joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10046780
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x90
mov esi, esp
mov dword [esi + 0x78], ebp
mov dword [esi + 0x18], edx
mov dword [esi + 0x1c], ecx
lea ecx, [esi + 0x80]
mov dword [ecx - 4], esp
xor ebx, ebx
dec ebx
mov dword [ecx + 8], ebx
mov dword [ecx + 4], 0x100556d0
mov eax, dword fs:[0]
mov dword [ecx], eax
mov dword fs:[0], ecx
xor eax, eax
lea ecx, [esi + 0x29]
mov dword [ecx + 3], eax
mov dword [ecx - 1], 0x25
mov edi, dword [ebp + 8]
mov edx, 0x1019d7b2
push dword [edi + 4]
push eax
call fcn.10052dca
add esp, 8
mov dword [esi + 0xc], esp
lea edi, [esi + 0x30]
mov dword [edi + 8], ebx
mov dword [edi + 4], ebx
mov dword [edi], ebx
mov byte [edi + 0xc], 0xff
sub esp, 0x1c
mov ebx, esp
lea ecx, [ebx + 8]
call fcn.10041423
mov dword [ebx], edi
mov dword [ebx + 4], 0xd
lea eax, [esi + 0x28]
mov dword [ebx + 0x14], eax
mov eax, dword [ebp + 0x10]
mov dword [ebx + 0x18], eax
call fcn.1005859e
add esp, 0x1c
mov esp, dword [esi + 0xc]
lea edx, [esi + eax]
add edx, 0x30
mov dword [esi + 0x20], edx
mov ecx, edi
push dword [ebp + 8]
call fcn.100460ec
add esp, 4
pcmpeqd xmm0, xmm0
lea ebx, [esi + 0x40]
movdqu xmmword [ebx + 0x1e], xmm0
movdqa xmmword [ebx + 0x10], xmm0
movdqa xmmword [ebx], xmm0
lea edx, [esi + 0x14]
xor ecx, ecx
dec ecx
mov dword [edx], ecx
lea edx, [esi + 0x10]
mov dword [edx], ecx
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx + 0x1c]
lea edx, [esi + 0x24]
mov dword [edx], ecx
mov dword [esi + 0xc], ecx
lock inc dword [ecx + 4]
lea ecx, [esi + 0x80]
xor edx, edx
mov dword [ecx + 8], edx
mov ecx, edi
mov edx, eax
lea eax, [esi + 0x24]
push eax
lea eax, [esi + 0x10]
push eax
lea eax, [esi + 0x14]
push eax
push ebx
push dword [esi + 0x20]
call fcn.10047f50
add esp, 0x14
movzx edx, word [ebp + 0xc]
xor eax, eax
dec eax
mov ecx, dword [esi + 0xc]
lock xadd dword [ecx + 4], eax
test eax, eax
jne 0x100468c7
mov ebx, dword [esi + 0xc]
mov eax, dword [ebx]
mov edi, dword [eax + 4]
mov dword [esi + 0x88], 0xffffffff
mov ecx, edi
call dword [section..00cfg]
mov ecx, ebx
call edi
movzx edx, word [ebp + 0xc]
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
mov dword [esi + 0x88], 0xffffffff
movzx edx, dx
push edx
push dword [ebp + 8]
push eax
push ecx
lea eax, [esi + 0x40]
push eax
push dword [esi + 0x18]
mov edi, dword [esi + 0x1c]
push edi
call fcn.10047530
add esp, 0x1c
mov eax, dword [esi + 0x80]
mov dword fs:[0], eax
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10046970
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xd0
mov esi, esp
mov dword [esi + 0xb8], ebp
mov dword [esi + 0x18], edx
mov dword [esi + 0x1c], ecx
lea ecx, [esi + 0xc0]
mov dword [ecx - 4], esp
xor ebx, ebx
dec ebx
mov dword [ecx + 8], ebx
mov dword [ecx + 4], 0x100556e0
mov eax, dword fs:[0]
mov dword [ecx], eax
mov dword fs:[0], ecx
xor eax, eax
lea ecx, [esi + 0x29]
mov dword [ecx + 3], eax
mov dword [ecx - 1], 0x25
mov edi, dword [ebp + 8]
mov edx, 0x1019d7d7
push dword [edi + 4]
push eax
call fcn.10052dca
add esp, 8
mov dword [esi + 0xc], esp
lea edi, [esi + 0x30]
mov dword [edi + 0x14], ebx
mov dword [edi + 0x10], ebx
pcmpeqd xmm0, xmm0
movdqa xmmword [edi], xmm0
sub esp, 0x20
mov ebx, esp
lea ecx, [ebx + 8]
call fcn.10041423
mov dword [ebx], edi
mov dword [ebx + 4], 0x18
lea eax, [esi + 0x28]
mov dword [ebx + 0x14], eax
mov eax, dword [ebp + 0x14]
mov dword [ebx + 0x1c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebx + 0x18], eax
call fcn.1005859e
add esp, 0x20
mov esp, dword [esi + 0xc]
lea ebx, [esi + eax]
add ebx, 0x30
mov ecx, edi
mov edx, ebx
push dword [ebp + 8]
call fcn.100460ec
add esp, 4
mov dword [esi + 0x20], eax
lea eax, [esi + 0x50]
pcmpeqd xmm0, xmm0
movdqu xmmword [eax + 0x4a], xmm0
movdqa xmmword [eax + 0x40], xmm0
movdqa xmmword [eax + 0x30], xmm0
movdqa xmmword [eax + 0x20], xmm0
movdqa xmmword [eax + 0x10], xmm0
movdqa xmmword [eax], xmm0
lea edx, [esi + 0x14]
xor ecx, ecx
dec ecx
mov dword [edx], ecx
lea edx, [esi + 0x10]
mov dword [edx], ecx
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx + 0x1c]
lea edx, [esi + 0x24]
mov dword [edx], ecx
mov dword [esi + 0xc], ecx
lock inc dword [ecx + 4]
lea ecx, [esi + 0xc0]
xor edx, edx
mov dword [ecx + 8], edx
mov ecx, edi
mov edx, dword [esi + 0x20]
lea edi, [esi + 0x24]
push edi
lea edi, [esi + 0x10]
push edi
lea edi, [esi + 0x14]
push edi
push eax
push ebx
call fcn.10047f50
add esp, 0x14
movzx edx, word [ebp + 0xc]
xor eax, eax
dec eax
mov ecx, dword [esi + 0xc]
lock xadd dword [ecx + 4], eax
test eax, eax
jne 0x10046ad2
mov ebx, dword [esi + 0xc]
mov eax, dword [ebx]
mov edi, dword [eax + 4]
mov dword [esi + 0xc8], 0xffffffff
mov ecx, edi
call dword [section..00cfg]
mov ecx, ebx
call edi
movzx edx, word [ebp + 0xc]
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
mov dword [esi + 0xc8], 0xffffffff
movzx edx, dx
push edx
push dword [ebp + 8]
push eax
push ecx
lea eax, [esi + 0x50]
push eax
push dword [esi + 0x18]
mov edi, dword [esi + 0x1c]
push edi
call fcn.10047530
add esp, 0x1c
mov eax, dword [esi + 0xc0]
mov dword fs:[0], eax
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10058b5d
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
push 8
call fcn.10145ba4
add esp, 4
mov dword [eax], ebx
mov dword [eax + 4], edi
xor ecx, ecx
push ecx
push ecx
push eax
push 0x10058bb0
push ecx
push ecx
call fcn.101555ba
add esp, 0x18
mov dword [esi], eax
test eax, eax
je 0x10058b9c
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
pop esi
pop edi
pop ebx
pop ebp
jmp dword [sym.imp.KERNEL32.dll_GetLastError]

Function at 0x1005a1f0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ebx, dword [0x101bee38]
test ebx, ebx
jne 0x1005a290
push 0x28
call fcn.10145ba4
add esp, 4
mov esi, eax
mov dword [eax], 0
mov dword [eax + 4], 0
mov byte [eax + 8], 0
push 0xc
call fcn.10145ba4
add esp, 4
mov dword [esi + 0xc], eax
lea ecx, [eax + 0xc]
mov dword [esi + 0x14], ecx
test eax, eax
je 0x1005a29a
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 8], 0
mov dword [esi + 0x10], ecx
mov eax, esi
add eax, 0x1c
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x18], eax
mov dword [esi + 0x24], 1
mov dword [0x101bee38], esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
test eax, eax
je 0x1005a29d
mov edi, eax
push eax
call fcn.10163aa4
add esp, 4
mov ecx, esi
push eax
push edi
call fcn.1005a2a0
test ebx, ebx
sete al
pop esi
pop edi
pop ebx
pop ebp
ret
int3
int3
Function at 0x10060480
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
and esp, 0xfffffff8
sub esp, 0x10
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov edx, dword [0x101b9014]
xor edx, ebp
mov dword [esp + 0xc], edx
mov dword [esp + 4], 0
mov dword [esp], 0
mov dword [esp + 8], 0
mov esi, esp
push esi
push ecx
push eax
call fcn.10078c10
add esp, 0xc
cmp byte [esp + 0xb], 0
jns 0x100604cb
mov esi, dword [esp]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov esi, eax
cmp byte [esp + 0xb], 0
jns 0x100604e8
push dword [esp]
call fcn.10145bd4
add esp, 4
test esi, esi
setne bl
mov ecx, dword [esp + 0xc]
xor ecx, ebp
call fcn.101465a3
mov eax, ebx
lea esp, [ebp - 8]
pop esi
pop ebx
pop ebp
ret 8

Function at 0x10060510
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x18
mov ebx, edx
mov edi, ecx
mov eax, dword [0x101b9014]
xor eax, ebp
mov dword [esp + 0x10], eax
mov dword [esp + 4], 0
mov dword [esp], 0
mov dword [esp + 8], 0
mov esi, esp
push esi
push edx
push ecx
call fcn.10078c10
add esp, 0xc
cmp byte [esp + 0xb], 0
jns 0x10060559
mov esi, dword [esp]
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esi, eax
cmp byte [esp + 0xb], 0
js 0x10060578
cmp dword [ebp + 8], 0
jne 0x1006058d
jmp 0x10060657
push dword [esp]
call fcn.10145bd4
add esp, 4
cmp dword [ebp + 8], 0
je 0x10060657
test esi, esi
je 0x10060657
lea eax, [esi + esi]
test esi, esi
mov ecx, 0xffffffff
cmovns ecx, eax
push ecx
call fcn.10145c03
add esp, 4
mov ecx, edi
mov edi, eax
mov dword [esp + 4], 0
mov dword [esp], 0
mov dword [esp + 8], 0
mov eax, ebx
mov ebx, esp
push ebx
push eax
push ecx
call fcn.10078c10
add esp, 0xc
cmp byte [esp + 0xb], 0
jns 0x100605df
mov ebx, dword [esp]
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
cmp byte [esp + 0xb], 0
jns 0x100605fa
push dword [esp]
call fcn.10145bd4
add esp, 4
test edi, edi
mov ebx, dword [ebp + 8]
je 0x10060671
push edi
call fcn.10163aa4
add esp, 4
mov dword [esp + 4], 0
mov dword [esp], 0
mov dword [esp + 8], 0
mov ecx, esp
push ecx
push eax
push edi
call fcn.10078390
add esp, 0xc
cmp byte [ebx + 0xb], 0
jns 0x1006063e
push dword [ebx]
call fcn.10145bd4
add esp, 4
mov eax, dword [esp + 8]
mov dword [ebx + 8], eax
movsd xmm0, qword [esp]
movsd qword [ebx], xmm0
push edi
call fcn.10145c0c
add esp, 4
test esi, esi
setne bl
mov ecx, dword [esp + 0x10]
xor ecx, ebp
call fcn.101465a3
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
int3
Function at 0x1006a2b0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
mov esi, dword [ebp + 0x10]
mov eax, dword [0x101b9014]
xor eax, ebp
mov dword [esp + 0x38], eax
cvtsi2sd xmm0, dword [ebp + 0xc]
movsd qword [esp], xmm0
call fcn.10162220
fstp qword [esp + 0x28]
mov eax, dword [esi]
mov ecx, dword [esi + 4]
sub ecx, eax
cmp ecx, 4
jbe 0x1006a494
mov ebx, dword [ebp + 8]
movsd xmm0, qword [esp + 0x28]
movsd qword [esp + 0x10], xmm0
mov dword [eax + 4], ebx
mov ecx, dword [esi]
mov eax, dword [esi + 4]
mov edi, eax
sub edi, ecx
sar edi, 2
lea edx, [edi - 1]
cmp edx, 3
jb 0x1006a3e7
mov eax, edi
neg eax
mov dword [esp + 0xc], eax
add edi, 0xfffffffd
mov esi, 2
nop word [eax + eax]
xorps xmm0, xmm0
cvtsi2sd xmm0, ebx
movsd qword [esp], xmm0
call fcn.10162220
fstp qword [esp + 0x30]
lea eax, [esp + 0x30]
mov dword [esp], eax
call fcn.10012050
movsd xmm0, qword [esp + 0x30]
movsd xmm1, qword [esp + 0x10]
subsd xmm1, xmm0
mov dword [esp + 8], edi
movd xmm2, edi
por xmm2, xmmword [0x1019da00]
subsd xmm2, qword [0x1019d9f8]
divsd xmm1, xmm2
addsd xmm1, xmm0
movsd qword [esp], xmm1
call fcn.10160520
fstp qword [esp + 0x20]
mov eax, dword [ebp + 0x10]
mov edi, dword [eax]
mov eax, dword [eax + 4]
sub eax, edi
sar eax, 2
cmp eax, esi
jbe 0x1006a491
movsd xmm0, qword [esp + 0x20]
movsd qword [esp], xmm0
call fcn.1017239a
fstp qword [esp + 0x18]
cvttsd2si eax, qword [esp + 0x18]
cmp ebx, eax
lea ebx, [ebx + 1]
cmovl ebx, eax
mov dword [edi + esi*4], ebx
mov eax, dword [esp + 0xc]
add eax, esi
inc eax
inc esi
mov edi, dword [esp + 8]
dec edi
cmp eax, 0xffffffff
jne 0x1006a330
mov esi, dword [ebp + 0x10]
mov ecx, dword [esi]
mov eax, dword [esi + 4]
cmp eax, ecx
je 0x1006a497
mov dword [eax - 4], 0x7fffffff
mov ecx, dword [esi]
mov esi, dword [esi + 4]
mov edx, esi
sub edx, ecx
je 0x1006a416
mov eax, edx
sar eax, 2
mov edi, ecx
not edi
add edi, esi
mov dword [esp + 8], edx
jne 0x1006a41a
xor esi, esi
jmp 0x1006a45e
xor eax, eax
jmp 0x1006a478
mov ebx, edx
and ebx, 0xfffffffe
xor esi, esi
nop word cs:[eax + eax]
movzx edi, al
movzx edx, byte [ecx + esi]
xor edx, edi
shr eax, 8
xor eax, dword [edx*4 + 0x101a3a68]
movzx edx, al
movzx edi, byte [ecx + esi + 1]
xor edi, edx
shr eax, 8
xor eax, dword [edi*4 + 0x101a3a68]
add esi, 2
cmp ebx, esi
jne 0x1006a430
test byte [esp + 8], 1
je 0x1006a478
movzx edx, al
movzx ecx, byte [ecx + esi]
xor ecx, edx
shr eax, 8
xor eax, dword [ecx*4 + 0x101a3a68]
mov ecx, dword [ebp + 0x10]
mov dword [ecx + 0xc], eax
mov ecx, dword [esp + 0x38]
xor ecx, ebp
call fcn.101465a3
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
int3
int3
int3
Function at 0x1006b550
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov dword [ebp - 0x10], edx
mov eax, dword [ebp + 8]
mov edx, dword [eax]
mov ebx, dword [eax + 4]
mov esi, ebx
sub esi, edx
sar esi, 2
lea edi, [esi - 1]
cmp edi, 2
jb 0x1006b603
cvtsi2sd xmm0, ecx
cvtsi2sd xmm1, dword [ebp - 0x10]
add esi, 0xfffffffd
movd xmm2, esi
por xmm2, xmmword [0x1019da00]
subsd xmm2, qword [0x1019d9f8]
mov ecx, 1
movq xmm3, qword [0x1019d9f8]
movsd xmm4, qword [0x1018b6c0]
mov ebx, dword [ebp + 8]
nop dword [eax]
mov edx, dword [ebx]
mov eax, dword [ebx + 4]
sub eax, edx
sar eax, 2
cmp eax, ecx
jbe 0x1006b695
movd xmm5, esi
por xmm5, xmm3
subsd xmm5, xmm3
mulsd xmm5, xmm0
lea eax, [ecx - 1]
movd xmm6, eax
por xmm6, xmm3
subsd xmm6, xmm3
mulsd xmm6, xmm1
addsd xmm6, xmm5
divsd xmm6, xmm2
addsd xmm6, xmm4
cvttsd2si eax, xmm6
mov dword [edx + ecx*4], eax
dec esi
inc ecx
cmp ecx, edi
jne 0x1006b5b0
mov edx, dword [ebx]
mov ebx, dword [ebx + 4]
cmp ebx, edx
je 0x1006b698
mov dword [ebx - 4], 0x7fffffff
mov edi, dword [ebp + 8]
mov edx, dword [edi]
mov esi, dword [edi + 4]
mov ebx, esi
sub ebx, edx
je 0x1006b634
mov ecx, ebx
sar ecx, 2
mov edi, edx
not edi
add edi, esi
mov dword [ebp - 0x10], ebx
jne 0x1006b638
xor esi, esi
jmp 0x1006b66e
xor ecx, ecx
jmp 0x1006b68a
and ebx, 0xfffffffe
xor esi, esi
nop dword [eax]
movzx edi, cl
movzx eax, byte [edx + esi]
xor eax, edi
shr ecx, 8
xor ecx, dword [eax*4 + 0x101a3a68]
movzx eax, cl
movzx edi, byte [edx + esi + 1]
xor edi, eax
shr ecx, 8
xor ecx, dword [edi*4 + 0x101a3a68]
add esi, 2
cmp ebx, esi
jne 0x1006b640
test byte [ebp - 0x10], 1
mov edi, dword [ebp + 8]
je 0x1006b68a
movzx eax, cl
movzx edx, byte [edx + esi]
xor edx, eax
shr ecx, 8
xor ecx, dword [edx*4 + 0x101a3a68]
mov dword [edi + 0xc], ecx
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
int3
int3
Function at 0x10071f20
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x18
mov edx, dword [ebp + 8]
mov eax, edx
sar eax, 0x1f
mov esi, dword [ebp + 0xc]
mov edi, esi
sar edi, 0x1f
mov ecx, dword [0x101b9014]
xor ecx, ebp
sub esi, edx
sbb edi, eax
mov dword [esp + 0x10], ecx
add esi, 1
adc edi, 0
mov dword [esp], edi
push edi
mov dword [esp + 8], esi
push esi
push 0xffffffffffffffff
push 0xffffffffffffffff
call fcn.1016c7e0
mov edi, 0xfffffffe
sub edi, eax
mov esi, 0xffffffff
sbb esi, edx
lea ebx, [esp + 8]
nop word cs:[eax + eax]
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], 0xffffffff
push 8
push ebx
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x10071fd4
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
cmp edi, eax
mov edx, esi
sbb edx, ecx
jb 0x10071f80
push dword [esp]
push dword [esp + 8]
push ecx
push eax
call fcn.1016c7e0
mov esi, eax
add esi, dword [ebp + 8]
mov ecx, dword [esp + 0x10]
xor ecx, ebp
call fcn.101465a3
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
int3

Function at 0x10071fe0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov dword [ecx], 0x1019b648
cmp byte [ecx + 0x2c], 0
je 0x1007203d
mov eax, dword [0x101beeb8]
mov ecx, dword [0x101bd164]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x1007205b
push dword [0x101bac5c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
and eax, 0xfffffffc
je 0x1007203d
mov ecx, dword [0x101beeb0]
mov dword [eax + ecx*8], 0
mov ecx, dword [0x101beeb4]
mov edx, dword [0x101beeb0]
mov dword [eax + edx*8 + 4], ecx
lea ecx, [esi + 0x10]
call fcn.100720b0
mov eax, dword [esi + 4]
test eax, eax
je 0x10072058
mov dword [esi + 8], eax
push eax
call fcn.10145bd4
add esp, 4
pop esi
pop ebp
ret
push 0x101beeb8
call fcn.10145c47
add esp, 4
cmp dword [0x101beeb8], 0xffffffff
jne 0x1007200f
mov dword [0x101beeb4], 0
mov dword [0x101beeb0], 0xffffffff
mov ecx, 0x101beeb0
push 0
call fcn.1007a5a0
push 0x101beeb8
call fcn.10145cbd
add esp, 4
jmp 0x1007200f
Function at 0x10072210
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
mov eax, dword [0x101beeb8]
mov ecx, dword [0x101bd164]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x100722ac
mov edi, dword [ebp + 8]
push dword [0x101bac5c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
xor ecx, ecx
and eax, 0xfffffffc
je 0x10072260
mov edx, dword [0x101beeb0]
mov ebx, dword [eax + edx*8 + 4]
cmp ebx, dword [0x101beeb4]
jne 0x10072260
mov ecx, dword [eax + edx*8]
mov dword [esi], ecx
mov dword [esi + 4], edi
mov dword [esi + 8], 0
mov byte [esi + 0xc], 1
call fcn.100bdc80
mov eax, dword [eax]
mov dword [esi + 0x10], eax
test eax, eax
je 0x10072282
lock inc dword [eax + 4]
push 8
call fcn.10145ba4
add esp, 4
mov dword [eax], 0
mov byte [eax + 4], 0
mov dword [esi + 0x14], eax
test eax, eax
je 0x100722a0
lock inc dword [eax]
mov dword [esi + 0x18], esi
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret 4
push 0x101beeb8
call fcn.10145c47
add esp, 4
cmp dword [0x101beeb8], 0xffffffff
jne 0x10072235
mov dword [0x101beeb4], 0
mov dword [0x101beeb0], 0xffffffff
mov ecx, 0x101beeb0
push 0
call fcn.1007a5a0
push 0x101beeb8
call fcn.10145cbd
add esp, 4
jmp 0x10072235
Function at 0x100731b0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x101beeb8]
mov ecx, dword [0x101bd164]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x1007320c
push dword [0x101bac5c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
and eax, 0xfffffffc
je 0x10073208
mov ecx, dword [0x101beeb0]
mov edx, dword [eax + ecx*8 + 4]
cmp edx, dword [0x101beeb4]
jne 0x10073208
mov eax, dword [eax + ecx*8]
test eax, eax
je 0x10073208
mov ecx, dword [eax + 8]
sub ecx, dword [eax + 4]
cmp ecx, 5
setae al
pop ebp
ret
xor eax, eax
pop ebp
ret
push 0x101beeb8
call fcn.10145c47
add esp, 4
cmp dword [0x101beeb8], 0xffffffff
jne 0x100731d0
mov dword [0x101beeb4], 0
mov dword [0x101beeb0], 0xffffffff
mov ecx, 0x101beeb0
push 0
call fcn.1007a5a0
push 0x101beeb8
call fcn.10145cbd
add esp, 4
jmp 0x100731d0

Function at 0x10073260
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov eax, dword [0x101beeb8]
mov ecx, dword [0x101bd164]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x100732ba
mov esi, dword [ebp + 8]
push dword [0x101bac5c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
xor ecx, ecx
and eax, 0xfffffffc
je 0x100732ad
mov edx, dword [0x101beeb0]
mov edi, dword [eax + edx*8 + 4]
cmp edi, dword [0x101beeb4]
jne 0x100732ad
mov ecx, dword [eax + edx*8]
add ecx, 0x10
push esi
call fcn.10073300
pop esi
pop edi
pop ebp
ret
push 0x101beeb8
call fcn.10145c47
add esp, 4
cmp dword [0x101beeb8], 0xffffffff
jne 0x10073282
mov dword [0x101beeb4], 0
mov dword [0x101beeb0], 0xffffffff
mov ecx, 0x101beeb0
push 0
call fcn.1007a5a0
push 0x101beeb8
call fcn.10145cbd
add esp, 4
jmp 0x10073282

Function at 0x100733f0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov eax, dword [0x101beeb8]
mov ecx, dword [0x101bd164]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x1007344a
mov esi, dword [ebp + 8]
push dword [0x101bac5c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
xor ecx, ecx
and eax, 0xfffffffc
je 0x1007343d
mov edx, dword [0x101beeb0]
mov edi, dword [eax + edx*8 + 4]
cmp edi, dword [0x101beeb4]
jne 0x1007343d
mov ecx, dword [eax + edx*8]
add ecx, 0x10
push esi
call fcn.10073490
pop esi
pop edi
pop ebp
ret
push 0x101beeb8
call fcn.10145c47
add esp, 4
cmp dword [0x101beeb8], 0xffffffff
jne 0x10073412
mov dword [0x101beeb4], 0
mov dword [0x101beeb0], 0xffffffff
mov ecx, 0x101beeb0
push 0
call fcn.1007a5a0
push 0x101beeb8
call fcn.10145cbd
add esp, 4
jmp 0x10073412
Function at 0x10079710
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov eax, dword [0x101b9014]
xor eax, ebp
mov dword [esp + 0x58], eax
mov ebx, dword [0x101bee38]
mov dword [esp + 0x10], str.enable_low_end_device_mode
mov dword [esp + 0x14], 0x1a
lea ecx, [ebx + 0x18]
add ebx, 0x1c
lea esi, [esp + 0x10]
lea eax, [esp + 0xc]
push esi
push eax
call fcn.1005d390
mov eax, dword [esp + 0xc]
mov dword [esp + 8], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x10], xmm0
movdqa xmmword [esp + 0x40], xmm0
movdqa xmmword [esp + 0x30], xmm0
movdqa xmmword [esp + 0x20], xmm0
mov dword [esp + 0x10], 0x40
push esi
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov edi, eax
mov esi, eax
test eax, eax
je 0x10079795
mov edi, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
cmp dword [esp + 8], ebx
jne 0x100797ac
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.101465a3
mov eax, esi
mov edx, edi
jmp 0x100797ce
cmp esi, 0x20000000
mov eax, 0x20000000
cmovae esi, eax
test edi, edi
cmovne esi, eax
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.101465a3
mov eax, esi
xor edx, edx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x100797e0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov eax, dword [0x101ce500]
mov ecx, dword [0x101bd164]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x10079862
mov esi, dword [ebp + 8]
push dword [0x101bac5c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
xor edi, edi
and eax, 0xfffffffc
je 0x1007982d
mov ecx, dword [0x101ce4f8]
mov edx, dword [eax + ecx*8 + 4]
cmp edx, dword [0x101ce4fc]
jne 0x1007982d
mov edi, dword [eax + ecx*8]
mov eax, edi
shr eax, 0xe
mov ecx, edi
shr ecx, 0x13
mov ecx, dword [ecx*4 + 0x101c1e84]
bt ecx, eax
jae 0x1007984e
push edi
call fcn.10069180
add esp, 4
jmp 0x1007985a
mov eax, edi
shr eax, 0x15
mov byte [eax + 0x101c9e84], 1
mov dword [esi], edi
mov eax, esi
pop esi
pop edi
pop ebp
ret
push 0x101ce500
call fcn.10145c47
add esp, 4
cmp dword [0x101ce500], 0xffffffff
jne 0x10079802
mov dword [0x101ce4fc], 0
mov dword [0x101ce4f8], 0xffffffff
mov ecx, 0x101ce4f8
push 0
call fcn.1007a5a0
push 0x101ce500
call fcn.10145cbd
add esp, 4
jmp 0x10079802

Function at 0x10079c00
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x101bef38]
mov ecx, dword [0x101bd164]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x10079c4c
push dword [0x101bac5c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
and eax, 0xfffffffc
je 0x10079c91
mov ecx, dword [0x101bef30]
mov edx, dword [eax + ecx*8 + 4]
cmp edx, dword [0x101bef34]
jne 0x10079c91
mov eax, dword [eax + ecx*8]
test eax, eax
je 0x10079c91
pop ebp
ret
push 0x101bef38
call fcn.10145c47
add esp, 4
cmp dword [0x101bef38], 0xffffffff
jne 0x10079c20
mov dword [0x101bef34], 0
mov dword [0x101bef30], 0xffffffff
mov ecx, 0x101bef30
push 0
call fcn.1007a5a0
push 0x101bef38
call fcn.10145cbd
add esp, 4
jmp 0x10079c20
int3