joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1017d8a0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov eax, dword [ebp + 0xc]
cmp eax, 3
je 0x1017d8b7
test eax, eax
jne 0x1017da18
mov edi, dword [0x1048f110]
test edi, edi
je 0x1017da18
mov dword [ebp - 0x10], 0
jmp 0x1017d8d7
mov edi, dword [edi + 8]
test edi, edi
je 0x1017d906
mov esi, dword [edi]
mov ebx, dword [edi + 4]
test ebx, ebx
je 0x1017da57
dec esi
push esi
call sub.KERNEL32.dll_TlsGetValue
test eax, eax
je 0x1017d8d0
push 0
push esi
mov esi, eax
call sub.KERNEL32.dll_TlsSetValue
push esi
call ebx
add esp, 4
mov al, 1
mov dword [ebp - 0x10], eax
jmp 0x1017d8d0
test byte [ebp - 0x10], 1
je 0x1017da18
mov edi, dword [0x1048f110]
test edi, edi
je 0x1017da18
mov dword [ebp - 0x10], 0
jmp 0x1017d937
mov edi, dword [edi + 8]
test edi, edi
je 0x1017d966
mov esi, dword [edi]
mov ebx, dword [edi + 4]
test ebx, ebx
je 0x1017da57
dec esi
push esi
call sub.KERNEL32.dll_TlsGetValue
test eax, eax
je 0x1017d930
push 0
push esi
mov esi, eax
call sub.KERNEL32.dll_TlsSetValue
push esi
call ebx
add esp, 4
mov al, 1
mov dword [ebp - 0x10], eax
jmp 0x1017d930
test byte [ebp - 0x10], 1
je 0x1017da18
mov edi, dword [0x1048f110]
test edi, edi
je 0x1017da18
mov dword [ebp - 0x10], 0
jmp 0x1017d997
mov edi, dword [edi + 8]
test edi, edi
je 0x1017d9c6
mov esi, dword [edi]
mov ebx, dword [edi + 4]
test ebx, ebx
je 0x1017da57
dec esi
push esi
call sub.KERNEL32.dll_TlsGetValue
test eax, eax
je 0x1017d990
push 0
push esi
mov esi, eax
call sub.KERNEL32.dll_TlsSetValue
push esi
call ebx
add esp, 4
mov al, 1
mov dword [ebp - 0x10], eax
jmp 0x1017d990
test byte [ebp - 0x10], 1
je 0x1017da18
mov edi, dword [0x1048f110]
test edi, edi
je 0x1017da18
mov dword [ebp - 0x10], 0
jmp 0x1017d9e7
mov edi, dword [edi + 8]
test edi, edi
je 0x1017da12
mov esi, dword [edi]
mov ebx, dword [edi + 4]
test ebx, ebx
je 0x1017da57
dec esi
push esi
call sub.KERNEL32.dll_TlsGetValue
test eax, eax
je 0x1017d9e0
push 0
push esi
mov esi, eax
call sub.KERNEL32.dll_TlsSetValue
push esi
call ebx
add esp, 4
mov al, 1
mov dword [ebp - 0x10], eax
jmp 0x1017d9e0
test byte [ebp - 0x10], 1
jne 0x1017da22
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
mov edi, dword [0x1048f110]
jmp 0x1017da2d
mov edi, dword [edi + 8]
test edi, edi
je 0x1017da18
mov esi, dword [edi]
mov ebx, dword [edi + 4]
test ebx, ebx
je 0x1017da57
dec esi
push esi
call sub.KERNEL32.dll_TlsGetValue
test eax, eax
je 0x1017da2a
push 0
push esi
mov esi, eax
call sub.KERNEL32.dll_TlsSetValue
push esi
call ebx
add esp, 4
jmp 0x1017da2a
push 0x1043b0d0
push 0x2b
push str.called__Option::unwrap____on_a__None__value_rustc_d5c2e9c342b358556da91d61ed4133f6f50fc0c3library_alloc_srccollections_btree_navigate.rs
call fcn.10027330
add esp, 0xc
ud2
Function at 0x1017f470
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1a8
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov edi, dword [eax]
mov ebx, dword [eax + 4]
movzx eax, word [eax + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [0x1048f0fc]
cmp eax, 3
jne 0x1017f60c
cmp ebx, 0x17f
ja 0x1017f61d
lea eax, [ebp - 0x1b4]
push ebx
push edi
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
lea eax, [ebx + 1]
cmp ebx, 6
mov byte [ebp + ebx - 0x1b4], 0
ja 0x1017f4e8
xor edx, edx
nop dword [eax + eax]
cmp byte [ebp + edx - 0x1b4], 0
je 0x1017f583
inc edx
cmp eax, edx
jne 0x1017f4d0
jmp 0x1017f5d2
mov dl, 1
xor ecx, ecx
test dl, dl
jne 0x1017f513
jne 0x1017f513
xor edx, edx
nop word cs:[eax + eax]
nop
cmp byte [ebp + edx - 0x1b4], 0
je 0x1017f583
inc edx
jne 0x1017f500
xor edx, edx
test dl, dl
jne 0x1017f55d
lea edx, [ebx - 7]
nop word cs:[eax + eax]
mov edi, dword [ebp + ecx - 0x1b4]
mov esi, edi
add edi, 0xfefefeff
not esi
and edi, esi
test edi, 0x80808080
jne 0x1017f55d
mov esi, dword [ebp + ecx - 0x1b0]
mov edi, esi
add esi, 0xfefefeff
not edi
and esi, edi
test esi, 0x80808080
jne 0x1017f55d
add ecx, 8
cmp ecx, edx
jbe 0x1017f520
mov esi, dword [ebp + 8]
cmp eax, ecx
je 0x1017f5d2
nop word cs:[eax + eax]
nop
cmp byte [ebp + ecx - 0x1b4], 0
je 0x1017f581
inc ecx
cmp eax, ecx
jne 0x1017f570
jmp 0x1017f5d2
mov edx, ecx
cmp edx, ebx
jne 0x1017f5d2
xorps xmm0, xmm0
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
lea ecx, [ebp - 0x34]
movups xmmword [ebp - 0x34], xmm0
movups xmmword [ebp - 0x24], xmm0
mov dword [ebp - 0x2c], 1
push eax
push ecx
push 0
lea eax, [ebp - 0x1b4]
push eax
call sub.ws2_32.dll_getaddrinfo
test eax, eax
je 0x1017f5f6
call sub.ws2_32.dll_WSAGetLastError
mov ecx, 1
mov dword [esi + 8], eax
mov dword [esi + 4], 0
mov dword [esi], ecx
jmp 0x1017f5e9
mov eax, dword [0x10439c48]
mov ecx, dword [0x10439c4c]
mov dword [esi + 8], ecx
mov dword [esi + 4], eax
mov dword [esi], 1
mov eax, esi
add esp, 0x1a8
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x14]
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov eax, dword [ebp - 0x10]
mov word [esi + 0xc], ax
xor eax, eax
mov dword [esi], eax
jmp 0x1017f5e9
call fcn.1016dd40
cmp ebx, 0x17f
jbe 0x1017f4a8
mov ecx, esi
mov edx, edi
push dword [ebp - 0x10]
push ebx
call fcn.1016e320
add esp, 8
jmp 0x1017f5e9
Function at 0x10183f60
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x68
movaps xmm0, xmmword [0x10438060]
mov eax, dword [ebp + 8]
mov ebx, ecx
mov dword [esp + 0x34], 0
mov word [esp + 0x38], 0
mov dword [esp + 0x18], 0
movups xmmword [esp + 0x20], xmm0
mov dword [esp + 0x30], 0
mov byte [esp + 0x34], 1
lea esi, [esp + 0x18]
lea ecx, [esp + 0x10]
push esi
push eax
call fcn.101746e0
add esp, 8
cmp byte [esp + 0x10], 4
jne 0x10183fc0
mov esi, dword [esp + 0x14]
jmp 0x1018401e
movzx eax, byte [esp + 0x10]
mov esi, dword [esp + 0x14]
cmp eax, 4
je 0x1018401e
cmp eax, 3
jne 0x10184013
mov edi, dword [esi + 4]
mov dword [esp + 4], ebx
mov ebx, dword [esi]
mov eax, dword [edi]
push ebx
call eax
add esp, 4
cmp dword [edi + 4], 0
je 0x10184001
cmp dword [edi + 8], 9
jb 0x10183ff3
mov ebx, dword [ebx - 4]
push ebx
push 0
push dword [0x1048f0f8]
call sub.KERNEL32.dll_HeapFree
push esi
push 0
push dword [0x1048f0f8]
call sub.KERNEL32.dll_HeapFree
mov ebx, dword [esp + 4]
mov dword [ebx], 0
jmp 0x10184158
lea edi, [esp + 0x18]
mov edx, esi
mov ecx, edi
call fcn.10174910
mov eax, dword [esp + 0x18]
xor eax, 2
or eax, dword [esp + 0x1c]
jne 0x10184090
cmp byte [esp + 0x20], 3
jne 0x101840d1
mov eax, dword [esp + 0x24]
mov dword [esp + 4], ebx
mov ebx, dword [eax + 4]
mov edi, dword [eax]
mov dword [esp + 8], eax
mov eax, dword [ebx]
push edi
call eax
add esp, 4
cmp dword [ebx + 4], 0
je 0x10184079
cmp dword [ebx + 8], 9
jb 0x1018406b
mov edi, dword [edi - 4]
push edi
push 0
push dword [0x1048f0f8]
call sub.KERNEL32.dll_HeapFree
push dword [esp + 8]
push 0
push dword [0x1048f0f8]
call sub.KERNEL32.dll_HeapFree
mov ebx, dword [esp + 4]
jmp 0x101840d1
cmp dword [esp + 0x54], 0
jne 0x101840d1
mov eax, dword [esp + 0x50]
test esi, esi
mov dword [esp + 8], eax
je 0x101840d9
mov dword [esp + 0x18], 0
call sub.KERNEL32.dll_GetCurrentProcess
push 2
push 0
push 0
push edi
push eax
push esi
push eax
call sub.KERNEL32.dll_DuplicateHandle
test eax, eax
je 0x10184147
mov eax, dword [esp + 0x18]
mov dword [esp + 4], ebx
jmp 0x101840df
mov dword [ebx], 0
jmp 0x10184152
mov dword [esp + 4], ebx
xor eax, eax
push 0
push 0
push 0
push 2
push 0
mov dword [esp + 0x20], eax
push eax
call sub.KERNEL32.dll_CreateFileMappingA
test eax, eax
je 0x10184132
mov edi, eax
push dword [esp + 8]
push 0
push 0
push 4
push eax
call sub.KERNEL32.dll_MapViewOfFile
mov ebx, eax
push edi
call sub.KERNEL32.dll_CloseHandle
test ebx, ebx
je 0x10184132
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov dword [eax + 4], ecx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], edx
mov dword [eax], 1
jmp 0x10184152
mov eax, dword [esp + 4]
mov dword [eax], 0
push dword [esp + 0xc]
call sub.KERNEL32.dll_CloseHandle
jmp 0x10184152
call sub.KERNEL32.dll_GetLastError
mov dword [ebx], 0
push esi
call sub.KERNEL32.dll_CloseHandle
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x101848b0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov eax, dword [0x102bc0b0]
mov esi, ecx
test eax, eax
je 0x101848d9
dec eax
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
jbe 0x101848f1
cmp dword [eax + 4], 0
je 0x101848f1
add eax, 8
pop esi
pop edi
pop ebp
ret
push 0x102bc0b0
call fcn.1017d760
add esp, 4
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
ja 0x101848cc
mov eax, dword [0x102bc0b0]
test eax, eax
je 0x101849a1
dec eax
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
je 0x101849bd
mov edi, eax
test eax, eax
jne 0x10184969
mov eax, dword [0x1044f00c]
movzx eax, byte [eax]
mov eax, dword [0x1048f0f8]
test eax, eax
jne 0x10184937
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x101849d2
mov dword [0x1048f0f8], eax
push 0x10
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x101849d2
mov dword [eax], 0x102bc0b0
mov dword [eax + 4], 0
mov edi, eax
mov eax, dword [0x102bc0b0]
test eax, eax
je 0x101849c3
dec eax
push edi
push eax
call sub.KERNEL32.dll_TlsSetValue
test esi, esi
je 0x10184989
mov eax, dword [esi]
xor ecx, ecx
mov edx, 0
mov dword [esi], 0
cmp eax, 1
jne 0x1018498d
mov ecx, dword [esi + 4]
mov edx, dword [esi + 8]
jmp 0x1018498d
xor ecx, ecx
xor edx, edx
mov dword [edi + 4], 1
mov dword [edi + 8], ecx
lea eax, [edi + 8]
mov byte [edi + 0xc], dl
pop esi
pop edi
pop ebp
ret
push 0x102bc0b0
call fcn.1017d760
add esp, 4
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
jne 0x1018490e
xor eax, eax
pop esi
pop edi
pop ebp
ret
push 0x102bc0b0
call fcn.1017d760
add esp, 4
jmp 0x10184962
push 0x10
push 4
call fcn.1001ac80
add esp, 8
ud2
Function at 0x101849e0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, dword [0x102bc0c0]
mov esi, ecx
test eax, eax
je 0x10184a0d
dec eax
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
jbe 0x10184a25
cmp dword [eax + 4], 0
mov ebx, eax
je 0x10184a25
add ebx, 8
jmp 0x10184b02
push 0x102bc0c0
call fcn.1017d760
add esp, 4
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
ja 0x101849fd
mov eax, dword [0x102bc0c0]
test eax, eax
je 0x10184ae4
dec eax
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
je 0x10184b00
mov edi, eax
test eax, eax
jne 0x10184a9d
mov eax, dword [0x1044f00c]
movzx eax, byte [eax]
mov eax, dword [0x1048f0f8]
test eax, eax
jne 0x10184a6b
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x10184b1b
mov dword [0x1048f0f8], eax
push 0x10
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x10184b1b
mov dword [eax], 0x102bc0c0
mov dword [eax + 4], 0
mov edi, eax
mov eax, dword [0x102bc0c0]
test eax, eax
je 0x10184b09
dec eax
push edi
push eax
call sub.KERNEL32.dll_TlsSetValue
test esi, esi
je 0x10184ab7
mov eax, dword [esi]
mov dword [esi], 0
test eax, eax
mov edx, eax
je 0x10184abb
mov eax, dword [esi + 4]
mov edx, dword [esi + 8]
jmp 0x10184abb
xor eax, eax
xor edx, edx
mov ecx, dword [edi + 0xc]
cmp dword [edi + 4], 0
lea ebx, [edi + 8]
mov dword [edi + 4], 1
mov dword [edi + 8], eax
mov dword [edi + 0xc], edx
je 0x10184b02
test ecx, ecx
je 0x10184b02
lock dec dword [ecx]
jne 0x10184b02
call fcn.1014f6d0
jmp 0x10184b02
push 0x102bc0c0
call fcn.1017d760
add esp, 4
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
jne 0x10184a42
xor ebx, ebx
mov eax, ebx
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x102bc0c0
call fcn.1017d760
add esp, 4
jmp 0x10184a96
push 0x10
push 4
call fcn.1001ac80
add esp, 8
ud2
Function at 0x10184b30
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov eax, dword [0x102bc0d0]
mov esi, ecx
test eax, eax
je 0x10184b59
dec eax
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
jbe 0x10184b71
cmp byte [eax + 4], 0
je 0x10184b71
add eax, 5
pop esi
pop edi
pop ebp
ret
push 0x102bc0d0
call fcn.1017d760
add esp, 4
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
ja 0x10184b4c
mov eax, dword [0x102bc0d0]
test eax, eax
je 0x10184c05
dec eax
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
je 0x10184c21
mov edi, eax
test eax, eax
jne 0x10184be2
mov eax, dword [0x1044f00c]
movzx eax, byte [eax]
mov eax, dword [0x1048f0f8]
test eax, eax
jne 0x10184bb7
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x10184c36
mov dword [0x1048f0f8], eax
push 8
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x10184c36
mov dword [eax], 0x102bc0d0
mov byte [eax + 4], 0
mov edi, eax
mov eax, dword [0x102bc0d0]
test eax, eax
je 0x10184c27
dec eax
push edi
push eax
call sub.KERNEL32.dll_TlsSetValue
xor ecx, ecx
test esi, esi
je 0x10184bf7
cmp byte [esi], 0
mov byte [esi], 0
movzx eax, byte [esi + 1]
cmove eax, ecx
mov ecx, eax
mov byte [edi + 4], 1
lea eax, [edi + 5]
mov byte [edi + 5], cl
pop esi
pop edi
pop ebp
ret
push 0x102bc0d0
call fcn.1017d760
add esp, 4
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
jne 0x10184b8e
xor eax, eax
pop esi
pop edi
pop ebp
ret
push 0x102bc0d0
call fcn.1017d760
add esp, 4
jmp 0x10184bdb
push 8
push 4
call fcn.1001ac80
add esp, 8
ud2

Function at 0x10184c50
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
mov eax, dword [0x102bc0e0]
test eax, eax
je 0x10184c75
dec eax
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
jbe 0x10184c8d
cmp byte [eax + 4], 0
je 0x10184c8d
add eax, 5
pop esi
pop ebp
ret
push 0x102bc0e0
call fcn.1017d760
add esp, 4
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
ja 0x10184c69
mov eax, dword [0x102bc0e0]
test eax, eax
je 0x10184d23
dec eax
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
je 0x10184d3f
mov esi, eax
test eax, eax
jne 0x10184cfe
mov eax, dword [0x1044f00c]
movzx eax, byte [eax]
mov eax, dword [0x1048f0f8]
test eax, eax
jne 0x10184cd3
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x10184d53
mov dword [0x1048f0f8], eax
push 8
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x10184d53
mov dword [eax], 0x102bc0e0
mov byte [eax + 4], 0
mov esi, eax
mov eax, dword [0x102bc0e0]
test eax, eax
je 0x10184d44
dec eax
push esi
push eax
call sub.KERNEL32.dll_TlsSetValue
mov eax, dword [ebp + 8]
xor ecx, ecx
test eax, eax
je 0x10184d16
cmp byte [eax], 0
mov byte [eax], 0
movzx eax, byte [eax + 1]
cmove eax, ecx
mov ecx, eax
mov byte [esi + 4], 1
lea eax, [esi + 5]
mov byte [esi + 5], cl
pop esi
pop ebp
ret
push 0x102bc0e0
call fcn.1017d760
add esp, 4
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
jne 0x10184caa
xor eax, eax
pop esi
pop ebp
ret
push 0x102bc0e0
call fcn.1017d760
add esp, 4
jmp 0x10184cf7
push 8
push 4
call fcn.1001ac80
add esp, 8
ud2
Function at 0x10184d70
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov eax, dword [0x102bc0f0]
test eax, eax
je 0x10184d9a
dec eax
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
jbe 0x10184db2
cmp dword [eax + 4], 0
mov edi, eax
je 0x10184db2
add edi, 8
jmp 0x10184e8a
push 0x102bc0f0
call fcn.1017d760
add esp, 4
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
ja 0x10184d8a
mov eax, dword [0x102bc0f0]
test eax, eax
je 0x10184e6c
dec eax
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
je 0x10184e88
mov esi, eax
test eax, eax
jne 0x10184e2a
mov eax, dword [0x1044f00c]
movzx eax, byte [eax]
mov eax, dword [0x1048f0f8]
test eax, eax
jne 0x10184df8
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x10184e9f
mov dword [0x1048f0f8], eax
push 0xc
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x10184e9f
mov dword [eax], 0x102bc0f0
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0x102bc0f0]
test eax, eax
je 0x10184e90
dec eax
push esi
push eax
call sub.KERNEL32.dll_TlsSetValue
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x10184e65
mov eax, dword [ecx + 4]
cmp dword [ecx], 0
mov dword [ecx], 0
je 0x10184e65
mov ecx, dword [esi + 8]
cmp dword [esi + 4], 0
lea edi, [esi + 8]
mov dword [esi + 4], 1
mov dword [esi + 8], eax
je 0x10184e8a
test ecx, ecx
je 0x10184e8a
lock dec dword [ecx]
jne 0x10184e8a
call fcn.1014f610
jmp 0x10184e8a
call fcn.1016d7a0
jmp 0x10184e3f
push 0x102bc0f0
call fcn.1017d760
add esp, 4
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
jne 0x10184dcf
xor edi, edi
mov eax, edi
pop esi
pop edi
pop ebp
ret
push 0x102bc0f0
call fcn.1017d760
add esp, 4
jmp 0x10184e23
push 0xc
push 4
call fcn.1001ac80
add esp, 8
ud2
Function at 0x10184ed0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, dword [0x102bc100]
mov esi, ecx
test eax, eax
je 0x10184efd
dec eax
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
jbe 0x10184f15
cmp dword [eax + 4], 0
mov ebx, eax
je 0x10184f15
add ebx, 8
jmp 0x10184fe8
push 0x102bc100
call fcn.1017d760
add esp, 4
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
ja 0x10184eed
mov eax, dword [0x102bc100]
test eax, eax
je 0x10184fca
dec eax
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
je 0x10184fe6
mov edi, eax
test eax, eax
jne 0x10184f8d
mov eax, dword [0x1044f00c]
movzx eax, byte [eax]
mov eax, dword [0x1048f0f8]
test eax, eax
jne 0x10184f5b
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x10184ffe
mov dword [0x1048f0f8], eax
push 0xc
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x10184ffe
mov dword [eax], 0x102bc100
mov dword [eax + 4], 0
mov edi, eax
mov eax, dword [0x102bc100]
test eax, eax
je 0x10184fef
dec eax
push edi
push eax
call sub.KERNEL32.dll_TlsSetValue
test esi, esi
je 0x10184fa2
mov eax, dword [esi]
mov dword [esi], 0
test eax, eax
je 0x10184fa4
mov eax, dword [esi + 4]
jmp 0x10184fa4
xor eax, eax
mov ecx, dword [edi + 8]
cmp dword [edi + 4], 0
lea ebx, [edi + 8]
mov dword [edi + 4], 1
mov dword [edi + 8], eax
je 0x10184fe8
test ecx, ecx
je 0x10184fe8
lock dec dword [ecx]
jne 0x10184fe8
call fcn.1014f5a0
jmp 0x10184fe8
push 0x102bc100
call fcn.1017d760
add esp, 4
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
jne 0x10184f32
xor ebx, ebx
mov eax, ebx
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x102bc100
call fcn.1017d760
add esp, 4
jmp 0x10184f86
push 0xc
push 4
call fcn.1001ac80
add esp, 8
ud2
Function at 0x10185010
Capabilities:
Generate random numbers via winapi
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff0
sub esp, 0x30
mov eax, dword [0x102bc110]
test eax, eax
je 0x10185125
dec eax
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
jbe 0x10185040
mov esi, eax
mov eax, dword [eax]
or eax, dword [esi + 4]
jne 0x10185120
mov eax, dword [0x102bc110]
test eax, eax
je 0x10185146
dec eax
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
je 0x10185162
mov esi, eax
test eax, eax
jne 0x101850c3
mov eax, dword [0x1044f00c]
movzx eax, byte [eax]
mov eax, dword [0x1048f0f8]
test eax, eax
jne 0x10185086
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x1018517e
mov dword [0x1048f0f8], eax
push 0x20
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x1018517e
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 0x18], 0x102bc110
mov esi, eax
mov eax, dword [0x102bc110]
test eax, eax
je 0x1018516c
dec eax
push esi
push eax
call sub.KERNEL32.dll_TlsSetValue
mov eax, dword [ebp + 8]
test eax, eax
je 0x101850e2
mov ecx, dword [eax]
movups xmm0, xmmword [eax + 8]
mov dword [eax + 4], 0
mov dword [eax], 0
cmp ecx, 1
je 0x1018510f
xorps xmm0, xmm0
mov eax, esp
movaps xmmword [esp], xmm0
push 2
push 0x10
push eax
push 0
call sub.bcrypt.dll_BCryptGenRandom
test eax, eax
js 0x10185101
movaps xmm0, xmmword [esp]
jmp 0x1018510f
lea ecx, [esp + 0x10]
call fcn.1017c800
movups xmm0, xmmword [esp + 0x10]
mov dword [esi + 4], 0
mov dword [esi], 1
movups xmmword [esi + 8], xmm0
add esi, 8
jmp 0x10185164
push 0x102bc110
call fcn.1017d760
add esp, 4
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
ja 0x10185033
jmp 0x10185040
push 0x102bc110
call fcn.1017d760
add esp, 4
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
jne 0x1018505d
xor esi, esi
mov eax, esi
lea esp, [ebp - 4]
pop esi
pop ebp
ret
push 0x102bc110
call fcn.1017d760
add esp, 4
jmp 0x101850bc
push 0x20
push 8
call fcn.1001ac80
add esp, 8
ud2
Function at 0x10189440
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xffffffc0
sub esp, 0x180
movaps xmm0, xmmword [0x1043b9a0]
mov edi, dword [0x1044f00c]
mov esi, dword [0x1044eff8]
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0
mov dword [esp + 0x80], 0
mov dword [esp + 0x84], 0
mov dword [esp + 0xc0], 0
mov byte [esp + 0xc4], 0
mov dword [esp + 0xc8], 4
mov dword [esp + 0xcc], 0
movaps xmmword [esp + 0xd0], xmm0
mov byte [esp + 0xe0], 1
mov dword [esp + 0x100], 1
mov dword [esp + 0x104], 1
mov byte [esp + 0x108], 0
movzx eax, byte [edi]
mov eax, dword [esi]
test eax, eax
jne 0x101894f7
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x10189652
mov dword [esi], eax
push 0x140
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x10189652
mov ecx, eax
and ecx, 0xffffffc0
mov dword [ecx + 0x3c], eax
add ecx, 0x40
lea ebx, [esp + 0x40]
push 0x100
push ebx
mov dword [esp + 0x44], ecx
push ecx
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov ecx, dword [ebp + 0xc]
cmp dword [ecx], 0
je 0x1018953b
mov ebx, dword [ecx + 4]
jmp 0x1018955d
xorps xmm0, xmm0
mov dword [esp + 0x60], 0
movaps xmmword [esp + 0x50], xmm0
movaps xmmword [esp + 0x40], xmm0
push ebx
call sub.KERNEL32.dll_GetSystemInfo
mov ebx, dword [esp + 0x54]
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx + 0x18]
movsd xmm0, qword [ecx + 0x10]
mov dword [esp + 0x58], eax
movsd qword [esp + 0x50], xmm0
movsd xmm0, qword [ecx + 8]
mov eax, dword [esp + 0x3c]
movsd qword [esp + 0x48], xmm0
mov dword [esp + 0x5c], 0
mov byte [esp + 0x60], 0
mov dword [esp + 0x64], 1
mov dword [esp + 0x68], eax
mov dword [esp + 0x6c], 0
mov byte [esp + 0x70], 0
mov dword [esp + 0x7c], 0
mov dword [esp + 0x80], 0
mov dword [esp + 0x74], 0
mov dword [esp + 0x78], 0
mov dword [esp + 0x84], ebx
mov dword [esp + 0x88], 0
mov dword [esp + 0x40], 1
mov dword [esp + 0x44], 1
movzx eax, byte [edi]
mov eax, dword [esi]
test eax, eax
jne 0x101895fd
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x10189663
mov dword [esi], eax
push 0x4c
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x10189663
lea esi, [esp + 0x40]
mov ecx, 0x13
mov edi, eax
inc ebx
rep movsd dword es:[edi], dword [esi]
mov edi, eax
nop dword [eax + eax]
dec ebx
je 0x10189631
lock inc dword [edi]
jle 0x1018964e
mov ecx, edi
call fcn.101899a0
jmp 0x10189620
mov ecx, dword [ebp + 8]
mov eax, dword [esp + 0x3c]
mov dword [ecx], 1
mov dword [ecx + 4], eax
mov dword [ecx + 8], edi
mov eax, ecx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
ud2
push 0x100
push 0x40
call fcn.1001ac80
add esp, 8
jmp 0x1018966f
push 0x4c
push 4
call fcn.1001ac80
add esp, 8
ud2