joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100784d0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x100b28a8
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x100f6f50]
xor eax, esp
mov dword [esp + 0x14], eax
push ebx
push esi
push edi
mov eax, dword [0x100f6f50]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x38]
mov esi, ecx
call fcn.100222a0
mov edi, dword [eax]
mov ecx, esi
call fcn.10021e10
cmp eax, 0x7fffffff
ja 0x100785d9
cmp eax, 2
jle 0x10078539
cmp word [edi], 0x7b
jne 0x10078539
cmp word [edi + eax*2 - 2], 0x7d
jne 0x10078539
add edi, 2
add eax, 0xfffffffe
push eax
push edi
lea ecx, [esp + 0x18]
call fcn.100224e0
mov dword [esp + 0x30], 0
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push eax
push ecx
call dword [sym.imp.RPCRT4.dll_UuidFromStringW]
test eax, eax
jne 0x100785ac
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov dword [ebx], edx
mov edx, dword [esp + 0x20]
mov dword [ebx + 4], eax
mov dword [ebx + 8], ecx
mov dword [ebx + 0xc], edx
mov dword [esp + 0x30], 0xffffffff
lea ecx, [esp + 0x10]
call fcn.10001df0
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.1008db44
add esp, 0x24
ret 4
push 0
cmp eax, 0x6a9
jne 0x100785c9
push 0x1da
push str..AutoString.cpp
push 0x80070057
call fcn.10001ed0
push 0x1de
push str..AutoString.cpp
push eax
call fcn.10001ed0
push 0
push 0x29f
push str.c:dvsp4_build_sw_relgpu_drvinstaller_coreincNVI2Defns.h
push 0x80070057
call fcn.10001ed0
int3

Function at 0x10078a50
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x100b29e0
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x100f6f50]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, ecx
xor ebx, ebx
push esi
mov dword [esp + 0x18], esi
mov byte [esp + 0x1c], bl
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [esp + 0x18], 1
mov dword [esp + 0x24], ebx
or edi, 0xffffffff
cmp dword [esi + 0x50], edi
jne 0x10078aea
mov eax, dword [esi + 0x4c]
push ebx
push 0x4000100
push 3
push ebx
push 7
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esp + 0x10], eax
mov byte [esp + 0x24], 1
cmp eax, edi
jne 0x10078ae3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x10078acd
cmp eax, 3
jne 0x10078adc
mov byte [esp + 0x24], bl
lea ecx, [esp + 0x10]
call fcn.100161a0
jmp 0x10078aea
push ebx
push ebx
call fcn.100207b0
mov dword [esp + 0x10], edi
mov dword [esi + 0x50], eax
mov dword [esp + 0x24], edi
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov byte [esp + 0x18], bl
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x18
ret
Function at 0x10078c70
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b2a50
mov eax, dword fs:[0]
push eax
sub esp, 0x30
push ebx
push esi
push edi
mov eax, dword [0x100f6f50]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x20], esi
xor ebx, ebx
mov byte [ebp - 0x1c], bl
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov al, 1
mov byte [ebp - 0x1c], al
mov dword [ebp - 4], ebx
cmp byte [ebp + 8], bl
jne 0x10078d07
cmp dword [esi + 0x50], 0xffffffff
jne 0x10078d07
mov ecx, dword [esi + 0x30]
cmp dword [ecx - 0xc], ebx
je 0x10078d07
mov byte [ebp - 4], al
mov ecx, esi
call fcn.10078a50
mov dword [ebp - 4], ebx
jmp 0x10078d07
mov eax, dword [esi + 0x50]
or edi, 0xffffffff
cmp eax, edi
je 0x10078d4a
cmp byte [ebp + 8], bl
je 0x10078d2b
push ebx
push 0xa0
push str..TempFilePath.cpp
push 0xe0e00000
call fcn.10001ed0
push 0xa4
push str..TempFilePath.cpp
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call fcn.1001e030
add esp, 0xc
mov dword [esi + 0x50], edi
jmp 0x10078d72
mov eax, dword [esi + 0x30]
cmp dword [eax - 0xc], ebx
je 0x10078d72
cmp byte [ebp + 8], bl
jne 0x10078d65
mov eax, dword [esi + 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x10078d72
mov eax, dword [esi + 0x4c]
push 4
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
lea ecx, [ebp - 0x3c]
call fcn.10025750
mov byte [ebp - 4], 3
lea ecx, [esi + 0x30]
add eax, 0x18
push eax
call fcn.100254c0
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x3c]
call fcn.10025580
mov dword [ebp - 4], edi
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov byte [ebp - 0x1c], bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100798a0
Capabilities:
Get file version info

Disassembly:
push 0xffffffffffffffff
push 0x100b2c73
mov eax, dword fs:[0]
push eax
sub esp, 0x188
push ebp
push esi
push edi
mov eax, dword [0x100f6f50]
xor eax, esp
push eax
lea eax, [esp + 0x198]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0x24], edi
xor ebp, ebp
mov dword [edi], ebp
mov dword [edi + 4], ebp
mov dword [edi + 8], ebp
mov dword [edi + 0xc], ebp
mov dword [esp + 0x1a0], ebp
mov ecx, dword [esp + 0x1a8]
mov eax, dword [ecx + 0x18]
cmp dword [eax - 0xc], ebp
jne 0x10079907
push ebp
push 0x14
push str..FileVersion.cpp
push 0x80070057
call fcn.10001ed0
push 1
lea edx, [esp + 0x64]
push edx
call fcn.100759d0
mov byte [esp + 0x1a0], 1
add eax, 0x18
push eax
lea ecx, [esp + 0x14]
call fcn.10001d90
mov byte [esp + 0x1a0], 3
lea ecx, [esp + 0x60]
call fcn.10025580
mov dword [esp + 0x1c], ebp
call fcn.10079d40
test al, al
je 0x10079a93
lea ecx, [esp + 0x7c]
call fcn.10065720
mov ecx, eax
call fcn.10024f90
test al, al
je 0x10079a93
lea eax, [esp + 0x28]
push eax
call fcn.10076200
add esp, 4
mov byte [esp + 0x1a0], 4
add eax, 0x18
push eax
lea ecx, [esp + 0x18]
call fcn.10001d90
mov byte [esp + 0x1a0], 6
lea ecx, [esp + 0x28]
call fcn.10025580
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov eax, dword [edx - 0xc]
mov esi, dword [ecx - 0xc]
add eax, 0xfffffffc
cmp eax, esi
jl 0x10079a82
push esi
push 4
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x1c]
call fcn.1001f8a0
mov byte [esp + 0x1a0], 7
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
push ecx
push edx
call fcn.100902a3
add esp, 8
test eax, eax
jne 0x10079a71
push esi
push 4
lea ecx, [esp + 0x18]
call fcn.100796b0
lea eax, [esp + 0x44]
push eax
call fcn.10075f60
add esp, 4
mov byte [esp + 0x1a0], 8
push str.Sysnative
lea ecx, [esp + 0x2c]
push ecx
mov ecx, eax
call fcn.1001f170
mov byte [esp + 0x1a0], 9
add eax, 0x18
push eax
lea ecx, [esp + 0x24]
call fcn.10001d90
mov byte [esp + 0x1a0], 0xa
mov eax, dword [eax]
push eax
push 4
lea ecx, [esp + 0x18]
call fcn.10079530
mov byte [esp + 0x1a0], 9
lea ecx, [esp + 0x20]
call fcn.10001df0
mov byte [esp + 0x1a0], 8
lea ecx, [esp + 0x28]
call fcn.10025580
mov byte [esp + 0x1a0], 7
lea ecx, [esp + 0x44]
call fcn.10025580
mov byte [esp + 0x1a0], 6
lea ecx, [esp + 0x18]
call fcn.10001df0
mov byte [esp + 0x1a0], 3
lea ecx, [esp + 0x14]
call fcn.10001df0
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x1c]
push edx
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
cmp esi, ebp
jne 0x10079aaf
push ebp
push ebp
call fcn.100207b0
push 0xffffffffffffffff
push esi
mov ecx, edi
call fcn.10066d30
mov eax, dword [edi]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x10]
push 0x3c
push str..FileVersion.cpp
push eax
push esi
push ecx
push edx
call sub.VERSION.dll_GetFileVersionInfoW
push eax
call fcn.1001e030
add esp, 0xc
mov byte [esp + 0x1a0], 0
lea ecx, [esp + 0x10]
call fcn.10001df0
mov dword [esp + 0x1a0], 0xffffffff
mov eax, edi
mov ecx, dword [esp + 0x198]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x194
ret 4
Function at 0x1007e404
Capabilities:
Write file on windows

Disassembly:
push 0x48
mov eax, 0x100b32d7
call fcn.10091ff4
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x3c], ebx
je 0x1007e516
cmp byte [esi + 0x42], bl
je 0x1007e516
mov eax, dword [esi]
mov edi, 0xffff
push edi
call dword [eax + 4]
movzx eax, ax
cmp di, ax
jne 0x1007e440
xor al, al
jmp 0x1007e518
push ebx
push 8
lea ecx, [ebp - 0x2c]
call fcn.1007b67a
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x54]
push eax
lea ecx, [ebp - 0x2c]
call fcn.1004a820
mov ecx, eax
call fcn.1004a8c0
mov edi, dword [ebp - 0x18]
mov ebx, eax
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x2c]
call fcn.1004a820
mov ecx, eax
call fcn.1004a8c0
mov ecx, dword [esi + 0x3c]
mov edx, dword [ecx]
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x30]
push eax
add edi, ebx
push edi
push dword [ebp - 0x34]
lea eax, [esi + 0x44]
push eax
call dword [edx + 0x18]
sub eax, 0
je 0x1007e4b0
dec eax
je 0x1007e4b4
dec eax
dec eax
je 0x1007e512
xor bl, bl
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.10059670
mov al, bl
jmp 0x1007e518
mov byte [esi + 0x42], 0
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x2c]
call fcn.1004a820
mov ecx, eax
call fcn.1004a8c0
mov edi, dword [ebp - 0x30]
sub edi, eax
je 0x1007e4f4
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x2c]
call fcn.1004a820
mov ecx, eax
call fcn.1004a8c0
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.10097207
add esp, 0x10
cmp edi, eax
jne 0x1007e49e
cmp byte [esi + 0x42], 0
je 0x1007e512
test edi, edi
jne 0x1007e44e
push edi
push 8
lea ecx, [ebp - 0x2c]
call fcn.1004a710
jmp 0x1007e44e
mov bl, 1
jmp 0x1007e4a0
mov al, 1
call fcn.1009203e
ret

Function at 0x1008c7e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 8]
cmp dword [eax + 0x18], 8
jb 0x1008c7ef
mov eax, dword [eax + 4]
jmp 0x1008c7f2
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1008c87b
push esi
mov esi, dword [0x1010408c]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x10]
mov dword [ecx + 4], esi
mov dword [ecx], eax
pop esi
cmp eax, 2
je 0x1008c860
cmp eax, 3
je 0x1008c860
cmp eax, 0x7b
je 0x1008c860
cmp eax, 0x57
je 0x1008c860
cmp eax, 0xa1
je 0x1008c860
cmp eax, 0x35
je 0x1008c860
cmp eax, 0x20
jne 0x1008c855
mov eax, dword [0x10104094]
mov dword [ecx], eax
mov edx, dword [0x10104098]
mov eax, dword [esp + 4]
mov dword [ecx + 4], edx
mov dword [eax], 9
ret
mov eax, dword [esp + 4]
mov dword [eax], 0
ret
mov eax, dword [0x10104094]
mov dword [ecx], eax
mov edx, dword [0x10104098]
mov eax, dword [esp + 4]
mov dword [ecx + 4], edx
mov dword [eax], 1
ret
mov edx, dword [0x10104094]
mov ecx, dword [esp + 0xc]
mov dword [ecx], edx
mov edx, dword [0x10104098]
test al, 0x10
mov dword [ecx + 4], edx
lea eax, [esp + 8]
mov dword [esp + 8], 3
jne 0x1008c8a8
mov dword [esp + 8], 2
mov ecx, dword [eax]
mov eax, dword [esp + 4]
mov dword [eax], ecx
ret
Function at 0x1008c8c0
Capabilities:
Delete directory

Disassembly:
mov eax, dword [esp + 4]
cmp dword [eax + 0x18], 8
jb 0x1008c8db
mov eax, dword [eax + 4]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
neg eax
sbb eax, eax
neg eax
ret
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
neg eax
sbb eax, eax
neg eax
ret

Function at 0x1008c8f0
Capabilities:
Delete file

Disassembly:
mov eax, dword [esp + 4]
cmp dword [eax + 0x18], 8
jb 0x1008c90b
mov eax, dword [eax + 4]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
neg eax
sbb eax, eax
neg eax
ret
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
neg eax
sbb eax, eax
neg eax
ret

Function at 0x1008c940
Capabilities:
Move file

Disassembly:
mov eax, dword [esp + 0xc]
mov edx, 8
cmp dword [eax + 0x18], edx
jb 0x1008c953
mov ecx, dword [eax + 4]
jmp 0x1008c956
lea ecx, [eax + 4]
mov eax, dword [esp + 8]
cmp dword [eax + 0x18], edx
jb 0x1008c964
mov eax, dword [eax + 4]
jmp 0x1008c967
add eax, 4
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x1008c985
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], ecx
mov ecx, dword [0x1010408c]
mov dword [eax + 4], ecx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
mov eax, dword [esp + 4]
mov dword [eax], ecx
mov ecx, dword [0x1010408c]
mov dword [eax + 4], ecx
ret

Function at 0x1008c9a0
Capabilities:
Create directory

Disassembly:
sub esp, 8
push ebp
push esi
push edi
xor esi, esi
call fcn.1008cc10
mov ebp, eax
mov dword [esp + 0xc], esi
call fcn.1008cc10
mov edi, dword [esp + 0x1c]
cmp dword [edi + 0x18], 8
mov dword [esp + 0x10], eax
jb 0x1008c9cb
mov eax, dword [edi + 4]
jmp 0x1008c9ce
lea eax, [edi + 4]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x1008c9ef
mov eax, dword [esp + 0x18]
pop edi
mov dword [eax], esi
pop esi
mov dword [eax + 4], ebp
mov byte [eax + 8], 1
pop ebp
add esp, 8
ret
mov ebp, dword [0x1010408c]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, 0xb7
jne 0x1008ca3f
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x20]
push edi
push ecx
call fcn.1008c7e0
add esp, 0xc
cmp dword [esp + 0x1c], 3
jne 0x1008ca3f
mov eax, dword [esp + 0x18]
mov edx, dword [0x10104094]
mov ecx, dword [0x10104098]
pop edi
pop esi
mov dword [eax], edx
mov dword [eax + 4], ecx
mov byte [eax + 8], 0
pop ebp
add esp, 8
ret
mov eax, dword [esp + 0x18]
pop edi
mov dword [eax], esi
pop esi
mov dword [eax + 4], ebp
mov byte [eax + 8], 0
pop ebp
add esp, 8
ret

Function at 0x1008db44
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100f6f50]
jne 0x1008db4e
repz ret
jmp fcn.100980b8
Function at 0x100a8a3e
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.1009879f
and dword [ebp - 4], 0
cmp dword [0x10104c7c], 0
mov ebx, eax
jne 0x100a8aef
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x100a8ba0
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x100a8ba0
push eax
call fcn.1009872d
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x10104c7c], eax
call esi
push eax
call fcn.1009872d
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x10104c80], eax
call esi
push eax
call fcn.1009872d
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x10104c84], eax
call esi
push eax
call fcn.1009872d
pop ecx
mov dword [0x10104c8c], eax
test eax, eax
je 0x100a8aef
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.1009872d
pop ecx
mov dword [0x10104c88], eax
mov eax, dword [0x10104c88]
cmp eax, ebx
je 0x100a8b47
cmp dword [0x10104c8c], ebx
je 0x100a8b47
push eax
call fcn.100987a8
push dword [0x10104c8c]
mov esi, eax
call fcn.100987a8
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x100a8b47
test edi, edi
je 0x100a8b47
call esi
test eax, eax
je 0x100a8b3e
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x100a8b3e
test byte [ebp - 0xc], 1
jne 0x100a8b47
or dword [ebp + 0x10], 0x200000
jmp 0x100a8b80
mov eax, dword [0x10104c80]
cmp eax, ebx
je 0x100a8b80
push eax
call fcn.100987a8
pop ecx
test eax, eax
je 0x100a8b80
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x100a8b80
mov eax, dword [0x10104c84]
cmp eax, ebx
je 0x100a8b80
push eax
call fcn.100987a8
pop ecx
test eax, eax
je 0x100a8b80
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x10104c7c]
call fcn.100987a8
pop ecx
test eax, eax
je 0x100a8ba0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x100a8ba2
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x100add60
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi]
test eax, eax
jne 0x100add7e
push eax
push 0x2f5
push 0x100cb114
push 0xe0e00000
call fcn.10001ed0
mov ecx, dword [esp + 8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x100addc4
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp edi, 5
jne 0x100addb2
mov esi, dword [esi]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x100addb2
pop edi
xor al, al
pop esi
ret 4
push 0
push 0x303
push 0x100cb114
push edi
call fcn.100614f0
mov al, 1
pop esi
ret 4
Function at 0x100af390
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push 0xffffffffffffffff
push 0x100b4448
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x100f6f50]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov eax, dword [0x10104cac]
test eax, eax
jne 0x100af3c2
xor esi, esi
jmp 0x100af3cb
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
mov dword [esp + 0x14], esi
mov ebp, dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [esp + 0x20], 0
test esi, esi
je 0x100af40d
cmp dword [esi + 0x14], 0
jne 0x100af44f
cmp dword [esi + 0x10], 0
jne 0x100af455
push 0x100af100
push 0x10104ca8
call fcn.100af2e0
mov eax, dword [0x10104cac]
add esp, 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [esp + 0x20], 0xffffffff
test esi, esi
je 0x100af43b
lea ecx, [esi + 4]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x100af43b
mov eax, dword [esi]
mov edx, dword [eax]
push 0
mov ecx, esi
call edx
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebp
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
cmp dword [esi + 0x10], 0
je 0x100af495
mov ebx, dword [esi + 0x10]
mov eax, dword [ebx + 4]
mov dword [esi + 0x10], eax
mov ecx, dword [ebx]
test ecx, ecx
je 0x100af483
mov edx, dword [ecx]
mov eax, dword [edx + 4]
call eax
mov edi, dword [ebx]
mov edx, dword [edi]
mov eax, dword [edx]
push 0
mov ecx, edi
call eax
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebp
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebp
cmp dword [esi + 0x10], 0
jne 0x100af455
cmp dword [esi + 0x14], 0
je 0x100af3e7
mov edi, dword [esi + 0x14]
mov ecx, dword [edi + 0x10]
mov dword [esi + 0x14], ecx
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x100af4ba
mov edx, dword [ecx]
mov eax, dword [edi + 0xc]
mov edx, dword [edx + 4]
push eax
call edx
mov ebx, dword [edi + 8]
test ebx, ebx
je 0x100af4eb
lea eax, [ebx + 4]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x100af4eb
mov edx, dword [ebx]
mov eax, dword [edx + 4]
mov ecx, ebx
call eax
lea ecx, [ebx + 8]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x100af4eb
mov eax, dword [ebx]
mov edx, dword [eax + 8]
mov ecx, ebx
call edx
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebp
cmp dword [esi + 0x14], 0
jne 0x100af49f
jmp 0x100af3e1
jmp 0x100af390
Function at 0x100af510
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push 0xffffffffffffffff
push 0x100b4448
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x100f6f50]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov eax, dword [0x10104cac]
test eax, eax
jne 0x100af3c2
xor esi, esi
jmp 0x100af3cb
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
mov dword [esp + 0x14], esi
mov ebp, dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [esp + 0x20], 0
test esi, esi
je 0x100af40d
cmp dword [esi + 0x14], 0
jne 0x100af44f
cmp dword [esi + 0x10], 0
jne 0x100af455
push 0x100af100
push 0x10104ca8
call fcn.100af2e0
mov eax, dword [0x10104cac]
add esp, 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [esp + 0x20], 0xffffffff
test esi, esi
je 0x100af43b
lea ecx, [esi + 4]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x100af43b
mov eax, dword [esi]
mov edx, dword [eax]
push 0
mov ecx, esi
call edx
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebp
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
cmp dword [esi + 0x10], 0
je 0x100af495
mov ebx, dword [esi + 0x10]
mov eax, dword [ebx + 4]
mov dword [esi + 0x10], eax
mov ecx, dword [ebx]
test ecx, ecx
je 0x100af483
mov edx, dword [ecx]
mov eax, dword [edx + 4]
call eax
mov edi, dword [ebx]
mov edx, dword [edi]
mov eax, dword [edx]
push 0
mov ecx, edi
call eax
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebp
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebp
cmp dword [esi + 0x10], 0
jne 0x100af455
cmp dword [esi + 0x14], 0
je 0x100af3e7
mov edi, dword [esi + 0x14]
mov ecx, dword [edi + 0x10]
mov dword [esi + 0x14], ecx
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x100af4ba
mov edx, dword [ecx]
mov eax, dword [edi + 0xc]
mov edx, dword [edx + 4]
push eax
call edx
mov ebx, dword [edi + 8]
test ebx, ebx
je 0x100af4eb
lea eax, [ebx + 4]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x100af4eb
mov edx, dword [ebx]
mov eax, dword [edx + 4]
mov ecx, ebx
call eax
lea ecx, [ebx + 8]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x100af4eb
mov eax, dword [ebx]
mov edx, dword [eax + 8]
mov ecx, ebx
call edx
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebp
cmp dword [esi + 0x14], 0
jne 0x100af49f
jmp 0x100af3e1
jmp 0x100af390
Function at 0x7ffe536d
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov eax, dword fs:[0x30]
stc
pushal
inc eax
popal
nop
pushal
inc eax
popal
clc
lea esp, [esp]
clc
lea esp, [esp]
nop
and bh, 0xff
cld
and bh, 0xff
stc
add eax, 0
nop
pushal
inc eax
popal
cld
push edx
cdq
pop edx
cld
lea esp, [esp]
cld
add eax, 0
stc
and bh, 0xff
cld
lea esp, [esp]
cld
and bh, 0xff
cld
push edx
cdq
pop edx
cld
lea esp, [esp]
stc
push edx
cdq
pop edx
nop
add eax, 0
stc
push edx
cdq
pop edx
cld
add eax, 0
cld
pushal
inc eax
popal
stc
and bh, 0xff
clc
add eax, 0
cld
pushal
inc eax
popal
clc
add eax, 0
cld
and bh, 0xff
clc
and bh, 0xff
cld
push edx
cdq
pop edx
cld
lea esp, [esp]
cld
add eax, 0
cld
pushal
inc eax
popal
cld
pushal
inc eax
popal
cld
push edx
cdq
pop edx
clc
nop
cld
cld
call 0x7ffe5400
pop edx
and bh, 0xff
xor dx, dx
pushal
inc eax
popal
lea esp, [esp]
add edx, 0xd5e0
stc
xor ecx, ecx
cld
inc esi
dec esi
clc
mov cl, 0x1e
push edx
cdq
pop edx
nop
stc
clc
clc
xor byte [ecx + edx], 0xd0
loop 0x7ffe5423
clc
pushal
inc eax
popal
cld
lea esp, [esp]
clc
nop
push dword fs:[0x24]
cld
push edx
cdq
pop edx
cld
add eax, 0
cld
pop dword [edx + 0xa]
add eax, 0
clc
pushal
inc eax
popal
cld
mov cl, 0xff
push es
pop ds
nop
push edx
loop 0x7ffe5453
stc
cld
mov dword [edx + 0x11], 0xffffacbb
pushal
inc eax
popal
stc
add eax, 0
cld
clc
mov ecx, dword [eax + 0x2c]
stc
push edx
cdq
pop edx
nop
cld
cld
nop
mov dword [edx + 0x1b], ecx
inc esi
dec esi
nop
mov dword [edx + 0x100], ecx
stc
nop
mov dword [eax + 0x2c], esp
nop
pushal
inc eax
popal
nop
push 0
and bh, 0xff
clc
push 0
and bh, 0xff
cld
and bh, 0xff
clc
push edx
cdq
pop edx
push 0
cld
and bh, 0xff
nop
and bh, 0xff
cld
clc
push 0
cld
and bh, 0xff
stc
push 0x30
push 0x20
and bh, 0xff
push 0
cld
add eax, 0
cld
add eax, 0
cld
cld
push 0
cld
add edx, 0xffff7f35
and bh, 0xff
stc
pushal
inc eax
popal
clc
push edx
pushal
inc eax
popal
stc
and bh, 0xff
clc
inc esi
dec esi
cld
push edx
push edx
cdq
pop edx
nop
pushal
inc eax
popal
push es
pop ds
clc
push 0
nop
add eax, 0
cld
call dword [edx + 0x820e]
pushal
inc eax
popal
clc
add eax, 0
clc
add esp, 0x3f8
push edx
cdq
pop edx
cld
lea esp, [esp]
xor eax, eax
cld
cld
inc eax
nop
ret 0xc