joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10037903
Capabilities:
Print debug messages
Terminate thread

Disassembly:
push 0x10
mov eax, 0x10075528
call fcn.1005a2eb
push str.CDownload::Uninit__
push 3
call fcn.1003a124
pop ecx
lea eax, [edi + 0x8c]
mov dword [ebp - 0x10], eax
pop ecx
add eax, 4
push eax
mov dword [ebp - 0x14], vtable.QQDectector::fund::lock::scoped_lock_class_QQDectector::fund::lock::critical_section_.0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
and dword [ebp - 4], 0
lea eax, [ebp - 0x1c]
push eax
lea eax, [edi + 0x78]
mov dword [ebp - 0x1c], 2
call fcn.10039669
push dword [edi + 0x70]
mov ebx, dword [sym.imp.KERNEL32.dll_SetEvent]
call ebx
lea esi, [ebp - 0x14]
call fcn.100398b1
push dword [edi + 0x68]
call ebx
push dword [edi + 0x70]
call ebx
cmp dword [edi + 0x64], 0
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x100379ab
push 0x1388
push dword [edi + 0x6c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x100379a2
push 0x3ff
push dword [edi + 0x64]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push str.Uninit::TerminateThread
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push dword [edi + 0x64]
call esi
and dword [edi + 0x64], 0
push dword [edi + 0x70]
call esi
push dword [edi + 0x68]
call esi
push dword [edi + 0x6c]
call esi
call fcn.1005a3c3
ret
Function at 0x10038463
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0x10
mov eax, 0x100754f8
call fcn.1005a2eb
mov dword [ebp - 0x10], ecx
mov edi, dword [ebp + 8]
cmp dword [edi + 0x1c], 8
jb 0x10038480
mov eax, dword [edi + 8]
jmp 0x10038483
lea eax, [edi + 8]
movzx ecx, word [edi + 0x20]
push ecx
push eax
push dword [edi]
push str.CDownload::SetProxy__._nstProxyInfo.eProxyType___d_nstProxyInfo.strProxyIP___s_nstProxyInfo.usProxyPort___d
push 3
call fcn.1003a124
push 0x78
call fcn.10052f00
xor esi, esi
add esp, 0x18
cmp eax, esi
je 0x100384da
mov dword [eax], esi
mov dword [eax + 0x18], esi
push 7
pop ecx
mov dword [eax + 0x1c], ecx
mov word [eax + 8], si
mov word [eax + 0x20], si
mov dword [eax + 0x38], esi
mov dword [eax + 0x3c], ecx
mov word [eax + 0x28], si
mov dword [eax + 0x54], esi
mov dword [eax + 0x58], ecx
mov word [eax + 0x44], si
mov dword [eax + 0x70], esi
mov dword [eax + 0x74], ecx
mov word [eax + 0x60], si
mov esi, eax
mov eax, dword [edi]
mov dword [esi], eax
push 0xffffffffffffffff
lea eax, [esi + 4]
push eax
xor ebx, ebx
lea eax, [edi + 4]
call fcn.10001d45
mov ax, word [edi + 0x20]
push 0xffffffffffffffff
lea ecx, [esi + 0x24]
mov word [esi + 0x20], ax
lea eax, [edi + 0x24]
push ecx
call fcn.10001d45
push 0xffffffffffffffff
lea ecx, [esi + 0x40]
lea eax, [edi + 0x40]
push ecx
call fcn.10001d45
push 0xffffffffffffffff
lea ecx, [esi + 0x5c]
lea eax, [edi + 0x5c]
push ecx
call fcn.10001d45
mov edi, dword [ebp - 0x10]
lea eax, [edi + 0x8c]
mov dword [ebp - 0x18], eax
add eax, 4
push eax
mov dword [ebp - 0x1c], vtable.QQDectector::fund::lock::scoped_lock_class_QQDectector::fund::lock::critical_section_.0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
and dword [ebp - 4], ebx
lea eax, [ebp - 0x14]
push eax
lea eax, [edi + 0x78]
mov dword [ebp - 0x14], 9
mov dword [ebp - 0x10], esi
call fcn.10039669
push dword [edi + 0x70]
call dword [sym.imp.KERNEL32.dll_SetEvent]
lea esi, [ebp - 0x1c]
call fcn.100398b1
xor eax, eax
inc eax
call fcn.1005a3c3
ret 4
Function at 0x10039305
Capabilities:
Check if file exists

Disassembly:
push 0x264
mov eax, 0x100777fb
call fcn.1005a354
and word [ebp - 0x224], 0
push 0x208
lea eax, [ebp - 0x222]
push 0
push eax
call fcn.10053710
add esp, 0xc
lea eax, [ebp - 0x250]
push eax
push str.DownloadProxy.Downloader.1
call dword [sym.imp.ole32.dll_CLSIDFromProgID]
sub esp, 0x10
lea esi, [ebp - 0x250]
mov edi, esp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea ebx, [ebp - 0x224]
movsd dword es:[edi], dword [esi]
call fcn.1003e693
add esp, 0x10
test eax, eax
je 0x10039564
xor edi, edi
mov dword [ebp - 0x228], 7
mov dword [ebp - 0x22c], edi
mov word [ebp - 0x23c], di
lea eax, [ebp - 0x224]
push eax
mov dword [ebp - 4], edi
call fcn.1005317b
pop ecx
lea ecx, [ebp - 0x224]
lea esi, [ebp - 0x240]
call fcn.100022ac
mov ebx, 0x100846e4
push ebx
call fcn.1005317b
mov edx, dword [ebp - 0x22c]
cmp edx, edi
pop ecx
mov dword [ebp - 0x254], eax
jbe 0x10039417
cmp dword [ebp - 0x228], 8
mov ecx, dword [ebp - 0x23c]
jae 0x100393d4
lea ecx, [ebp - 0x23c]
cmp dword [ebp - 0x228], 8
lea edi, [ecx + edx*2]
mov ecx, dword [ebp - 0x23c]
jae 0x10039413
lea ecx, [ebp - 0x23c]
jmp 0x10039413
mov eax, dword [ebp - 0x254]
test eax, eax
mov edx, ebx
jbe 0x10039407
movzx esi, word [ecx]
cmp word [edx], si
je 0x10039409
inc edx
inc edx
dec eax
jne 0x100393fd
xor edx, edx
test edx, edx
je 0x10039497
inc ecx
inc ecx
cmp ecx, edi
jb 0x100393ee
or ecx, 0xffffffff
push ecx
xor edi, edi
lea esi, [ebp - 0x240]
call fcn.100018fa
push ebx
call fcn.1005317b
pop ecx
mov ecx, dword [ebp - 0x22c]
test ecx, ecx
jbe 0x100394d2
or edx, 0xffffffff
cmp ecx, edx
ja 0x10039447
lea edx, [ecx - 1]
cmp dword [ebp - 0x228], 8
mov ecx, dword [ebp - 0x23c]
jae 0x1003945c
lea ecx, [ebp - 0x23c]
lea ecx, [ecx + edx*2]
test eax, eax
mov edi, eax
mov edx, ebx
jbe 0x10039474
movzx esi, word [ecx]
cmp word [edx], si
je 0x10039476
inc edx
inc edx
dec edi
jne 0x1003946a
xor edx, edx
test edx, edx
je 0x100394b5
cmp dword [ebp - 0x228], 8
mov edx, dword [ebp - 0x23c]
jae 0x1003948f
lea edx, [ebp - 0x23c]
cmp ecx, edx
je 0x100394d2
dec ecx
dec ecx
jmp 0x1003945f
cmp dword [ebp - 0x228], 8
mov eax, dword [ebp - 0x23c]
jae 0x100394ac
lea eax, [ebp - 0x23c]
sub ecx, eax
sar ecx, 1
jmp 0x1003941a
cmp dword [ebp - 0x228], 8
mov eax, dword [ebp - 0x23c]
jae 0x100394ca
lea eax, [ebp - 0x23c]
sub ecx, eax
sar ecx, 1
mov eax, ecx
jmp 0x100394d5
or eax, 0xffffffff
push 0xffffffffffffffff
lea edi, [eax + 1]
lea esi, [ebp - 0x240]
call fcn.100018fa
lea eax, [ebp - 0x258]
mov ecx, esi
call fcn.10001968
mov esi, eax
lea eax, [ebp - 0x268]
lea ecx, [ebp - 0x240]
call fcn.10001988
mov edi, eax
lea eax, [ebp - 0x270]
lea ecx, [ebp - 0x240]
call fcn.10001968
push dword [esi + 4]
push dword [esi]
push dword [edi + 4]
push dword [edi]
push dword [eax + 4]
push dword [eax]
lea eax, [ebp - 0x260]
call fcn.10039ef8
mov eax, dword [ebp - 0x23c]
add esp, 0x18
cmp dword [ebp - 0x228], 8
jae 0x1003954a
lea eax, [ebp - 0x23c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push 0
push 1
lea esi, [ebp - 0x240]
mov edi, eax
call fcn.10001efb
mov eax, edi
call fcn.1005a3d7
ret
Function at 0x1003a26a
Capabilities:
Check if file exists
Get file attributes

Disassembly:
test eax, eax
je 0x1003a288
cmp word [eax], 0
je 0x1003a288
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1003a288
and al, 0x10
cmp al, 0x10
setne al
ret
xor al, al
ret

Function at 0x1003a28b
Capabilities:
Get file version info

Disassembly:
push 0x280
mov eax, 0x1007548c
call fcn.1005a354
mov eax, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 0x22c], eax
mov esi, ecx
mov dword [ebp - 0x240], edi
mov dword [ebp - 0x250], edi
mov dword [ebp - 0x24c], edi
mov dword [ebp - 0x248], edi
push 0x20a
lea eax, [ebp - 0x224]
push edi
push eax
mov dword [ebp - 4], edi
call fcn.10053710
add esp, 0xc
lea eax, [ebp - 0x224]
push esi
push eax
call fcn.10057419
pop ecx
pop ecx
push edi
lea eax, [ebp - 0x224]
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
cmp esi, edi
jne 0x1003a370
mov dword [ebp - 0x238], edi
mov dword [ebp - 0x234], edi
mov dword [ebp - 0x230], edi
mov byte [ebp - 4], 1
lea ebx, [ebp - 0x228]
lea esi, [ebp - 0x23c]
mov dword [ebp - 0x228], edi
call fcn.1003d3f5
lea ebx, [ebp - 0x228]
mov dword [ebp - 0x228], edi
call fcn.1003d3f5
lea ebx, [ebp - 0x228]
mov dword [ebp - 0x228], edi
call fcn.1003d3f5
lea ebx, [ebp - 0x228]
mov dword [ebp - 0x228], edi
call fcn.1003d3f5
mov eax, dword [ebp - 0x22c]
mov ebx, esi
call fcn.1003d345
call fcn.1003d3bc
jmp 0x1003a496
push esi
call fcn.100527d6
pop ecx
push esi
mov ebx, eax
push edi
push ebx
mov dword [ebp - 0x240], ebx
call fcn.10053710
add esp, 0xc
push ebx
push esi
push edi
lea eax, [ebp - 0x224]
push eax
call sub.VERSION.dll_GetFileVersionInfoW
cmp eax, edi
jne 0x1003a3b8
mov dword [ebp - 0x238], edi
mov dword [ebp - 0x234], edi
mov dword [ebp - 0x230], edi
mov byte [ebp - 4], 2
jmp 0x1003a30f
lea eax, [ebp - 0x258]
push eax
lea eax, [ebp - 0x244]
push eax
push 0x1007dfc8
push ebx
mov dword [ebp - 0x244], edi
mov dword [ebp - 0x258], edi
call sub.VERSION.dll_VerQueryValueW
cmp eax, edi
jne 0x1003a3fc
mov dword [ebp - 0x238], edi
mov dword [ebp - 0x234], edi
mov dword [ebp - 0x230], edi
mov byte [ebp - 4], 3
jmp 0x1003a30f
push 0x34
push dword [ebp - 0x244]
lea eax, [ebp - 0x28c]
push eax
call fcn.10053790
mov eax, dword [ebp - 0x284]
shr eax, 0x10
add esp, 0xc
lea ebx, [ebp - 0x228]
lea esi, [ebp - 0x254]
mov dword [ebp - 0x228], eax
call fcn.1003d3f5
movzx eax, word [ebp - 0x284]
lea ebx, [ebp - 0x228]
mov dword [ebp - 0x228], eax
call fcn.1003d3f5
mov eax, dword [ebp - 0x280]
shr eax, 0x10
lea ebx, [ebp - 0x228]
mov dword [ebp - 0x228], eax
call fcn.1003d3f5
movzx eax, word [ebp - 0x280]
lea ebx, [ebp - 0x228]
mov dword [ebp - 0x228], eax
call fcn.1003d3f5
push dword [ebp - 0x240]
call fcn.10055691
mov eax, dword [ebp - 0x22c]
pop ecx
mov ebx, esi
call fcn.1003d345
lea esi, [ebp - 0x254]
call fcn.1003d3bc
mov eax, dword [ebp - 0x22c]
call fcn.1005a3d7
ret
Function at 0x1003bbda
Capabilities:
Print debug messages

Disassembly:
push 0x50
mov eax, 0x10078138
call fcn.1005a2eb
xor esi, esi
cmp dword [ebx + 0x70], esi
je 0x1003bbf4
xor eax, eax
jmp 0x1003bd28
mov eax, ebx
call fcn.1003aa23
cmp byte [ebp + 8], 0
jne 0x1003bc1a
lea eax, [ebx + 0x84]
mov ecx, dword [eax]
cmp ecx, 1
ja 0x1003bc1a
inc ecx
mov dword [eax], ecx
mov ecx, ebx
call fcn.1003a833
jmp 0x1003bc27
mov edi, ebx
call fcn.1003c535
mov dword [ebx + 0x70], eax
mov dword [ebx + 0x18], eax
push dword [ebx + 0x88]
mov eax, ebx
call fcn.1003b8a1
push dword [ebx + 0x8c]
mov eax, ebx
call fcn.1003b95e
cmp dword [ebx + 0x98], esi
je 0x1003bc57
lea eax, [ebx + 0x9c]
push eax
mov eax, ebx
call fcn.1003bae8
cmp dword [ebx + 0x90], esi
je 0x1003bc6c
push dword [ebx + 0x94]
mov eax, ebx
call fcn.1003ba1c
push 0x10087bfc
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea eax, [ebp - 0x24]
lea ecx, [ebx + 0x11e8]
push eax
call fcn.1003cc2b
lea edi, [ebx + 0x11f4]
mov dword [ebp - 4], esi
call fcn.1002b48b
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x24]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
mov esi, dword [ebp - 0x20]
je 0x1003bcb3
lea eax, [ebp - 0x24]
cmp dword [ebp - 0x18], eax
je 0x1003bcb8
call fcn.10053094
cmp dword [ebp - 0x14], esi
je 0x1003bd0e
lea esi, [ebp - 0x18]
call fcn.1003d44b
push dword [eax]
push 0
call fcn.1003d44b
add eax, 4
push eax
push ebx
call fcn.1003aadf
test eax, eax
jne 0x1003bd04
push 0x38
push eax
lea eax, [ebp - 0x5c]
push eax
call fcn.10053710
or dword [ebp - 0x5c], 0xffffffff
add esp, 0xc
call fcn.1003d44b
lea ecx, [ebp - 0x5c]
push ecx
push dword [eax]
mov ecx, dword [ebx + 0x7c]
push 0x59
call fcn.10038838
lea esi, [ebp - 0x18]
call fcn.1003da9e
jmp 0x1003bca2
push str.ReloadDownloadtask_end
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x24]
call fcn.1003d85b
xor eax, eax
inc eax
call fcn.1005a3c3
ret 4
Function at 0x1003e693
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x68]
sub esp, 0x2f0
mov eax, dword [0x10098428]
xor eax, ebp
mov dword [ebp + 0x64], eax
push esi
push edi
lea esi, [ebp + 0x70]
lea edi, [ebp - 0x27c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 0x64
xor edi, edi
lea eax, [ebp - 0x64]
push edi
push eax
call fcn.10053710
movzx eax, byte [ebp - 0x270]
movzx ecx, byte [ebp - 0x26f]
shl eax, 8
or eax, ecx
movzx ecx, byte [ebp - 0x26e]
shl eax, 8
or eax, ecx
movzx ecx, byte [ebp - 0x26d]
shl eax, 8
or eax, ecx
movzx ecx, byte [ebp - 0x271]
push eax
movzx eax, byte [ebp - 0x272]
shl eax, 8
or eax, ecx
movzx ecx, byte [ebp - 0x273]
push eax
movzx eax, byte [ebp - 0x274]
shl eax, 8
or eax, ecx
push eax
movzx eax, word [ebp - 0x276]
push eax
movzx eax, word [ebp - 0x278]
push eax
push dword [ebp - 0x27c]
lea eax, [ebp - 0x64]
push str._X__X__X__X__X_X
push eax
call fcn.10057435
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x26c]
push str.CLSID_sLocalServer32
push eax
call fcn.10057435
add esp, 0x38
lea eax, [ebp - 0x280]
push eax
lea eax, [ebp - 0x26c]
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x1003e776
xor eax, eax
jmp 0x1003e7ba
lea eax, [ebp - 0x288]
push eax
push ebx
lea eax, [ebp - 0x284]
push eax
push edi
push edi
push dword [ebp - 0x280]
xor esi, esi
inc esi
mov dword [ebp - 0x284], esi
mov dword [ebp - 0x288], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1003e7ac
xor esi, esi
push dword [ebp - 0x280]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp + 0x64]
pop edi
xor ecx, ebp
pop esi
call fcn.10053191
add ebp, 0x68
leave
ret
Function at 0x1003ebf0
Capabilities:
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0x10076363
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push ebp
push esi
push edi
mov eax, dword [0x10098428]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov edi, 0x10099714
mov ebp, 0x1009da40
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], 3
lea ecx, [ecx]
push 0x44
call fcn.10052f00
add esp, 4
mov dword [esp + 0x20], eax
xor ebx, ebx
cmp eax, ebx
mov dword [esp + 0x40], ebx
je 0x1003ec5c
mov ecx, dword [edi + 4]
mov edx, dword [edi - 4]
push ecx
mov ecx, dword [edi]
push edx
push eax
call fcn.1003f610
mov esi, eax
jmp 0x1003ec5e
xor esi, esi
mov dword [esp + 0x40], 0xffffffff
mov ecx, dword [ebp]
cmp esi, ecx
je 0x1003ec7c
cmp ecx, ebx
je 0x1003ec79
mov eax, dword [ecx]
mov edx, dword [eax]
push 1
call edx
mov dword [ebp], esi
mov ecx, dword [ebp]
xor eax, eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x24], ebx
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
lea edx, [esp + 0x24]
push edx
call eax
test al, al
je 0x1003ed35
mov eax, dword [ebp]
lea ecx, [esp + 0x1c]
call fcn.1003e900
mov dword [esp + 0x40], 1
mov esi, dword [eax]
cmp esi, ebx
je 0x1003eccd
lea ecx, [esi + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov eax, dword [ebp + 0x10]
cmp eax, ebx
je 0x1003ecf8
lea edi, [eax + 4]
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x1003ecf4
test edi, edi
je 0x1003eceb
lea ecx, [edi - 4]
jmp 0x1003eced
xor ecx, ecx
mov edx, dword [ecx]
mov eax, dword [edx + 0x18]
call eax
mov edi, dword [esp + 0x14]
mov dword [ebp + 0x10], esi
mov dword [esp + 0x40], 0xffffffff
mov esi, dword [esp + 0x1c]
test esi, esi
je 0x1003ed66
add esi, 4
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x1003ed66
test esi, esi
je 0x1003ed2a
mov edx, dword [esi - 4]
mov eax, dword [edx + 0x18]
lea ecx, [esi - 4]
call eax
jmp 0x1003ed66
xor ecx, ecx
mov edx, dword [ecx]
mov eax, dword [edx + 0x18]
call eax
jmp 0x1003ed66
call fcn.100434e4
test al, al
je 0x1003ed57
mov ecx, dword [esp + 0x30]
push ecx
push str.CreateThread_Failed__last_error_d
push 2
mov ebx, str.._asyncframertapi.cpp
call fcn.100432b4
add esp, 0xc
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
add edi, 0xc
add ebp, 4
sub dword [esp + 0x18], 1
mov dword [esp + 0x14], edi
jne 0x1003ec30
mov eax, 1
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret
Function at 0x1003fc60
Capabilities:
Allocate thread local storage
Get thread local storage value

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push esi
push edi
mov edi, 0x1009d3d8
push 0x1009da5c
call ebx
mov esi, dword [edi]
test esi, esi
je 0x1003fc98
cmp dword [esi + 0x14], 0
je 0x1003fc98
push 0x1009da5c
call ebp
mov eax, dword [esi]
mov edx, dword [eax + 0x10]
mov ecx, esi
call edx
sub edi, 4
cmp edi, 0x1009d3cc
jne 0x1003fc75
mov eax, dword [0x1009d8d4]
test eax, eax
jne 0x1003fcfa
call fcn.100434e4
test al, al
je 0x1003fcc9
push str.Create_Thread_LocalPoint
push 0xb
push str.D:_for10.0includeAsyncFrame_MessageLoop.h
call fcn.10043373
add esp, 0xc
push 8
call fcn.10052f00
mov esi, eax
add esp, 4
test esi, esi
je 0x1003fcf3
mov dword [esi], 0
mov dword [esi + 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [esi + 4], eax
mov eax, esi
jmp 0x1003fcf5
xor eax, eax
mov dword [0x1009d8d4], eax
mov eax, dword [eax + 4]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
pop edi
pop esi
pop ebp
pop ebx
je 0x1003fd13
mov dword [eax + 0x68], 1
mov al, 1
ret

Function at 0x1003fd30
Capabilities:
Allocate thread local storage

Disassembly:
mov eax, dword [0x1009d8d4]
test eax, eax
jne 0x1003fd90
call fcn.100434e4
test al, al
je 0x1003fd56
push str.Create_Thread_LocalPoint
push 0xb
push str.D:_for10.0includeAsyncFrame_MessageLoop.h
call fcn.10043373
add esp, 0xc
push esi
push 8
call fcn.10052f00
mov esi, eax
add esp, 4
test esi, esi
je 0x1003fd86
mov dword [esi], 0
mov dword [esi + 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [esi + 4], eax
mov eax, esi
mov dword [0x1009d8d4], eax
pop esi
ret
xor esi, esi
mov eax, esi
mov dword [0x1009d8d4], eax
pop esi
ret
Function at 0x1003fe30
Capabilities:
Set thread local storage value

Disassembly:
push 0xffffffffffffffff
push 0x100780dd
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x10098428]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, dword [esp + 0x28]
xor edi, edi
mov dword [esi], vtable.qmbase::MessageLoop.0
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esp + 0x20], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
lea eax, [esi + 0x2c]
push 0x7d0
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x58], edi
mov dword [esi + 0x5c], edi
mov dword [esi + 0x64], edi
mov dword [esi + 0x68], edi
mov dword [esi + 0x6c], edi
mov dword [esi + 0x70], edi
mov dword [esi + 0x78], edi
mov dword [esi + 0x7c], edi
mov dword [esi + 0x80], edi
mov dword [esi + 0x84], edi
mov byte [esp + 0x20], 5
mov dword [esi + 0x88], edi
call fcn.1003fd30
mov ebx, dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
push eax
call ebx
call fcn.1003fd30
mov eax, dword [eax + 4]
cmp eax, 0xffffffff
je 0x1003fee7
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push 0x24
call fcn.10052f00
add esp, 4
mov dword [esp + 0x14], eax
cmp eax, edi
mov byte [esp + 0x20], 6
je 0x1003ff08
push eax
call fcn.10042820
mov ebp, eax
jmp 0x1003ff0a
xor ebp, ebp
cmp ebp, edi
mov byte [esp + 0x20], 5
je 0x1003ff19
lea eax, [ebp + 4]
push eax
call ebx
mov eax, dword [esi + 0x70]
cmp eax, edi
je 0x1003ff40
lea ebx, [eax + 4]
push ebx
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x1003ff40
cmp ebx, edi
je 0x1003ff37
lea ecx, [ebx - 4]
jmp 0x1003ff39
xor ecx, ecx
mov edx, dword [ecx]
mov eax, dword [edx + 0x18]
call eax
mov dword [esi + 0x70], ebp
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 4
Function at 0x10042670
Capabilities:
Get thread local storage value

Disassembly:
push 0xffffffffffffffff
push 0x10078008
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x10098428]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
lea edi, [esi + 8]
push edi
mov dword [esp + 0x14], edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor ebx, ebx
mov dword [esp + 0x1c], ebx
cmp dword [esi + 0x20], ebx
je 0x100426c5
call fcn.1003fd30
mov eax, dword [eax + 4]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, dword [esi + 0x20]
jne 0x100426c5
mov bl, 1
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, bl
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret

Function at 0x10042710
Capabilities:
Get thread local storage value

Disassembly:
push 0xffffffffffffffff
push 0x10078da0
mov eax, dword fs:[0]
push eax
sub esp, 0x40
push ebx
push esi
push edi
mov eax, dword [0x10098428]
xor eax, esp
push eax
lea eax, [esp + 0x50]
mov dword fs:[0], eax
mov esi, ecx
lea edi, [esi + 8]
push edi
xor bl, bl
mov dword [esp + 0x14], edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [esp + 0x58], 0
cmp dword [esi + 0x20], 0
je 0x100427e5
call fcn.1003fd30
mov eax, dword [eax + 4]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, dword [esi + 0x20]
je 0x100427e5
push 0x38
push str..MessageLoopProxyImpl.cpp
push str.qmbase::MessageLoopProxyImpl::OnDestruct
lea ecx, [esp + 0x20]
push ecx
call fcn.10021a6e
push esi
mov byte [esp + 0x5c], 1
mov edx, dword [esi + 0x20]
push eax
push edx
call fcn.10042940
cmp dword [esp + 0x48], 0x10
jb 0x100427a8
mov eax, dword [esp + 0x34]
push eax
call fcn.100531a0
add esp, 4
cmp dword [esp + 0x2c], 0x10
mov ebx, 0xf
mov dword [esp + 0x48], ebx
mov dword [esp + 0x44], 0
mov byte [esp + 0x34], 0
jb 0x100427d2
mov ecx, dword [esp + 0x18]
push ecx
call fcn.100531a0
add esp, 4
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x28], 0
mov byte [esp + 0x18], 0
mov bl, 1
push edi
mov dword [esp + 0x5c], 0xffffffff
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test bl, bl
jne 0x10042803
mov edx, dword [esi]
mov eax, dword [edx + 0x14]
push 1
mov ecx, esi
call eax
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x4c
ret

Function at 0x10042820
Capabilities:
Get thread local storage value

Disassembly:
push 0xffffffffffffffff
push 0x10077fe3
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x10098428]
xor eax, esp
push eax
lea eax, [esp + 8]
mov dword fs:[0], eax
mov esi, dword [esp + 0x18]
xor eax, eax
mov dword [esi + 4], eax
mov dword [esp + 0x10], eax
lea eax, [esi + 8]
push 0x7d0
push eax
mov dword [esi], vtable.qmbase::MessageLoopProxyImpl.0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
mov byte [esp + 0x10], 1
call fcn.1003fd30
mov eax, dword [eax + 4]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [esi + 0x20], eax
mov eax, esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0xc
ret 4