joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10097950
Capabilities:
Terminate process

Disassembly:
push ecx
test ecx, ecx
jns 0x1009799e
push ecx
push ecx
mov edx, str.ERROR:
mov ecx, 0x1011f818
call fcn.10015f90
mov edx, str.Negative_value
mov ecx, eax
call fcn.10015f90
add esp, 4
mov ecx, eax
call fcn.10042d10
mov edx, str._passed_to_VarintBE::Length__which_requires_non_negative_argument
mov ecx, eax
call fcn.10015f90
push eax
call fcn.10088160
add esp, 4
cmp byte [0x10120b44], 0
jne 0x100979aa
xor eax, eax
pop ecx
ret
xor eax, eax
sar ecx, 7
inc eax
test ecx, ecx
jne 0x100979a0
pop ecx
ret
mov ecx, 0x1011f818
call fcn.1001a0e0
push 1
call fcn.100a1eb2
int3

Function at 0x100979c0
Capabilities:
Terminate process

Disassembly:
push ecx
push esi
push edi
test ecx, ecx
jns 0x10097a12
push ecx
push ecx
mov edx, str.ERROR:
mov ecx, 0x1011f818
call fcn.10015f90
mov edx, str.Negative_value
mov ecx, eax
call fcn.10015f90
add esp, 4
mov ecx, eax
call fcn.10042d10
mov edx, str._passed_to_VarintBE::EncodeInternal__which_requires_non_negative_argument
mov ecx, eax
call fcn.10015f90
push eax
call fcn.10088160
add esp, 4
cmp byte [0x10120b44], 0
jne 0x10097a41
xor eax, eax
pop edi
pop esi
pop ecx
ret
mov al, cl
lea esi, [edx + 4]
and al, 0x7f
sar ecx, 7
mov byte [esi], al
mov edi, 1
dec esi
test ecx, ecx
je 0x10097a3b
mov dl, cl
lea esi, [esi - 1]
or dl, 0x80
sar ecx, 7
inc edi
mov byte [esi + 1], dl
test ecx, ecx
jne 0x10097a28
mov eax, edi
pop edi
pop esi
pop ecx
ret
mov ecx, 0x1011f818
call fcn.1001a0e0
push 1
call fcn.100a1eb2
int3

Function at 0x10097af0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push esi
test eax, eax
jg 0x10097b4d
jl 0x10097b05
test edx, edx
jae 0x10097b4d
push eax
push edx
mov edx, str.ERROR:
mov ecx, 0x1011f818
call fcn.10015f90
mov edx, str.Negative_value
mov ecx, eax
call fcn.10015f90
mov ecx, eax
call fcn.100938b0
mov edx, str._passed_to_VarintBE::Length__which_requires_non_negative_argument
mov ecx, eax
call fcn.10015f90
push eax
call fcn.10088160
add esp, 4
cmp byte [0x10120b44], 0
jne 0x10097b64
xor eax, eax
pop esi
pop ecx
pop ebp
ret
xor esi, esi
nop
shrd edx, eax, 7
inc esi
sar eax, 7
mov ecx, edx
or ecx, eax
jne 0x10097b50
mov eax, esi
pop esi
pop ecx
pop ebp
ret
mov ecx, 0x1011f818
call fcn.1001a0e0
push 1
call fcn.100a1eb2
int3
Function at 0x10097b80
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push esi
push edi
test eax, eax
jg 0x10097bdd
jl 0x10097b95
test edx, edx
jae 0x10097bdd
push eax
push edx
mov edx, str.ERROR:
mov ecx, 0x1011f818
call fcn.10015f90
mov edx, str.Negative_value
mov ecx, eax
call fcn.10015f90
mov ecx, eax
call fcn.100938b0
mov edx, str._passed_to_VarintBE::EncodeInternal__which_requires_non_negative_argument
mov ecx, eax
call fcn.10015f90
push eax
call fcn.10088160
add esp, 4
cmp byte [0x10120b44], 0
jne 0x10097c1f
xor eax, eax
pop edi
pop esi
pop ebp
ret
lea esi, [ecx + 8]
mov edi, 1
mov cl, dl
and cl, 0x7f
shrd edx, eax, 7
mov byte [esi], cl
dec esi
sar eax, 7
mov ecx, edx
or ecx, eax
je 0x10097c19
lea ebx, [ebx]
mov cl, dl
lea esi, [esi - 1]
or cl, 0x80
inc edi
shrd edx, eax, 7
mov byte [esi + 1], cl
sar eax, 7
mov ecx, edx
or ecx, eax
jne 0x10097c00
mov eax, edi
pop edi
pop esi
pop ebp
ret
mov ecx, 0x1011f818
call fcn.1001a0e0
push 1
call fcn.100a1eb2
int3

Function at 0x10097c40
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d7761
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x10113840]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp + 8]
mov dword [ecx], eax
mov eax, dword [ebp + 0xc]
mov dword [ecx + 4], eax
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x10], 0
mov dword [ebp - 4], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x18], 0
mov dword [ecx + 0x1c], 0
mov byte [ebp - 4], 1
mov dword [ecx + 0x20], 0
mov dword [ecx + 0x24], 0
mov dword [ecx + 0x28], 0
mov byte [ebp - 4], 2
mov eax, dword [ebp + 0x10]
mov dword [ecx + 0x2c], 0
mov dword [ecx + 0x30], eax
mov dword [ecx + 0x34], 0xffffffff
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10097db0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 8]
cmp eax, dword [esi + 0xc]
jne 0x10097e98
mov eax, dword [esi + 0x14]
cmp eax, dword [esi + 0x18]
jne 0x10097e98
mov eax, dword [esi + 0x20]
cmp eax, dword [esi + 0x24]
jne 0x10097e98
mov ecx, dword [esi + 4]
call fcn.10098060
mov ecx, eax
test ecx, ecx
jne 0x10097e2f
push dword [esi + 4]
mov edx, str.ERROR:
push ecx
mov ecx, 0x1011f818
call fcn.10015f90
mov edx, str.Error_finding_table_size_for_source_size
mov ecx, eax
call fcn.10015f90
add esp, 4
mov ecx, eax
call fcn.1003be40
push eax
call fcn.10088160
add esp, 4
call fcn.100862e0
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
lea eax, [ecx - 1]
mov dword [ebp - 4], 0xffffffff
mov dword [esi + 0x2c], eax
lea eax, [ebp - 4]
push eax
push ecx
lea ecx, [esi + 8]
call fcn.10098700
lea eax, [ebp - 4]
mov dword [ebp - 4], 0xffffffff
push eax
mov eax, dword [esi + 4]
lea ecx, [esi + 0x14]
shr eax, 4
push eax
call fcn.10098700
lea eax, [ebp - 4]
mov dword [ebp - 4], 0xffffffff
push eax
mov eax, dword [esi + 4]
lea ecx, [esi + 0x20]
shr eax, 4
push eax
call fcn.10098700
cmp byte [ebp + 8], 0
je 0x10097e8d
push dword [esi + 4]
mov ecx, esi
call fcn.10098360
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edx, str.ERROR:
mov ecx, 0x1011f818
call fcn.10015f90
mov edx, str.Init___called_twice_for_same_BlockHash_object
mov ecx, eax
call fcn.10015f90
push eax
call fcn.10088160
add esp, 4
cmp byte [0x10120b44], 0
je 0x10097e24
mov ecx, 0x1011f818
call fcn.1001a0e0
push 1
call fcn.100a1eb2
int3
Function at 0x10098060
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, ecx
mov eax, 1
mov edx, esi
shr edx, 2
inc edx
cmp edx, eax
jbe 0x1009807a
add eax, eax
je 0x100980cb
cmp eax, edx
jb 0x10098072
lea ecx, [eax - 1]
test eax, ecx
je 0x1009812a
push eax
push ecx
push esi
push ecx
mov edx, str.ERROR:
mov ecx, 0x1011f818
call fcn.10015f90
mov edx, str.Internal_error:_CalcTableSize_dictionary_size_
mov ecx, eax
call fcn.10015f90
add esp, 4
mov ecx, eax
call fcn.1003be40
mov edx, str._:_resulting_table_size
mov ecx, eax
call fcn.10015f90
add esp, 4
mov ecx, eax
call fcn.1003be40
mov edx, str._is_not_a_power_of_2
jmp 0x1009810f
push eax
push ecx
push esi
push ecx
mov edx, str.ERROR:
mov ecx, 0x1011f818
call fcn.10015f90
mov edx, str.Internal_error:_CalcTableSize_dictionary_size_
mov ecx, eax
call fcn.10015f90
add esp, 4
mov ecx, eax
call fcn.1003be40
mov edx, str._:_resulting_table_size
mov ecx, eax
call fcn.10015f90
add esp, 4
mov ecx, eax
call fcn.1003be40
mov edx, str._is_zero_or_negative
mov ecx, eax
call fcn.10015f90
push eax
call fcn.10088160
add esp, 4
cmp byte [0x10120b44], 0
je 0x1009818e
jmp 0x10098192
test esi, esi
je 0x10098190
lea ecx, [edx + edx]
cmp eax, ecx
jbe 0x10098190
push eax
push ecx
push esi
push ecx
mov edx, str.ERROR:
mov ecx, 0x1011f818
call fcn.10015f90
mov edx, str.Internal_error:_CalcTableSize_dictionary_size_
mov ecx, eax
call fcn.10015f90
add esp, 4
mov ecx, eax
call fcn.1003be40
mov edx, str._:_resulting_table_size
mov ecx, eax
call fcn.10015f90
add esp, 4
mov ecx, eax
call fcn.1003be40
mov edx, str._is_too_large
mov ecx, eax
call fcn.10015f90
push eax
call fcn.10088160
add esp, 4
call fcn.100862e0
xor eax, eax
pop esi
ret
mov ecx, 0x1011f818
call fcn.1001a0e0
push 1
call fcn.100a1eb2
int3
Function at 0x100981b0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov edx, ecx
push ebx
push esi
push edi
mov eax, dword [edx + 8]
cmp eax, dword [edx + 0xc]
jne 0x100981f6
mov edx, str.ERROR:
mov ecx, 0x1011f818
call fcn.10015f90
mov edx, str.BlockHash::AddBlock___called_before_BlockHash::Init__
mov ecx, eax
call fcn.10015f90
push eax
call fcn.10088160
add esp, 4
cmp byte [0x10120b44], 0
je 0x10098340
jmp 0x10098347
mov esi, dword [edx + 0x34]
mov eax, dword [edx + 4]
inc esi
shr eax, 4
cmp esi, eax
jl 0x10098246
dec eax
mov edx, str.ERROR:
push eax
push ecx
push esi
push ecx
mov ecx, 0x1011f818
call fcn.10015f90
mov edx, str.BlockHash::AddBlock___called_with_block_number
mov ecx, eax
call fcn.10015f90
add esp, 4
mov ecx, eax
call fcn.10042d10
mov edx, str._that_is_past_last_block
mov ecx, eax
call fcn.10015f90
add esp, 4
mov ecx, eax
call fcn.10042d10
jmp 0x100981db
mov edi, dword [edx + 0x14]
cmp dword [edi + esi*4], 0xffffffff
lea eax, [edi + esi*4]
je 0x10098297
push dword [eax]
mov edx, str.ERROR:
push ecx
push esi
push ecx
mov ecx, 0x1011f818
call fcn.10015f90
mov edx, str.Internal_error_in_BlockHash::AddBlock__:_block_number_
mov ecx, eax
call fcn.10015f90
add esp, 4
mov ecx, eax
call fcn.10042d10
mov edx, str.__next_block_should_be__1_but_is
mov ecx, eax
call fcn.10015f90
add esp, 4
mov ecx, eax
call fcn.10042d10
jmp 0x100981db
mov ecx, dword [edx + 0x2c]
and ecx, dword [ebp + 8]
mov eax, dword [edx + 8]
mov ebx, dword [eax + ecx*4]
test ebx, ebx
jns 0x100982ba
mov dword [eax + ecx*4], esi
mov eax, dword [edx + 0x20]
mov dword [eax + esi*4], esi
mov dword [edx + 0x34], esi
pop edi
pop esi
pop ebx
pop ebp
ret 4
mov eax, dword [edx + 0x20]
mov eax, dword [eax + ebx*4]
cmp dword [edi + eax*4], 0xffffffff
je 0x10098334
push dword [edi + eax*4]
mov edx, str.ERROR:
push ecx
push eax
push ecx
push ebx
push ecx
mov ecx, 0x1011f818
call fcn.10015f90
mov edx, str.Internal_error_in_BlockHash::AddBlock__:_first_matching_block_
mov ecx, eax
call fcn.10015f90
add esp, 4
mov ecx, eax
call fcn.10042d10
mov edx, str.__last_matching_block_
mov ecx, eax
call fcn.10015f90
add esp, 4
mov ecx, eax
call fcn.10042d10
mov edx, str.__next_block_should_be__1_but_is
mov ecx, eax
call fcn.10015f90
add esp, 4
mov ecx, eax
call fcn.10042d10
push eax
call fcn.10088160
add esp, 4
call fcn.100862e0
pop edi
pop esi
pop ebx
pop ebp
ret 4
mov dword [edi + eax*4], esi
mov eax, dword [edx + 0x20]
mov dword [eax + ebx*4], esi
mov dword [edx + 0x34], esi
pop edi
pop esi
pop ebx
pop ebp
ret 4
mov ecx, 0x1011f818
call fcn.1001a0e0
push 1
call fcn.100a1eb2
int3
Function at 0x10098360
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push ebx
mov ebx, ecx
push esi
push edi
mov eax, dword [ebx + 4]
cmp edx, eax
jle 0x100983cc
push eax
push ecx
push edx
push ecx
mov edx, str.ERROR:
mov ecx, 0x1011f818
call fcn.10015f90
mov edx, str.BlockHash::AddAllBlocksThroughIndex___called_with_index
mov ecx, eax
call fcn.10015f90
add esp, 4
mov ecx, eax
call fcn.10042d10
mov edx, str._higher_than_end_index
mov ecx, eax
call fcn.10015f90
add esp, 4
mov ecx, eax
call fcn.1003be40
push eax
call fcn.10088160
add esp, 4
cmp byte [0x10120b44], 0
je 0x10098493
jmp 0x1009849a
mov ecx, dword [ebx + 0x34]
shl ecx, 4
cmp edx, ecx
jg 0x10098423
push ecx
push ecx
push edx
push ecx
mov edx, str.ERROR:
mov ecx, 0x1011f818
call fcn.10015f90
mov edx, str.BlockHash::AddAllBlocksThroughIndex___called_with_index
mov ecx, eax
call fcn.10015f90
add esp, 4
mov ecx, eax
call fcn.10042d10
mov edx, str.___last_index_added__
mov ecx, eax
call fcn.10015f90
add esp, 4
mov ecx, eax
call fcn.10042d10
mov edx, 0x100ebd68
mov ecx, eax
call fcn.10015f90
jmp 0x100983b1
cmp eax, 0x10
jb 0x10098493
add eax, 0xfffffff0
cmp edx, eax
jle 0x10098432
lea edx, [eax + 1]
mov eax, dword [ebx]
add edx, eax
mov dword [ebp + 8], edx
lea edi, [eax + 0x10]
add edi, ecx
cmp edi, edx
jae 0x10098493
movzx eax, byte [edi]
lea edx, [edi + 3]
movzx ecx, byte [edi + 1]
mov esi, 7
imul eax, eax, 0x101
add eax, ecx
lea esp, [esp]
movzx ecx, byte [edx - 1]
lea edx, [edx + 2]
imul eax, eax, 0x101
add ecx, eax
imul eax, ecx, 0x101
movzx ecx, byte [edx - 2]
add eax, ecx
and eax, 0x7fffff
dec esi
jne 0x10098460
push eax
mov ecx, ebx
call fcn.100981b0
add edi, 0x10
cmp edi, dword [ebp + 8]
jb 0x10098442
pop edi
pop esi
pop ebx
pop ebp
ret 4
mov ecx, 0x1011f818
call fcn.1001a0e0
push 1
call fcn.100a1eb2
int3

Function at 0x10098530
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ecx + 4]
mov edx, dword [ebp + 8]
shr eax, 4
cmp edx, eax
jb 0x10098580
push edx
push ecx
mov edx, str.ERROR:
mov ecx, 0x1011f818
call fcn.10015f90
mov edx, str.NextMatchingBlock_called_for_invalid_block_number
mov ecx, eax
call fcn.10015f90
add esp, 4
mov ecx, eax
call fcn.10042d10
push eax
call fcn.10088160
add esp, 4
cmp byte [0x10120b44], 0
jne 0x10098592
or eax, 0xffffffff
pop ebp
ret 8
mov eax, dword [ecx + 0x14]
push dword [ebp + 0xc]
push dword [eax + edx*4]
call fcn.100984b0
pop ebp
ret 8
mov ecx, 0x1011f818
call fcn.1001a0e0
push 1
call fcn.100a1eb2
int3
Function at 0x10098fe0
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Manually build aes constants

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, 0x10121620
mov word [0x10121b20], 0
push esi
dec eax
mov word [0x10121620], 0x301
push edi
mov edi, 0x10121620
mov byte [0x10121b23], 1
mov ebx, 2
sub edi, eax
lea esi, [eax + 2]
mov cl, byte [esi]
lea esi, [esi + 1]
mov dl, cl
mov al, cl
and dl, 0x80
neg dl
sbb dl, dl
add al, al
xor al, cl
and dl, 0x1b
xor al, dl
mov byte [edi + esi - 1], al
movzx eax, al
mov byte [eax + 0x10121b20], bl
inc ebx
cmp ebx, 0x100
jl 0x10099015
mov byte [0x101213a0], 0x63
mov ebx, 1
mov byte [0x10121503], 0
jmp 0x10099060
movzx eax, bl
mov ecx, 0x1012171f
movzx eax, byte [eax + 0x10121b20]
sub ecx, eax
mov cl, byte [ecx]
mov dl, cl
rol dl, 1
xor cl, dl
rol dl, 1
xor cl, dl
rol dl, 1
mov al, dl
rol al, 1
xor al, cl
xor al, dl
xor al, 0x63
mov byte [ebx + 0x101213a0], al
movzx eax, al
mov byte [eax + 0x101214a0], bl
inc ebx
cmp ebx, 0x100
jl 0x10099060
mov al, 1
mov edx, 0x101215a0
movzx ecx, al
mov dword [edx], ecx
mov cl, al
and cl, 0x80
neg cl
sbb cl, cl
add al, al
and cl, 0x1b
add edx, 4
xor al, cl
cmp edx, 0x10121618
jl 0x100990a8
mov ecx, dword [0x101151bc]
xor esi, esi
mov edi, 0xff
mov ah, byte [esi + 0x101213a0]
mov bl, ah
mov bh, ah
and bl, 0x80
mov al, bl
neg al
sbb al, al
add bh, bh
and al, 0x1b
mov dl, bh
xor dl, al
xor dl, ah
neg bl
movzx edx, dl
sbb bl, bl
movzx eax, ah
shl edx, 8
and bl, 0x1b
or edx, eax
xor bh, bl
mov bl, byte [esi + 0x101214a0]
shl edx, 8
or edx, eax
movzx eax, bh
shl edx, 8
or edx, eax
mov dword [esi*4 + 0x10121720], edx
test cl, cl
je 0x1009914c
test bl, bl
je 0x1009914c
movzx eax, cl
movzx edx, bl
movzx eax, byte [eax + 0x10121b20]
movzx edx, byte [edx + 0x10121b20]
add eax, edx
cdq
idiv edi
mov al, byte [edx + 0x10121620]
mov byte [ebp - 1], al
jmp 0x10099150
mov byte [ebp - 1], 0
test ch, ch
je 0x1009917c
test bl, bl
je 0x1009917c
movzx eax, ch
movzx edx, bl
movzx eax, byte [eax + 0x10121b20]
movzx edx, byte [edx + 0x10121b20]
add eax, edx
cdq
idiv edi
mov al, byte [edx + 0x10121620]
mov byte [ebp - 2], al
jmp 0x10099180
mov byte [ebp - 2], 0
mov al, byte [0x101151be]
test al, al
je 0x100991ae
test bl, bl
je 0x100991ae
movzx eax, al
movzx edx, bl
movzx eax, byte [eax + 0x10121b20]
movzx edx, byte [edx + 0x10121b20]
add eax, edx
cdq
idiv edi
mov bh, byte [edx + 0x10121620]
jmp 0x100991b0
xor bh, bh
mov al, byte [0x101151bf]
test al, al
je 0x100991de
test bl, bl
je 0x100991de
movzx eax, al
movzx edx, bl
movzx eax, byte [eax + 0x10121b20]
movzx edx, byte [edx + 0x10121b20]
add eax, edx
cdq
idiv edi
mov bl, byte [edx + 0x10121620]
jmp 0x100991e0
xor bl, bl
movzx edx, byte [ebp - 1]
movzx eax, byte [ebp - 2]
shl edx, 8
or edx, eax
movzx eax, bh
shl edx, 8
or edx, eax
movzx eax, bl
shl edx, 8
or edx, eax
mov dword [esi*4 + 0x10120fa0], edx
inc esi
cmp esi, 0x100
jl 0x100990d5
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100c2180
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
jmp 0x100c2250
push 0xffffffffffffffff
push 0x100d7ce8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov eax, dword [0x10113840]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov eax, dword [0x101146c8]
cmp eax, 0xffffffff
jne 0x100c2289
xor ebp, ebp
mov dword [esp + 0x14], ebp
jmp 0x100c2296
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebp, eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], ebp
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov dword [esp + 0x2c], 0
test ebp, ebp
je 0x100c22fd
jmp 0x100c22cc
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [ebp + 0x14], 0
mov edi, dword [ebp + 0xc]
jne 0x100c233a
test edi, edi
jne 0x100c2340
push 0x100c1e50
push 0x10120a58
call fcn.100c1af0
mov eax, dword [0x101146c8]
add esp, 8
cmp eax, 0xffffffff
je 0x100c22fd
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [esp + 0x2c], 0xffffffff
test ebp, ebp
je 0x100c2326
lea eax, [ebp + 4]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x100c2326
mov eax, dword [ebp]
mov ecx, ebp
push 0
call dword [eax]
push ebp
push 0
call esi
push eax
call ebx
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
test edi, edi
je 0x100c2378
mov edi, edi
mov eax, dword [edi + 4]
mov dword [ebp + 0xc], eax
mov ecx, dword [edi]
test ecx, ecx
je 0x100c2369
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [edi]
mov ecx, esi
push 0
mov eax, dword [esi]
call dword [eax]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0
call esi
push eax
call ebx
push edi
push 0
call esi
push eax
call ebx
mov edi, dword [ebp + 0xc]
test edi, edi
jne 0x100c2340
mov ebx, dword [ebp + 0x10]
lea eax, [ebp + 0x10]
mov dword [esp + 0x18], eax
mov esi, dword [ebx]
cmp esi, ebx
je 0x100c22c0
mov ebp, eax
mov edi, edi
cmp byte [esi + 0xd], 0
mov edi, esi
jne 0x100c23d7
mov eax, dword [esi + 8]
cmp byte [eax + 0xd], 0
jne 0x100c23bc
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0xd], 0
jne 0x100c23d7
jmp 0x100c23b0
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0xd], 0
je 0x100c23b0
jmp 0x100c23d7
mov eax, dword [esi + 4]
cmp byte [eax + 0xd], 0
jne 0x100c23d5
cmp esi, dword [eax + 8]
jne 0x100c23d5
mov esi, eax
mov eax, dword [eax + 4]
cmp byte [eax + 0xd], 0
je 0x100c23c5
mov esi, eax
mov ecx, dword [edi + 0x14]
test ecx, ecx
je 0x100c23eb
mov edx, dword [edi + 0x1c]
test edx, edx
je 0x100c23eb
mov eax, dword [ecx]
push edx
call dword [eax + 4]
push edi
lea eax, [esp + 0x24]
mov ecx, ebp
push eax
call fcn.100c1e80
cmp esi, ebx
jne 0x100c2390
mov ebp, dword [esp + 0x14]
jmp 0x100c22c0
Function at 0x100c2250
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
jmp 0x100c2250
push 0xffffffffffffffff
push 0x100d7ce8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov eax, dword [0x10113840]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov eax, dword [0x101146c8]
cmp eax, 0xffffffff
jne 0x100c2289
xor ebp, ebp
mov dword [esp + 0x14], ebp
jmp 0x100c2296
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebp, eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], ebp
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov dword [esp + 0x2c], 0
test ebp, ebp
je 0x100c22fd
jmp 0x100c22cc
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [ebp + 0x14], 0
mov edi, dword [ebp + 0xc]
jne 0x100c233a
test edi, edi
jne 0x100c2340
push 0x100c1e50
push 0x10120a58
call fcn.100c1af0
mov eax, dword [0x101146c8]
add esp, 8
cmp eax, 0xffffffff
je 0x100c22fd
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [esp + 0x2c], 0xffffffff
test ebp, ebp
je 0x100c2326
lea eax, [ebp + 4]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x100c2326
mov eax, dword [ebp]
mov ecx, ebp
push 0
call dword [eax]
push ebp
push 0
call esi
push eax
call ebx
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
test edi, edi
je 0x100c2378
mov edi, edi
mov eax, dword [edi + 4]
mov dword [ebp + 0xc], eax
mov ecx, dword [edi]
test ecx, ecx
je 0x100c2369
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [edi]
mov ecx, esi
push 0
mov eax, dword [esi]
call dword [eax]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0
call esi
push eax
call ebx
push edi
push 0
call esi
push eax
call ebx
mov edi, dword [ebp + 0xc]
test edi, edi
jne 0x100c2340
mov ebx, dword [ebp + 0x10]
lea eax, [ebp + 0x10]
mov dword [esp + 0x18], eax
mov esi, dword [ebx]
cmp esi, ebx
je 0x100c22c0
mov ebp, eax
mov edi, edi
cmp byte [esi + 0xd], 0
mov edi, esi
jne 0x100c23d7
mov eax, dword [esi + 8]
cmp byte [eax + 0xd], 0
jne 0x100c23bc
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0xd], 0
jne 0x100c23d7
jmp 0x100c23b0
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0xd], 0
je 0x100c23b0
jmp 0x100c23d7
mov eax, dword [esi + 4]
cmp byte [eax + 0xd], 0
jne 0x100c23d5
cmp esi, dword [eax + 8]
jne 0x100c23d5
mov esi, eax
mov eax, dword [eax + 4]
cmp byte [eax + 0xd], 0
je 0x100c23c5
mov esi, eax
mov ecx, dword [edi + 0x14]
test ecx, ecx
je 0x100c23eb
mov edx, dword [edi + 0x1c]
test edx, edx
je 0x100c23eb
mov eax, dword [ecx]
push edx
call dword [eax + 4]
push edi
lea eax, [esp + 0x24]
mov ecx, ebp
push eax
call fcn.100c1e80
cmp esi, ebx
jne 0x100c2390
mov ebp, dword [esp + 0x14]
jmp 0x100c22c0
Function at 0x42fb40
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x42fb6d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x42fb6d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x435540
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x20000]
push edi
or ebp, 0xffffffff
jmp 0x435562
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x435569
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x435558
mov eax, 1
add ebx, ebx
jne 0x43557b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x435570
jne 0x43558c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x435570
xor ecx, ecx
sub eax, 3
jb 0x4355a0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x435612
mov ebp, eax
add ebx, ebx
jne 0x4355ab
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4355b8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4355dc
inc ecx
add ebx, ebx
jne 0x4355c8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4355bd
jne 0x4355d9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4355bd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4355fc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4355ed
jmp 0x43555e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4355fc
add edi, ecx
jmp 0x43555e
pop esi
lea edi, [esi + 0x33000]
mov eax, dword [edi]
or eax, eax
je 0x435664
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x35000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x35094]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x435619
mov ecx, edi
jns 0x435648
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x3509c]
or eax, eax
je 0x43565e
mov dword [ebx], eax
add ebx, 4
jmp 0x435636
call dword [esi + 0x35098]
mov ebp, dword [esi + 0x350a0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x207]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x435698
sub esp, 0xffffff80
jmp 0x411fa7