joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100e0790
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x100e57c0
mov esi, ecx
lea eax, [ebp - 0x18]
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
mov eax, dword [0x1019c1fc]
test eax, eax
je 0x100e07e4
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jbe 0x100e07fd
cmp dword [eax], 0
mov ebx, eax
je 0x100e07fd
add ebx, 4
jmp 0x100e08db
push 0x1019c1fc
call fcn.1010bf10
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
ja 0x100e07d5
mov eax, dword [0x1019c1fc]
test eax, eax
je 0x100e08bc
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
je 0x100e08d9
mov edi, eax
test eax, eax
jne 0x100e086a
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x20], 0x1019c1fc
push 4
push 0xc
call fcn.10037be0
add esp, 8
test eax, eax
je 0x100e0900
mov edi, eax
mov eax, dword [ebp - 0x20]
movsd xmm0, qword [ebp - 0x28]
mov dword [edi + 8], eax
movsd qword [edi], xmm0
mov eax, dword [0x1019c1fc]
test eax, eax
je 0x100e08ee
dec eax
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
xor edx, edx
test esi, esi
je 0x100e0898
mov eax, dword [esi]
mov ecx, dword [esi + 4]
mov dword [esi], 0
test eax, eax
je 0x100e0898
cmp eax, 1
jne 0x100e0888
mov edx, ecx
jmp 0x100e0898
test ecx, ecx
je 0x100e0898
lock dec dword [ecx]
jne 0x100e0898
call fcn.100d5700
xor edx, edx
mov ecx, dword [edi + 4]
cmp dword [edi], 0
lea ebx, [edi + 4]
mov dword [edi], 1
mov dword [edi + 4], edx
je 0x100e08db
test ecx, ecx
je 0x100e08db
lock dec dword [ecx]
jne 0x100e08db
call fcn.100d5700
jmp 0x100e08db
push 0x1019c1fc
call fcn.1010bf10
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jne 0x100e081b
xor ebx, ebx
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, ebx
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x1019c1fc
call fcn.1010bf10
add esp, 4
jmp 0x100e0862
mov dword [ebp - 0x10], 0
push 4
push 0xc
call fcn.1010c590
add esp, 8
ud2
Function at 0x100e0a40
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
mov eax, dword [0x1019c20c]
mov esi, ecx
test eax, eax
je 0x100e0a66
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jbe 0x100e0a7f
cmp byte [eax + 4], 0
je 0x100e0a7f
add eax, 5
pop esi
pop edi
ret
push 0x1019c20c
call fcn.1010bf10
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
ja 0x100e0a5a
mov eax, dword [0x1019c20c]
test eax, eax
je 0x100e0aec
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
je 0x100e0b05
mov edi, eax
test eax, eax
jne 0x100e0ac9
push 4
push 8
call fcn.10037be0
add esp, 8
test eax, eax
je 0x100e0b19
mov dword [eax], 0x1019c20c
mov byte [eax + 4], 0
mov edi, eax
mov eax, dword [0x1019c20c]
test eax, eax
je 0x100e0b0a
dec eax
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test esi, esi
je 0x100e0add
movzx ecx, byte [esi]
mov byte [esi], 0
and cl, 1
neg cl
and cl, byte [esi + 1]
jmp 0x100e0adf
xor ecx, ecx
mov byte [edi + 4], 1
lea eax, [edi + 5]
mov byte [edi + 5], cl
pop esi
pop edi
ret
push 0x1019c20c
call fcn.1010bf10
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jne 0x100e0a95
xor eax, eax
pop esi
pop edi
ret
push 0x1019c20c
call fcn.1010bf10
add esp, 4
jmp 0x100e0ac1
push 4
push 8
call fcn.1010c590
add esp, 8
ud2

Function at 0x100e0ef0
Capabilities:
Delete file

Disassembly:
push ebx
push edi
push esi
sub esp, 0x10
mov esi, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
mov ecx, esp
push dword [esp + 0x28]
call fcn.100e2680
add esp, 4
cmp dword [esp], 0
je 0x100e0f1e
movsd xmm0, qword [esp + 4]
movsd qword [esi], xmm0
jmp 0x100e0f46
mov ebx, dword [esp + 4]
mov edi, dword [esp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x100e0f4f
mov byte [esi], 4
test ebx, ebx
je 0x100e0f46
add ebx, ebx
push 2
push ebx
push edi
call fcn.10037bf0
add esp, 0xc
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [esi], 0
mov byte [esi + 3], 0
mov word [esi + 1], 0
mov dword [esi + 4], eax
test ebx, ebx
jne 0x100e0f38
jmp 0x100e0f46
Function at 0x100e0f70
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x34
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x100e57d0
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
lea ecx, [ebp - 0x18]
mov esi, dword fs:[0]
mov dword [ebp - 0x18], esi
mov dword fs:[0], ecx
lea ecx, [ebp - 0x34]
push eax
call fcn.100e2680
add esp, 4
cmp dword [ebp - 0x34], 0
je 0x100e0fc7
movsd xmm0, qword [ebp - 0x30]
movsd qword [ebx], xmm0
jmp 0x100e104e
mov edi, dword [ebp - 0x30]
mov esi, dword [ebp - 0x2c]
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp + 0x14]
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x24], edi
lea ecx, [ebp - 0x34]
push eax
call fcn.100e2680
add esp, 4
cmp dword [ebp - 0x34], 0
mov ebx, dword [ebp + 8]
je 0x100e100c
movsd xmm0, qword [ebp - 0x30]
movsd qword [ebx], xmm0
jmp 0x100e1037
mov edi, dword [ebp - 0x30]
mov esi, dword [ebp - 0x2c]
push 1
push esi
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x100e1061
mov byte [ebx], 4
test edi, edi
je 0x100e1037
add edi, edi
push 2
push edi
push esi
call fcn.10037bf0
add esp, 0xc
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x100e104e
add eax, eax
push 2
push eax
push dword [ebp - 0x20]
call fcn.10037bf0
add esp, 0xc
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, ebx
add esp, 0x34
pop esi
pop edi
pop ebx
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [ebx], 0
mov byte [ebx + 3], 0
mov word [ebx + 1], 0
mov dword [ebx + 4], eax
test edi, edi
jne 0x100e1029
jmp 0x100e1037
Function at 0x100e1430
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
mov esi, esp
mov dword [esi + 0x28], ebp
mov dword [esi + 0x2c], esp
mov dword [esi + 0x38], 0xffffffff
mov dword [esi + 0x34], 0x100e57f0
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
lea ecx, [esi + 0x30]
mov eax, dword fs:[0]
mov dword [esi + 0x30], eax
mov dword fs:[0], ecx
mov ecx, esi
push ebx
call fcn.100e2680
add esp, 4
cmp dword [esi], 0
je 0x100e1495
mov eax, dword [esi + 4]
mov ecx, dword [esi + 8]
mov dword [edi + 8], ecx
mov dword [edi + 4], eax
mov dword [edi], 1
jmp 0x100e1568
mov edx, dword [esi + 8]
mov edi, dword [esi + 4]
mov eax, dword [ebp + 0x18]
mov ecx, dword [esi + 0xc]
mov dword [esi + 0x38], 0
mov dword [esi + 0x14], edx
mov dword [esi + 0x20], edx
mov edx, dword [ebp + 0x14]
mov dword [esi + 0x1c], edi
mov dword [esi + 0x24], ecx
mov dword [esi + 0x18], edi
mov ecx, esi
push eax
call fcn.100e2680
add esp, 4
cmp dword [esi], 0
mov edx, dword [ebp + 8]
je 0x100e14fb
mov eax, dword [esi + 4]
mov ecx, dword [esi + 8]
mov dword [edx + 8], ecx
mov dword [edx + 4], eax
mov dword [edx], 1
mov eax, dword [esi + 0x18]
mov edi, dword [ebp + 8]
test eax, eax
je 0x100e1568
add eax, eax
push 2
push eax
push dword [esi + 0x14]
call fcn.10037bf0
add esp, 0xc
jmp 0x100e1568
mov ebx, dword [esi + 4]
mov edi, dword [esi + 8]
mov dword [esi + 4], 0
mov dword [esi], 0
push 0
push 0
mov eax, esi
push eax
push 0x100e15e0
push edi
push dword [esi + 0x14]
call dword [sym.imp.KERNEL32.dll_CopyFileExW]
test eax, eax
je 0x100e157b
mov eax, dword [esi]
mov edx, dword [ebp + 8]
mov ecx, dword [esi + 4]
test ebx, ebx
mov dword [edx + 8], eax
mov dword [edx + 0xc], ecx
mov dword [edx], 0
je 0x100e154e
add ebx, ebx
push 2
push ebx
push edi
call fcn.10037bf0
add esp, 0xc
mov eax, dword [esi + 0x18]
test eax, eax
je 0x100e1565
add eax, eax
push 2
push eax
push dword [esi + 0x14]
call fcn.10037bf0
add esp, 0xc
mov edi, dword [ebp + 8]
mov eax, dword [esi + 0x30]
mov dword fs:[0], eax
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 8]
test ebx, ebx
mov byte [ecx + 4], 0
mov byte [ecx + 7], 0
mov word [ecx + 5], 0
mov dword [ecx + 8], eax
mov dword [ecx], 1
je 0x100e14df
add ebx, ebx
push 2
push ebx
push edi
call fcn.10037bf0
add esp, 0xc
jmp 0x100e14df
Function at 0x100e2c50
Capabilities:
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x80
mov dword [esp + 8], edx
mov esi, ecx
mov edi, dword [0x1019ccac]
test edi, edi
mov dword [esp + 0x10], edi
jne 0x100e2cae
lea eax, [esp + 0x10]
push 0
push 0
push 0x1017725c
push eax
call dword [sym.imp.bcrypt.dll_BCryptOpenAlgorithmProvider]
test eax, eax
js 0x100e2cee
mov ecx, dword [esp + 0x10]
xor eax, eax
lock cmpxchg dword [0x1019ccac], ecx
jne 0x100e2ca0
mov edi, dword [esp + 0x10]
jmp 0x100e2cae
mov edi, eax
push 0
push dword [esp + 0x14]
call dword [sym.imp.bcrypt.dll_BCryptCloseAlgorithmProvider]
xorps xmm0, xmm0
lea eax, [esp + 0x10]
movaps xmmword [esp + 0x10], xmm0
push 0
push 0x10
push eax
push edi
call dword [sym.imp.bcrypt.dll_BCryptGenRandom]
test eax, eax
js 0x100e2cee
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov edi, dword [esp + 0x1c]
mov dword [esi + 0xc], edi
mov dword [esi + 8], edx
mov dword [esi + 4], ecx
mov dword [esi], eax
mov eax, esi
lea esp, [ebp - 8]
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0xc], eax
lea eax, [esp + 8]
movsd xmm0, qword [0x101756b0]
movsd xmm2, qword [0x101756c0]
movsd xmm1, qword [0x10175720]
mov dword [esp + 0x70], 0x101772ac
mov dword [esp + 0x74], 2
mov dword [esp + 0x58], eax
lea eax, [esp + 0xc]
mov dword [esp + 0x5c], fcn.100f7550
mov dword [esp + 0x60], eax
lea eax, [esp + 0x10]
mov dword [esp + 0x64], fcn.100f7550
mov dword [esp + 0x68], eax
lea eax, [esp + 0x58]
mov dword [esp + 0x6c], 2
mov dword [esp + 0x78], eax
movsd qword [esp + 0x10], xmm0
mov dword [esp + 0x1c], 2
movsd qword [esp + 0x24], xmm2
mov byte [esp + 0x2c], 3
movsd qword [esp + 0x30], xmm1
mov dword [esp + 0x3c], 2
movsd qword [esp + 0x44], xmm2
mov byte [esp + 0x4c], 3
mov dword [esp + 0x7c], 2
lea eax, [esp + 0x68]
push 0x101772bc
push eax
call fcn.1010c690
add esp, 8
ud2
Function at 0x100e4740
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x100e58c0
mov esi, ecx
lea eax, [ebp - 0x18]
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
mov eax, dword [0x1019c238]
test eax, eax
je 0x100e4794
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jbe 0x100e47ad
cmp dword [eax], 0
mov ebx, eax
je 0x100e47ad
add ebx, 4
jmp 0x100e489c
push 0x1019c238
call fcn.1010bf10
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
ja 0x100e4785
mov eax, dword [0x1019c238]
test eax, eax
je 0x100e487d
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
je 0x100e489a
mov edi, eax
test eax, eax
jne 0x100e481e
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x20], 0x1019c238
push 4
push 0x10
call fcn.10037be0
add esp, 8
test eax, eax
je 0x100e48c1
movsd xmm0, qword [ebp - 0x2c]
movsd xmm1, qword [ebp - 0x24]
mov edi, eax
movsd qword [eax + 8], xmm1
movsd qword [eax], xmm0
mov eax, dword [0x1019c238]
test eax, eax
je 0x100e48af
dec eax
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test esi, esi
je 0x100e4852
mov edx, dword [esi]
mov eax, dword [esi + 4]
mov ecx, dword [esi + 8]
mov dword [esi], 0
test edx, edx
je 0x100e4852
cmp edx, 1
jne 0x100e483d
mov edx, ecx
jmp 0x100e4856
test ecx, ecx
je 0x100e4852
xor eax, eax
lock dec dword [ecx]
mov edx, 0
jne 0x100e4856
call fcn.100d56c0
xor eax, eax
xor edx, edx
mov ecx, dword [edi + 8]
cmp dword [edi], 0
lea ebx, [edi + 4]
mov dword [edi], 1
mov dword [edi + 4], eax
mov dword [edi + 8], edx
je 0x100e489c
test ecx, ecx
je 0x100e489c
lock dec dword [ecx]
jne 0x100e489c
call fcn.100d56c0
jmp 0x100e489c
push 0x1019c238
call fcn.1010bf10
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jne 0x100e47cb
xor ebx, ebx
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, ebx
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x1019c238
call fcn.1010bf10
add esp, 4
jmp 0x100e4816
mov dword [ebp - 0x10], 0
push 4
push 0x10
call fcn.1010c590
add esp, 8
ud2
Function at 0x100e4950
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
mov eax, dword [0x1019c248]
mov esi, ecx
test eax, eax
je 0x100e4975
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jbe 0x100e498e
cmp dword [eax], 0
je 0x100e498e
add eax, 4
pop esi
pop edi
ret
push 0x1019c248
call fcn.1010bf10
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
ja 0x100e496a
mov eax, dword [0x1019c248]
test eax, eax
je 0x100e4a04
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
je 0x100e4a1d
mov edi, eax
test eax, eax
jne 0x100e49db
push 4
push 0xc
call fcn.10037be0
add esp, 8
test eax, eax
je 0x100e4a31
mov dword [eax], 0
mov dword [eax + 8], 0x1019c248
mov edi, eax
mov eax, dword [0x1019c248]
test eax, eax
je 0x100e4a22
dec eax
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test esi, esi
je 0x100e49f3
mov eax, dword [esi]
xor ecx, ecx
mov dword [esi], 0
cmp eax, 1
jne 0x100e49f5
mov ecx, dword [esi + 4]
jmp 0x100e49f5
xor ecx, ecx
mov dword [edi], 1
lea eax, [edi + 4]
mov dword [edi + 4], ecx
pop esi
pop edi
ret
push 0x1019c248
call fcn.1010bf10
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jne 0x100e49a4
xor eax, eax
pop esi
pop edi
ret
push 0x1019c248
call fcn.1010bf10
add esp, 4
jmp 0x100e49d3
push 4
push 0xc
call fcn.1010c590
add esp, 8
ud2
Function at 0x100f6510
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword [esp + 0x14]
test eax, eax
je 0x100f6568
mov esi, dword [esp + 0x18]
lea edi, [edx + eax*2]
xor ebx, ebx
movzx eax, byte [edx + 1]
cmp byte [edx], ch
lea edx, [edx + 2]
lea ebp, [ebx + eax]
jne 0x100f6560
cmp ebp, ebx
jb 0x100f65e2
cmp ebp, dword [esp + 0x1c]
ja 0x100f65f3
add ebx, esi
nop word [eax + eax]
test eax, eax
je 0x100f6562
dec eax
cmp byte [ebx], cl
lea ebx, [ebx + 1]
jne 0x100f6550
jmp 0x100f65bf
ja 0x100f6568
cmp edx, edi
mov ebx, ebp
jne 0x100f6525
mov edx, dword [esp + 0x24]
test edx, edx
je 0x100f65c3
mov esi, dword [esp + 0x20]
movzx ecx, cx
mov al, 1
add edx, esi
nop dword [eax + eax]
movzx ebx, byte [esi]
lea edi, [esi + 1]
test bl, bl
js 0x100f65a0
mov esi, edi
sub ecx, ebx
jns 0x100f65b7
jmp 0x100f65c5
cmp edi, edx
je 0x100f65cc
movzx edi, byte [esi + 1]
and ebx, 0x7f
add esi, 2
shl ebx, 8
or ebx, edi
sub ecx, ebx
js 0x100f65c5
xor al, 1
cmp esi, edx
jne 0x100f6580
jmp 0x100f65c5
xor eax, eax
jmp 0x100f65c5
mov al, 1
and al, 1
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x1017a118
push 0x2b
push 0x1017944d
call fcn.1010c750
add esp, 0xc
ud2
push 0x1017a108
push ebp
push ebx
call fcn.1010cb70
add esp, 0xc
ud2
push 0x1017a108
push dword [esp + 0x20]
push ebp
call fcn.1010cb50
add esp, 0xc
ud2

Function at 0x100fdaa2
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x100fdae1
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x100fdae1
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x100fdae1
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x100fdae1
cmp dword [ecx + 0x74], 0xe
jbe 0x100fdae1
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x101014f3
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x10101590
push ebx
push esi
call fcn.101014bc
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.10101450
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x1010153d
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1010158f
push edi
push eax
call fcn.101024ae
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x1010155d
call fcn.100fff97
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1010158e
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.10101450
add esp, 0x20
test eax, eax
jne 0x1010157c
push edi
call fcn.100fff97
jmp 0x10101584
push ebx
call fcn.100fff97
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x101017fd
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x101828c8
push 0x101828c0
push str.FlsAlloc
push 0x1f
call fcn.10101719
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10101831
push dword [ebp + 8]
mov ecx, esi
call dword [0x1010d190]
call esi
jmp 0x10101837
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1010187b
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x101828d8
push 0x101828d0
push str.FlsGetValue
push 0x21
call fcn.10101719
mov esi, eax
add esp, 0x10
test esi, esi
je 0x101018b2
push dword [ebp + 8]
mov ecx, esi
call dword [0x1010d190]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x101018ba
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x101828e0
push 0x101828d8
push str.FlsSetValue
push 0x22
call fcn.10101719
mov esi, eax
add esp, 0x10
test esi, esi
je 0x101018f4
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x1010d190]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x10106f80
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10106fad
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10106fad
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x1010bf10
Capabilities:
Allocate thread local storage

Disassembly:
push ebx
push edi
push esi
sub esp, 0x20
mov edi, dword [esp + 0x30]
cmp dword [edi + 4], 0
je 0x1010bf8a
lea ebx, [edi + 0xc]
mov dword [esp + 4], 0
lea eax, [esp + 4]
push 0
push eax
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_InitOnceBeginInitialize]
cmp eax, 1
mov dword [esp], eax
jne 0x1010bfc5
cmp dword [esp + 4], 0
je 0x1010bfac
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x1010bfe8
mov esi, eax
inc eax
mov dword [edi], eax
mov eax, dword [0x1019ccb0]
nop word [eax + eax]
mov dword [edi + 8], eax
lock cmpxchg dword [0x1019ccb0], edi
jne 0x1010bf70
push 0
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_InitOnceComplete]
jmp 0x1010bfbc
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [esp], eax
je 0x1010c02f
mov ecx, eax
xor eax, eax
inc ecx
lock cmpxchg dword [edi], ecx
jne 0x1010bfb0
mov esi, dword [esp]
jmp 0x1010bfbc
mov esi, dword [edi]
jmp 0x1010bfbb
mov esi, eax
push dword [esp]
call dword [sym.imp.KERNEL32.dll_TlsFree]
dec esi
mov eax, esi
add esp, 0x20
pop esi
pop edi
pop ebx
ret
mov dword [esp + 0x10], 0
lea eax, [esp + 8]
mov ecx, esp
mov edx, 0x10177520
push 0x10177554
push eax
call fcn.1010ba60
add esp, 8
ud2
push 0
push 4
push ebx
call dword [sym.imp.KERNEL32.dll_InitOnceComplete]
mov dword [esp + 0x10], 0x10177578
mov dword [esp + 0x14], 1
mov dword [esp + 8], 0
mov dword [esp + 0x18], str._rustc_5b8f284536d00ba649ca968584bedab4820d8527librarycore_src_sliceiter.rs
mov dword [esp + 0x1c], 0
lea eax, [esp + 8]
push 0x10177580
push eax
call fcn.1010c690
add esp, 8
ud2
mov ecx, esp
lea edx, [esp + 8]
mov dword [esp + 8], 0
mov dword [esp + 0x10], 0x10177578
mov dword [esp + 0x14], 1
mov dword [esp + 0x18], str._rustc_5b8f284536d00ba649ca968584bedab4820d8527librarycore_src_sliceiter.rs
mov dword [esp + 0x1c], 0
call fcn.1010b9a0
ud2
Function at 0x415124
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffb4
mov dword [esp], eax
lea esi, [esp + 0x30]
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetSystemInfo_1
mov edi, dword [esp]
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery_1
test eax, eax
je 0x4151ef
jmp 0x4151e3
cmp dword [esi + 0x10], 0x1000
jne 0x4151cf
test byte [esi + 0x15], 1
jne 0x4151cf
mov byte [esp + 4], 0
mov ebp, dword [esi + 0x14]
cmp ebp, 1
je 0x415180
cmp ebp, 2
je 0x415180
cmp ebp, 0x10
je 0x415180
cmp ebp, 0x20
jne 0x41519c
lea eax, [esp + 8]
push eax
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x41519c
mov byte [esp + 4], 1
xor ebx, ebx
jmp 0x4151ad
mov eax, dword [esi]
add eax, ebx
call fcn.0041511c
add ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0xc]
jb 0x4151a0
cmp byte [esp + 4], 0
je 0x4151cf
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov edi, eax
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery_1
test eax, eax
je 0x4151ef
mov eax, dword [esi + 4]
cmp eax, dword [esp]
je 0x415155
add esp, 0x4c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x4031f2
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x10]
push ebx
push 1
push 0
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
js 0x40322a
push edi
push 0
push 0x4aeecc
push 0xa
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.DLL_FindResourceExW]
mov edi, eax
test edi, edi
jne 0x4757d3
pop edi
pop esi
pop ebx
leave
ret
push edi
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.DLL_LoadResource]
mov dword [ebp - 4], eax
test eax, eax
je 0x403229
push edi
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
mov edi, eax
test edi, edi
je 0x403229
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_LockResource]
test eax, eax
je 0x403229
mov ecx, dword [ebx]
push 0
mov edx, dword [ecx]
push edi
push eax
push ecx
call dword [edx + 0x10]
mov eax, dword [ebx]
xor edx, edx
mov ecx, dword [eax]
push edx
push edx
push edx
push edx
push eax
call dword [ecx + 0x14]
mov byte [esi + 0x14], 1
jmp 0x403229