joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10010070
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10
lea eax, [esp]
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
jne 0x1001009f
mov eax, dword [ebp + 8]
mov dword [eax], 0
mov dword [eax + 4], 0
pop edi
pop esi
mov esp, ebp
pop ebp
ret
cmp dword [esp + 0xc], 0
jg 0x100100af
jl 0x10010089
cmp dword [esp + 8], 0
jbe 0x10010089
mov edi, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea eax, [esp + 0x10]
push eax
xor esi, esi
call edi
test eax, eax
jne 0x100100d3
inc esi
cmp esi, 3
ja 0x10010089
lea eax, [esp + 0x10]
push eax
call edi
test eax, eax
je 0x100100c2
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
call fcn.100abe80
mulsd xmm0, qword [0x10105ff0]
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 8]
movsd qword [esp + 0x10], xmm0
call fcn.100abe80
movsd xmm1, qword [esp + 0x10]
divsd xmm1, xmm0
movaps xmm0, xmm1
call fcn.100abdd0
mov ecx, dword [ebp + 8]
pop edi
pop esi
mov dword [ecx], eax
mov eax, ecx
mov dword [ecx + 4], edx
mov esp, ebp
pop ebp
ret

Function at 0x10010120
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100dcf69
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x3c
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], vtable.boost::detail::thread_data_base.0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [ebp - 4], 0
lea esi, [edi + 0x14]
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
push 0x20
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.100aaff9
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
push 0
push 0
push 1
push 0
mov byte [ebp - 4], 3
invalid
invalid
xor bh, al
stosb byte es:[edi], al
Function at 0x10013a70
Capabilities:
Terminate process

Disassembly:
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0xffffffffffffffff
call fcn.100b6d74
int3

Function at 0x1001f310
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x10]
xor ecx, ecx
test esi, esi
je 0x1001f33b
mov edx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x1001f324
pop edi
mov eax, edx
pop esi
pop ebp
ret
mov eax, dword [ebp + 8]
pop esi
pop ebp
ret

Function at 0x100216b0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov edx, 0x811c9dc5
push edi
mov edi, dword [ebp + 8]
mov ecx, 0
sub esi, edi
je 0x100216e1
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x100216d0
pop edi
mov eax, edx
pop esi
pop ebp
ret 8

Function at 0x10022d60
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, ecx
xor cl, cl
mov eax, dword [esi + 0x4c]
cmp eax, 0xffffffff
je 0x10022e20
nop dword [eax + eax]
Function at 0x10027210
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x101151a4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, ecx
mov ebx, edx
push 0x24
mov dword [ebp - 0x14], esi
call fcn.100bdccb
mov edi, eax
add esp, 4
test edi, edi
je 0x100273dd
push 5
mov dword [edi], 0
mov dword [edi + 4], esi
mov dword [edi + 8], ebx
mov dword [edi + 0xc], 0
mov dword [edi + 0x18], 5
mov dword [edi + 0x1c], 0x19
mov dword [edi + 0x20], 0
call fcn.100bdccb
mov ecx, eax
add esp, 4
mov dword [ebp - 0x10], ecx
mov dword [edi + 0x10], ecx
test ecx, ecx
jne 0x10027298
push edi
call fcn.100b91f4
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100aba16
mov esp, ebp
pop ebp
ret
mov eax, dword [esi]
mov dword [ecx], eax
mov al, byte [esi + 4]
push 0x19
push 1
mov byte [ecx + 4], al
call fcn.100b6d8a
mov ebx, eax
add esp, 8
mov dword [edi + 0x14], ebx
test ebx, ebx
jne 0x100272db
push dword [ebp - 0x10]
call fcn.100b91f4
push edi
call fcn.100b91f4
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100aba16
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 8]
push eax
push 0x40
push 5
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x100273c6
test esi, esi
je 0x100273c6
lea eax, [ebp - 0xc]
push eax
push 0x40
push 0x19
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x100273c6
mov eax, dword [0x1011bc7c]
xor esi, esi
mov edx, dword [ebp - 0x14]
test eax, eax
mov ecx, 0x100270c0
cmovne ecx, eax
mov dword [ebp - 8], ecx
nop dword [eax + eax]
lea eax, [esi + edx]
mov dword [ebp - 0x10], 0
lea edx, [ebp - 0x10]
mov dword [ebp - 0x18], eax
push edx
push eax
call ecx
add esp, 8
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x1002739c
push eax
push dword [ebp - 0x18]
lea eax, [ebx + esi]
push eax
call fcn.100ad440
mov eax, dword [ebp - 0x10]
add esp, 0xc
mov edx, dword [ebp - 0x14]
test eax, eax
jle 0x10027372
lea ecx, [ebx + eax]
mov eax, edx
sub eax, ebx
add dword [ecx + esi], eax
add esi, dword [ebp - 0x1c]
mov ecx, dword [ebp - 8]
cmp esi, 5
jb 0x10027330
lea eax, [esi + 5]
mov byte [ebx + esi], 0xe9
lea ecx, [ebx + esi]
mov dword [ebp - 8], eax
mov dword [edi + 0x20], eax
sub esi, ecx
lea eax, [edx - 5]
add eax, esi
mov dword [ecx + 1], eax
mov eax, dword [ebp - 8]
jmp 0x1002739f
mov eax, dword [edi + 0x20]
test eax, eax
jne 0x100273b3
push ebx
call fcn.100b91f4
add esp, 4
mov dword [edi + 0x14], 0
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100aba16
mov esp, ebp
pop ebp
ret
push ebx
call fcn.100b91f4
push dword [edi + 0x10]
call fcn.100b91f4
push edi
call fcn.100b91f4
add esp, 0xc
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100aba16
mov esp, ebp
pop ebp
ret
Function at 0x1002a5d0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100deae0
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x101151a4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea edx, [esi + 0x4c]
mov dword [esi], vtable.CryptoPP::StreamTransformationFilter.0
mov dword [esi + 4], vtable.CryptoPP::StreamTransformationFilter.1.0
mov dword [edx], vtable.CryptoPP::FilterPutSpaceHelper.0
mov eax, dword [edx + 8]
cmp eax, dword [edx + 0xc]
mov dword [ebp - 4], 0
sbb ecx, ecx
xor al, al
and ecx, 0xfffffffc
add ecx, 0xc
add ecx, edx
mov edx, dword [edx + 0x10]
mov edi, edx
push edx
mov ecx, dword [ecx]
rep stosb byte es:[edi], al
call fcn.1002c410
mov dword [esi], vtable.CryptoPP::FilterWithBufferedInput.0
mov dword [esi + 4], vtable.CryptoPP::FilterWithBufferedInput.1.0
mov eax, dword [esi + 0x30]
mov ecx, dword [esi + 0x34]
cmp eax, ecx
mov edx, dword [esi + 0x38]
mov edi, edx
cmovb ecx, eax
mov dword [ebp - 4], 1
xor al, al
rep stosb byte es:[edi], al
push edx
call fcn.1002c410
mov ecx, dword [esi + 0x10]
add esp, 8
test ecx, ecx
je 0x1002a672
mov eax, dword [ecx]
push 1
call dword [eax]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100391f0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
mov ecx, dword [esp + 0x10]
xor dl, dl
mov eax, dword [esp + 0x14]
push ebx
mov ebx, dword [esp + 0x10]
mov dword [esp + 8], ecx
push ebp
push esi
push edi
test bl, 3
jne 0x10039327
test cl, 3
jne 0x10039327
test eax, eax
je 0x10039327
mov edi, eax
xor ecx, ecx
shr edi, 2
xor esi, esi
mov dword [esp + 0x10], ecx
test edi, edi
je 0x100392ee
mov ebp, dword [esp + 0x20]
cmp edi, 8
jb 0x100392b7
mov edx, edi
lea ecx, [ebp + 0x10]
mov eax, ebx
and edx, 0xfffffff8
sub eax, ebp
xorps xmm3, xmm3
mov dword [esp + 0x14], eax
xorps xmm2, xmm2
mov eax, dword [esp + 0x24]
mov ebp, dword [esp + 0x14]
nop
movups xmm0, xmmword [ecx - 0x10]
lea ecx, [ecx + 0x20]
movups xmm1, xmmword [ebx + esi*4]
add esi, 8
pxor xmm1, xmm0
por xmm3, xmm1
movups xmm1, xmmword [ecx + ebp - 0x20]
movups xmm0, xmmword [ecx - 0x20]
pxor xmm1, xmm0
por xmm2, xmm1
cmp esi, edx
jb 0x10039260
mov ebp, dword [esp + 0x20]
por xmm2, xmm3
movaps xmm0, xmm2
psrldq xmm0, 8
por xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 4
por xmm2, xmm0
movd ecx, xmm2
mov dword [esp + 0x10], ecx
cmp esi, edi
jae 0x100392f2
mov ecx, ebx
lea edx, [esi*4]
sub ecx, ebp
mov ebx, edi
add edx, ebp
mov dword [esp + 0x14], ecx
sub ebx, esi
mov ebp, ecx
mov esi, edi
mov edi, dword [esp + 0x10]
mov ecx, dword [edx + ebp]
lea edx, [edx + 4]
xor ecx, dword [edx - 4]
or edi, ecx
sub ebx, 1
jne 0x100392d4
mov ebx, dword [esp + 0x1c]
mov ecx, edi
mov dword [esp + 0x10], edi
mov ebp, dword [esp + 0x20]
shl esi, 2
sub eax, esi
jne 0x10039306
pop edi
pop esi
test ecx, ecx
pop ebp
sete al
pop ebx
add esp, 8
ret
mov edx, ecx
add ebp, esi
shr ecx, 0x10
add ebx, esi
shr edx, 0x18
or dl, cl
mov dword [esp + 0x14], ebp
mov ecx, dword [esp + 0x10]
shr ecx, 8
or dl, cl
mov ecx, ebp
or dl, byte [esp + 0x10]
xor edi, edi
test eax, eax
je 0x100393f0
cmp eax, 0x20
jb 0x100393cf
mov esi, eax
add ecx, 0x10
and esi, 0xffffffe0
xorps xmm3, xmm3
mov dword [esp + 0x1c], esi
xorps xmm2, xmm2
mov esi, ebx
sub esi, dword [esp + 0x14]
mov dword [esp + 0x10], esi
mov esi, dword [esp + 0x1c]
mov ebp, dword [esp + 0x10]
nop
movups xmm0, xmmword [ecx - 0x10]
lea ecx, [ecx + 0x20]
movups xmm1, xmmword [edi + ebx]
add edi, 0x20
pxor xmm1, xmm0
por xmm3, xmm1
movups xmm1, xmmword [ecx + ebp - 0x20]
movups xmm0, xmmword [ecx - 0x20]
pxor xmm1, xmm0
por xmm2, xmm1
cmp edi, esi
jb 0x10039360
por xmm2, xmm3
mov ebp, dword [esp + 0x14]
movaps xmm0, xmm2
psrldq xmm0, 8
por xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 4
por xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 2
por xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 1
por xmm2, xmm0
movd ecx, xmm2
or dl, cl
cmp edi, eax
jae 0x100393f0
jmp 0x100393d3
mov ebp, dword [esp + 0x14]
sub ebx, ebp
lea esi, [edi + ebp]
sub eax, edi
nop word [eax + eax]
mov cl, byte [ebx + esi]
lea esi, [esi + 1]
xor cl, byte [esi - 1]
or dl, cl
sub eax, 1
jne 0x100393e0
pop edi
pop esi
test dl, dl
pop ebp
sete al
pop ebx
add esp, 8
ret
Function at 0x1003c3e0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100df2dd
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x101151a4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov esi, eax
mov edx, 2
test esi, esi
mov eax, 1
cmove esi, eax
xor ecx, ecx
mov eax, esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.100ab6aa
mov ebx, eax
add esp, 4
mov dword [ebp - 0x10], ebx
push ebx
push esi
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
jne 0x1003c46b
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x1003c46b
push str.boost::filesystem::current_path
push dword [ebp + 0xc]
push eax
call fcn.10040110
add esp, 0xc
jmp 0x1003c483
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x1003c483
mov dword [eax], 0
mov byte [eax + 4], 0
mov dword [eax + 8], 0x100e5570
mov esi, dword [ebp + 8]
mov ecx, ebx
xor eax, eax
mov dword [esi], 0
lea edx, [ecx + 2]
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1003c4a4
sub ecx, edx
sar ecx, 1
push ecx
push ebx
mov ecx, esi
call fcn.10015bc0
push ebx
call fcn.100aaff4
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1003c9c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 8
push ebx
push esi
mov esi, dword [esp + 0x14]
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x1003c9d3
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x1003c9fb
push dword [esp + 0x18]
lea eax, [esp + 0xc]
push esi
push eax
call fcn.1003c890
add esp, 0xc
mov eax, dword [eax]
pop esi
pop ebx
add esp, 8
ret
mov eax, dword [esp + 0x18]
test eax, eax
je 0x1003ca14
mov dword [eax], 0
mov byte [eax + 4], 0
mov dword [eax + 8], 0x100e5570
test ebx, 0x400
je 0x1003ca4a
push esi
call fcn.1003c5a0
add esp, 4
test al, al
je 0x1003ca3f
test bl, 0x10
mov eax, 4
mov ecx, 0xb
pop esi
cmovne eax, ecx
pop ebx
add esp, 8
ret
pop esi
mov eax, 9
pop ebx
add esp, 8
ret
and ebx, 0x10
or ebx, 0x20
shr ebx, 4
pop esi
mov eax, ebx
pop ebx
add esp, 8
ret
Function at 0x1003cde0
Capabilities:
Check if file exists
Delete directory
Delete file

Disassembly:
mov eax, dword [esp + 8]
cmp eax, 1
jne 0x1003ce05
mov eax, dword [esp + 0xc]
test eax, eax
je 0x1003ce02
mov dword [eax], 0
mov byte [eax + 4], 0
mov dword [eax + 8], 0x100e5570
xor al, al
ret
push esi
push edi
cmp eax, 3
je 0x1003ce28
cmp eax, 0xb
je 0x1003ce28
mov esi, dword [esp + 0xc]
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x1003ce1f
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
adc bl, ch
invalid
mov esi, dword [esp + 0xc]
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x1003ce36
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x1003ce91
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
cmp eax, 2
je 0x1003ce91
cmp eax, 3
je 0x1003ce91
cmp eax, 0x7b
je 0x1003ce91
cmp eax, 0xf
je 0x1003ce91
cmp eax, 0x15
je 0x1003ce91
cmp eax, 0x57
je 0x1003ce91
cmp eax, 0xa1
je 0x1003ce91
cmp eax, 0x35
je 0x1003ce91
call edi
test eax, eax
je 0x1003ce91
push str.boost::filesystem::remove
push dword [esp + 0x18]
push esi
push eax
call fcn.10040050
add esp, 0x10
xor al, al
pop edi
pop esi
ret
mov eax, dword [esp + 0x14]
test eax, eax
je 0x1003ceaa
mov dword [eax + 8], 0x100e5570
mov byte [eax + 4], 0
mov dword [eax], 0
pop edi
mov al, 1
pop esi
ret
Function at 0x1003ceb0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100df3bd
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
mov eax, dword [0x101151a4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x68], esi
test esi, esi
je 0x1003cefc
mov dword [esi], 0
mov byte [esi + 4], 0
mov dword [esi + 8], 0x100e5570
cmp dword [ebx + 0x14], 8
mov eax, ebx
jb 0x1003cf06
mov eax, dword [ebx]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
adc byte [ecx - 0x77c5fbb], cl
push dword [ebp + 0x10]
push esi
push ebx
push edi
call fcn.1003c890
add esp, 0xc
jmp 0x1003d00f
push eax
push ebx
call fcn.1003c690
add esp, 8
mov esi, eax
test dword [ebp - 0x60], 0x400
mov dword [ebp - 0x64], esi
je 0x1003cfe9
push ebx
call fcn.1003c5a0
add esp, 4
test al, al
jne 0x1003cf59
mov dword [edi], 9
jmp 0x1003d00c
cmp dword [ebx + 0x14], 8
mov eax, ebx
jb 0x1003cf63
mov eax, dword [ebx]
push eax
lea ecx, [ebp - 0x28]
call fcn.1003c2a0
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push 0
cmovae eax, dword [ebp - 0x28]
push 0x2000000
push 3
push 0
push 7
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 0x60], esi
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0
call fcn.10004730
cmp esi, 0xffffffff
jne 0x1003cfb5
push dword [ebp - 0x68]
push ebx
push edi
call fcn.1003c890
add esp, 0xc
jmp 0x1003d00f
lea eax, [ebp - 0x5c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
jne 0x1003cfda
push dword [ebp - 0x68]
push ebx
push edi
call fcn.1003c890
add esp, 0xc
push esi
call dword [0x100e2208]
jmp 0x1003d00f
mov ebx, dword [ebp - 0x5c]
push esi
call dword [0x100e2208]
mov esi, dword [ebp - 0x64]
jmp 0x1003cfec
mov ebx, dword [ebp - 0x60]
and ebx, 0x10
je 0x1003cff6
mov ecx, dword [ebp - 0x64]
jmp 0x1003cffb
mov ecx, esi
mov esi, dword [ebp - 0x64]
xor eax, eax
test ebx, ebx
setne al
add eax, 2
test ebx, ebx
mov dword [edi], eax
cmove esi, ecx
mov dword [edi + 4], esi
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100aba16
mov esp, ebp
pop ebp
ret
Function at 0x1003faf0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100df948
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x101151a4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
mov dword [ebp - 0x14], edi
push dword [ebp + 8]
movq xmm0, qword [ebp + 0xc]
mov eax, dword [ebp + 0x14]
sub esp, 0xc
mov edx, esp
movq qword [edx], xmm0
mov dword [edx + 8], eax
call fcn.1003fe70
mov dword [edi], vtable.boost::filesystem::filesystem_error.0
mov dword [ebp - 4], 0
mov dword [edi + 0x30], 0
push 0x4c
mov byte [ebp - 4], 2
call fcn.100aaff9
mov ecx, eax
add esp, 4
mov eax, 1
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x18], 0
mov dword [ecx + 0x20], 0
mov dword [ecx + 0x24], 0
mov dword [ecx + 0x28], 0
mov dword [ecx + 0x2c], 0
mov dword [ecx + 0x30], 0
mov dword [ecx + 0x38], 0
mov dword [ecx + 0x3c], 0
mov dword [ecx + 0x40], 0
mov dword [ecx + 0x44], 0
mov dword [ecx + 0x48], 0
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x18], 7
mov dword [ecx + 0x1c], 0
mov dword [ecx + 0x2c], 0
mov dword [ecx + 0x30], 7
mov dword [ecx + 0x34], 0
mov dword [ecx + 0x44], 0
mov dword [ecx + 0x48], 0xf
lock xadd dword [ecx], eax
mov esi, dword [edi + 0x30]
mov dword [edi + 0x30], ecx
test esi, esi
je 0x1003fe4d
or eax, 0xffffffff
lock xadd dword [esi], eax
add eax, 0xffffffff
jne 0x1003fe4d
mov ecx, dword [esi + 0x48]
cmp ecx, 0x10
jb 0x1003fc69
mov eax, dword [esi + 0x34]
inc ecx
cmp ecx, 0x1000
jb 0x1003fc5f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1003fe63
mov eax, edx
push ecx
push eax
call fcn.100ab029
add esp, 8
mov dword [esi + 0x44], 0
mov dword [esi + 0x48], 0xf
mov byte [esi + 0x34], 0
mov ecx, dword [esi + 0x30]
cmp ecx, 8
jb 0x1003fcb5
mov eax, dword [esi + 0x1c]
lea ecx, [ecx*2 + 2]
cmp ecx, 0x1000
jb 0x1003fcab
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1003fe63
mov eax, edx
push ecx
push eax
call fcn.100ab029
add esp, 8
xor eax, eax
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 7
mov word [esi + 0x1c], ax
mov ecx, dword [esi + 0x18]
cmp ecx, 8
jb 0x1003fd03
mov eax, dword [esi + 4]
lea ecx, [ecx*2 + 2]
cmp ecx, 0x1000
jb 0x1003fcf9
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1003fe63
mov eax, edx
push ecx
push eax
call fcn.100ab029
add esp, 8
xor eax, eax
mov dword [esi + 0x14], 0
push 0x4c
push esi
mov dword [esi + 0x18], 7
mov word [esi + 4], ax
call fcn.100ab029
add esp, 8
jmp 0x1003fe4d
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
call fcn.100ba0f9
int3
Function at 0x10042d10
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100dfd3d
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x101151a4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x101150f0]
cmp eax, 0xffffffff
jne 0x10042d44
xor ebx, ebx
jmp 0x10042d4d
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], 0
test ebx, ebx
je 0x10042e44
mov eax, dword [ebx + 0x18]
test eax, eax
jne 0x10042d70
cmp dword [ebx + 0xc], 0
je 0x10042dfd
mov esi, dword [ebx + 0xc]
test esi, esi
je 0x10042dbc
mov eax, dword [esi + 4]
mov dword [ebx + 0xc], eax
mov ecx, dword [esi]
test ecx, ecx
je 0x10042da2
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [esi]
mov ecx, edi
push 0
mov eax, dword [edi]
call dword [eax]
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov esi, dword [ebx + 0xc]
test esi, esi
jne 0x10042d77
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x10042d66
mov esi, dword [ebx + 0x14]
mov esi, dword [esi]
mov ecx, dword [esi + 0x18]
test ecx, ecx
je 0x10042ddd
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x10042ddd
push eax
mov eax, dword [esi + 0x14]
push ecx
call eax
add esp, 8
push esi
lea ecx, [ebx + 0x14]
call fcn.10041c40
push 0x20
push eax
call fcn.100ab029
mov eax, dword [ebx + 0x18]
add esp, 8
test eax, eax
jne 0x10042dc0
jmp 0x10042d62
push 0x10042230
push 0x1011a8d4
call fcn.10041fc0
mov eax, dword [0x101150f0]
add esp, 8
cmp eax, 0xffffffff
je 0x10042e22
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
or eax, 0xffffffff
lock xadd dword [ebx + 4], eax
jne 0x10042e44
mov eax, dword [ebx]
mov ecx, ebx
push 0
call dword [eax]
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10042e60
Capabilities:
Create thread
Resume thread

Disassembly:
push ebx
push esi
mov esi, ecx
mov edx, dword [esi]
lea eax, [edx + 0x10]
push eax
push 4
push edx
push 0x10042ec0
push 0
push 0
call fcn.100bfdf2
mov ebx, eax
add esp, 0x18
test ebx, ebx
jne 0x10042e89
pop esi
xor al, al
pop ebx
ret
mov eax, dword [esi]
push edi
add eax, 4
lock inc dword [eax]
mov edi, dword [esi]
mov eax, dword [edi + 8]
test eax, eax
je 0x10042ea7
cmp eax, 0xffffffff
je 0x10042ea7
push eax
call dword [0x100e2208]
mov dword [edi + 8], ebx
mov eax, dword [esi]
push dword [eax + 8]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop edi
pop esi
mov al, 1
pop ebx
ret