joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100938a0
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
push ebx
sub esp, 0x20
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x38]
mov edi, dword [esp + 0x3c]
test edx, edx
je 0x100939b0
cmp eax, 2
je 0x10093990
jbe 0x10093910
cmp eax, 4
je 0x10093970
cmp eax, 8
jne 0x10093930
mov esi, dword [edx + 4]
mov ebx, dword [edx]
xor eax, eax
xor esi, edi
xor ebx, ecx
or esi, ebx
je 0x10093902
lea esi, [esi]
lea edi, [edi]
add eax, 1
mov esi, dword [edx + eax*8 + 4]
mov ebx, dword [edx + eax*8]
xor esi, edi
xor ebx, ecx
or esi, ebx
jne 0x100938f0
add esp, 0x20
pop ebx
pop esi
pop edi
ret
cmp eax, 1
jne 0x10093930
xor eax, eax
cmp cl, byte [edx]
mov ebx, ecx
je 0x10093902
lea esi, [esi]
add eax, 1
cmp bl, byte [edx + eax]
jne 0x10093920
add esp, 0x20
pop ebx
pop esi
pop edi
ret
mov dword [esp + 0x14], 0x74
mov dword [esp + 0x10], str.src_libavutil_utils.c
mov dword [esp + 0xc], str.__valid_element_size_
mov dword [esp + 8], str.Assertion__s_failed_at__s:_d_n
mov dword [esp + 4], 0
mov dword [esp], 0
call sym.avutil_56.dll_av_log
call sub.msvcrt.dll_abort
lea esi, [esi]
xor eax, eax
cmp ecx, dword [edx]
je 0x10093902
lea esi, [esi]
lea edi, [edi]
add eax, 1
cmp ecx, dword [edx + eax*4]
jne 0x10093980
add esp, 0x20
pop ebx
pop esi
pop edi
ret
xor eax, eax
cmp cx, word [edx]
mov ebx, ecx
je 0x10093902
lea esi, [esi]
add eax, 1
cmp bx, word [edx + eax*2]
jne 0x100939a0
add esp, 0x20
pop ebx
pop esi
pop edi
ret
add esp, 0x20
xor eax, eax
pop ebx
pop esi
pop edi
ret

Function at 0x10096b00
Capabilities:
Encode data using xor
Encrypt data using xtea

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 8
mov edi, dword [ecx]
mov esi, dword [ecx + 4]
mov dword [esp], edx
mov edx, dword [esp + 0x1c]
test edx, edx
je 0x10096ba0
mov ebp, 0xc6ef3720
mov dword [esp + 4], ecx
mov ebx, edi
mov edx, edi
shl ebx, 4
shr edx, 5
xor edx, ebx
mov ebx, ebp
shr ebx, 0xb
add edx, edi
and ebx, 3
mov ecx, dword [eax + ebx*4]
add ecx, ebp
add ebp, 0x61c88647
xor edx, ecx
sub esi, edx
mov ebx, esi
mov edx, esi
shl ebx, 4
shr edx, 5
xor edx, ebx
mov ebx, ebp
and ebx, 3
add edx, esi
mov ecx, dword [eax + ebx*4]
add ecx, ebp
xor edx, ecx
sub edi, edx
test ebp, ebp
jne 0x10096b24
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 4]
test eax, eax
je 0x10096b8c
mov eax, dword [esp + 0x20]
mov edx, dword [ecx + 4]
xor edi, dword [eax]
xor esi, dword [eax + 4]
mov eax, dword [ecx]
mov ecx, dword [esp + 0x20]
mov dword [ecx], eax
mov dword [ecx + 4], edx
mov eax, dword [esp]
mov dword [eax], edi
mov dword [eax + 4], esi
add esp, 8
pop ebx
pop esi
pop edi
pop ebp
ret
xor ecx, ecx
mov ebx, esi
mov edx, esi
shl ebx, 4
shr edx, 5
xor edx, ebx
mov ebx, ecx
and ebx, 3
add edx, esi
mov ebp, dword [eax + ebx*4]
add ebp, ecx
sub ecx, 0x61c88647
xor edx, ebp
add edi, edx
mov ebx, edi
mov edx, edi
shl ebx, 4
shr edx, 5
xor edx, ebx
mov ebx, ecx
shr ebx, 0xb
add edx, edi
and ebx, 3
mov ebp, dword [eax + ebx*4]
add ebp, ecx
xor edx, ebp
add esi, edx
cmp ecx, 0xc6ef3720
jne 0x10096ba2
mov eax, dword [esp]
mov dword [eax], edi
mov dword [eax + 4], esi
add esp, 8
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x1009ce00
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
mov ebx, dword [esp + 0x5c]
mov esi, dword [esp + 0x54]
mov edi, dword [esp + 0x58]
test ebx, ebx
mov dword [esp + 0x2c], esi
je 0x1009cee0
mov ebp, dword [ebx]
lea eax, [esp + 0x2c]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], edi
mov dword [esp + 8], 0
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x50]
mov dword [esp + 4], eax
mov eax, dword [ecx]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor edx, edx
sub esp, 0x18
test eax, eax
jne 0x1009ce5b
cmp esi, dword [esp + 0x2c]
je 0x1009ce70
add esp, 0x3c
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret 0x10
lea eax, [esi - 1]
test edi, edi
setne dl
cmp eax, 1
jbe 0x1009ceb0
test ebx, ebx
setne al
and edx, eax
cmp esi, 7
sete al
and dl, al
je 0x1009cf00
cmp ebp, 3
jbe 0x1009cf10
mov eax, dword [ebx]
lea ecx, [ebp - 4]
cmp ecx, eax
jae 0x1009cef0
shr ebp, 1
sub ebp, 1
xor eax, eax
xor ecx, ecx
mov word [edi + ebp*2 - 2], ax
mov word [edi + ebp*2], cx
jmp 0x1009ce5b
test ebx, ebx
setne al
and dl, al
je 0x1009cf00
cmp ebp, 1
jbe 0x1009cf10
mov ecx, dword [ebx]
lea ebx, [ebp - 2]
mov eax, ecx
shr eax, 1
cmp ebx, ecx
jae 0x1009ced0
shr ebp, 1
lea eax, [ebp - 1]
xor ebx, ebx
mov word [edi + eax*2], bx
jmp 0x1009ce5b
xor ebp, ebp
jmp 0x1009ce21
shr eax, 1
lea ebp, [eax + 1]
jmp 0x1009cea1
mov edx, 1
jmp 0x1009ce5b
xor edx, edx
jmp 0x1009ce5b

Function at 0x1009cf80
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x2c
mov eax, dword [esp + 0x38]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [ecx]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
sub esp, 0x20
test eax, eax
sete al
add esp, 0x2c
ret 0xc
Function at 0x100aad60
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
lea ebx, [esp + 0x24]
mov dword [esp], str.Mingw_w64_runtime_failure:_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
jmp fcn.100aadc0

Function at 0x100aadc0
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov esi, dword [0x101032b8]
test esi, esi
jle 0x100aaead
mov edi, dword [0x101032bc]
xor ebx, ebx
lea edx, [edi + 4]
nop
mov ecx, dword [edx]
cmp ecx, eax
ja 0x100aadf4
mov edi, dword [edx + 4]
add ecx, dword [edi + 8]
cmp eax, ecx
jb 0x100aaea6
add ebx, 1
add edx, 0xc
cmp ebx, esi
jne 0x100aade0
mov dword [esp], eax
mov ebx, eax
call fcn.100ab540
test eax, eax
mov edi, eax
je 0x100aaeea
lea ebx, [esi + esi*2]
mov esi, dword [0x101032bc]
shl ebx, 2
add esi, ebx
mov dword [esi + 8], eax
mov dword [esi], 0
call fcn.100ab670
add eax, dword [edi + 0xc]
mov dword [esi + 4], eax
lea eax, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov eax, dword [0x101032bc]
mov eax, dword [eax + ebx + 4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x100aaeca
mov eax, dword [esp + 0x28]
lea edx, [eax - 4]
and edx, 0xfffffffb
je 0x100aae9f
sub eax, 0x40
and eax, 0xffffffbf
je 0x100aae9f
mov eax, dword [esp + 0x20]
add ebx, dword [0x101032bc]
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0xc], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
je 0x100aaeb4
add dword [0x101032b8], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
xor esi, esi
jmp 0x100aadfe
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.100aad60
mov eax, dword [0x101032bc]
mov eax, dword [eax + ebx + 4]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.100aad60
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.100aad60
lea esi, [esi]

Function at 0x100abe90
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
sub esp, 4
mov eax, ebx
add esp, 0x14
pop ebx
pop esi
ret
Function at 0x100abed0
Capabilities:
Set thread local storage value

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x24]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
je 0x100abef5
xor eax, eax
add esp, 0x1c
ret
add esp, 0x1c
jmp dword [sym.imp.KERNEL32.dll_GetLastError]

Function at 0x100ac260
Capabilities:
Allocate thread local storage

Disassembly:
sub esp, 0x1c
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x100ac294
mov dword [esp + 4], 0
mov dword [esp], eax
mov dword [0x101032e4], eax
call fcn.100cda10
test eax, eax
sete al
movzx eax, al
mov dword [0x100d54b8], eax
add esp, 0x1c
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x100ac283

Function at 0x100ac3b0
Capabilities:
Set thread local storage value

Disassembly:
push ebp
push edi
mov ebp, eax
push esi
push ebx
mov ebx, edx
sub esp, 0x3c
mov eax, dword [eax + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x28], eax
mov eax, dword [edx]
jmp 0x100ac3dc
mov dword [0x101032e8], edx
mov eax, dword [ebx]
mov eax, dword [eax]
mov dword [ebx], eax
test eax, eax
je 0x100ac4a0
mov esi, dword [eax + 0x18]
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], ebp
mov eax, dword [ebp]
mov edx, dword [ebp + 4]
mov dword [esp + 4], 0xa
mov dword [esp], 1
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
mov eax, dword [esp + 0x28]
call eax
test eax, eax
jne 0x100ac500
test esi, esi
je 0x100ac45b
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], ebp
mov eax, dword [ebp]
mov edx, dword [ebp + 4]
mov dword [esp + 4], 0xa
mov dword [esp], 1
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
call esi
cmp eax, 7
je 0x100ac510
cmp eax, 8
jne 0x100ac500
mov eax, dword [ebx]
mov edx, dword [eax]
mov eax, dword [0x100d54b8]
test eax, eax
js 0x100ac4e0
test eax, eax
je 0x100ac3d0
mov eax, dword [0x101032e4]
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
jne 0x100ac3d6
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x100ac3d6
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], ebp
mov eax, dword [ebp]
mov edx, dword [ebp + 4]
mov dword [esp + 4], 0x1a
mov dword [esp], 1
mov dword [esp + 8], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0xc], edx
call eax
test eax, eax
jne 0x100ac500
add esp, 0x3c
mov eax, 5
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0x2c], edx
call fcn.100ac2a0
mov eax, dword [0x100d54b8]
mov edx, dword [esp + 0x2c]
jmp 0x100ac468
add esp, 0x3c
mov eax, 2
pop ebx
pop esi
pop edi
pop ebp
ret
add esp, 0x3c
mov eax, 7
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x100ac520
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov eax, dword [0x100d54b8]
mov ebx, dword [esp + 0x30]
test eax, eax
js 0x100ac5a0
test eax, eax
jne 0x100ac550
mov eax, dword [0x101032e8]
mov dword [0x101032e8], ebx
mov dword [ebx], eax
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
mov edi, dword [0x101032e4]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
mov ebp, eax
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov edi, eax
mov dword [esp], ebp
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [0x101032e4]
sub esp, 4
mov dword [ebx], edi
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
jne 0x100ac545
add esp, 0x1c
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
jmp eax
call fcn.100ac2a0
mov eax, dword [0x100d54b8]
jmp 0x100ac534

Function at 0x100ac5b0
Capabilities:
Set thread local storage value

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [esp + 0x20]
mov ebx, dword [eax]
mov eax, dword [0x100d54b8]
test eax, eax
js 0x100ac5f5
test eax, eax
jne 0x100ac5d2
mov dword [0x101032e8], ebx
add esp, 0x18
pop ebx
ret
mov eax, dword [0x101032e4]
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
jne 0x100ac5cd
add esp, 0x18
pop ebx
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
call fcn.100ac2a0
mov eax, dword [0x100d54b8]
jmp 0x100ac5c3

Function at 0x100ac710
Capabilities:
Get thread local storage value

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov eax, dword [0x100d54b8]
mov edi, dword [esp + 0x40]
test eax, eax
js 0x100ac7fc
test eax, eax
mov esi, dword [0x101032e8]
jne 0x100ac791
test esi, esi
mov dword [esp + 0x2c], esi
je 0x100ac785
lea ebx, [esp + 0x2c]
mov eax, esi
nop
mov eax, dword [eax + 0x18]
test eax, eax
je 0x100ac777
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], edi
mov edx, dword [edi]
mov ecx, dword [edi + 4]
mov dword [esp + 4], 1
mov dword [esp], 1
mov dword [esp + 8], edx
mov dword [esp + 0xc], ecx
call eax
cmp eax, 6
je 0x100ac7c0
cmp eax, 8
jne 0x100ac7f0
mov eax, dword [esp + 0x2c]
mov eax, dword [eax]
test eax, eax
mov dword [esp + 0x2c], eax
jne 0x100ac740
mov eax, 5
add esp, 0x30
pop ebx
pop esi
pop edi
ret
mov esi, dword [0x101032e4]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov esi, eax
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
sub esp, 4
jmp 0x100ac731
mov eax, dword [esp + 0x2c]
mov dword [edi + 0xc], 0
mov edx, ebx
mov dword [esp + 0x2c], esi
mov dword [edi + 0x10], eax
mov eax, edi
call fcn.100ac1c0
cmp eax, 7
jne 0x100ac78a
mov eax, ebx
call fcn.100ac340
mov esi, esi
lea edi, [edi]
add esp, 0x30
mov eax, 3
pop ebx
pop esi
pop edi
ret
call fcn.100ac2a0
mov eax, dword [0x100d54b8]
jmp 0x100ac727
Function at 0x100ac8b0
Capabilities:
Get thread local storage value

Disassembly:
push edi
push esi
push ebx
sub esp, 0x20
mov edx, dword [0x100d54b8]
mov ebx, dword [esp + 0x30]
test edx, edx
js 0x100ac925
test edx, edx
mov eax, dword [0x101032e8]
jne 0x100ac8fd
mov ecx, dword [ebx + 0xc]
lea esi, [esp + 0x1c]
mov dword [esp + 0x1c], eax
mov eax, ebx
mov edx, esi
test ecx, ecx
jne 0x100ac8ef
call fcn.100ac1c0
cmp eax, 7
je 0x100ac8f6
call sub.msvcrt.dll_abort
call fcn.100ac3b0
jmp 0x100ac8e5
mov eax, esi
call fcn.100ac340
mov esi, dword [0x101032e4]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
mov esi, eax
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
push edi
jmp 0x100ac8cd
call fcn.100ac2a0
mov edx, dword [0x100d54b8]
jmp 0x100ac8c4

Function at 0x100ac940
Capabilities:
Get thread local storage value

Disassembly:
push edi
push esi
push ebx
sub esp, 0x20
mov ebx, dword [esp + 0x30]
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x100ac980
mov edx, dword [0x100d54b8]
test edx, edx
js 0x100ac9d0
test edx, edx
mov eax, dword [0x101032e8]
jne 0x100ac9a0
lea edx, [esp + 0x1c]
mov dword [esp + 0x1c], eax
mov eax, ebx
call fcn.100ac3b0
cmp eax, 7
je 0x100ac990
call sub.msvcrt.dll_abort
lea esi, [esi]
mov dword [esp], ebx
call fcn.100ac710
add esp, 0x20
pop ebx
pop esi
pop edi
ret
lea eax, [esp + 0x1c]
call fcn.100ac340
lea esi, [esi]
mov esi, dword [0x101032e4]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov esi, eax
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
sub esp, 4
jmp 0x100ac964
call fcn.100ac2a0
mov edx, dword [0x100d54b8]
jmp 0x100ac95b
Function at 0x100c59f0
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov ebx, dword [0x10103ce0]
test ebx, ebx
je 0x100c5a60
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [ebx]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
sub esp, 4
test ebx, ebx
je 0x100c5a60
mov eax, dword [esp + 0x20]
test eax, eax
je 0x100c5a3d
mov eax, dword [ebx]
test eax, eax
je 0x100c5a3d
mov edx, dword [ebx + 4]
mov dword [esp], edx
call eax
mov eax, dword [ebx + 8]
mov dword [esp + 4], eax
mov eax, dword [0x10103ce0]
mov dword [esp], eax
call fcn.100c5450
add esp, 0x14
mov eax, ebx
pop ebx
pop esi
ret
xor ebx, ebx
add esp, 0x14
mov eax, ebx
pop ebx
pop esi
ret

Function at 0x100c5a70
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov esi, dword [0x10103ce0]
mov ebx, dword [esp + 0x30]
mov eax, dword [esp + 0x34]
test esi, esi
mov dword [ebx], eax
mov eax, dword [esp + 0x38]
mov dword [ebx + 4], eax
je 0x100c5ad3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov eax, dword [esi]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov edi, eax
mov dword [esp], ebp
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov esi, dword [0x10103ce0]
sub esp, 4
mov dword [ebx + 8], edi
mov dword [esp + 0x34], ebx
mov dword [esp + 0x30], esi
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.100c5450
xor edi, edi
jmp 0x100c5abc
Function at 0x100c5ae0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x4c
mov ebx, dword [0x10103ce4]
test ebx, ebx
je 0x100c5b30
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [ebx]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
sub esp, 4
test ebx, ebx
je 0x100c5b30
mov ebp, dword [ebx + 0x10]
mov eax, dword [ebx + 0xc]
mov edx, ebp
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
call fcn.100bf750
test eax, eax
mov ebx, eax
mov ebp, edx
je 0x100c5bc4
or byte [eax + 0x94], 1
mov dword [eax + 0x84], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebx + 0x98], eax
call esi
mov dword [esp + 0x2c], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov edi, eax
call esi
mov edx, dword [esp + 0x2c]
lea ecx, [ebx + 8]
mov dword [esp + 0x18], 2
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], ecx
mov dword [esp + 4], edi
mov dword [esp + 8], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
sub esp, 0x1c
test eax, eax
jne 0x100c5bd0
mov dword [esp], ebx
mov dword [esp + 4], ebp
call fcn.100bf540
xor eax, eax
xor edx, edx
jmp 0x100c5b21
xor eax, eax
jmp 0x100c5b1f
call esi
lea ecx, [esp + 0x3c]
mov dword [esp], eax
mov dword [esp + 8], ecx
lea ecx, [esp + 0x38]
mov dword [esp + 4], ecx
call dword [sym.imp.KERNEL32.dll_GetProcessAffinityMask]
sub esp, 0xc
test eax, eax
jne 0x100c5c1a
mov eax, dword [ebx + 8]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [ebx + 0x88], eax
mov eax, dword [0x10103ce4]
sub esp, 4
mov dword [esp + 4], ebx
mov dword [esp], eax
call fcn.100c5450
jmp 0x100c5baf
mov eax, dword [esp + 0x38]
mov edi, dword [sym.imp.KERNEL32.dll_SetThreadAffinityMask]
mov dword [esp + 4], eax
mov eax, dword [ebx + 8]
mov dword [esp], eax
call edi
sub esp, 8
test eax, eax
mov esi, eax
je 0x100c5bf2
mov dword [esp + 4], eax
mov eax, dword [ebx + 8]
mov dword [esp], eax
call edi
sub esp, 8
test eax, eax
je 0x100c5bf2
mov eax, dword [ebx + 8]
mov dword [ebx + 0x9c], esi
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
push edx
mov dword [ebx + 0x88], eax
mov eax, dword [0x10103ce4]
mov dword [esp + 4], ebx
mov dword [esp], eax
call fcn.100c5450
mov eax, ebx
jmp 0x100c5b1f
Function at 0x100ca1d0
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov ebx, dword [esp + 0x20]
test ebx, ebx
je 0x100ca210
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [ebx]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
sub esp, 4
add esp, 0x14
mov eax, ebx
pop ebx
pop esi
ret
xor ebx, ebx
jmp 0x100ca201

Function at 0x100ca220
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov eax, dword [0x10103ce4]
mov dword [esp], eax
call fcn.100ca1d0
mov ebx, eax
mov dword [eax + 0x18], 5
mov eax, dword [esp + 0x30]
sub eax, 1
cmp eax, 1
jbe 0x100ca255
mov dword [esp], 1
call sub.msvcrt.dll_exit
test byte [ebx + 0x94], 1
jne 0x100ca2d3
mov esi, dword [0x10103ce0]
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
jne 0x100ca2ad
mov eax, dword [esp + 0x30]
add ebx, 0x38
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.msvcrt.dll_longjmp
mov eax, dword [esi]
test eax, eax
je 0x100ca28f
mov edx, dword [esi + 4]
mov dword [esp], edx
call eax
mov eax, dword [esi + 8]
mov dword [esp + 4], eax
mov eax, dword [0x10103ce0]
mov dword [esp], eax
call fcn.100c5450
mov esi, dword [0x10103ce0]
test esi, esi
je 0x100ca26e
call ebp
mov edi, eax
mov eax, dword [esi]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov esi, eax
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
sub esp, 4
test esi, esi
jne 0x100ca281
jmp 0x100ca26e
or esi, 0xffffffff
cmp dword [esp + 0x30], 2
jne 0x100ca2ef
cmp dword [0x10103ce8], 0
jne 0x100ca2f4
mov dword [esp], esi
call dword [sym.imp.msvcrt.dll__endthreadex]
mov esi, dword [ebx + 0x28]
jmp 0x100ca2dd
call fcn.100bee40
jmp 0x100ca2e6
Function at 0x100ccbb0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x4c
test eax, eax
mov dword [esp + 0x20], 0
je 0x100cccb0
mov esi, dword [eax]
mov ebx, eax
mov eax, 0x16
test esi, esi
je 0x100ccca3
cmp esi, 0xffffffff
mov ebp, ecx
mov edi, edx
je 0x100cccd0
lea ebx, [esi + 0x10]
mov dword [esp], ebx
call fcn.100cbb50
test eax, eax
jne 0x100cccc0
add dword [esi], 1
mov dword [esp], ebx
call fcn.100c2ae0
test eax, eax
jne 0x100cccc0
lea eax, [esp + 0x20]
mov ebx, dword [0x10103ce0]
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], esi
mov dword [esp + 0x30], 0x100c7370
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x24]
test ebx, ebx
mov dword [esp + 0x34], eax
je 0x100ccd4d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x1c], eax
mov eax, dword [ebx]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov edx, dword [esp + 0x1c]
mov dword [esp + 0x18], eax
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_SetLastError]
sub esp, 4
mov ebx, dword [0x10103ce0]
mov eax, dword [esp + 0x18]
mov dword [esp + 0x38], eax
lea eax, [esp + 0x30]
mov dword [esp], ebx
mov dword [esp + 4], eax
call fcn.100c5450
mov dword [esp], edi
call fcn.100c7210
test eax, eax
mov dword [esp + 0x20], eax
je 0x100ccd10
mov dword [esp], 1
call fcn.100c59f0
mov eax, dword [esp + 0x20]
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
add esp, 0x4c
mov eax, 0x16
pop ebx
pop esi
pop edi
pop ebp
ret
call dword [sym.imp.msvcrt.dll__errno]
mov eax, dword [eax]
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
lea esi, [esp + 0x30]
mov dword [esp], 0x10103cb4
mov dword [esp + 0x18], eax
mov dword [esp + 4], esi
call fcn.100be050
mov edx, dword [ebx]
mov eax, dword [esp + 0x18]
cmp edx, 0xffffffff
je 0x100ccd54
test edx, edx
je 0x100ccd38
mov dword [esp], esi
call fcn.100bdaa0
mov dword [esp + 0x20], 0
mov esi, dword [ebx]
jmp 0x100ccbe5
add esi, 0xc
mov dword [esp + 4], ebp
mov dword [esp], esi
call fcn.100cc5c0
test eax, eax
je 0x100ccc93
call dword [sym.imp.msvcrt.dll__errno]
mov eax, dword [eax]
mov dword [esp + 0x20], eax
jmp 0x100ccc93
mov dword [esp], esi
mov dword [esp + 0x18], eax
call fcn.100bdaa0
mov eax, dword [esp + 0x18]
jmp 0x100ccca3
xor eax, eax
jmp 0x100ccc6f
mov dword [esp + 4], 0
mov dword [esp], ebx
call fcn.100c22e0
mov dword [esp], esi
mov dword [esp + 0x18], eax
call fcn.100bdaa0
mov eax, dword [esp + 0x18]
test eax, 0xffffffef
mov dword [esp + 0x20], eax
jne 0x100ccca3
jmp 0x100ccd07