joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001b1a0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2b0
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x2ac], eax
mov eax, dword [ebp + 8]
lea edx, [esp + 0x210]
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x1001b1c6
push 0
lea eax, [esp + 8]
push eax
mov eax, dword [0x100278f8]
push 0x2a0
lea ecx, [esp + 0x14]
push ecx
push 0x2a0
mov edx, ecx
push edx
push 0x2201c8
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push eax
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
mov eax, 1
je 0x1001b216
mov eax, dword [esp + 0x296]
mov ecx, dword [esp + 0x2ac]
xor ecx, esp
call fcn.1000d340
mov esp, ebp
pop ebp
ret

Function at 0x1001b230
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2b0
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x2ac], eax
mov eax, dword [ebp + 8]
lea edx, [esp + 0x210]
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x1001b256
mov al, byte [ebp + 0xc]
push 0
lea ecx, [esp + 8]
push ecx
mov ecx, dword [0x100278f8]
push 0x2a0
lea edx, [esp + 0x14]
push edx
push 0x2a0
mov byte [esp + 0x2b7], al
mov eax, edx
push eax
push 0x2201c4
push ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push eax
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
mov eax, 1
je 0x1001b2b1
mov eax, dword [esp + 0x296]
mov ecx, dword [esp + 0x2ac]
xor ecx, esp
call fcn.1000d340
mov esp, ebp
pop ebp
ret

Function at 0x1001b2d0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2ac
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x2a8], eax
push esi
mov esi, dword [ebp + 8]
xor eax, eax
movzx ecx, word [eax + str.ArcNamemulti_0_disk_0_rdisk_0_partition_1_]
mov word [esp + eax + 0x210], cx
add eax, 2
test cx, cx
jne 0x1001b2f0
push 0
lea eax, [esp + 8]
push eax
mov eax, dword [0x100278f8]
push 0x2a0
lea ecx, [esp + 0x14]
push ecx
push 0x2a0
mov edx, ecx
push edx
push 0x2201d0
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push eax
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x1001b374
mov eax, dword [esp + 0x296]
test eax, eax
jne 0x1001b379
lea ecx, [esp + 0x210]
mov edx, ecx
sub esi, edx
movzx edx, word [ecx]
mov word [esi + ecx], dx
add ecx, 2
test dx, dx
jne 0x1001b352
pop esi
mov ecx, dword [esp + 0x2a8]
xor ecx, esp
call fcn.1000d340
mov esp, ebp
pop ebp
ret
mov eax, 1
mov ecx, dword [esp + 0x2ac]
pop esi
xor ecx, esp
call fcn.1000d340
mov esp, ebp
pop ebp
ret
Function at 0x1001b390
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2b0
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x2ac], eax
push ebx
mov ebx, dword [sym.imp.msvcrt.dll_wcschr]
push esi
mov esi, ecx
push 0x7d
push esi
call ebx
xor ecx, ecx
lea edx, [edi + 0x20c]
add esp, 8
mov word [eax + 2], cx
mov dword [esp + 8], edx
mov eax, esi
sub edx, esi
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x1001b3d0
push 0x7b
push esi
call ebx
push eax
push str.__Volume_s
lea edx, [esp + 0x228]
push 0x41
push edx
call dword [sym.imp.msvcrt.dll__snwprintf]
mov esi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
add esp, 0x18
push 0
lea eax, [esp + 0x10]
push eax
mov eax, dword [0x100278f8]
push 0x2a0
lea ecx, [esp + 0x1c]
push ecx
push 0x2a0
mov edx, ecx
push edx
push 0x2201d0
push eax
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push eax
call ebx
test eax, eax
je 0x1001b4d5
cmp dword [esp + 0x29e], 0
jne 0x1001b4d5
lea eax, [esp + 0x218]
lea edx, [edi + 4]
mov ecx, eax
sub edx, ecx
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x1001b456
push 0
lea edx, [esp + 0x10]
push edx
mov edx, dword [0x100278f8]
push 0x22c
lea eax, [edi + 0x414]
push eax
push 0x2a0
lea ecx, [esp + 0x24]
push ecx
push 0x2201ac
push edx
call esi
push eax
call ebx
test eax, eax
je 0x1001b4d5
cmp word [edi + 0x438], 0
lea edx, [edi + 0x438]
jne 0x1001b4bf
mov eax, dword [esp + 8]
sub edx, eax
lea ecx, [ecx]
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x1001b4b0
xor eax, eax
pop esi
pop ebx
mov ecx, dword [esp + 0x2ac]
xor ecx, esp
call fcn.1000d340
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x2b4]
pop esi
pop ebx
xor ecx, esp
mov eax, 1
call fcn.1000d340
mov esp, ebp
pop ebp
ret

Function at 0x1001b4f0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x100278f8]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x1001b538
push eax
push eax
push 3
push eax
push eax
push eax
push str..dcrypt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x1001b52a
mov eax, 0x591
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x100278f8]
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x14]
push 0
lea edx, [ebp - 4]
push edx
mov edx, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push ecx
mov ecx, dword [ebp + 8]
push edx
push eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x1001b568
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1001b5e0
Capabilities:
Allocate or change rwx memory
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push 0x40
push 0x3000
push 0x2a0
push 0
mov dword [ebp - 0xc], 0x2a0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x1001b683
mov eax, dword [0x100278f8]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x1001b643
push eax
push eax
push 3
push eax
push eax
push eax
push str..dcrypt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x1001b66d
mov ecx, dword [0x100278f8]
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push 0
lea edx, [ebp - 4]
push edx
push 0
push 0
push 8
lea eax, [ebp - 0x10]
push eax
push 0x2201f0
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x1001b67c
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x1001b67c
mov ecx, dword [ebp - 0x10]
push 0x2a0
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualLock]
mov ebx, dword [ebp - 0x10]
test ebx, ebx
jne 0x1001b68e
pop esi
mov eax, 9
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0x100278f8]
mov esi, dword [ebp + 8]
push edi
push 0
lea edx, [ebp - 8]
push edx
push 0x2a0
push ebx
push 0x2a0
push ebx
push 0x220194
mov ecx, 0x41
mov edi, ebx
push eax
rep movsd dword es:[edi], dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push eax
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
pop edi
mov esi, 1
test eax, eax
je 0x1001b6d5
mov esi, dword [ebx + 0x28e]
push ebx
call sym.dcapi.dll_secure_free
add esp, 4
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1001b6f0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x100278f8]
sub esp, 8
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x1001b730
push eax
push eax
push 3
push eax
push eax
push eax
push str..dcrypt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x1001b75a
mov ecx, dword [0x100278f8]
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push 0
lea edx, [ebp - 8]
push edx
push 4
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x220190
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x1001b761
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x1001b761
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1001b890
Capabilities:
Allocate or change rwx memory
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push 0x40
push 0x3000
push 0x2a0
push 0
mov dword [ebp - 0xc], 0x2a0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x1001b933
mov eax, dword [0x100278f8]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x1001b8f3
push eax
push eax
push 3
push eax
push eax
push eax
push str..dcrypt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x1001b91d
mov ecx, dword [0x100278f8]
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push 0
lea edx, [ebp - 4]
push edx
push 0
push 0
push 8
lea eax, [ebp - 0x10]
push eax
push 0x2201f0
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x1001b92c
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x1001b92c
mov ecx, dword [ebp - 0x10]
push 0x2a0
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualLock]
mov ebx, dword [ebp - 0x10]
test ebx, ebx
jne 0x1001b93d
mov esi, 9
jmp 0x1001b9eb
mov ecx, dword [ebp + 8]
lea edx, [ebx + 0x208]
movzx eax, word [ecx]
mov word [edx], ax
add ecx, 2
add edx, 2
test ax, ax
jne 0x1001b946
mov esi, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
push edi
push 0
mov ecx, 0x41
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov ax, word [edx]
mov ecx, dword [ebp + 0x14]
lea edx, [ebp - 8]
push edx
push 0x2a0
push ebx
push 0x2a0
push ebx
mov word [ebx + 0x29a], ax
mov eax, dword [0x100278f8]
push 0x2201b8
push eax
mov dword [ebx + 0x296], ecx
mov dword [ebx + 0x29c], 0xffffffff
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push eax
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
pop edi
test eax, eax
jne 0x1001b9d8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.DeviceIoControl:__d
push 0x1b6
push str.drv_ioctl.c
call sym.dcapi.dll_log_print
add esp, 0x10
mov esi, 1
jmp 0x1001b9de
mov esi, dword [ebx + 0x28e]
push ebx
call sym.dcapi.dll_secure_free
add esp, 4
test esi, esi
je 0x1001ba03
push esi
push str.dc_start_encrypt_errorcode:__d
push 0x1c2
push str.drv_ioctl.c
call sym.dcapi.dll_log_print
add esp, 0x10
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1001ba10
Capabilities:
Set thread local storage value

Disassembly:
push 0
push 0
push 3
push 0
push 0
push 0
push str..dcrypt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x1001ba3c
push eax
mov eax, dword [0x100278f8]
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
xor eax, eax
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Error_in_CreateFile:_0x_X_n
push 0x2c
push str.drv_ioctl.c
call sym.dcapi.dll_log_print
add esp, 0x10
mov eax, 1
ret
Function at 0x1001ba60
Capabilities:
Allocate or change rwx memory
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
push 0x40
push 0x3000
push 0x98e
push 0
mov dword [ebp - 0xc], 0x98e
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x1001bb06
mov eax, dword [0x100278f8]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x1001bac4
push eax
push eax
push 3
push eax
push eax
push eax
push str..dcrypt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x1001baee
mov ecx, dword [0x100278f8]
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push 0
lea edx, [ebp - 4]
push edx
push 0
push 0
push 8
lea eax, [ebp - 0x10]
push eax
push 0x2201f0
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x1001bafd
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x1001bafd
mov ecx, dword [ebp - 0x10]
push 0x98e
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualLock]
mov edx, dword [ebp - 0x10]
mov ebx, edx
test edx, edx
jne 0x1001bb14
mov esi, 9
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 8]
movzx eax, word [ecx]
mov word [edx], ax
add ecx, 2
add edx, 2
test ax, ax
jne 0x1001bb17
mov esi, dword [ebp + 0xc]
lea edi, [ebx + 0x82]
mov ecx, 0x41
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp + 0x10]
lea edx, [ebp - 4]
push 1
lea edi, [ebx + 0x186]
mov ecx, 0x200
push edx
rep movsd dword es:[edi], dword [esi]
call sym.dcapi.dll_checker_dc_obtain_structure_info
add esp, 8
cmp eax, 1
jne 0x1001bb62
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 4]
mov ecx, esi
call fcn.10016ac0
xor edx, edx
mov ecx, 0x3e8
div ecx
mov eax, dword [0x100278f8]
push 0
mov dword [ebx + 0x98a], edx
lea edx, [ebp - 8]
push edx
push 0x98e
push ebx
push 0x98e
push ebx
push 0x220208
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push eax
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov edi, eax
test esi, esi
je 0x1001bbb5
push esi
call dword [sym.imp.msvcrt.dll_free]
add esp, 4
mov esi, 1
test edi, edi
je 0x1001bbc4
mov esi, dword [ebx + 0x986]
push ebx
call sym.dcapi.dll_secure_free
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001bbe0
Capabilities:
Allocate or change rwx memory
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0x40
push 0x3000
push 0x98e
push 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0x98e
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x1001bc8d
mov eax, dword [0x100278f8]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x1001bc4b
push eax
push eax
push 3
push eax
push eax
push eax
push str..dcrypt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x1001bc75
mov ecx, dword [0x100278f8]
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push 0
lea edx, [ebp - 8]
push edx
push 0
push 0
push 8
lea eax, [ebp - 0x14]
push eax
push 0x2201f0
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x1001bc84
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x1001bc84
mov ecx, dword [ebp - 0x14]
push 0x98e
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualLock]
mov edx, dword [ebp - 0x14]
mov ebx, edx
test edx, edx
jne 0x1001bc9b
mov esi, 9
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 8]
mov edi, edi
movzx eax, word [ecx]
mov word [edx], ax
add ecx, 2
add edx, 2
test ax, ax
jne 0x1001bca0
mov esi, dword [ebp + 0xc]
lea edx, [ebp - 4]
push 1
lea edi, [ebx + 0x82]
mov ecx, 0x41
push edx
rep movsd dword es:[edi], dword [esi]
call sym.dcapi.dll_checker_dc_obtain_structure_info
add esp, 8
cmp eax, 1
jne 0x1001bcdb
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 4]
mov ecx, esi
call fcn.10016ac0
xor edx, edx
mov ecx, 0x3e8
div ecx
mov eax, dword [0x100278f8]
push 0
mov dword [ebx + 0x98a], edx
lea edx, [ebp - 0xc]
push edx
push 0x98e
push ebx
push 0x98e
push ebx
push 0x220204
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push eax
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov edi, eax
test esi, esi
je 0x1001bd2e
push esi
call dword [sym.imp.msvcrt.dll_free]
add esp, 4
test edi, edi
jne 0x1001bd47
push ebx
lea esi, [edi + 1]
call sym.dcapi.dll_secure_free
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, dword [ebp + 0x10]
lea esi, [ebx + 0x186]
mov ecx, 0x200
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebx + 0x986]
push ebx
call sym.dcapi.dll_secure_free
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001bd70
Capabilities:
Allocate or change rwx memory
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0x40
push 0x3000
push 0x2a0
push 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0x2a0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x1001be1b
mov eax, dword [0x100278f8]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x1001bddb
push eax
push eax
push 3
push eax
push eax
push eax
push str..dcrypt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x1001be05
mov ecx, dword [0x100278f8]
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push 0
lea edx, [ebp - 8]
push edx
push 0
push 0
push 8
lea eax, [ebp - 0x14]
push eax
push 0x2201f0
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x1001be14
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x1001be14
mov ecx, dword [ebp - 0x14]
push 0x2a0
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualLock]
mov ebx, dword [ebp - 0x14]
test ebx, ebx
jne 0x1001be29
mov esi, 9
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 8]
lea edx, [ebx + 0x208]
movzx eax, word [ecx]
mov word [edx], ax
add ecx, 2
add edx, 2
test ax, ax
jne 0x1001be32
mov esi, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov ecx, 0x41
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov ax, word [edx]
lea ecx, [ebp - 4]
push 1
push ecx
mov word [ebx + 0x29a], ax
call sym.dcapi.dll_checker_dc_obtain_structure_info
add esp, 8
cmp eax, 1
jne 0x1001be76
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 4]
mov ecx, esi
call fcn.10016ac0
xor edx, edx
mov ecx, 0x3e8
div ecx
mov eax, dword [0x100278f8]
push 0
mov dword [ebx + 0x29c], edx
lea edx, [ebp - 0xc]
push edx
push 0x2a0
push ebx
push 0x2a0
push ebx
push 0x2201f8
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push eax
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov edi, eax
test esi, esi
je 0x1001bec9
push esi
call dword [sym.imp.msvcrt.dll_free]
add esp, 4
mov esi, 1
test edi, edi
je 0x1001bed8
mov esi, dword [ebx + 0x28e]
push ebx
call sym.dcapi.dll_secure_free
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001bef0
Capabilities:
Allocate or change rwx memory
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0x40
push 0x3000
push 0x2a0
push 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0x2a0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x1001bf9b
mov eax, dword [0x100278f8]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x1001bf5b
push eax
push eax
push 3
push eax
push eax
push eax
push str..dcrypt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x1001bf85
mov ecx, dword [0x100278f8]
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push 0
lea edx, [ebp - 8]
push edx
push 0
push 0
push 8
lea eax, [ebp - 0x14]
push eax
push 0x2201f0
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x1001bf94
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x1001bf94
mov ecx, dword [ebp - 0x14]
push 0x2a0
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualLock]
mov ebx, dword [ebp - 0x14]
test ebx, ebx
jne 0x1001bfa9
mov esi, 9
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 8]
lea edx, [ebx + 0x208]
movzx eax, word [ecx]
mov word [edx], ax
add ecx, 2
add edx, 2
test ax, ax
jne 0x1001bfb2
mov esi, dword [ebp + 0xc]
mov ecx, 0x41
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp + 0x10]
lea edx, [ebp - 4]
push 1
lea edi, [ebx + 0x104]
mov ecx, 0x41
push edx
rep movsd dword es:[edi], dword [esi]
call sym.dcapi.dll_checker_dc_obtain_structure_info
add esp, 8
cmp eax, 1
jne 0x1001bff9
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 4]
mov ecx, esi
call fcn.10016ac0
xor edx, edx
mov ecx, 0x3e8
div ecx
mov eax, dword [0x100278f8]
push 0
mov dword [ebx + 0x29c], edx
lea edx, [ebp - 0xc]
push edx
push 0x2a0
push ebx
push 0x2a0
push ebx
push 0x2201b4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push eax
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov edi, eax
test esi, esi
je 0x1001c04c
push esi
call dword [sym.imp.msvcrt.dll_free]
add esp, 4
mov esi, 1
test edi, edi
je 0x1001c05b
mov esi, dword [ebx + 0x28e]
push ebx
call sym.dcapi.dll_secure_free
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001c070
Capabilities:
Allocate or change rwx memory
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0x40
push 0x3000
push 0x2a0
push 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0x2a0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x1001c11d
mov eax, dword [0x100278f8]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x1001c0db
push eax
push eax
push 3
push eax
push eax
push eax
push str..dcrypt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x1001c105
mov ecx, dword [0x100278f8]
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push 0
lea edx, [ebp - 8]
push edx
push 0
push 0
push 8
lea eax, [ebp - 0x14]
push eax
push 0x2201f0
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x1001c114
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x1001c114
mov ecx, dword [ebp - 0x14]
push 0x2a0
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualLock]
mov edx, dword [ebp - 0x14]
mov ebx, edx
test edx, edx
jne 0x1001c127
mov esi, 9
jmp 0x1001c1e9
mov ecx, dword [ebp + 8]
add edx, 0x208
movzx eax, word [ecx]
mov word [edx], ax
add ecx, 2
add edx, 2
test ax, ax
jne 0x1001c130
mov eax, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
mov ecx, 0x41
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, 0xffffffff
jne 0x1001c18a
lea edx, [ebp - 4]
push 1
push edx
call sym.dcapi.dll_checker_dc_obtain_structure_info
add esp, 8
cmp eax, 1
jne 0x1001c16f
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, dword [ebp - 4]
mov ecx, edi
call fcn.10016ac0
xor edx, edx
mov ecx, 0x3e8
div ecx
mov dword [ebx + 0x29c], edx
jmp 0x1001c193
mov edi, dword [ebp - 4]
mov dword [ebx + 0x29c], eax
mov eax, dword [0x100278f8]
push 0
lea edx, [ebp - 0xc]
push edx
push 0x2a0
push ebx
push 0x2a0
push ebx
push 0x2201bc
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push eax
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov esi, eax
test edi, edi
je 0x1001c1cd
push edi
call dword [sym.imp.msvcrt.dll_free]
add esp, 4
test esi, esi
mov esi, 1
je 0x1001c1dc
mov esi, dword [ebx + 0x28e]
push ebx
call sym.dcapi.dll_secure_free
add esp, 4
test esi, esi
je 0x1001c201
push esi
push str.dc_start_decrypt_errorcode:__d
push 0x222
push str.drv_ioctl.c
call sym.dcapi.dll_log_print
add esp, 0x10
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret