [ebp + 8]
mov ecx, 0xc25
mov edx, eax
call fcn.1010e980
add esp, 8
or byte [edi + 0xb4], 8
mov dword [edi + 0xb0], ebx
mov eax, dword [0x101e316c]
test eax, eax
jge 0x1015149d
xor eax, eax
jmp 0x101514a4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [eax + 4]
push 0x10
push 0xc
call fcn.101d8457
test eax, eax
jne 0x101514bb
mov eax, 0x8007000e
jmp 0x101514d4
mov edx, dword [ebp + 0xc]
mov dword [eax], edi
mov dword [eax + 4], edx
mov ecx, dword [ebx + 0xac]
mov dword [eax + 8], ecx
mov dword [ebx + 0xac], eax
xor eax, eax
test eax, eax
jl 0x101514fe
mov ebx, dword [ebx + 0x58]
test ebx, ebx
jne 0x101513d3
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
mov dword [ebp - 4], eax
test eax, eax
jne 0x101513c0
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp eax, 0x8007000e
jne 0x1015150f
mov ecx, dword [ebp + 8]
mov byte [ecx + 0x240], 1
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8