joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100164a2
Capabilities:
Set thread local storage value

Disassembly:
test ebx, ebx
je 0x100164b8
mov eax, dword [0x1005aae4]
test eax, eax
js 0x100164b8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push esi
push str.LoadLibraryExW__ls________p:_x_n
push 1
call fcn.1001b460
add esp, 0x14
test edi, edi
je 0x10016512
mov ecx, edi
call fcn.1001b740
mov esi, eax
test esi, esi
je 0x10016512
push 0x104
lea eax, [ebp - 0x22c]
push eax
push edi
call dword [0x10089890]
test eax, eax
je 0x10016512
push dword [esi + 0x58]
lea eax, [ebp - 0x22c]
push eax
push edi
push str.__08lx:___43.43ls__08x_n
push 0x60
call fcn.10029910
add esp, 0x14
ret

Function at 0x100166d7
Capabilities:
Set thread local storage value

Disassembly:
test edi, edi
je 0x100166ed
mov eax, dword [0x1005aae4]
test eax, eax
js 0x100166ed
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ebx
push esi
push str.LoadLibraryA__hs______p:_x_n
push 1
call fcn.1001b460
add esp, 0x14
test ebx, ebx
je 0x10016747
mov ecx, ebx
call fcn.1001b740
mov esi, eax
test esi, esi
je 0x10016747
push 0x104
lea eax, [ebp - 0x22c]
push eax
push ebx
call dword [0x10089890]
test eax, eax
je 0x10016747
push dword [esi + 0x58]
lea eax, [ebp - 0x22c]
push eax
push ebx
push str.__08lx:___43.43ls__08x_n
push 0x60
call fcn.10029910
add esp, 0x14
ret

Function at 0x10016908
Capabilities:
Set thread local storage value

Disassembly:
test edi, edi
je 0x1001691e
mov eax, dword [0x1005aae4]
test eax, eax
js 0x1001691e
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ebx
push esi
push str.LoadLibraryW__ls______p:_x_n
push 1
call fcn.1001b460
add esp, 0x14
test ebx, ebx
je 0x10016978
mov ecx, ebx
call fcn.1001b740
mov esi, eax
test esi, esi
je 0x10016978
push 0x104
lea eax, [ebp - 0x22c]
push eax
push ebx
call dword [0x10089890]
test eax, eax
je 0x10016978
push dword [esi + 0x58]
lea eax, [ebp - 0x22c]
push eax
push ebx
push str.__08lx:___43.43ls__08x_n
push 0x60
call fcn.10029910
add esp, 0x14
ret

Function at 0x10016b66
Capabilities:
Set thread local storage value

Disassembly:
test ebx, ebx
je 0x10016b7c
mov eax, dword [0x1005aae4]
test eax, eax
js 0x10016b7c
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push esi
push str.LoadMUILibraryA__hs________p:_x_n
push 1
call fcn.1001b460
add esp, 0x14
test edi, edi
je 0x10016bd6
mov ecx, edi
call fcn.1001b740
mov esi, eax
test esi, esi
je 0x10016bd6
push 0x104
lea eax, [ebp - 0x22c]
push eax
push edi
call dword [0x10089890]
test eax, eax
je 0x10016bd6
push dword [esi + 0x58]
lea eax, [ebp - 0x22c]
push eax
push edi
push str.__08lx:___43.43ls__08x_n
push 0x60
call fcn.10029910
add esp, 0x14
ret
Function at 0x10016dc7
Capabilities:
Set thread local storage value

Disassembly:
test ebx, ebx
je 0x10016ddd
mov eax, dword [0x1005aae4]
test eax, eax
js 0x10016ddd
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push esi
push str.LoadMUILibraryW__ls________p:_x_n
push 1
call fcn.1001b460
add esp, 0x14
test edi, edi
je 0x10016e37
mov ecx, edi
call fcn.1001b740
mov esi, eax
test esi, esi
je 0x10016e37
push 0x104
lea eax, [ebp - 0x22c]
push eax
push edi
call dword [0x10089890]
test eax, eax
je 0x10016e37
push dword [esi + 0x58]
lea eax, [ebp - 0x22c]
push eax
push edi
push str.__08lx:___43.43ls__08x_n
push 0x60
call fcn.10029910
add esp, 0x14
ret
Function at 0x10017f60
Capabilities:
Create udp socket
Get socket status
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x234
mov eax, dword [0x1005a014]
xor eax, esp
mov dword [esp + 0x230], eax
mov eax, dword [ebp + 0x10]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 0
push 2
push 2
mov dword [esp + 0x18], eax
call dword [sym.imp.WS2_32.dll_socket]
mov edi, eax
xorps xmm0, xmm0
mov eax, 2
mov dword [esp + 0x10], edi
push esi
movlpd qword [esp + 0x2c], xmm0
mov word [esp + 0x24], ax
call dword [sym.imp.WS2_32.dll_inet_addr]
push dword [ebp + 0xc]
mov dword [esp + 0x28], eax
call dword [sym.imp.WS2_32.dll_htons]
mov word [esp + 0x22], ax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [esp + 0xc]
xor ebx, ebx
mov dword [esp + 0x139], eax
test edx, edx
je 0x10018045
cmp byte [edx], bl
je 0x10018045
mov ebx, edx
lea ecx, [ebx + 1]
mov al, byte [ebx]
inc ebx
test al, al
jne 0x10017fe5
sub ebx, ecx
test ebx, ebx
jle 0x1001803b
cmp ebx, 0xfa
jge 0x10018016
push ebx
push edx
lea eax, [esp + 0x146]
push eax
call fcn.1002e510
add esp, 0xc
mov byte [esp + ebx + 0x13e], 0
jmp 0x10018045
mov ecx, 0x3e
lea edi, [esp + 0x13e]
mov esi, edx
mov ebx, 0xf9
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov edi, dword [esp + 0x10]
mov byte [esp + 0x237], 0
jmp 0x10018045
mov byte [esp + 0x13e], 0
xor ebx, ebx
push 0x10
lea eax, [ebx + 6]
mov byte [esp + 0x141], bl
mov byte [esp + 0x13c], al
or esi, 0xffffffff
lea eax, [esp + 0x24]
push eax
push 0
lea eax, [ebx + 6]
push eax
lea eax, [esp + 0x148]
push eax
push edi
call dword [sym.imp.WS2_32.dll_sendto]
test eax, eax
jle 0x10018101
lea eax, [esp + 0x18]
mov dword [esp + 0x34], edi
push eax
push 0
push 0
lea eax, [esp + 0x3c]
mov dword [esp + 0x3c], 1
push eax
lea eax, [edi + 1]
mov dword [esp + 0x28], 3
push eax
mov dword [esp + 0x30], 0
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
jle 0x10018101
lea eax, [esp + 0x30]
push eax
push edi
call dword [sym.imp.WS2_32.dll___WSAFDIsSet]
test eax, eax
je 0x10018101
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x10
push eax
lea eax, [esp + 0x24]
push eax
push 0
push 0x100
lea eax, [esp + 0x148]
push eax
push edi
call dword [sym.imp.WS2_32.dll_recvfrom]
cmp eax, 5
jl 0x10018101
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
sub esi, dword [esp + 0x139]
push edi
call dword [sym.imp.WS2_32.dll_closesocket]
mov ecx, dword [esp + 0x23c]
mov eax, esi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1002bcfe
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1001b2e0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40c
mov eax, dword [0x1005a014]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
je 0x1001b443
push 0
call fcn.100297e0
add esp, 4
test eax, eax
je 0x1001b443
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x1005aaec]
xor edi, edi
mov esi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
xor ebx, ebx
mov dword [ebp - 0x40c], eax
test ecx, ecx
js 0x1001b347
push ecx
call esi
mov edi, eax
lea ecx, [edi + 1]
push ecx
push dword [0x1005aaec]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [0x1005aaf0]
test eax, eax
js 0x1001b355
push eax
call esi
mov ebx, eax
cmp dword [0x1005aae8], 0
je 0x1001b434
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x1001b434
test edi, edi
jle 0x1001b381
cmp edi, 0x23
jge 0x1001b37a
add edi, edi
jmp 0x1001b383
mov edi, 0x46
jmp 0x1001b383
xor edi, edi
mov eax, 0x51eb851f
mov byte [ebp - 0x401], 0x20
imul ebx
mov ecx, 0xa
sar edx, 5
mov eax, edx
mov dword [ebp - 0x408], ecx
shr eax, 0x1f
add eax, edx
cdq
idiv ecx
mov eax, 0x66666667
add dl, 0x30
mov byte [ebp - 0x404], dl
imul ebx
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, ecx
cdq
idiv dword [ebp - 0x408]
mov al, cl
shl cl, 2
add al, cl
add dl, 0x30
add al, al
mov byte [ebp - 0x403], dl
sub bl, al
lea eax, [ebp - 0x400]
add bl, 0x30
mov byte [ebp - 0x402], bl
test edi, edi
jle 0x1001b407
push edi
push 0x20
push eax
call fcn.1002ea90
lea eax, [ebp - 0x400]
add esp, 0xc
add eax, edi
mov cl, byte [esi]
inc esi
mov byte [eax], cl
inc eax
mov dword [ebp + 0xc], esi
test cl, cl
je 0x1001b41b
lea ecx, [ebp - 5]
cmp eax, ecx
jb 0x1001b407
lea eax, [ebp + 0x10]
mov byte [ebp - 5], 0
push eax
lea eax, [ebp - 0x404]
push eax
push 0x60
call fcn.10029940
add esp, 0xc
push dword [ebp - 0x40c]
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002bcfe
mov esp, ebp
pop ebp
ret
Function at 0x1001b460
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40c
mov eax, dword [0x1005a014]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
je 0x1001b5c1
push 0
call fcn.100297e0
add esp, 4
test eax, eax
je 0x1001b5c1
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x1005aaec]
xor edi, edi
mov esi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
xor ebx, ebx
mov dword [ebp - 0x40c], eax
test ecx, ecx
js 0x1001b4c5
push ecx
call esi
lea edi, [eax - 1]
push edi
push dword [0x1005aaec]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [0x1005aaf0]
test eax, eax
js 0x1001b4d3
push eax
call esi
mov ebx, eax
cmp dword [0x1005aae8], 0
je 0x1001b5b2
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x1001b5b2
test edi, edi
jle 0x1001b4ff
cmp edi, 0x23
jge 0x1001b4f8
add edi, edi
jmp 0x1001b501
mov edi, 0x46
jmp 0x1001b501
xor edi, edi
mov eax, 0x51eb851f
mov byte [ebp - 0x401], 0x20
imul ebx
mov ecx, 0xa
sar edx, 5
mov eax, edx
mov dword [ebp - 0x408], ecx
shr eax, 0x1f
add eax, edx
cdq
idiv ecx
mov eax, 0x66666667
add dl, 0x30
mov byte [ebp - 0x404], dl
imul ebx
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, ecx
cdq
idiv dword [ebp - 0x408]
mov al, cl
shl cl, 2
add al, cl
add dl, 0x30
add al, al
mov byte [ebp - 0x403], dl
sub bl, al
lea eax, [ebp - 0x400]
add bl, 0x30
mov byte [ebp - 0x402], bl
test edi, edi
jle 0x1001b585
push edi
push 0x20
push eax
call fcn.1002ea90
lea eax, [ebp - 0x400]
add esp, 0xc
add eax, edi
mov cl, byte [esi]
inc esi
mov byte [eax], cl
inc eax
mov dword [ebp + 0xc], esi
test cl, cl
je 0x1001b599
lea ecx, [ebp - 5]
cmp eax, ecx
jb 0x1001b585
lea eax, [ebp + 0x10]
mov byte [ebp - 5], 0
push eax
lea eax, [ebp - 0x404]
push eax
push 0x60
call fcn.10029940
add esp, 0xc
push dword [ebp - 0x40c]
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002bcfe
mov esp, ebp
pop ebp
ret
Function at 0x1001b5d0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40c
mov eax, dword [0x1005a014]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
je 0x1001b723
push 0
call fcn.100297e0
add esp, 4
test eax, eax
je 0x1001b723
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x1005aaec]
xor edi, edi
mov esi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
xor ebx, ebx
mov dword [ebp - 0x40c], eax
test ecx, ecx
js 0x1001b627
push ecx
call esi
mov edi, eax
mov eax, dword [0x1005aaf0]
test eax, eax
js 0x1001b635
push eax
call esi
mov ebx, eax
cmp dword [0x1005aae8], 0
je 0x1001b714
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x1001b714
test edi, edi
jle 0x1001b661
cmp edi, 0x23
jge 0x1001b65a
add edi, edi
jmp 0x1001b663
mov edi, 0x46
jmp 0x1001b663
xor edi, edi
mov eax, 0x51eb851f
mov byte [ebp - 0x401], 0x20
imul ebx
mov ecx, 0xa
sar edx, 5
mov eax, edx
mov dword [ebp - 0x408], ecx
shr eax, 0x1f
add eax, edx
cdq
idiv ecx
mov eax, 0x66666667
add dl, 0x30
mov byte [ebp - 0x404], dl
imul ebx
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, ecx
cdq
idiv dword [ebp - 0x408]
mov al, cl
shl cl, 2
add al, cl
add dl, 0x30
add al, al
mov byte [ebp - 0x403], dl
sub bl, al
lea eax, [ebp - 0x400]
add bl, 0x30
mov byte [ebp - 0x402], bl
test edi, edi
jle 0x1001b6e7
push edi
push 0x20
push eax
call fcn.1002ea90
lea eax, [ebp - 0x400]
add esp, 0xc
add eax, edi
mov cl, byte [esi]
inc esi
mov byte [eax], cl
inc eax
mov dword [ebp + 0xc], esi
test cl, cl
je 0x1001b6fb
lea ecx, [ebp - 5]
cmp eax, ecx
jb 0x1001b6e7
lea eax, [ebp + 0x10]
mov byte [ebp - 5], 0
push eax
lea eax, [ebp - 0x404]
push eax
push 0x60
call fcn.10029940
add esp, 0xc
push dword [ebp - 0x40c]
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002bcfe
mov esp, ebp
pop ebp
ret
Function at 0x1001b860
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x1005aaec]
sub esp, 0x14
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_TlsSetValue]
push edi
test eax, eax
js 0x1001b87d
push 0
push eax
call esi
mov eax, dword [0x1005aaf0]
test eax, eax
js 0x1001b88b
push 0
push eax
call esi
mov eax, dword [0x1005aae4]
test eax, eax
js 0x1001b899
push 0
push eax
call esi
mov dword [0x1005aae8], 0
or eax, 0xffffffff
mov ecx, section.Shared
lock xadd dword [ecx], eax
dec eax
push eax
push str._instance_count:__ld_n
push 0x60
call fcn.10029910
add esp, 0xc
call fcn.10019e20
test eax, eax
je 0x1001b8d9
push eax
push str._Error_detaching_detours:__d_n
push 0
call fcn.10029910
add esp, 0xc
push str._Closing._n
push 0x50
call fcn.10029910
push 0
call fcn.10029960
mov eax, dword [0x1005aaec]
add esp, 0xc
mov esi, dword [sym.imp.KERNEL32.dll_TlsFree]
test eax, eax
js 0x1001b901
push eax
call esi
mov eax, dword [0x1005aaf0]
test eax, eax
js 0x1001b90d
push eax
call esi
mov eax, dword [0x1005aae4]
test eax, eax
js 0x1001b919
push eax
call esi
lea ecx, [ebp - 0x14]
call fcn.100111d0
mov esi, dword [ebp - 0xc]
mov edi, dword [0x10064fd8]
mov ebx, dword [ebp - 0x10]
mov dword [ebp - 4], edi
test esi, esi
je 0x1001ba16
push 0xffffffffffffffff
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor edx, edx
mov eax, edi
div dword [esi]
mov edi, dword [esi + 8]
xor ecx, ecx
add edi, 0xc
mov eax, edi
imul eax, dword [esi]
lea edx, [edx*4 + 0xc]
mov dword [ebp - 8], edx
add eax, edx
mov edx, dword [eax + esi]
test edx, edx
jle 0x1001ba08
nop dword [eax + eax]
mov ebx, dword [ebp - 4]
mov eax, edi
imul eax, edx
cmp dword [eax + esi + 0xc], ebx
mov ebx, dword [ebp - 0x10]
je 0x1001b98d
mov ecx, edx
mov edx, dword [eax + esi + 0x14]
test edx, edx
jg 0x1001b970
jmp 0x1001ba08
imul edi, edx
mov dword [edi + esi + 0xc], 0
mov eax, dword [esi + 8]
add eax, 0xc
imul eax, edx
mov dword [eax + esi + 0x10], 0
mov eax, edx
mov edi, dword [esi + 8]
add edi, 0xc
imul eax, edi
mov eax, dword [eax + esi + 0x14]
test ecx, ecx
jne 0x1001b9c9
mov ecx, dword [esi]
imul ecx, edi
add ecx, dword [ebp - 8]
mov dword [ecx + esi], eax
jmp 0x1001b9d0
imul edi, ecx
mov dword [edi + esi + 0x14], eax
mov ecx, dword [esi + 8]
mov eax, dword [esi + 0x14]
add ecx, 0xc
imul ecx, edx
mov dword [ecx + esi + 0x14], eax
mov dword [esi + 0x14], edx
mov ecx, dword [esi + 4]
cmp edx, ecx
jne 0x1001ba08
test ecx, ecx
jle 0x1001ba08
nop
mov eax, dword [esi + 8]
add eax, 0xc
imul eax, ecx
cmp dword [eax + esi + 0xc], 0
jne 0x1001ba08
dec ecx
mov dword [esi + 4], ecx
test ecx, ecx
jg 0x1001b9f0
push ebx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, dword [ebp - 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x1001ba26
push eax
call esi
test ebx, ebx
je 0x1001ba2d
push ebx
call esi
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001ba40
Capabilities:
Allocate thread local storage
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x1005a014]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
call fcn.10025680
test eax, eax
jne case.default.0x1001ba78
mov ecx, edi
call fcn.1000c850
mov eax, dword [ebp + 0xc]
cmp eax, 3
ja case.default.0x1001ba78
jmp dword [eax*4 + 0x1001bc94]
push ebx
call fcn.10028760
mov ebx, 1
mov eax, section.Shared
lock xadd dword [eax], ebx
mov esi, dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x1005aae8], 0
call esi
mov dword [0x1005aaec], eax
call esi
mov dword [0x1005aaf0], eax
call esi
push 0x104
push 0x1008a070
push edi
mov dword [0x1005aae4], eax
mov dword [0x1008a068], edi
call dword [0x1008988c]
push 0x50
push str.vthook32
call fcn.10029740
push str._Binaries_n
push 0x60
call fcn.10029910
add esp, 0x10
push 0
call fcn.10028290
mov esi, eax
test esi, esi
je 0x1001bb41
mov ecx, esi
call fcn.1001b740
mov edi, eax
test edi, edi
je 0x1001bb35
push 0x104
lea eax, [ebp - 0x20c]
push eax
push esi
call dword [0x10089890]
test eax, eax
je 0x1001bb35
push dword [edi + 0x58]
lea eax, [ebp - 0x20c]
push eax
push esi
push str.__08lx:___43.43ls__08x_n
push 0x60
call fcn.10029910
add esp, 0x14
push esi
call fcn.10028290
mov esi, eax
test esi, esi
jne 0x1001baf7
push 0x1008a070
push str._attaching_dll:__s_n
push 0x60
call fcn.10029910
push str.00:11:41
push str.Apr_24_2023
push str.version:__s__s_n
push 0x60
call fcn.10029910
add esp, 0x1c
call fcn.10018520
test eax, eax
je 0x1001bb84
push eax
push str._Error_attaching_detours:__d_n
push 0
call fcn.10029910
add esp, 0xc
mov eax, dword [0x1005aaec]
mov esi, dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
js 0x1001bb98
push 0
push eax
call esi
cmp dword [0x1005aaf0], 0
jl 0x1001bbb8
mov eax, 1
lock xadd dword [0x1008a298], eax
inc eax
push eax
push dword [0x1005aaf0]
call esi
mov eax, dword [0x1005aae4]
test eax, eax
js 0x1001bbc6
push 0
push eax
call esi
push 0x1008a178
lea ecx, [ebx + 1]
mov dword [0x1005aae8], 1
push ecx
push str._instance_count:__ld__s_n
push 0x60
call fcn.10029910
add esp, 0x10
pop ebx
jmp case.default.0x1001ba78
call fcn.1001b860
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002bcfe
mov esp, ebp
pop ebp
ret 0xc
cmp dword [0x10064fd4], 0
jne 0x1001bc19
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [0x10064fd4], eax
mov eax, dword [0x1005aaec]
mov esi, dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
js 0x1001bc2d
push 0
push eax
call esi
cmp dword [0x1005aaf0], 0
jl 0x1001bc6f
mov eax, 1
lock xadd dword [0x1008a298], eax
inc eax
push eax
push dword [0x1005aaf0]
jmp 0x1001bc6d
mov eax, dword [0x1005aaec]
mov esi, dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
js 0x1001bc61
push 0
push eax
call esi
mov eax, dword [0x1005aaf0]
test eax, eax
js 0x1001bc6f
push 0
push eax
call esi
mov eax, dword [0x1005aae4]
test eax, eax
js case.default.0x1001ba78
push 0
push eax
call esi
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
xor ecx, ebp
pop esi
call fcn.1002bcfe
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10023d80
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
mov eax, dword [0x1005a014]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0
jne 0x10023daa
push 0x57
call sub.KERNEL32.dll_SetLastError
xor eax, eax
jmp 0x10023e5e
push 0x1c
push 0
lea ecx, [ebp - 0x64]
push ecx
call fcn.1002ea90
add esp, 0xc
push 0x1c
lea edx, [ebp - 0x64]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call sub.KERNEL32.dll_VirtualQueryEx
test eax, eax
jne 0x10023dd8
xor eax, eax
jmp 0x10023e5e
push 0
push 0x40
lea edx, [ebp - 0x44]
push edx
mov eax, dword [ebp - 0x48]
push eax
mov ecx, dword [ebp + 8]
push ecx
call sub.KERNEL32.dll_ReadProcessMemory
test eax, eax
jne 0x10023df5
xor eax, eax
jmp 0x10023e5e
movzx edx, word [ebp - 0x44]
cmp edx, 0x5a4d
jne 0x10023e0f
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x58]
ja 0x10023e0f
cmp dword [ebp - 8], 0x40
jae 0x10023e1d
push 0xc1
call sub.KERNEL32.dll_SetLastError
xor eax, eax
jmp 0x10023e5e
push 0
push 0xf8
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0x48]
add edx, dword [ebp - 8]
push edx
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.dll_ReadProcessMemory
test eax, eax
jne 0x10023e40
xor eax, eax
jmp 0x10023e5e
mov ecx, dword [ebp + 0x10]
cmp dword [ecx], 0x4550
je 0x10023e59
push 0xc1
call sub.KERNEL32.dll_SetLastError
xor eax, eax
jmp 0x10023e5e
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002bcfe
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100252d0
Capabilities:
Resume thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [ebp + 0x34], 0
jne 0x100252e3
mov dword [ebp + 0x34], 0x1002bbf6
cmp dword [ebp + 0x2c], 0
jne 0x100252ff
lea eax, [ebp - 0x14]
mov dword [ebp + 0x2c], eax
push 0x10
push 0
lea ecx, [ebp - 0x14]
push ecx
call fcn.1002ea90
add esp, 0xc
mov edx, dword [ebp + 0x2c]
push edx
mov eax, dword [ebp + 0x28]
push eax
mov ecx, dword [ebp + 0x24]
push ecx
mov edx, dword [ebp + 0x20]
push edx
mov eax, dword [ebp + 0x1c]
or eax, 4
push eax
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp + 0x34]
test eax, eax
jne 0x10025338
xor eax, eax
jmp 0x100253cb
mov eax, dword [ebp + 0x30]
mov dword [ebp - 4], eax
push 1
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp + 0x2c]
mov eax, dword [edx]
push eax
call fcn.10025c50
test eax, eax
jne 0x10025393
mov ecx, dword [ebp + 0x34]
push ecx
mov edx, dword [ebp + 0x30]
push edx
mov eax, dword [ebp + 0x2c]
mov ecx, dword [eax + 8]
push ecx
call fcn.10025710
test eax, eax
jne 0x10025393
push 0xffffffffffffffff
mov edx, dword [ebp + 0x2c]
mov eax, dword [edx]
push eax
call sub.KERNEL32.dll_TerminateProcess
mov ecx, dword [ebp + 0x2c]
mov edx, dword [ecx]
push edx
call sub.KERNEL32.dll_CloseHandle
mov eax, dword [ebp + 0x2c]
mov ecx, dword [eax + 4]
push ecx
call sub.KERNEL32.dll_CloseHandle
xor eax, eax
jmp 0x100253cb
mov edx, dword [ebp + 0x1c]
and edx, 4
jne 0x100253a7
mov eax, dword [ebp + 0x2c]
mov ecx, dword [eax + 4]
push ecx
call sub.KERNEL32.dll_ResumeThread
lea edx, [ebp - 0x14]
cmp dword [ebp + 0x2c], edx
jne 0x100253c6
mov eax, dword [ebp + 0x2c]
mov ecx, dword [eax]
push ecx
call sub.KERNEL32.dll_CloseHandle
mov edx, dword [ebp + 0x2c]
mov eax, dword [edx + 4]
push eax
call sub.KERNEL32.dll_CloseHandle
mov eax, 1
mov esp, ebp
pop ebp
ret 0x30
Function at 0x100253e0
Capabilities:
Resume thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [ebp + 0x34], 0
jne 0x100253f3
mov dword [ebp + 0x34], 0x1002bbfc
cmp dword [ebp + 0x2c], 0
jne 0x1002540f
lea eax, [ebp - 0x14]
mov dword [ebp + 0x2c], eax
push 0x10
push 0
lea ecx, [ebp - 0x14]
push ecx
call fcn.1002ea90
add esp, 0xc
mov edx, dword [ebp + 0x2c]
push edx
mov eax, dword [ebp + 0x28]
push eax
mov ecx, dword [ebp + 0x24]
push ecx
mov edx, dword [ebp + 0x20]
push edx
mov eax, dword [ebp + 0x1c]
or eax, 4
push eax
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp + 0x34]
test eax, eax
jne 0x10025448
xor eax, eax
jmp 0x100254db
mov eax, dword [ebp + 0x30]
mov dword [ebp - 4], eax
push 1
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp + 0x2c]
mov eax, dword [edx]
push eax
call fcn.10025c50
test eax, eax
jne 0x100254a3
mov ecx, dword [ebp + 0x34]
push ecx
mov edx, dword [ebp + 0x30]
push edx
mov eax, dword [ebp + 0x2c]
mov ecx, dword [eax + 8]
push ecx
call fcn.10025c30
test eax, eax
jne 0x100254a3
push 0xffffffffffffffff
mov edx, dword [ebp + 0x2c]
mov eax, dword [edx]
push eax
call sub.KERNEL32.dll_TerminateProcess
mov ecx, dword [ebp + 0x2c]
mov edx, dword [ecx]
push edx
call sub.KERNEL32.dll_CloseHandle
mov eax, dword [ebp + 0x2c]
mov ecx, dword [eax + 4]
push ecx
call sub.KERNEL32.dll_CloseHandle
xor eax, eax
jmp 0x100254db
mov edx, dword [ebp + 0x1c]
and edx, 4
jne 0x100254b7
mov eax, dword [ebp + 0x2c]
mov ecx, dword [eax + 4]
push ecx
call sub.KERNEL32.dll_ResumeThread
lea edx, [ebp - 0x14]
cmp dword [ebp + 0x2c], edx
jne 0x100254d6
mov eax, dword [ebp + 0x2c]
mov ecx, dword [eax]
push ecx
call sub.KERNEL32.dll_CloseHandle
mov edx, dword [ebp + 0x2c]
mov eax, dword [edx + 4]
push eax
call sub.KERNEL32.dll_CloseHandle
mov eax, 1
mov esp, ebp
pop ebp
ret 0x30