joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100f8290
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push edi
mov edi, dword [ebp + 8]
cmp byte [edi + 0xd], 0
jne 0x100f82ae
mov eax, 0x8000ffff
pop edi
mov esp, ebp
pop ebp
ret 4
push ebx
push esi
xor esi, esi
cmp ecx, esi
jbe 0x100f82e2
lea eax, [ebp - 4]
push eax
mov eax, edi
call fcn.100f8dc0
cmp eax, esi
jne 0x100f83f1
mov ebx, dword [ebp - 4]
cmp ebx, 0xfffffff
jbe 0x100f831f
pop esi
pop ebx
mov eax, 0x80070216
pop edi
mov esp, ebp
pop ebp
ret 4
mov dword [ebp - 4], esi
mov ebx, esi
mov eax, dword [edi]
push eax
mov eax, dword [edi + 8]
xor ecx, ecx
call fcn.100da890
mov dword [ebp - 0xc], esi
cmp byte [edi + 0xc], 0
je 0x100f83db
mov esi, dword [edi]
test esi, esi
je 0x100f83db
mov eax, dword [0x101e316c]
test eax, eax
jge 0x100f83c8
xor eax, eax
jmp 0x100f83cf
cmp ebx, esi
jbe 0x100f82e7
mov ecx, ebx
shl ecx, 4
push ecx
call fcn.10119140
mov dword [ebp - 0xc], eax
cmp eax, esi
jne 0x100f8343
pop esi
pop ebx
mov eax, 0x8007000e
pop edi
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [edi + 8]
mov esi, ebx
mov dword [ebp - 8], esi
cmp ebx, ecx
jbe 0x100f8354
mov dword [ebp - 8], ecx
mov esi, ecx
push eax
mov ecx, esi
xor edx, edx
call fcn.100f8b90
test esi, esi
jbe 0x100f83b6
xor ebx, ebx
mov dword [ebp - 0x10], esi
jmp 0x100f8370
mov edi, dword [edi]
mov edx, dword [edi + ebx + 8]
movzx eax, byte [edi + ebx + 0xd]
movzx ecx, byte [edi + ebx + 0xc]
add edi, ebx
push edx
mov edx, dword [edi + 4]
push eax
mov eax, dword [edi]
push ecx
mov ecx, dword [ebp - 0xc]
push edx
push eax
lea esi, [ebx + ecx]
call fcn.100f8e90
xor eax, eax
add ebx, 0x10
sub dword [ebp - 0x10], 1
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov byte [edi + 0xc], al
mov edi, dword [ebp + 8]
jne 0x100f8370
mov esi, dword [ebp - 8]
mov ebx, dword [ebp - 4]
mov edx, dword [edi]
mov eax, dword [edi + 8]
push edx
mov ecx, esi
call fcn.100da890
jmp 0x100f82f7
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [eax]
push esi
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edx, dword [ebp - 0xc]
mov dword [edi], edx
mov dword [edi + 4], ebx
cmp dword [edi + 8], ebx
jbe 0x100f83eb
mov dword [edi + 8], ebx
mov byte [edi + 0xc], 1
xor eax, eax
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 4
Function at 0x100f8400
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push edi
mov edi, dword [ebp + 8]
cmp byte [edi + 0xd], 0
jne 0x100f841e
mov eax, 0x8000ffff
pop edi
mov esp, ebp
pop ebp
ret 4
push ebx
push esi
xor esi, esi
cmp ecx, esi
jbe 0x100f8452
lea eax, [ebp - 8]
push eax
mov eax, edi
call fcn.100f8dc0
cmp eax, esi
jne 0x100f855d
mov ebx, dword [ebp - 8]
cmp ebx, 0xccccccc
jbe 0x100f848f
pop esi
pop ebx
mov eax, 0x80070216
pop edi
mov esp, ebp
pop ebp
ret 4
mov dword [ebp - 8], esi
mov ebx, esi
mov ecx, dword [edi]
push ecx
xor ecx, ecx
mov eax, dword [edi + 8]
call fcn.100da990
cmp byte [edi + 0xc], 0
je 0x100f854a
mov ecx, dword [edi]
mov dword [ebp + 8], ecx
test ecx, ecx
je 0x100f854a
mov eax, dword [0x101e316c]
test eax, eax
jge 0x100f8534
xor eax, eax
jmp 0x100f853e
cmp ebx, esi
jbe 0x100f8457
lea ecx, [ebx + ebx*4]
add ecx, ecx
add ecx, ecx
push ecx
call fcn.10119140
mov esi, eax
mov dword [ebp - 0xc], esi
test esi, esi
jne 0x100f84b7
pop esi
pop ebx
mov eax, 0x8007000e
pop edi
mov esp, ebp
pop ebp
ret 4
mov eax, dword [edi + 8]
mov dword [ebp - 4], ebx
cmp ebx, eax
jbe 0x100f84c4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
push esi
xor edx, edx
call fcn.100f8be0
cmp dword [ebp - 4], 0
jbe 0x100f8529
mov edx, dword [ebp - 4]
xor ebx, ebx
mov dword [ebp - 0x10], edx
lea ecx, [ecx]
mov edi, dword [edi]
mov eax, dword [edi + ebx]
add edi, ebx
mov dword [ebx + esi], eax
mov ecx, dword [edi + 0xc]
movzx edx, byte [edi + 0x11]
movzx eax, byte [edi + 0x10]
push ecx
mov ecx, dword [edi + 8]
push edx
mov edx, dword [edi + 4]
push eax
push ecx
push edx
lea esi, [ebx + esi + 4]
call fcn.100f8e90
mov esi, dword [ebp - 0xc]
xor eax, eax
add ebx, 0x14
sub dword [ebp - 0x10], 1
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
mov byte [edi + 0x10], al
mov edi, dword [ebp + 8]
jne 0x100f84e0
mov ebx, dword [ebp - 8]
mov eax, dword [edi]
mov ecx, dword [ebp - 4]
push eax
jmp 0x100f845c
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [ebp + 8]
mov edx, dword [eax]
push ecx
push 0
push edx
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi], esi
mov dword [edi + 4], ebx
cmp dword [edi + 8], ebx
jbe 0x100f8557
mov dword [edi + 8], ebx
mov byte [edi + 0xc], 1
xor eax, eax
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 4
Function at 0x100f8570
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push edi
mov edi, dword [ebp + 8]
cmp byte [edi + 0xd], 0
jne 0x100f858e
mov eax, 0x8000ffff
pop edi
mov esp, ebp
pop ebp
ret 4
push ebx
xor ebx, ebx
push esi
cmp ecx, ebx
jbe 0x100f85c2
lea eax, [ebp - 4]
push eax
mov eax, edi
call fcn.100f8dc0
cmp eax, ebx
jne 0x100f86a4
mov esi, dword [ebp - 4]
cmp esi, 0x5555555
jbe 0x100f85ff
pop esi
pop ebx
mov eax, 0x80070216
pop edi
mov esp, ebp
pop ebp
ret 4
mov dword [ebp - 4], ebx
mov esi, ebx
mov ecx, dword [edi]
mov eax, dword [edi + 8]
push ecx
xor ecx, ecx
call fcn.100da910
mov dword [ebp - 0xc], ebx
cmp byte [edi + 0xc], 0
je 0x100f868e
mov ebx, dword [edi]
test ebx, ebx
je 0x100f868e
mov eax, dword [0x101e316c]
test eax, eax
jge 0x100f867b
xor eax, eax
jmp 0x100f8682
cmp esi, ebx
jbe 0x100f85c7
lea ecx, [esi + esi*2]
shl ecx, 4
push ecx
call fcn.10119140
mov dword [ebp - 0xc], eax
cmp eax, ebx
jne 0x100f8624
pop esi
pop ebx
mov eax, 0x8007000e
pop edi
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [edi + 8]
mov ebx, esi
mov dword [ebp - 8], ebx
cmp esi, ecx
jbe 0x100f8635
mov dword [ebp - 8], ecx
mov ebx, ecx
push eax
mov ecx, ebx
xor edx, edx
call fcn.100f8c20
test ebx, ebx
jbe 0x100f8669
xor esi, esi
mov dword [ebp - 0x10], ebx
mov edi, dword [edi]
mov edx, dword [ebp - 0xc]
add edi, esi
lea ebx, [esi + edx]
call fcn.100f8c70
mov edi, dword [ebp + 8]
add esi, 0x30
sub dword [ebp - 0x10], 1
jne 0x100f8648
mov esi, dword [ebp - 4]
mov ebx, dword [ebp - 8]
mov eax, dword [edi]
push eax
mov eax, dword [edi + 8]
mov ecx, ebx
call fcn.100da910
jmp 0x100f85d7
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edx, dword [eax]
push ebx
push 0
push edx
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 0xc]
mov dword [edi], eax
mov dword [edi + 4], esi
cmp dword [edi + 8], esi
jbe 0x100f869e
mov dword [edi + 8], esi
mov byte [edi + 0xc], 1
xor eax, eax
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 4
Function at 0x100f86c0
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
cmp byte [esi + 0xd], 0
jne 0x100f86d5
mov eax, 0x8000ffff
mov esp, ebp
pop ebp
ret
push ebx
push edi
test ecx, ecx
jbe 0x100f8704
lea eax, [ebp - 4]
push eax
mov eax, esi
call fcn.100f8dc0
test eax, eax
jne 0x100f879a
mov ebx, dword [ebp - 4]
cmp ebx, 0x1fffffff
jbe 0x100f8724
pop edi
mov eax, 0x80070216
pop ebx
mov esp, ebp
pop ebp
ret
xor ebx, ebx
xor edi, edi
cmp byte [esi + 0xc], 0
je 0x100f8787
mov ecx, dword [esi]
mov dword [ebp - 4], ecx
test ecx, ecx
je 0x100f8787
mov eax, dword [0x101e316c]
test eax, eax
jge 0x100f8771
xor eax, eax
jmp 0x100f877b
test ebx, ebx
jbe 0x100f8706
lea ecx, [ebx*8]
push ecx
call fcn.10119140
mov edi, eax
test edi, edi
jne 0x100f8746
pop edi
mov eax, 0x8007000e
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 8]
mov edx, ebx
cmp ebx, eax
jbe 0x100f8751
mov edx, eax
xor eax, eax
test edx, edx
jbe 0x100f8708
mov ecx, dword [esi]
mov ebx, dword [ecx + eax*8]
mov dword [edi + eax*8], ebx
mov ecx, dword [ecx + eax*8 + 4]
mov dword [edi + eax*8 + 4], ecx
inc eax
cmp eax, edx
jb 0x100f8757
mov ebx, dword [ebp - 4]
jmp 0x100f8708
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [ebp - 4]
mov edx, dword [eax]
push ecx
push 0
push edx
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [esi], edi
mov dword [esi + 4], ebx
cmp dword [esi + 8], ebx
jbe 0x100f8794
mov dword [esi + 8], ebx
mov byte [esi + 0xc], 1
xor eax, eax
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100f87b0
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
cmp byte [ebx + 0xd], 0
jne 0x100f87c7
mov eax, 0x8000ffff
mov esp, ebp
pop ebp
ret
push esi
push edi
xor edi, edi
cmp ecx, edi
jbe 0x100f87f8
lea eax, [ebp - 4]
push eax
mov eax, ebx
call fcn.100f8dc0
cmp eax, edi
jne 0x100f8897
mov esi, dword [ebp - 4]
cmp esi, 0x71c71c7
jbe 0x100f8819
pop edi
mov eax, 0x80070216
pop esi
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], edi
mov esi, edi
mov dword [ebp - 8], edi
cmp byte [ebx + 0xc], 0
je 0x100f8881
mov edi, dword [ebx]
test edi, edi
je 0x100f8881
mov eax, dword [0x101e316c]
test eax, eax
jge 0x100f886e
xor eax, eax
jmp 0x100f8875
cmp esi, edi
jbe 0x100f87fd
lea ecx, [esi + esi*8]
add ecx, ecx
add ecx, ecx
push ecx
call fcn.10119140
mov dword [ebp - 8], eax
cmp eax, edi
jne 0x100f883c
pop edi
mov eax, 0x8007000e
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebx + 8]
mov edx, esi
cmp esi, eax
jbe 0x100f8847
mov edx, eax
cmp edx, edi
jbe 0x100f8800
xor eax, eax
lea ecx, [ecx]
mov esi, dword [ebx]
mov ecx, dword [ebp - 8]
add esi, eax
lea edi, [eax + ecx]
mov ecx, 9
add eax, 0x24
sub edx, 1
rep movsd dword es:[edi], dword [esi]
jne 0x100f8850
mov esi, dword [ebp - 4]
jmp 0x100f8800
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edx, dword [eax]
push edi
push 0
push edx
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 8]
mov dword [ebx], eax
mov dword [ebx + 4], esi
cmp dword [ebx + 8], esi
jbe 0x100f8891
mov dword [ebx + 8], esi
mov byte [ebx + 0xc], 1
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100f8970
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
cmp byte [esi + 0xd], 0
jne 0x100f8987
mov eax, 0x8000ffff
mov esp, ebp
pop ebp
ret
push ebx
push edi
test ecx, ecx
jbe 0x100f89b6
lea eax, [ebp - 4]
push eax
mov eax, esi
call fcn.100f8dc0
test eax, eax
jne 0x100f8a6c
mov edi, dword [ebp - 4]
cmp edi, 0xfffffff
jbe 0x100f89de
pop edi
mov eax, 0x80070216
pop ebx
mov esp, ebp
pop ebp
ret
xor edi, edi
xor ebx, ebx
cmp byte [esi + 0xc], 0
je 0x100f8a59
mov ecx, dword [esi]
mov dword [ebp - 8], ecx
test ecx, ecx
je 0x100f8a59
mov eax, dword [0x101e316c]
test eax, eax
jge 0x100f8a43
xor eax, eax
jmp 0x100f8a4d
test edi, edi
jbe 0x100f89b8
mov ecx, edi
shl ecx, 4
push ecx
call fcn.10119140
mov ebx, eax
mov dword [ebp - 8], ebx
test ebx, ebx
jne 0x100f8a01
pop edi
mov eax, 0x8007000e
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 8]
mov edx, edi
cmp edi, eax
jbe 0x100f8a0c
mov edx, eax
test edx, edx
jbe 0x100f89ba
xor ecx, ecx
mov eax, dword [esi]
lea edi, [ecx + ebx]
mov ebx, dword [eax + ecx]
add eax, ecx
mov dword [edi], ebx
mov ebx, dword [eax + 4]
mov dword [edi + 4], ebx
mov ebx, dword [eax + 8]
mov dword [edi + 8], ebx
mov eax, dword [eax + 0xc]
mov ebx, dword [ebp - 8]
add ecx, 0x10
sub edx, 1
mov dword [edi + 0xc], eax
jne 0x100f8a12
mov edi, dword [ebp - 4]
jmp 0x100f89ba
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [ebp - 8]
push ecx
mov ecx, dword [eax]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [esi], ebx
mov dword [esi + 4], edi
cmp dword [esi + 8], edi
jbe 0x100f8a66
mov dword [esi + 8], edi
mov byte [esi + 0xc], 1
xor eax, eax
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100f8a80
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
cmp byte [esi + 0xd], 0
jne 0x100f8a97
mov eax, 0x8000ffff
mov esp, ebp
pop ebp
ret
push ebx
push edi
test ecx, ecx
jbe 0x100f8ac6
lea eax, [ebp - 4]
push eax
mov eax, esi
call fcn.100f8dc0
test eax, eax
jne 0x100f8b78
mov edi, dword [ebp - 4]
cmp edi, 0x15555555
jbe 0x100f8aee
pop edi
mov eax, 0x80070216
pop ebx
mov esp, ebp
pop ebp
ret
xor edi, edi
xor ebx, ebx
cmp byte [esi + 0xc], 0
je 0x100f8b65
mov ecx, dword [esi]
mov dword [ebp - 8], ecx
test ecx, ecx
je 0x100f8b65
mov eax, dword [0x101e316c]
test eax, eax
jge 0x100f8b4f
xor eax, eax
jmp 0x100f8b59
test edi, edi
jbe 0x100f8ac8
lea ecx, [edi + edi*2]
add ecx, ecx
add ecx, ecx
push ecx
call fcn.10119140
mov ebx, eax
mov dword [ebp - 8], ebx
test ebx, ebx
jne 0x100f8b13
pop edi
mov eax, 0x8007000e
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 8]
mov edx, edi
cmp edi, eax
jbe 0x100f8b1e
mov edx, eax
test edx, edx
jbe 0x100f8aca
xor ecx, ecx
mov eax, dword [esi]
lea edi, [ecx + ebx]
mov ebx, dword [eax + ecx]
add eax, ecx
mov dword [edi], ebx
mov ebx, dword [eax + 4]
mov dword [edi + 4], ebx
mov eax, dword [eax + 8]
mov ebx, dword [ebp - 8]
add ecx, 0xc
sub edx, 1
mov dword [edi + 8], eax
jne 0x100f8b24
mov edi, dword [ebp - 4]
jmp 0x100f8aca
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [ebp - 8]
push ecx
mov ecx, dword [eax]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [esi], ebx
mov dword [esi + 4], edi
cmp dword [esi + 8], edi
jbe 0x100f8b72
mov dword [esi + 8], edi
mov byte [esi + 0xc], 1
xor eax, eax
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100f8ce0
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
cmp byte [esi + 0xd], 0
jne 0x100f8cf5
mov eax, 0x8000ffff
mov esp, ebp
pop ebp
ret
push ebx
push edi
test ecx, ecx
jbe 0x100f8d24
lea eax, [ebp - 4]
push eax
mov eax, esi
call fcn.100f8dc0
test eax, eax
jne 0x100f8dad
mov ebx, dword [ebp - 4]
cmp ebx, 0x7fffffff
jbe 0x100f8d44
pop edi
mov eax, 0x80070216
pop ebx
mov esp, ebp
pop ebp
ret
xor ebx, ebx
xor edi, edi
cmp byte [esi + 0xc], 0
je 0x100f8d9a
mov ecx, dword [esi]
mov dword [ebp - 4], ecx
test ecx, ecx
je 0x100f8d9a
mov eax, dword [0x101e316c]
test eax, eax
jge 0x100f8d84
xor eax, eax
jmp 0x100f8d8e
test ebx, ebx
jbe 0x100f8d26
lea ecx, [ebx + ebx]
push ecx
call fcn.10119140
mov edi, eax
test edi, edi
jne 0x100f8d62
pop edi
mov eax, 0x8007000e
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 8]
mov ecx, ebx
cmp ebx, eax
jbe 0x100f8d6d
mov ecx, eax
xor eax, eax
test ecx, ecx
jbe 0x100f8d28
mov edx, dword [esi]
mov dx, word [edx + eax*2]
mov word [edi + eax*2], dx
inc eax
cmp eax, ecx
jb 0x100f8d73
jmp 0x100f8d28
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [ebp - 4]
mov eax, dword [eax]
push ecx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [esi], edi
mov dword [esi + 4], ebx
cmp dword [esi + 8], ebx
jbe 0x100f8da7
mov dword [esi + 8], ebx
mov byte [esi + 0xc], 1
xor eax, eax
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100f8e10
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [esi]
push eax
mov eax, dword [esi + 8]
xor ecx, ecx
call fcn.100da990
cmp byte [esi + 0xc], 0
mov dword [esi + 8], 0
je 0x100f8e5b
push edi
mov edi, dword [esi]
test edi, edi
je 0x100f8e56
mov eax, dword [0x101e316c]
test eax, eax
jge 0x100f8e43
xor eax, eax
jmp 0x100f8e4a
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [eax]
push edi
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov byte [esi + 0xc], 0
pop edi
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x18]
mov dword [esi], edx
mov dl, byte [ebp + 0x10]
mov dword [esi + 4], eax
mov al, byte [ebp + 0x14]
mov dword [esi + 8], ecx
mov byte [esi + 0xc], dl
mov byte [esi + 0xd], al
pop ebp
ret 0x14

Function at 0x100f8e90
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp byte [esi + 0xc], 0
mov dword [esi + 8], 0
je 0x100f8ece
push edi
mov edi, dword [esi]
test edi, edi
je 0x100f8ec9
mov eax, dword [0x101e316c]
test eax, eax
jge 0x100f8eb6
xor eax, eax
jmp 0x100f8ebd
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov eax, dword [eax]
push edi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov byte [esi + 0xc], 0
pop edi
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x18]
mov dword [esi], ecx
mov cl, byte [ebp + 0x10]
mov dword [esi + 4], edx
mov dl, byte [ebp + 0x14]
mov dword [esi + 8], eax
mov byte [esi + 0xc], cl
mov byte [esi + 0xd], dl
pop ebp
ret 0x14

Function at 0x10101cd0
Capabilities:
Get thread local storage value

Disassembly:
mov ecx, dword [ebx + 8]
push esi
xor esi, esi
push edi
cmp ecx, esi
je 0x10101ce3
mov eax, dword [ecx]
mov edx, dword [eax]
push 1
call edx
mov edi, dword [ebx + 0x1a4]
mov dword [ebx + 8], esi
cmp edi, esi
je 0x10101d08
call fcn.10117760
lea esi, [edi + 0x28]
call fcn.10118ed0
push edi
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
add esp, 4
xor esi, esi
mov dword [ebx + 0x1a4], esi
cmp byte [ebx + 0x1a0], 0
mov dword [ebx + 0x19c], esi
je 0x10101d4d
mov edi, dword [ebx + 0x194]
cmp edi, esi
je 0x10101d46
mov eax, dword [0x101e316c]
cmp eax, esi
jge 0x10101d34
xor eax, eax
jmp 0x10101d3b
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov eax, dword [eax]
push edi
push esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov byte [ebx + 0x1a0], 0
mov dword [ebx + 0x194], esi
mov dword [ebx + 0x198], esi
mov esi, ebx
call fcn.10101be0
pop edi
pop esi
ret
Function at 0x10107fd0
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
xor edx, edx
div dword [ebp + 0x10]
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 0x14], eax
cmp eax, edi
jbe 0x10108143
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], edi
mov dword [ebp + 0xc], eax
lea esp, [esp]
mov ecx, dword [ebp + 8]
mov eax, dword [0x101e316c]
cmp eax, edi
mov edx, dword [ecx + 8]
mov dword [ebp - 0x10], edx
jge 0x10108016
xor eax, eax
jmp 0x1010801d
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp dword [eax + 0xc], edi
je 0x10108045
mov ecx, dword [eax + 0xc]
cmp ecx, edi
jne 0x1010802f
xor ecx, ecx
mov ebx, ecx
jmp 0x10108056
mov edx, dword [ecx]
mov dword [eax + 0xc], edx
cmp edx, edi
jne 0x1010803b
mov dword [eax + 0x10], edi
mov dword [ecx], 0xfefefefe
mov ebx, ecx
jmp 0x10108056
mov ecx, dword [eax + 8]
push 0x10
push pe_nt_image_headers32
call fcn.101d8457
mov ebx, eax
cmp ebx, edi
je 0x101080a2
or eax, 0xffffffff
push edi
mov dword [ebx + 0x50], eax
mov dword [ebx + 0x48], eax
mov eax, dword [ebp + 0x14]
push edi
push eax
mov eax, ebx
mov dword [ebx], edi
mov dword [ebx + 4], edi
mov dword [ebx + 0x94], edi
mov dword [ebx + 0x98], edi
mov dword [ebx + 0x24], edi
call fcn.10165570
mov esi, eax
cmp esi, edi
jl 0x101080a9
push edi
mov edi, dword [ebp - 0x10]
call fcn.10169830
mov esi, eax
test esi, esi
jl 0x101080a9
xor esi, esi
mov dword [ebp - 8], ebx
xor edi, edi
jmp 0x101080f5
mov esi, 0x8007000e
jmp 0x101080f2
mov edi, ebx
call fcn.101654a0
mov eax, dword [0x101e316c]
test eax, eax
jge 0x101080bd
xor edi, edi
jmp 0x101080c6
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
push pe_nt_image_headers32
push 0xfe
push ebx
call sub.msvcrt.dll_memset
mov dword [ebx], 0
mov eax, dword [edi + 0x10]
add esp, 0xc
test eax, eax
je 0x101080ea
mov dword [eax], ebx
jmp 0x101080ed
mov dword [edi + 0xc], ebx
mov dword [edi + 0x10], ebx
xor edi, edi
mov ebx, dword [ebp - 8]
cmp esi, edi
jl 0x1010814e
mov eax, dword [ebp + 0x18]
cmp eax, edi
je 0x1010810f
mov ecx, dword [ebp - 4]
mov dword [ebx + 0x8c], eax
mov dword [ebx + 0x90], ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
mov eax, dword [eax + 0x60]
mov ecx, dword [ebp + 0x14]
mov dword [ebx + 0x60], eax
cmp eax, dword [ecx + 0x10]
jb 0x10108126
inc eax
mov dword [ecx + 0x10], eax
mov eax, dword [ebp + 0x10]
add dword [ebp - 4], eax
mov ecx, dword [ebp - 0xc]
add eax, eax
add eax, eax
add dword [ebp + 0xc], eax
inc ecx
mov dword [ebp - 0xc], ecx
cmp ecx, dword [ebp - 0x14]
jb 0x10108000
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x1010f4b0
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x94
push ebx
push esi
xor ebx, ebx
push edi
xor edi, edi
mov dword [ebp - 8], ebx
mov dword [ebp - 4], edi
mov dword [ebp - 0x90], edi
mov dword [ebp - 0x8c], edi
mov dword [ebp - 0x88], edi
mov dword [ebp - 0x54], edi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x10], edi
cmp byte [ebp + 0xc], bl
je 0x1010f51f
push 8
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
cmp eax, edi
je 0x1010f50c
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
mov dword [eax], ecx
mov dword [eax + 4], edx
mov dword [ebp - 4], eax
jmp 0x1010f522
lea esi, [ebp - 0x90]
mov dword [ebp - 4], edi
call fcn.100a6140
jmp 0x1010f5d9
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 4]
lea eax, [ebp - 8]
push eax
mov eax, dword [ecx + 0x50]
mov ecx, dword [ecx + 0x54]
push edx
and eax, 0xc3
push eax
push ecx
lea ebx, [ebp - 0x90]
call fcn.100a61e0
test eax, eax
jge 0x1010f555
mov esi, ebx
call fcn.100a6140
mov ebx, dword [ebp - 8]
jmp 0x1010f5d7
mov ebx, dword [ebp - 8]
mov edx, dword [ebx]
mov eax, dword [edx + 0x10]
push ebx
call eax
mov edi, eax
mov eax, dword [0x101e316c]
mov dword [ebp + 0xc], edi
test eax, eax
jl 0x1010f5cc
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x1010f5cc
mov ecx, dword [eax + 0x20]
push 1
push edi
call fcn.101d8457
mov esi, eax
test esi, esi
je 0x1010f5cc
mov ecx, dword [ebx]
mov edx, dword [ecx + 0xc]
push edi
push ebx
call edx
push eax
push esi
call sub.msvcrt.dll_memcpy
mov eax, dword [ebx]
mov ecx, dword [eax + 8]
add esp, 0xc
push ebx
call ecx
xor ebx, ebx
lea edi, [ebx + 0x48]
call fcn.100a9db0
test eax, eax
je 0x1010f5cc
mov edx, dword [ebp + 8]
push esi
add edx, 0x218
push edx
mov edx, dword [ebp + 0xc]
call fcn.10112070
mov edi, eax
test edi, edi
jne 0x1010f606
lea esi, [ebp - 0x90]
call fcn.100a6140
xor edi, edi
mov ecx, dword [ebp - 4]
mov eax, dword [ebp + 8]
push ecx
mov byte [eax + 0x241], 1
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
add esp, 4
cmp ebx, edi
je 0x1010f5fb
mov edx, dword [ebx]
mov eax, dword [edx + 8]
push ebx
call eax
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
push ecx
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
add esp, 4
lea esi, [ebp - 0x90]
call fcn.100a6140
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x10112190
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [0x101e316c]
test eax, eax
jge 0x101121a2
xor eax, eax
jmp 0x101121a9
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [eax + 4]
push 0x10
push 0x1c
call fcn.101d8457
test eax, eax
je 0x101121f3
mov ecx, dword [ebp + 0xc]
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xffffffff
mov dword [eax], 0x1008b758
mov dword [eax + 4], 2
mov dword [eax + 0x18], 0x11
mov dword [eax + 0x18], ecx
pop ebp
ret 8
mov edx, dword [ebp + 8]
mov byte [edx + 0x240], 1
xor eax, eax
pop ebp
ret 8
Function at 0x101123f0
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [0x101e316c]
push esi
xor esi, esi
cmp eax, esi
jge 0x10112405
xor eax, eax
jmp 0x1011240c
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [eax + 4]
push 0x10
push 0x30
call fcn.101d8457
cmp eax, esi
je 0x1011246e
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov dword [eax + 8], esi
mov dword [eax + 0xc], esi
mov dword [eax + 0x10], esi
mov dword [eax + 0x14], 0xffffffff
mov dword [eax], 0x1008b7c0
mov dword [eax + 4], 6
mov dword [eax + 0x18], 0x10
mov dword [eax + 0x2c], 1
mov dword [eax + 0x18], ecx
mov ecx, dword [ebp + 0x14]
mov dword [eax + 0x1c], edx
mov edx, dword [ebp + 0x18]
mov dword [eax + 0x20], ecx
mov dword [eax + 0x24], edx
mov dword [eax + 0x28], edi
cmp edi, esi
jbe 0x1011247a
mov dword [eax + 0x2c], edi
pop esi
pop ebp
ret 0x14
mov eax, dword [ebp + 8]
mov byte [eax + 0x240], 1
xor eax, eax
pop esi
pop ebp
ret 0x14