joyce8/EMBER2024-capa huggingface dataset:
Function at 0x420750
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov word [ebp - 4], cx
mov byte [ebp - 1], dl
xor eax, eax
push ebp
push 0x46dd6b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.00404cd0
xor ebx, ebx
mov eax, ebx
and eax, 0x80000001
jns 0x42078b
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x4207a4
lea eax, [ebp - 0x10]
mov edx, dword [0x48b73c]
mov edx, dword [edx]
mov edx, dword [edx + 0x14]
call fcn.00404d30
jmp 0x4207b7
lea eax, [ebp - 0x10]
mov edx, dword [0x48b73c]
mov edx, dword [edx]
mov edx, dword [edx + 0x18]
call fcn.00404d30
lea eax, [ebp - 0x10]
mov edx, ebx
sar edx, 1
jns 0x4207c3
adc edx, 0
mov edx, dword [edx*4 + 0x48a538]
call fcn.00404f20
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 0x10]
call fcn.00404f04
push eax
call fcn.00406b1c
mov esi, eax
cmp esi, 0xffffffff
je 0x42093d
mov eax, 0x40
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0x40
push edi
push esi
call fcn.00406d8c
test eax, eax
je 0x420930
mov eax, edi
cmp word [eax], 0x5a4d
jne 0x420930
push 0
push 0
mov eax, dword [eax + 0x3c]
push eax
push esi
call fcn.00406dec
mov eax, edi
call fcn.00403288
mov eax, 0x18
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0x18
push edi
push esi
call fcn.00406d8c
test eax, eax
je 0x420930
mov eax, edi
cmp dword [eax], 0x4550
jne 0x420930
add eax, 4
mov dword [ebp - 0xc], eax
cmp byte [ebp - 1], 0
je 0x4208ce
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x8664
jne 0x4208ce
mov eax, edi
call fcn.00403288
mov eax, 0xf0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0xf0
push edi
push esi
call fcn.00406d8c
test eax, eax
je 0x4208ce
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 4]
jne 0x4208ce
mov eax, dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
cmp byte [ebp - 1], 0
jne 0x420930
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x14c
jb 0x420930
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x150
ja 0x420930
mov eax, edi
call fcn.00403288
mov eax, 0xe0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0xe0
push edi
push esi
call fcn.00406d8c
test eax, eax
je 0x420930
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 4]
jne 0x420930
mov eax, dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
mov eax, edi
call fcn.00403288
push esi
call fcn.00406ad4
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor edx, edx
call fcn.0040502c
jne 0x420955
inc ebx
cmp ebx, 0x19
jne 0x42077d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46dd72
lea eax, [ebp - 0x10]
call fcn.00404cd0
ret
Function at 0x421c70
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.00417fea
mov esi, dword [ebp + 8]
push 2
mov edi, eax
lea eax, [ebp - 4]
push eax
mov ecx, esi
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x421ca8
xor eax, eax
jmp 0x421cd4
cmp esi, dword [ebp - 4]
je 0x421cd1
cmp dword [ebp + 0xc], 0
je 0x421cd1
push dword [edi + 0x9c]
call fcn.0042187e
push dword [edi + 0x9c]
mov esi, eax
call fcn.004126f6
pop ecx
pop ecx
cmp esi, eax
je 0x421ca4
xor eax, eax
inc eax
pop edi
pop esi
leave
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
mov ecx, 0x50ac60ed
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x433024
nop
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x27060f7
nop
nop
nop
test eax, eax
nop
nop
je 0x433084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
nop
pop eax
nop
add eax, 0x403a69
nop
nop
sub eax, 0x403a0f
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x42e030
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x42e01e
nop
nop
nop
nop
popal
nop
nop
nop
jmp loc.00401219
Function at 0x10014f70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x88
call fcn.1002e3f0
mov esi, eax
test eax, eax
je 0x10014fbb
js 0x10015106
mov eax, dword [0x100f5654]
movzx eax, byte [eax]
push 1
push esi
call fcn.10004670
add esp, 8
test eax, eax
je 0x1001510d
mov edi, eax
push esi
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
jmp 0x10014fc0
mov edi, 1
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov dword [esp + 0x34], esi
mov dword [esp + 0x38], 0
mov byte [esp + 0x3c], 0
movsd xmm0, qword [eax]
movsd xmm1, qword [eax + 8]
movsd qword [esp + 0xf], xmm0
movsd qword [esp + 0x17], xmm1
movsd xmm0, qword [esp + 0xc]
movsd xmm1, qword [esp + 0x14]
mov eax, dword [esp + 0x1b]
movsd qword [esp + 0x45], xmm1
movsd qword [esp + 0x3d], xmm0
mov dword [esp + 0x4c], eax
mov dword [esp + 0x2c], edi
mov dword [esp + 0x30], esi
call fcn.1002e3f0
test eax, eax
je 0x1001509a
shr eax, 1
mov dword [esp + 8], eax
mov eax, dword [esp + 0x34]
nop word [eax + eax]
test eax, eax
je 0x100150e4
lea ecx, [eax - 1]
lock cmpxchg dword [esp + 0x34], ecx
jne 0x10015030
lea eax, [esp + 7]
lea ecx, [esp + 8]
lea edx, [esp + 0x2c]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], eax
lea eax, [esp + 0xc]
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], edx
mov dword [esp + 0x28], ebx
push eax
call fcn.10013b30
add esp, 4
fstp qword [esp + 0x78]
fstp qword [esp + 0x70]
xorpd xmm0, xmm0
addsd xmm0, qword [esp + 0x78]
addsd xmm0, qword [esp + 0x70]
test esi, esi
jne 0x100150ba
jmp 0x100150d2
lea eax, [esp + 0x2c]
push ebx
push 0
push 0
push eax
call fcn.10013d10
add esp, 0x10
fstp qword [esp + 0x60]
movsd xmm0, qword [esp + 0x60]
test esi, esi
je 0x100150d2
push 1
push esi
push edi
movsd qword [esp + 0x5c], xmm0
call fcn.10004680
movsd xmm0, qword [esp + 0x5c]
add esp, 0xc
movsd qword [esp + 0x58], xmm0
fld qword [esp + 0x58]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
lea eax, [esp + 0x2c]
push ebx
push 0
push 0
push eax
call fcn.10013d10
add esp, 0x10
fstp qword [esp + 0x68]
movsd xmm0, qword [esp + 0x68]
test esi, esi
jne 0x100150ba
jmp 0x100150d2
call fcn.100a3290
ud2
push esi
push 1
call fcn.100a32d0
add esp, 8
ud2
Function at 0x10019a50
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x14
mov edi, dword [ebp + 8]
mov eax, dword [edi]
test eax, eax
je 0x10019a7b
dec eax
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 2
jb 0x10019a8f
cmp dword [eax + 4], 0
je 0x10019a8f
add eax, 8
jmp 0x10019b66
push edi
call fcn.1007e000
add esp, 4
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 2
jae 0x10019a6d
mov eax, dword [edi]
test eax, eax
je 0x10019b4c
dec eax
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
je 0x10019b64
mov esi, eax
test eax, eax
jne 0x10019ae8
mov eax, dword [0x100f5654]
movzx eax, byte [eax]
push 4
push 0x1c
call fcn.10004670
add esp, 8
test eax, eax
je 0x10019b7b
mov dword [eax], edi
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [edi]
test eax, eax
je 0x10019b6d
dec eax
push esi
push eax
call sub.KERNEL32.dll_TlsSetValue
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x10019b18
mov ecx, dword [eax]
mov dword [eax], 0
cmp ecx, 1
jne 0x10019b18
mov ecx, dword [eax + 0x14]
movsd xmm0, qword [eax + 4]
movsd xmm1, qword [eax + 0xc]
mov dword [ebp - 0xc], ecx
movsd qword [ebp - 0x14], xmm1
movsd qword [ebp - 0x1c], xmm0
jmp 0x10019b26
xorps xmm0, xmm0
mov dword [ebp - 0xc], 0
movups xmmword [ebp - 0x1c], xmm0
mov dword [esi + 4], 1
lea eax, [esi + 8]
movsd xmm0, qword [ebp - 0x1c]
movsd xmm1, qword [ebp - 0x14]
movsd qword [esi + 8], xmm0
movsd qword [esi + 0x10], xmm1
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x18], ecx
jmp 0x10019b66
push edi
call fcn.1007e000
add esp, 4
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
jne 0x10019aa9
xor eax, eax
add esp, 0x14
pop esi
pop edi
pop ebp
ret
push edi
call fcn.1007e000
add esp, 4
jmp 0x10019ae1
push 0x1c
push 4
call fcn.100a32d0
add esp, 8
ud2
Function at 0x10019b90
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov edi, dword [ebp + 8]
mov eax, dword [edi]
test eax, eax
je 0x10019bb7
dec eax
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 2
jb 0x10019bcb
cmp dword [eax + 4], 0
je 0x10019bcb
add eax, 8
pop esi
pop edi
pop ebp
ret
push edi
call fcn.1007e000
add esp, 4
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 2
jae 0x10019baa
mov eax, dword [edi]
test eax, eax
je 0x10019c3f
dec eax
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
je 0x10019c53
mov esi, eax
test eax, eax
jne 0x10019c14
mov eax, dword [0x100f5654]
movzx eax, byte [eax]
push 4
push 0xc
call fcn.10004670
add esp, 8
test eax, eax
je 0x10019c64
mov dword [eax], edi
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [edi]
test eax, eax
je 0x10019c59
dec eax
push esi
push eax
call sub.KERNEL32.dll_TlsSetValue
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x10019c2c
mov ecx, dword [eax]
mov dword [eax], 0
test ecx, ecx
je 0x10019c2e
mov ecx, dword [eax + 4]
jmp 0x10019c2e
xor ecx, ecx
lea eax, [esi + 8]
mov dword [esi + 4], 1
mov dword [esi + 8], ecx
pop esi
pop edi
pop ebp
ret
push edi
call fcn.1007e000
add esp, 4
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
jne 0x10019bdd
xor eax, eax
pop esi
pop edi
pop ebp
ret
push edi
call fcn.1007e000
add esp, 4
jmp 0x10019c0d
push 0xc
push 4
call fcn.100a32d0
add esp, 8
ud2
Function at 0x10027bf0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x14
mov eax, dword [0x100d4024]
mov esi, ecx
test eax, eax
je 0x10027c1d
dec eax
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 2
jb 0x10027c35
cmp dword [eax + 4], 0
je 0x10027c35
add eax, 8
jmp 0x10027d17
push 0x100d4024
call fcn.1007e000
add esp, 4
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 2
jae 0x10027c0f
mov eax, dword [0x100d4024]
test eax, eax
je 0x10027cf9
dec eax
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
je 0x10027d15
mov edi, eax
test eax, eax
jne 0x10027c98
mov eax, dword [0x100f5654]
movzx eax, byte [eax]
push 4
push 0x1c
call fcn.10004670
add esp, 8
test eax, eax
je 0x10027d30
mov dword [eax], 0x100d4024
mov dword [eax + 4], 0
mov edi, eax
mov eax, dword [0x100d4024]
test eax, eax
je 0x10027d1e
dec eax
push edi
push eax
call sub.KERNEL32.dll_TlsSetValue
test esi, esi
je 0x10027cc5
mov eax, dword [esi]
mov dword [esi], 0
cmp eax, 1
jne 0x10027cc5
mov eax, dword [esi + 0x14]
movsd xmm0, qword [esi + 4]
movsd xmm1, qword [esi + 0xc]
mov dword [ebp - 0xc], eax
movsd qword [ebp - 0x14], xmm1
movsd qword [ebp - 0x1c], xmm0
jmp 0x10027cd3
xorps xmm0, xmm0
mov dword [ebp - 0xc], 0
movups xmmword [ebp - 0x1c], xmm0
mov dword [edi + 4], 1
lea eax, [edi + 8]
movsd xmm0, qword [ebp - 0x1c]
movsd xmm1, qword [ebp - 0x14]
movsd qword [edi + 8], xmm0
movsd qword [edi + 0x10], xmm1
mov ecx, dword [ebp - 0xc]
mov dword [edi + 0x18], ecx
jmp 0x10027d17
push 0x100d4024
call fcn.1007e000
add esp, 4
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
jne 0x10027c52
xor eax, eax
add esp, 0x14
pop esi
pop edi
pop ebp
ret
push 0x100d4024
call fcn.1007e000
add esp, 4
jmp 0x10027c91
push 0x1c
push 4
call fcn.100a32d0
add esp, 8
ud2

Function at 0x10027d90
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov eax, dword [ebp + 8]
mov edi, dword [eax]
mov esi, dword [edi]
mov eax, dword [esi]
test eax, eax
je 0x10027ddf
dec eax
push 1
push eax
call sub.KERNEL32.dll_TlsSetValue
cmp dword [edi + 4], 0
je 0x10027dbd
lea eax, [edi + 8]
push eax
call fcn.10027730
add esp, 4
push 4
push 0xc
push edi
call fcn.10004680
add esp, 0xc
mov eax, dword [esi]
test eax, eax
je 0x10027dea
dec eax
push 0
push eax
call sub.KERNEL32.dll_TlsSetValue
xor eax, eax
pop esi
pop edi
pop ebp
ret
push esi
call fcn.1007e000
add esp, 4
jmp 0x10027da3
push esi
call fcn.1007e000
add esp, 4
jmp 0x10027dd1
Function at 0x1002a8d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi]
mov edi, dword [esi + 0x40]
xor edi, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call fcn.1002bd80
add esp, 0xc
mfence
nop word cs:[eax + eax]
nop dword [eax + eax]
mov eax, dword [esi + 0xbc]
test eax, 0x10000
jne 0x1002a92a
lea ecx, [eax + 0x10000]
lock cmpxchg dword [esi + 0xbc], ecx
jne 0x1002a900
mov eax, ecx
and eax, 0xff
jne 0x1002a935
pop esi
pop edi
pop ebp
ret
mov ecx, eax
mov eax, ecx
and eax, 0xff
je 0x1002a926
cmp edi, 1
ja 0x1002a941
movzx ecx, ch
cmp ecx, eax
jne 0x1002a926
add esi, 0xb0
push 1
push esi
call fcn.100306d0
add esp, 8
pop esi
pop edi
pop ebp
ret
Function at 0x100309b0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov edi, dword [ebp + 8]
mov eax, dword [edi]
test eax, eax
je 0x100309d9
dec eax
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 2
jb 0x100309ed
cmp dword [eax + 4], 0
je 0x100309ed
add eax, 8
jmp 0x10030aa8
push edi
call fcn.1007e000
add esp, 4
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 2
jae 0x100309cb
mov eax, dword [edi]
test eax, eax
je 0x10030a8e
dec eax
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
je 0x10030aa6
mov esi, eax
test eax, eax
jne 0x10030a42
mov eax, dword [0x100f5654]
movzx eax, byte [eax]
push 4
push 0x14
call fcn.10004670
add esp, 8
test eax, eax
je 0x10030ab8
mov dword [eax], edi
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [edi]
test eax, eax
je 0x10030aad
dec eax
push esi
push eax
call sub.KERNEL32.dll_TlsSetValue
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x10030a6a
mov ecx, dword [eax]
mov dword [eax], 0
cmp ecx, 1
jne 0x10030a6a
mov edi, dword [eax + 4]
movzx ebx, byte [eax + 8]
movzx edx, byte [eax + 9]
movzx ecx, word [eax + 0xa]
mov eax, dword [eax + 0xc]
jmp 0x10030a72
xor eax, eax
xor edx, edx
xor ebx, ebx
xor edi, edi
mov dword [esi + 4], 1
mov dword [esi + 8], edi
mov byte [esi + 0xc], bl
mov byte [esi + 0xd], dl
mov word [esi + 0xe], cx
mov dword [esi + 0x10], eax
lea eax, [esi + 8]
jmp 0x10030aa8
push edi
call fcn.1007e000
add esp, 4
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
jne 0x10030a07
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
push edi
call fcn.1007e000
add esp, 4
jmp 0x10030a3b
push 0x14
push 4
call fcn.100a32d0
add esp, 8
ud2

Function at 0x10030ad0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov edi, dword [ebp + 8]
mov eax, dword [edi]
test eax, eax
je 0x10030af7
dec eax
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 2
jb 0x10030b0b
cmp dword [eax + 4], 0
je 0x10030b0b
add eax, 8
pop esi
pop edi
pop ebp
ret
push edi
call fcn.1007e000
add esp, 4
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 2
jae 0x10030aea
mov eax, dword [edi]
test eax, eax
je 0x10030b7f
dec eax
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
je 0x10030b93
mov esi, eax
test eax, eax
jne 0x10030b54
mov eax, dword [0x100f5654]
movzx eax, byte [eax]
push 4
push 0xc
call fcn.10004670
add esp, 8
test eax, eax
je 0x10030ba4
mov dword [eax], edi
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [edi]
test eax, eax
je 0x10030b99
dec eax
push esi
push eax
call sub.KERNEL32.dll_TlsSetValue
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x10030b6c
mov ecx, dword [eax]
mov dword [eax], 0
test ecx, ecx
je 0x10030b6e
mov ecx, dword [eax + 4]
jmp 0x10030b6e
xor ecx, ecx
lea eax, [esi + 8]
mov dword [esi + 4], 1
mov dword [esi + 8], ecx
pop esi
pop edi
pop ebp
ret
push edi
call fcn.1007e000
add esp, 4
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
jne 0x10030b1d
xor eax, eax
pop esi
pop edi
pop ebp
ret
push edi
call fcn.1007e000
add esp, 4
jmp 0x10030b4d
push 0xc
push 4
call fcn.100a32d0
add esp, 8
ud2
Function at 0x100335f0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov edi, dword [ebp + 8]
mov eax, dword [edi]
test eax, eax
je 0x10033617
dec eax
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 2
jb 0x1003362b
cmp dword [eax + 4], 0
je 0x1003362b
add eax, 8
pop esi
pop edi
pop ebp
ret
push edi
call fcn.1007e000
add esp, 4
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 2
jae 0x1003360a
mov eax, dword [edi]
test eax, eax
je 0x10033687
dec eax
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
je 0x1003369b
mov esi, eax
test eax, eax
jne 0x10033674
mov eax, dword [0x100f5654]
movzx eax, byte [eax]
push 4
push 0xc
call fcn.10004670
add esp, 8
test eax, eax
je 0x100336ac
mov dword [eax], edi
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [edi]
test eax, eax
je 0x100336a1
dec eax
push esi
push eax
call sub.KERNEL32.dll_TlsSetValue
add esi, 4
push dword [ebp + 0xc]
push esi
call fcn.10031900
add esp, 8
pop esi
pop edi
pop ebp
ret
push edi
call fcn.1007e000
add esp, 4
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
jne 0x1003363d
xor eax, eax
pop esi
pop edi
pop ebp
ret
push edi
call fcn.1007e000
add esp, 4
jmp 0x1003366d
push 0xc
push 4
call fcn.100a32d0
add esp, 8
ud2

Function at 0x10033db0
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov eax, dword [ebp + 8]
mov edi, dword [eax]
mov esi, dword [edi]
mov eax, dword [esi]
test eax, eax
je 0x10033e13
dec eax
push 1
push eax
call sub.KERNEL32.dll_TlsSetValue
cmp dword [edi + 4], 0
je 0x10033df1
mov eax, dword [edi + 8]
mov ecx, dword [eax + 0x410]
lea edx, [ecx - 1]
mov dword [eax + 0x410], edx
cmp dword [eax + 0x40c], 0
jne 0x10033df1
cmp ecx, 1
je 0x10033e29
push 4
push 0xc
push edi
call fcn.10004680
add esp, 0xc
mov eax, dword [esi]
test eax, eax
je 0x10033e1e
dec eax
push 0
push eax
call sub.KERNEL32.dll_TlsSetValue
xor eax, eax
pop esi
pop edi
pop ebp
ret
push esi
call fcn.1007e000
add esp, 4
jmp 0x10033dc3
push esi
call fcn.1007e000
add esp, 4
jmp 0x10033e05
push eax
call fcn.100333b0
add esp, 4
jmp 0x10033df1

Function at 0x10045020
Capabilities:
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x300
mov edi, dword [ebp + 8]
call fcn.10045037
Function at 0x10048c90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xe0
mov edi, dword [edx + 0x1c]
mov dword [esp + 0x5c], ecx
test edi, edi
je 0x1004a09f
call fcn.10048cb3
Function at 0x10055860
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x24
mov esi, dword [ebp + 8]
xorps xmm0, xmm0
lea eax, [ebp - 0x28]
mov dword [ebp - 8], 0
movups xmmword [ebp - 0x18], xmm0
movups xmmword [ebp - 0x28], xmm0
push eax
call sub.KERNEL32.dll_GetSystemInfo
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x10055894
mov dword [esi + 4], eax
mov byte [esi], 4
jmp 0x1005589e
mov byte [esi], 2
mov dword [esi + 4], 0x100de2c8
mov eax, esi
add esp, 0x24
pop esi
pop ebp
ret
Function at 0x10056d50
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x42c
mov edi, 0x200
xor esi, esi
mov dword [ebp - 0x28], 2
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x14], 2
mov dword [ebp - 0x1c], 0
cmp edi, 0x201
jae 0x10056dc0
jmp 0x10056da1
mov esi, dword [ebp - 0x10]
jbe 0x10056e49
cmp edi, 0x201
jae 0x10056dc0
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x18], 0x200
lea ebx, [ebp - 0x438]
mov esi, edi
jmp 0x10056df1
mov eax, dword [ebp - 0x1c]
sub edi, esi
sub eax, esi
cmp eax, edi
jae 0x10056de2
mov edx, esi
lea ecx, [ebp - 0x28]
push edi
call fcn.1003fa60
add esp, 4
mov eax, dword [ebp - 0x28]
mov esi, dword [ebp - 0x24]
mov dword [ebp - 0x14], eax
mov ebx, dword [ebp - 0x14]
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x10], esi
push 0
call sub.KERNEL32.dll_SetLastError
push ebx
push esi
call sub.KERNEL32.dll_GetCurrentDirectoryW
mov edi, eax
test eax, eax
jne 0x10056e12
call sub.KERNEL32.dll_GetLastError
test eax, eax
jne 0x10056e96
cmp edi, esi
jne 0x10056d90
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x7a
jne 0x10056eb1
lea edi, [esi + esi]
test esi, esi
mov esi, dword [ebp - 0x10]
mov eax, 0xffffffff
cmovs edi, eax
cmp edi, 0x201
jb 0x10056da1
jmp 0x10056dc0
mov eax, dword [ebp - 0x18]
cmp edi, eax
ja 0x10056ec7
lea eax, [ebp - 0x38]
push edi
push ebx
push eax
call fcn.10063970
add esp, 0xc
movsd xmm0, qword [ebp - 0x38]
mov eax, dword [ebp + 8]
movsd xmm1, qword [ebp - 0x30]
movsd qword [eax + 8], xmm1
movsd qword [eax], xmm0
test esi, esi
je 0x10056e88
add esi, esi
push 2
push esi
push dword [ebp - 0x14]
call fcn.10004680
add esp, 0xc
mov eax, dword [ebp + 8]
add esp, 0x42c
pop esi
pop edi
pop ebx
pop ebp
ret
call sub.KERNEL32.dll_GetLastError
mov ecx, dword [ebp + 8]
mov esi, dword [ebp - 0x10]
mov byte [ecx], 0
mov dword [ecx + 4], eax
mov byte [ecx + 0xc], 2
test esi, esi
jne 0x10056e78
jmp 0x10056e88
push 0x100de4c0
push 0x28
push 0x100dab04
call fcn.100b0df0
add esp, 0xc
jmp 0x10056ed6
push 0x100de4b0
push eax
push edi
call fcn.100b6af0
add esp, 0xc
ud2

Function at 0x10056f20
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
call sub.KERNEL32.dll_GetEnvironmentStringsW
test eax, eax
je 0x10056f3c
mov edx, eax
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
call sub.KERNEL32.dll_GetLastError
mov byte [ebp - 0x18], 0
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x38], 0x100ddbf4
mov dword [ebp - 0x34], 1
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
mov dword [ebp - 0x1c], 0x1005b9e0
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], 1
lea eax, [ebp - 0x38]
push 0x100ddbfc
push eax
call fcn.100b0d70
add esp, 8
ud2
Function at 0x1006a710
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x34
mov esi, ecx
lea eax, [ebp - 0x20]
push dword [ebp + 8]
push edx
push eax
call fcn.100a3bc0
add esp, 0xc
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x1006a75f
mov ecx, dword [0x100dca88]
mov edx, dword [0x100dca8c]
mov dword [esi + 4], ecx
mov ecx, dword [ebp - 0x1c]
mov dword [esi + 8], edx
mov dword [esi], 1
test ecx, ecx
je 0x1006a7bb
push 1
push ecx
push eax
call fcn.10004680
add esp, 0x40
jmp 0x1006a7be
mov edi, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x18]
xorps xmm0, xmm0
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x40]
movups xmmword [ebp - 0x40], xmm0
movups xmmword [ebp - 0x30], xmm0
mov dword [ebp - 0x38], 1
push eax
push ecx
push 0
push edi
call sub.WS2_32.dll_getaddrinfo
test eax, eax
je 0x1006a7c3
call sub.WS2_32.dll_WSAGetLastError
mov dword [esi + 8], eax
mov dword [esi + 4], 0
mov eax, 1
test ebx, ebx
mov dword [esi], eax
mov byte [edi], 0
je 0x1006a7bb
push 1
push ebx
push edi
call fcn.10004680
add esp, 0xc
add esp, 0x34
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, dword [ebp - 0x10]
movzx eax, word [ebp + 0xc]
mov dword [esi + 4], ecx
mov dword [esi + 8], ecx
mov word [esi + 0xc], ax
xor eax, eax
test ebx, ebx
mov dword [esi], eax
mov byte [edi], 0
jne 0x1006a7af
jmp 0x1006a7bb