joyce8/EMBER2024-capa huggingface dataset:
Function at 0x101433e8
Capabilities:
Get file system object information

Disassembly:
push 0x398
mov eax, 0x10179fad
call fcn.1014b896
mov ebx, ecx
mov ecx, dword [ebp + 0x14]
xor esi, esi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x3a0], edi
test ecx, ecx
je 0x10143579
mov eax, dword [ebp + 0x10]
sub eax, esi
je 0x1014354b
sub eax, 1
je 0x10143467
sub eax, 1
je 0x1014343f
sub eax, 1
je 0x10143467
push 0x1017be21
mov ecx, edi
call fcn.10002bec
mov eax, edi
call fcn.1014b845
ret 0x10
push 0x408
push 0x160
lea eax, [ebp - 0x39c]
push eax
push esi
push dword [ecx + 4]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
test eax, eax
je 0x10143429
lea eax, [ebp - 0x28c]
push eax
jmp 0x1014342e
lea eax, [ebp - 0x114]
push eax
push dword [ecx + 4]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
test eax, eax
je 0x10143429
push esi
lea eax, [ebp - 0x23c]
mov dword [ebp - 0x23c], esi
push eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x238], esi
push eax
mov dword [ebp - 0x234], esi
mov dword [ebp - 0x230], esi
mov dword [ebp - 0x22c], esi
mov dword [ebp - 0x228], esi
call fcn.100a1537
test eax, eax
je 0x10143429
lea ecx, [ebp - 0x3a0]
call fcn.10002c96
cmp dword [ebp + 0x10], 1
mov dword [ebp - 4], esi
jne 0x10143501
test byte [ebp - 0x21c], 0x18
jne 0x10143523
mov eax, dword [ebx]
lea ecx, [ebp - 0x3a0]
push ecx
push dword [ebp - 0x220]
mov esi, dword [eax + 0x1a0]
mov ecx, esi
push dword [ebp - 0x224]
call dword [0x1017b9f0]
mov ecx, ebx
call esi
jmp 0x10143523
mov eax, dword [ebx]
lea ecx, [ebp - 0x3a0]
push ecx
lea ecx, [ebp - 0x234]
push ecx
mov esi, dword [eax + 0x1a4]
mov ecx, esi
call dword [0x1017b9f0]
mov ecx, ebx
call esi
mov eax, dword [ebp - 0x3a0]
add eax, 0xfffffff0
push eax
call fcn.10003630
pop ecx
mov ecx, dword [ebp - 0x3a0]
add eax, 0x10
mov dword [edi], eax
lea ecx, [ecx - 0x10]
call fcn.100045aa
jmp 0x10143435
push 0x208
push 0x160
lea eax, [ebp - 0x39c]
push eax
push esi
push dword [ecx + 4]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
test eax, eax
je 0x10143429
lea eax, [ebp - 0x390]
jmp 0x10143464
call fcn.10014b9e
int3

Function at 0x101436f1
Capabilities:
Get common file path

Disassembly:
push esi
mov esi, ecx
call fcn.1014a97e
call fcn.100165a6
cmp dword [eax + 0x14], 0
jne 0x1014370c
mov ecx, esi
pop esi
jmp fcn.101429f3
pop esi
ret

Function at 0x10144087
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x16c
mov eax, dword [0x101c9e80]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x168], esi
test eax, eax
je 0x101440f1
push 0x208
push 0x160
lea ecx, [ebp - 0x164]
push ecx
push 0
push dword [eax + 4]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
mov ecx, esi
test eax, eax
je 0x101440d6
lea eax, [ebp - 0x158]
push eax
jmp 0x101440db
push 0x101a42a8
call fcn.10002bec
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.1014b0c0
leave
ret 8
call fcn.10014b9e
int3
Function at 0x101445d6
Capabilities:
Get common file path
Get file system object information

Disassembly:
push esi
mov esi, ecx
call fcn.100026d0
call fcn.100165a6
cmp dword [eax + 0x14], 0
jne 0x101445f1
mov ecx, esi
pop esi
jmp fcn.10143e31
pop esi
ret

Function at 0x10150616
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x10150655
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10150655
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10150655
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x10150655
cmp dword [ecx + 0x74], 0xe
jbe 0x10150655
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x10160e89
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x101a8c78
push 0x101a8c70
push str.FlsAlloc
push 0x1f
call fcn.10160d08
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10160ebd
push dword [ebp + 8]
mov ecx, esi
call dword [0x1017b9f0]
call esi
jmp 0x10160ec3
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x10160f07
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x101a8c88
push 0x101a8c80
push str.FlsGetValue
push 0x21
call fcn.10160d08
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10160f3e
push dword [ebp + 8]
mov ecx, esi
call dword [0x1017b9f0]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x10160f46
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x101a8c90
push 0x101a8c88
push str.FlsSetValue
push 0x22
call fcn.10160d08
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10160f80
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x1017b9f0]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x10165c8b
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x10165d28
push ebx
push esi
call fcn.10165c54
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.10163681
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x10165cd5
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10165d27
push edi
push eax
call fcn.1015ec72
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x10165cf5
call fcn.1015ee4f
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10165d26
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.10163681
add esp, 0x20
test eax, eax
jne 0x10165d14
push edi
call fcn.1015ee4f
jmp 0x10165d1c
push ebx
call fcn.1015ee4f
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x10165d2b
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x10165d3c
pop esi
ret
push ebx
push edi
push esi
call fcn.10165c54
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.1015ec72
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x10165d64
push ebx
push esi
push edi
call fcn.1014cf50
add esp, 0xc
push 0
call fcn.1015ee4f
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x10166134
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10165d79

Function at 0x1016b500
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1016b52d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1016b52d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x401554
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push edi
push esi
push ebx
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
test ebx, ebx
je 0x4015aa
xor edx, edx
xor ecx, ecx
cmp edx, edi
jge 0x401598
mov eax, dword [esi + 0xc]
cmp ebx, eax
jb 0x401580
add eax, dword [esi + 0x10]
cmp ebx, eax
jb 0x401598
add ecx, 0x28
inc edx
cmp edx, edi
jge 0x401598
mov eax, dword [esi + ecx + 0xc]
cmp ebx, eax
jb 0x401580
add eax, dword [esi + ecx + 0x10]
cmp ebx, eax
jae 0x401580
cmp edx, edi
je 0x4015ee
lea eax, [edx + edx*4]
shl eax, 3
mov ebx, dword [esi + eax + 0x10]
test ebx, ebx
jne 0x4015b1
mov al, 1
jmp 0x40169d
mov esi, dword [esi + eax + 0x14]
add esp, 0xfffffff4
push 0x40152a
call fcn.00401280
mov dword [ebp - 8], eax
add esp, 0xfffffff4
push 0x401545
call fcn.00401280
mov dword [ebp - 0xc], eax
add esp, 0x20
add esp, 0xfffffff4
push 0x19000
call sub.msvcrt.dll_malloc
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x4015f5
mov al, 0
jmp 0x40169d
push 0
push 0
push esi
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.dll_SetFilePointer
mov byte [ebp - 0xd], 1
mov esi, ebx
jmp 0x40163c
add esp, 0xfffffffc
mov eax, dword [ebp - 8]
push eax
push ebx
push edi
call fcn.004012c8
add esp, 0x10
test al, al
jne 0x40166a
add esp, 0xfffffffc
mov eax, dword [ebp - 0xc]
push eax
push ebx
push edi
call fcn.004012c8
add esp, 0x10
test al, al
jne 0x40166a
sub esi, ebx
test esi, esi
je 0x40166e
mov ebx, esi
cmp esi, 0x19000
jbe 0x40164f
mov ebx, 0x19000
add esp, 0xfffffff4
push 0
lea eax, [ebp - 4]
push eax
push ebx
push edi
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.dll_ReadFile
add esp, 0xc
test eax, eax
jne 0x401610
test esi, esi
jne 0x401672
mov byte [ebp - 0xd], 0
add esp, 0xfffffff4
push edi
call sub.msvcrt.dll_free
add esp, 0xfffffff4
mov eax, dword [ebp - 8]
push eax
call fcn.0040387c
add esp, 0x20
add esp, 0xfffffff4
mov eax, dword [ebp - 0xc]
push eax
call fcn.0040387c
xor byte [ebp - 0xd], 1
mov al, byte [ebp - 0xd]
lea esp, [ebp - 0x28]
pop ebx
pop esi
pop edi
leave
ret
Function at 0x402d24
Capabilities:
Create service
Delete service
Persist via windows service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push edi
push esi
push ebx
add esp, 0xfffffffc
push 0xf003f
push 0
push 0
call sub.ADVAPI32.DLL_OpenSCManagerA
mov dword [ebp - 8], eax
add esp, 4
test eax, eax
jne 0x402d50
xor eax, eax
jmp 0x402e5e
add esp, 0xfffffffc
push 0xf003f
push dword [0x40a004]
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.DLL_OpenServiceA
mov esi, eax
add esp, 4
test esi, esi
je 0x402d8c
add esp, 0xfffffff4
push esi
call sub.ADVAPI32.DLL_DeleteService
push esi
call sub.ADVAPI32.DLL_CloseServiceHandle
push 0x3e8
call sub.KERNEL32.dll_Sleep
add esp, 0xc
add esp, 0xfffffff4
push 0x402cb2
call fcn.00401280
mov ebx, eax
add esp, 0xfffffff4
push 0
push 0
push 0
push 0
push 0
push dword [0x40a034]
push 0
push 2
push 0x10
push 0xf003f
push ebx
push dword [0x40a004]
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.DLL_CreateServiceA
mov esi, eax
push ebx
call fcn.0040387c
add esp, 0x20
add esp, 0xfffffff4
push 0x402d01
call fcn.00401280
mov ebx, eax
add esp, 0xfffffff4
push ebx
call sub.KERNEL32.dll_GetModuleHandleA
mov edi, eax
push ebx
call fcn.0040387c
add esp, 0x20
test edi, edi
je 0x402e50
add esp, 0xfffffff4
push 0x402d0e
call fcn.00401280
mov ebx, eax
add esp, 0xfffffff8
push ebx
push edi
call sub.KERNEL32.dll_GetProcAddress
mov edi, eax
add esp, 0xfffffffc
push ebx
call fcn.0040387c
add esp, 0x20
test edi, edi
je 0x402e50
add esp, 0xfffffff4
push 0x402cd0
call fcn.00401280
mov dword [ebp - 4], eax
add esp, 0xfffffffc
lea eax, [ebp - 4]
push eax
push 1
push esi
call edi
add esp, 0xfffffff8
push dword [ebp - 4]
call fcn.0040387c
add esp, 0x20
add esp, 0xfffffff4
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.DLL_CloseServiceHandle
mov eax, esi
lea esp, [ebp - 0x28]
pop ebx
pop esi
pop edi
leave
ret
Function at 0x404820
Capabilities:
Contain obfuscated stackstrings

Disassembly:
je 0x404e23
mov edi, dword [eax + 0x3c]
add edi, eax
movzx eax, word [edi + 0x14]
lea esi, [eax + edi + 0x18]
mov dword [ebp - 0x44], esi
call fcn.0040462a
lcall 0x47b7, 0xf7e5983
push es
lea eax, [eax + eax*4]
shl eax, 3
sub eax, dword [ebp + 0x10]
add eax, esi
mov dword [ebp - 0xb4], eax
mov dword [ebp - 8], eax
call fcn.0040462a
ffree st(1)
jl 0x404871
mov ax, word [edi + 6]
cmp ax, bx
jbe 0x404884
lea ecx, [esi + 0xc]
movzx edx, ax
mov eax, dword [ecx + 4]
mov esi, dword [ecx]
add eax, esi
cmp dword [ebp - 8], eax
jae 0x40487e
add al, 0x8b
xor dword [ebx], eax
invalid
mov dword [ebp - 8], eax
add ecx, 0x28
dec edx
jne 0x40486f
mov byte [ebp - 0x58], bl
mov byte [ebp - 0x57], bl
mov byte [ebp - 0x56], 0x58
mov byte [ebp - 0x55], bl
mov byte [ebp - 0x54], 0xe0
mov byte [ebp - 0x53], 0xc2
mov byte [ebp - 0x52], 0xd3
mov byte [ebp - 0x51], 0xf4
mov byte [ebp - 0x50], 0xde
mov byte [ebp - 0x4f], 0xd4
mov byte [ebp - 0x4e], 0xd3
mov byte [ebp - 0x4d], 0xc2
mov byte [ebp - 0x4c], 0xca
mov byte [ebp - 0x4b], 0xee
mov byte [ebp - 0x4a], 0xc9
mov byte [ebp - 0x49], 0xc1
mov byte [ebp - 0x48], 0xc8
mov byte [ebp - 0x47], 0xa7
call fcn.0040462a
shl dword [ebx + 5], 1
je 0x404860
inc ebp
test al, 0x50
call fcn.0040463a
mov esi, dword [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
call fcn.004045ef
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x404918
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl

Function at 0x404928
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.0040462a
repne outsb dx, byte [esi]
mov ebx, 0xc0458d6f
push eax
call fcn.0040463a
push eax
push esi
push dword [ebp + 8]
call fcn.004045ef
add esp, 0x10
mov dword [ebp - 0x88], eax
call fcn.0040462a
mov ch, 0x5c
vpsubsb zmm1 {k5}, zmm6, zmmword [eax - 0x77af17a3]
pop ebp
jmp 0x412a8f65
Function at 0x404cdc
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax], ebx
je 0x404cde
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x404cd9
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x404cc3
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x404ccb
cmp edx, ebx
jne 0x404e19
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x404c9a
add eax, dword [eax + 4]
jmp 0x404c87
mov dword [ebp + 0xc], ebx
jmp 0x404ce9
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x404d01
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x404d1f
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x404d7d
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x404d64
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x404d6d
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x404d77
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x404d59
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x404ce3
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x404dca
dec eax
je 0x404dc1
sub eax, 3
je 0x404db8
mov dword [ebp - 4], 0x40
jmp 0x404de7
mov dword [ebp - 4], 4
jmp 0x404dcd
mov dword [ebp - 4], 0x20
jmp 0x404dcd
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x404e19
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x404d99
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.0040462a
sub eax, dword [esi + 0x1475ff3f]
push 1
push esi
call edi
mov eax, esi
jmp 0x404e25
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100a4820
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
mov edi, edi
push esi
mov esi, dword [sym.imp.kernel32.dll_InterlockedCompareExchange]
push 0xfffffffffffffffe
push 0xfffffffffffffffe
push 0x101e316c
mov dword [ebx], 0
call esi
cmp eax, 0xfffffffe
jne 0x100a48ad
push edi
push 0
push 1
push 0x101e8a94
call esi
cmp eax, 1
jne 0x100a486a
mov edi, dword [sym.imp.kernel32.dll_Sleep]
push 1
call edi
push 0
push 1
push 0x101e8a94
call esi
cmp eax, 1
je 0x100a4856
push 0xfffffffffffffffe
push 0xfffffffffffffffe
push 0x101e316c
call esi
mov edi, dword [sym.imp.kernel32.dll_InterlockedExchange]
mov esi, eax
cmp esi, 0xfffffffe
jne 0x100a4897
call dword [sym.imp.kernel32.dll_TlsAlloc]
mov esi, eax
cmp esi, 0xffffffff
je 0x100a4897
push esi
push 0x101e316c
call edi
push 0
push 0x101e8a94
call edi
pop edi
cmp esi, 0xffffffff
jne 0x100a48ad
mov eax, 0x8007000e
pop esi
ret
mov eax, dword [0x101e316c]
test eax, eax
jl 0x100a48d1
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x100a48d1
inc dword [eax + 0x12c]
mov dword [ebx], 1
xor eax, eax
pop esi
ret
push 0x130
call sub.msvcrt.dll_malloc
mov esi, eax
add esp, 4
test esi, esi
je 0x100a48a6
push 0x130
push 0
push esi
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [esi + 0x12c], 1
mov dword [ebx], 1
mov eax, dword [0x101e316c]
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
xor eax, eax
pop esi
ret

Function at 0x100a9db0
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x101e316c]
test eax, eax
jge 0x100a9dbd
xor eax, eax
jmp 0x100a9dc4
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
xor ecx, ecx
lea edx, [eax + 0x24]
lea esp, [esp]
cmp dword [ecx*4 + 0x10053234], edi
jne 0x100a9dde
cmp dword [edx], 0
jne 0x100a9df3
inc ecx
add edx, 8
cmp ecx, 0xf
jb 0x100a9dd0
mov ecx, dword [eax + 0x20]
push 0x10
push edi
call fcn.101091d0
ret
mov edx, dword [eax + ecx*8 + 0x24]
test edx, edx
je 0x100a9e15
push esi
mov esi, dword [edx]
mov dword [eax + ecx*8 + 0x24], esi
test esi, esi
pop esi
jne 0x100a9e0f
mov dword [eax + ecx*8 + 0x28], 0
mov dword [edx], 0xfefefefe
cmp ecx, 0xf
jb 0x100a9e26
mov ecx, dword [eax + 0x20]
push 0x10
push edi
call fcn.101091d0
ret
mov eax, edx
ret

Function at 0x100aaa70
Capabilities:
Get thread local storage value

Disassembly:
test esi, esi
je 0x100aaac4
mov eax, dword [0x101e316c]
push ebx
push edi
test eax, eax
jge 0x100aaa83
xor ebx, ebx
jmp 0x100aaa8c
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov ebx, eax
mov edi, dword [esi + 4]
mov eax, dword [edi*4 + 0x10053234]
push eax
push 0xfe
push esi
call sub.msvcrt.dll_memset
lea ecx, [ebx + edi*8 + 0x28]
mov dword [esi], 0
mov eax, dword [ecx]
add esp, 0xc
test eax, eax
je 0x100aaabc
pop edi
mov dword [eax], esi
mov dword [ecx], esi
pop ebx
ret
mov dword [ebx + edi*8 + 0x24], esi
pop edi
mov dword [ecx], esi
pop ebx
ret
Function at 0x10101cd0
Capabilities:
Get thread local storage value

Disassembly:
mov ecx, dword [ebx + 8]
push esi
xor esi, esi
push edi
cmp ecx, esi
je 0x10101ce3
mov eax, dword [ecx]
mov edx, dword [eax]
push 1
call edx
mov edi, dword [ebx + 0x1a4]
mov dword [ebx + 8], esi
cmp edi, esi
je 0x10101d08
call fcn.10117760
lea esi, [edi + 0x28]
call fcn.10118ed0
push edi
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
add esp, 4
xor esi, esi
mov dword [ebx + 0x1a4], esi
cmp byte [ebx + 0x1a0], 0
mov dword [ebx + 0x19c], esi
je 0x10101d4d
mov edi, dword [ebx + 0x194]
cmp edi, esi
je 0x10101d46
mov eax, dword [0x101e316c]
cmp eax, esi
jge 0x10101d34
xor eax, eax
jmp 0x10101d3b
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov eax, dword [eax]
push edi
push esi
push eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov byte [ebx + 0x1a0], 0
mov dword [ebx + 0x194], esi
mov dword [ebx + 0x198], esi
mov esi, ebx
call fcn.10101be0
pop edi
pop esi
ret

Function at 0x10117350
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebx
push esi
mov esi, eax
xor ebx, ebx
cmp dword [esi + 4], ebx
jbe 0x1011737c
push edi
xor edi, edi
mov eax, dword [esi + 0xc]
mov ecx, dword [eax + edi + 0x10]
test ecx, ecx
je 0x10117372
push 1
call fcn.101091d0
inc ebx
add edi, 0x18
cmp ebx, dword [esi + 4]
jb 0x10117360
pop edi
mov esi, dword [esi + 0xc]
test esi, esi
je 0x101173af
mov eax, dword [0x101e316c]
test eax, eax
jge 0x1011739c
xor eax, eax
mov ecx, dword [eax]
push esi
push eax
push ecx
call dword [sym.imp.kernel32.dll_HeapFree]
pop esi
pop ebx
ret
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov ecx, dword [eax]
push esi
push 0
push ecx
call dword [sym.imp.kernel32.dll_HeapFree]
pop esi
pop ebx
ret

Function at 0x10117950
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ecx
push esi
push edi
mov edi, ecx
mov esi, edx
test eax, eax
jne 0x101179af
lea ecx, [ecx]
cmp dword [eax*4 + 0x1006ea30], edi
jae 0x10117971
inc eax
cmp eax, 0x1c
jb 0x10117960
jmp 0x10117978
mov edi, dword [eax*4 + 0x1006ea30]
mov eax, dword [0x101e316c]
test eax, eax
jge 0x10117985
xor eax, eax
jmp 0x1011798c
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov edx, dword [eax]
lea ecx, [edi*4]
push ecx
push 0
push edx
call dword [sym.imp.kernel32.dll_HeapAlloc]
test eax, eax
jne 0x101179ac
mov eax, 0x8007000e
pop edi
pop esi
pop ecx
ret
mov dword [esi + 0x38], eax
mov ecx, eax
neg ecx
sbb ecx, ecx
and ecx, edi
push ecx
mov ecx, eax
add esi, 0x28
mov eax, edi
call fcn.101091d0
pop edi
pop esi
pop ecx
ret
Function at 0x10165510
Capabilities:
Get thread local storage value

Disassembly:
cmp byte [esi + 0xc], 0
mov dword [esi + 8], 0
je 0x10165549
push edi
mov edi, dword [esi]
test edi, edi
je 0x10165544
mov eax, dword [0x101e316c]
test eax, eax
jge 0x10165531
xor eax, eax
jmp 0x10165538
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov eax, dword [eax]
push edi
push 0
push eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov byte [esi + 0xc], 0
pop edi
push esi
mov dword [esi], 0
mov dword [esi + 4], 0
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
add esp, 4
mov eax, esi
ret

Function at 0x10168d10
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x101e316c]
test eax, eax
jge 0x10168d1d
xor eax, eax
jmp 0x10168d24
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp dword [eax + 0xc], 0
je 0x10168d49
mov ecx, dword [eax + 0xc]
test ecx, ecx
jne 0x10168d34
xor eax, eax
ret
mov edx, dword [ecx]
mov dword [eax + 0xc], edx
test edx, edx
jne 0x10168d40
mov dword [eax + 0x10], edx
mov dword [ecx], 0xfefefefe
mov eax, ecx
ret
mov ecx, dword [eax + 8]
push 0x10
push pe_nt_image_headers32
call fcn.101091d0
ret

Function at 0x10168d60
Capabilities:
Get thread local storage value

Disassembly:
test esi, esi
je 0x10168da9
mov eax, dword [0x101e316c]
push edi
test eax, eax
jge 0x10168d72
xor edi, edi
jmp 0x10168d7b
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov edi, eax
push pe_nt_image_headers32
push 0xfe
push esi
call sub.msvcrt.dll_memset
mov dword [esi], 0
mov eax, dword [edi + 0x10]
add esp, 0xc
test eax, eax
je 0x10168da2
mov dword [eax], esi
mov dword [edi + 0x10], esi
pop edi
ret
mov dword [edi + 0xc], esi
mov dword [edi + 0x10], esi
pop edi
ret