joyce8/EMBER2024-capa huggingface dataset:
Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x433072
nop
mov ebx, 0x40de38
nop
nop
nop
nop
mov ecx, ebx
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x3a6923ad
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x433060
nop
nop
mov eax, section..rsrc
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4330d2
nop
nop
mov ebx, 0x4304d8
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x5b501fd9
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x4330c0
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x40181c
Capabilities:
Hash data using murmur3

Disassembly:
ror ecx, 0x10
mov dword [ebp - 0x74], ecx
pop ebx
pop esi
pop edi
ret
push edi
push esi
push ebx
mov ebx, dword [ebp - 0x60]
test ebx, ebx
rol ebx, 0xf
mov ecx, dword [ebx]
mov eax, dword [ebp - 0x20]
test ebx, eax
ror eax, 0x11
cmp ecx, eax
jne 0x4018d4
mov ecx, 0x200000
rol ecx, 0xd
add ebx, ecx
mov ecx, dword [ebx]
mov eax, dword [ebp - 0x24]
test edi, eax
rol eax, 0xc
cmp ecx, eax
jne 0x4018d4
mov ecx, 0x800000
ror ecx, 0x15
add ebx, ecx
mov ecx, dword [ebx]
mov eax, dword [ebp - 0x2c]
test edi, eax
rol eax, 0x12
cmp ecx, eax
jne 0x4018d4
mov ecx, 0x8000000
ror ecx, 0x19
add ebx, ecx
mov ecx, dword [ebx]
mov eax, dword [ebp - 0x38]
test esi, eax
ror eax, 0xc
cmp ecx, eax
jne 0x4018d4
mov ecx, 0x1000
ror ecx, 0xa
add ebx, ecx
mov ecx, dword [ebx]
mov eax, dword [ebp - 0x18]
test esi, eax
rol eax, 0xf
cmp ecx, eax
jne 0x4018d4
jmp 0x401990
xor ecx, eax
xor esi, esi
mov edx, 0xff
ror edx, 8
jmp 0x401a00
cmp ecx, esi
je 0x401990
mov ecx, esi
jmp 0x401808
inc ecx
jmp 0x401808
mov edi, eax
and edi, edx
cmp edi, edx
jne 0x40197c
shl ecx, 8
shl eax, 8
jmp 0x401a00

Function at 0x1000125c
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 0xc], 0
call sub.KERNEL32.DLL_GetEnvironmentStringsA
mov ebx, eax
mov dword [ebp - 0x10], ebx
jmp 0x10001299
cmp byte [ebx], 0x3d
je 0x10001285
inc dword [ebp - 0xc]
mov edi, ebx
xor eax, eax
stc
sbb ecx, ecx
repne scasb al, byte es:[edi]
neg ecx
lea eax, [ecx - 2]
mov edi, eax
inc edi
lea ebx, [ebx + edi]
cmp byte [ebx], 0
jne 0x10001278
mov edi, dword [ebp - 0xc]
inc edi
lea edi, [edi*4]
mov dword [ebp - 0x14], edi
push dword [ebp - 0x14]
call sub.CRTDLL.DLL_malloc
pop ecx
mov dword [ebp - 8], eax
mov dword [0x10003010], eax
cmp dword [ebp - 8], 0
jne 0x100012cc
xor eax, eax
jmp 0x10001342
mov ebx, dword [ebp - 0x10]
jmp 0x10001325
mov edi, ebx
xor eax, eax
stc
sbb ecx, ecx
repne scasb al, byte es:[edi]
neg ecx
lea eax, [ecx - 2]
mov edi, eax
inc edi
mov dword [ebp - 4], edi
cmp byte [ebx], 0x3d
je 0x1000131f
push dword [ebp - 4]
call sub.CRTDLL.DLL_malloc
pop ecx
mov esi, dword [ebp - 8]
mov dword [esi], eax
or eax, eax
jne 0x10001308
jmp 0x10001342
push ebx
mov edi, dword [ebp - 8]
push dword [edi]
call sub.CRTDLL.DLL_strcpy
add esp, 8
add dword [ebp - 8], 4
mov edx, dword [ebp - 4]
lea ebx, [ebx + edx]
cmp byte [ebx], 0
jne 0x100012d1
mov edx, dword [ebp - 8]
mov dword [edx], 0
mov eax, 1
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10001836
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x98
mov esi, esp
mov dword [esi + 0x80], ebp
lea ecx, [esi + 0x88]
mov eax, dword [ebp + 0xc]
mov dword [ecx - 4], esp
or dword [ecx + 8], 0xffffffff
mov dword [ecx + 4], 0x100369b0
mov edx, dword fs:[0]
mov dword [ecx], edx
mov dword fs:[0], ecx
lea edx, [esi + 0x68]
mov ecx, dword [eax + 8]
movsd xmm0, qword [eax]
mov eax, dword [eax + 8]
mov dword [esi], eax
mov dword [edx + 8], ecx
movsd qword [edx], xmm0
lea eax, [esi + 0x10]
push edx
push eax
call fcn.100d176a
pop eax
pop ecx
lea eax, [esi + 4]
and dword [eax], 0
mov dword [eax + 4], 8
and dword [eax + 8], 0
lea eax, [esi + 0x10]
mov dword [esi + 0x90], 1
push eax
lea eax, [esi + 0x38]
push eax
call fcn.10010ae1
pop eax
pop ecx
cmp byte [esi + 0x38], 7
je 0x10001915
movsd xmm0, qword [esi + 0x38]
movsd xmm1, qword [esi + 0x40]
movsd xmm2, qword [esi + 0x48]
movsd qword [esi + 0x50], xmm0
movsd qword [esi + 0x60], xmm2
movsd qword [esi + 0x58], xmm1
cmp byte [esi + 0x50], 6
je 0x10001939
movsd xmm0, qword [esi + 0x48]
movsd xmm2, qword [esi + 0x38]
movsd xmm1, qword [esi + 0x40]
lea ecx, [esi + 4]
lea edx, [esi + 0x68]
movsd qword [esi + 0x78], xmm0
movsd qword [esi + 0x70], xmm1
movsd qword [esi + 0x68], xmm2
call fcn.1000db39
jmp 0x100018a7
mov eax, dword [esi + 0x3c]
and dword [esi + 0x90], 0
lea ecx, [esi + 4]
mov dword [esi], eax
call fcn.1000b525
mov edi, dword [ebp + 8]
mov eax, dword [esi]
mov dword [edi + 4], eax
mov byte [edi], 6
jmp 0x100019ba
lea ecx, [esi + 0x50]
call fcn.1000b7b8
mov ecx, dword [esi + 4]
mov byte [esi + 0x20], 4
mov eax, dword [esi + 0xc]
mov edx, dword [esi + 8]
mov dword [esi + 0x24], ecx
mov ecx, dword [esi + 0x18]
mov dword [esi + 0x2c], eax
mov dword [esi + 0x28], edx
cmp ecx, dword [esi + 0x14]
je 0x1000199a
mov dword [esi + 0x90], 2
push 0x1010d440
push 0x1010d438
push dword [esi]
call fcn.1010732c
add esp, 0xc
mov ecx, dword [ebp + 8]
and dword [esi + 0x90], 0
mov dword [ecx + 4], eax
mov byte [ecx], 6
lea ecx, [esi + 0x20]
call fcn.10009d50
mov edi, dword [ebp + 8]
jmp 0x100019ba
movsd xmm0, qword [esi + 0x30]
mov edi, dword [ebp + 8]
movsd xmm2, qword [esi + 0x20]
movsd xmm1, qword [esi + 0x28]
movsd qword [edi + 0x10], xmm0
movsd qword [edi + 8], xmm1
movsd qword [edi], xmm2
or dword [esi + 0x90], 0xffffffff
lea eax, [esi + 0x10]
push eax
call fcn.10011643
pop eax
mov eax, dword [esi + 0x88]
mov dword fs:[0], eax
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1000affa
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
lea eax, [ebp - 0x18]
mov dword [ebp - 0x20], ecx
mov dword [eax - 4], esp
or dword [eax + 8], 0xffffffff
mov dword [eax + 4], 0x10036dc0
mov edx, dword fs:[0]
mov dword [eax], edx
mov dword fs:[0], eax
mov dword [eax + 8], 5
call fcn.10009d76
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x10], 4
lea ecx, [eax + 0xc]
call fcn.10009d76
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x10], 3
lea ecx, [eax + 0x18]
call fcn.10009d76
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x10], 2
lea ecx, [eax + 0x24]
call fcn.10009d76
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x10], 1
lea ecx, [eax + 0x30]
call fcn.10009d76
mov eax, dword [ebp - 0x20]
and dword [ebp - 0x10], 0
lea ecx, [eax + 0x3c]
call fcn.10009d76
mov ecx, dword [ebp - 0x20]
or dword [ebp - 0x10], 0xffffffff
add ecx, 0x48
call fcn.10009d76
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x100367a9
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x88
mov esi, esp
mov dword [esi + 0x70], ebp
lea eax, [esi + 0x78]
mov dword [esi + 8], ecx
mov dword [eax - 4], esp
or dword [eax + 8], 0xffffffff
mov dword [eax + 4], 0x10037bd0
mov ecx, dword fs:[0]
mov dword [eax], ecx
mov dword fs:[0], eax
and dword [esi + 0xc], 0
xor ecx, ecx
and dword [esi + 0x24], 0
mov dword [esi + 0x28], 4
and dword [esi + 0x18], 0
and dword [esi + 0x2c], 0
and dword [eax + 8], 0
inc ecx
mov dword [esi + 0x10], ecx
mov dword [esi + 0x1c], ecx
and dword [esi + 0x14], 0
and dword [esi + 0x20], 0
lea ecx, [esi + 0x60]
call fcn.10011323
mov eax, dword [esi + 0x6c]
mov ecx, dword [esi + 0x68]
mov edx, dword [esi + 0x60]
mov edi, dword [esi + 0x64]
mov dword [esi + 0x80], 1
mov dword [esi + 0x30], edx
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], ecx
mov dword [esi + 0x3c], eax
and dword [esi + 0x40], 0
and dword [esi + 0x44], 0
and dword [esi + 0x48], 0
lea ecx, [esi + 0x50]
mov dword [esi + 0x4c], 0x1010e400
call fcn.10011323
mov eax, dword [esi + 0x5c]
mov ebx, dword [esi + 0x14]
mov ecx, dword [esi + 8]
movsd xmm0, qword [esi + 0xc]
movsd xmm2, qword [esi + 0x18]
movsd xmm1, qword [esi + 0x24]
movsd xmm3, qword [esi + 0x30]
mov dword [esi + 4], eax
mov eax, dword [esi + 0x58]
mov edx, dword [esi + 0x50]
mov edi, dword [esi + 0x54]
mov dword [ecx + 0x48], ebx
mov ebx, dword [esi + 0x20]
movsd qword [ecx + 0x40], xmm0
movsd qword [ecx + 0x4c], xmm2
movsd xmm2, qword [esi + 0x40]
mov dword [ecx + 0x54], ebx
mov ebx, dword [esi + 0x2c]
movsd qword [ecx + 0x58], xmm1
movsd xmm1, qword [esi + 0x38]
mov dword [ecx + 0x60], ebx
movsd qword [ecx + 8], xmm1
movsd xmm1, qword [esi + 0x48]
movsd qword [ecx], xmm3
movsd qword [ecx + 0x10], xmm2
movsd qword [ecx + 0x18], xmm1
mov dword [ecx + 0x24], edi
mov edi, dword [esi + 4]
mov dword [ecx + 0x20], edx
mov dword [ecx + 0x28], eax
mov eax, dword [esi + 0x78]
mov dword [ecx + 0x2c], edi
and dword [ecx + 0x30], 0
and dword [ecx + 0x34], 0
and dword [ecx + 0x38], 0
mov dword [ecx + 0x3c], 0x1010e400
mov dword fs:[0], eax
mov eax, ecx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x10039082
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebx
push edi
push esi
mov edi, dword [esp + 0x10]
mov ecx, edi
call fcn.10038eee
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
je 0x1003907c
mov ebx, dword [esp + 0x14]
mov esi, eax
test eax, eax
jne 0x1003906e
call fcn.10039835
mov ecx, edi
mov dword [eax], edi
mov esi, eax
mov byte [eax + 4], 0
call fcn.10038eee
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
add esi, 4
push ebx
push esi
call fcn.10039184
pop ecx
pop edx
jmp 0x1003907e
xor eax, eax
pop esi
pop edi
pop ebx
ret
mov ecx, dword [esp + 4]
call fcn.10038eee
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jbe 0x100390a1
cmp byte [eax + 4], 0
je 0x100390a1
add eax, 5
ret
jmp 0x1003902e
Function at 0x100391c0
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x28
lea ecx, [ebp - 0x18]
mov eax, dword [ebp + 8]
mov dword [ecx - 4], esp
or dword [ecx + 8], 0xffffffff
mov dword [ecx + 4], 0x1003bc80
mov edx, dword fs:[0]
mov dword [ecx], edx
mov dword fs:[0], ecx
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x24], eax
mov ecx, dword [eax]
mov eax, dword [ecx]
mov dword [ebp - 0x28], ecx
test eax, eax
je 0x10039203
dec eax
jmp 0x10039215
mov byte [ebp - 0x1d], 1
mov dword [ebp - 0x10], 1
push ecx
call fcn.1010bf10
pop ecx
xor ecx, ecx
mov byte [ebp - 0x1d], 1
inc ecx
mov dword [ebp - 0x10], ecx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [ebp - 0x24]
lea ecx, [ebp - 0x34]
mov dword [ecx], eax
call fcn.10039421
mov ecx, dword [ebp - 0x28]
mov eax, dword [ecx]
test eax, eax
je 0x10039240
dec eax
jmp 0x1003924b
mov byte [ebp - 0x1d], 0
push ecx
call fcn.1010bf10
pop ecx
mov byte [ebp - 0x1d], 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
xor eax, eax
mov ecx, dword [ebp - 0x18]
mov dword fs:[0], ecx
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10046ac1
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x58
mov esi, esp
mov dword [esi + 0x40], ebp
lea ebx, [esi + 0x48]
lea edi, [esi + 0x30]
mov dword [ebx - 4], esp
or dword [ebx + 8], 0xffffffff
mov dword [ebx + 4], 0x100470f0
mov ecx, edi
mov eax, dword fs:[0]
mov dword [ebx], eax
mov dword fs:[0], ebx
call fcn.10043eff
mov eax, dword [edi + 8]
mov ecx, dword [edi + 0xc]
mov edx, dword [edi]
mov edi, dword [edi + 4]
and dword [ebx + 8], 0
mov dword [esi + 4], edi
mov dword [esi], edx
mov dword [esi + 0xc], ecx
mov dword [esi + 8], eax
and dword [esi + 0x10], 0
and dword [esi + 0x14], 0
and dword [esi + 0x18], 0
lea ecx, [esi + 0x20]
mov dword [esi + 0x1c], 0x10118970
call fcn.10043eff
mov ebx, dword [ebp + 8]
movsd xmm1, qword [esi + 0x10]
mov eax, dword [esi + 0x2c]
mov ecx, dword [esi + 0x28]
mov edx, dword [esi + 0x20]
mov edi, dword [esi + 0x24]
movsd xmm0, qword [esi + 0x18]
movsd xmm2, qword [esi]
mov dword [esi + 0x50], 1
movsd qword [ebx + 0x10], xmm1
movsd xmm1, qword [esi + 8]
movsd qword [ebx + 0x18], xmm0
movsd qword [ebx], xmm2
movsd qword [ebx + 8], xmm1
mov dword [ebx + 0x24], edi
mov dword [ebx + 0x20], edx
mov dword [ebx + 0x28], ecx
mov dword [ebx + 0x2c], eax
and dword [ebx + 0x30], 0
and dword [ebx + 0x34], 0
and dword [ebx + 0x38], 0
mov dword [ebx + 0x3c], 0x10118970
mov dword [ebx + 0x40], 0x10118818
mov dword [ebx + 0x44], 0x101192e8
push 9
push str.unescaped
push ebx
call fcn.10046beb
add esp, 0xc
mov eax, dword [esi + 0x48]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1004c41a
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x7c
lea esi, [ebp - 0x18]
mov dword [ebp - 0x24], ecx
mov edi, edx
lea ecx, [ebp - 0x30]
mov dword [esi - 4], esp
or dword [esi + 8], 0xffffffff
mov dword [esi + 4], 0x1004ce80
mov eax, dword fs:[0]
mov dword [esi], eax
lea eax, [edx + 4]
mov dword fs:[0], esi
push eax
push ecx
call fcn.1004b372
pop eax
pop ecx
and dword [esi + 8], 0
lea eax, [ebp - 0x48]
mov dword [ebp - 0x20], edi
push edi
push eax
call fcn.10063457
pop eax
pop ecx
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
lea eax, [ebp - 0x88]
mov dword [ebp - 0x10], 1
mov dword [eax + 8], edx
mov dword [eax + 0xc], ecx
and dword [eax], 0
mov dword [eax + 4], ecx
and dword [eax + 0x10], 0
mov byte [eax + 0x18], 0
lea ecx, [ebp - 0x6c]
push eax
push ecx
call fcn.1007ef15
pop eax
pop ecx
mov eax, dword [ebp - 0x28]
mov esi, dword [ebp - 0x24]
movsd xmm0, qword [ebp - 0x30]
movsd xmm1, qword [ebp - 0x40]
movsd xmm2, qword [ebp - 0x48]
mov dword [esi + 0x2c], eax
movsd qword [esi + 0x24], xmm0
movsd qword [esi + 0x10], xmm1
movsd xmm1, qword [ebp - 0x38]
movsd qword [esi + 8], xmm2
lea eax, [esi + 0x30]
movsd qword [esi + 0x18], xmm1
push 0x24
lea ecx, [ebp - 0x6c]
push ecx
push eax
call fcn.100f9c00
add esp, 0xc
mov eax, dword [ebp + 8]
mov dword [esi], eax
mov eax, dword [ebp + 0xc]
mov dword [esi + 4], eax
mov eax, dword [ebp - 0x20]
mov dword [esi + 0x20], eax
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, esi
add esp, 0x7c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1005209a
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebx
push edi
push esi
mov esi, dword [esp + 0x10]
mov ecx, esi
call fcn.10038eee
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
je 0x10052094
mov ebx, dword [esp + 0x14]
mov edi, eax
test eax, eax
jne 0x10052089
push 0xc
pop ecx
push 4
pop edx
call fcn.1000dee4
and dword [eax], 0
mov ecx, esi
mov edi, eax
mov dword [eax + 8], esi
call fcn.10038eee
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push ebx
push edi
call fcn.1005219b
pop ecx
pop edx
jmp 0x10052096
xor eax, eax
pop esi
pop edi
pop ebx
ret
mov ecx, dword [esp + 4]
call fcn.10038eee
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jbe 0x100520b8
cmp dword [eax], 0
je 0x100520b8
add eax, 4
ret
jmp 0x10052043

Function at 0x10052203
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x28
lea ecx, [ebp - 0x18]
mov eax, dword [ebp + 8]
mov dword [ecx - 4], esp
or dword [ecx + 8], 0xffffffff
mov dword [ecx + 4], 0x100843f0
mov edx, dword fs:[0]
mov dword [ecx], edx
mov dword fs:[0], ecx
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x24], eax
mov ecx, dword [eax + 8]
mov eax, dword [ecx]
mov dword [ebp - 0x28], ecx
test eax, eax
je 0x10052247
dec eax
jmp 0x10052259
mov byte [ebp - 0x1d], 1
mov dword [ebp - 0x10], 1
push ecx
call fcn.1010bf10
pop ecx
xor ecx, ecx
mov byte [ebp - 0x1d], 1
inc ecx
mov dword [ebp - 0x10], ecx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [ebp - 0x24]
lea ecx, [ebp - 0x34]
mov dword [ecx], eax
call fcn.1000afc4
mov ecx, dword [ebp - 0x28]
mov eax, dword [ecx]
test eax, eax
je 0x10052284
dec eax
jmp 0x1005228f
mov byte [ebp - 0x1d], 0
push ecx
call fcn.1010bf10
pop ecx
mov byte [ebp - 0x1d], 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
xor eax, eax
mov ecx, dword [ebp - 0x18]
mov dword fs:[0], ecx
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x10053c89
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
lea eax, [ebp - 0x18]
mov dword [ebp - 0x20], ecx
add ecx, 4
mov dword [eax - 4], esp
or dword [eax + 8], 0xffffffff
mov dword [eax + 4], 0x10084590
mov dword [ebp - 0x24], ecx
mov edx, dword fs:[0]
mov dword [eax], edx
mov dword fs:[0], eax
mov dword [eax + 8], 4
push ecx
call fcn.1009b535
pop eax
mov dword [ebp - 0x10], 3
push dword [ebp - 0x24]
call fcn.1009b8b2
pop eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x10], 2
lea ecx, [eax + 0x10]
call fcn.10052e7a
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x10], 1
lea ecx, [eax + 0x20]
call fcn.10052e10
mov eax, dword [ebp - 0x20]
and dword [ebp - 0x10], 0
lea ecx, [eax + 0x30]
call fcn.10052d8a
mov ecx, dword [ebp - 0x20]
or dword [ebp - 0x10], 0xffffffff
add ecx, 0x44
call fcn.10009d76
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1005b2cc
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x590
mov esi, esp
mov dword [esi + 0x578], ebp
lea edx, [esi + 0x580]
mov ebx, dword [ebp + 0x10]
lea edi, [esi + 0x90]
call fcn.1005b2f7
Function at 0x1005de99
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xe0
mov esi, esp
mov dword [esi + 0xc8], ebp
lea eax, [esi + 0xcc]
mov dword [eax], esp
or dword [eax + 0xc], 0xffffffff
push 4
pop ecx
mov dword [eax + 8], 0x10084b60
lea edx, [eax + ecx]
mov edi, dword fs:[0]
mov dword [eax + 4], edi
mov dword fs:[0], edx
and dword [esi + 4], 0
mov dword [esi + 8], ecx
and dword [esi + 0x10], 0
mov dword [esi + 0x14], ecx
and dword [esi + 0x1c], 0
mov dword [esi + 0x20], ecx
and dword [eax + 0xc], 0
and dword [esi + 0xc], 0
and dword [esi + 0x18], 0
and dword [esi + 0x24], 0
lea eax, [esi + 0x48]
push 0x1011b2bc
push eax
call fcn.10051fe2
pop eax
pop ecx
mov ecx, dword [esi + 0x50]
mov edx, dword [esi + 0x48]
mov edi, dword [esi + 0x4c]
mov eax, dword [esi + 0x54]
mov dword [esi + 0x28], edx
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], ecx
mov ecx, dword [ebp + 0xc]
mov dword [esi + 0x34], eax
and dword [esi + 0x38], 0
and dword [esi + 0x3c], 0
and dword [esi + 0x40], 0
mov dword [esi + 0x44], 0x1011bcf0
mov eax, dword [ecx + 0x280]
lea ecx, [esi + 0x58]
mov edx, dword [eax + 0x13c]
mov dword [esi + 0xd8], 1
mov dword [esi], edx
call fcn.100828ec
mov edx, dword [esi]
lea ecx, [esi + 0x74]
mov dword [esi + 0xd8], 2
call fcn.100828ec
mov eax, dword [esi + 0x70]
movsd xmm1, qword [esi + 0x60]
lea edi, [esi + 0x90]
movsd xmm0, qword [esi + 0x68]
movsd xmm2, qword [esi + 0x58]
mov ebx, dword [ebp + 8]
movsd xmm3, qword [esi + 0x74]
mov dword [edi + 0x18], eax
movsd qword [edi + 8], xmm1
movsd xmm1, qword [esi + 0x7c]
mov eax, dword [esi + 0x8c]
movsd qword [edi], xmm2
movsd qword [edi + 0x10], xmm0
movsd xmm2, qword [esi + 0x84]
movsd qword [edi + 0x1c], xmm3
movsd xmm3, qword [esi + 0x28]
movsd qword [edi + 0x24], xmm1
mov dword [edi + 0x34], eax
mov eax, dword [esi + 0xc]
movsd xmm1, qword [esi + 4]
movsd qword [edi + 0x2c], xmm2
movsd xmm2, qword [esi + 0x10]
mov dword [ebx + 0x7c], eax
movsd qword [ebx + 0x74], xmm1
mov eax, dword [esi + 0x18]
movsd xmm1, qword [esi + 0x1c]
movsd qword [ebx + 0x80], xmm2
movsd xmm2, qword [esi + 0x38]
mov dword [ebx + 0x88], eax
movsd qword [ebx + 0x8c], xmm1
mov eax, dword [esi + 0x24]
movsd xmm1, qword [esi + 0x30]
mov dword [ebx + 0x94], eax
movsd qword [ebx + 8], xmm1
movsd xmm1, qword [esi + 0x40]
movsd qword [ebx], xmm3
movsd qword [ebx + 0x10], xmm2
lea eax, [ebx + 0x30]
movsd qword [ebx + 0x18], xmm1
push 0x38
push edi
push eax
call fcn.100f9c00
add esp, 0xc
mov eax, dword [ebp + 0xc]
and dword [ebx + 0x98], 0
mov dword [ebx + 0x9c], 4
and dword [ebx + 0xa0], 0
and dword [ebx + 0xa4], 0
mov dword [ebx + 0xa8], 1
and dword [ebx + 0xac], 0
and dword [ebx + 0x20], 0
and dword [ebx + 0x68], 0
and dword [ebx + 0x6c], 0
and dword [ebx + 0x70], 0
and dword [ebx + 0xb0], 0
lea ecx, [esi + 0x90]
mov dword [esi + 0xd8], 3
mov dword [edi], eax
mov dword [edi + 4], ebx
call fcn.1005e690
mov eax, dword [esi + 0xd0]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10069c78
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
mov esi, esp
mov dword [esi + 0x28], ebp
lea eax, [esi + 0x30]
mov dword [esi + 4], ecx
lea edx, [esi + 0x20]
mov dword [eax - 4], esp
or dword [eax + 8], 0xffffffff
mov dword [eax + 4], 0x10084ca0
mov ecx, dword fs:[0]
mov dword [eax], ecx
mov dword fs:[0], eax
and dword [eax + 8], 0
and dword [edx], 0
mov byte [esi + 3], 1
lea eax, [esi + 8]
push edx
push eax
call fcn.1007df5a
pop eax
pop ecx
lea ecx, [esi + 8]
mov byte [esi + 3], 1
call fcn.10056ea4
mov dword [esi + 0x10], eax
mov eax, dword [esi + 4]
movsd xmm0, qword [eax]
mov eax, dword [eax + 8]
mov dword [esi + 0x1c], eax
xor eax, eax
movsd qword [esi + 0x14], xmm0
inc eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x38], eax
push 0x18
pop ecx
push 4
pop edx
call fcn.1000dee4
movsd xmm0, qword [esi + 0x18]
movsd qword [eax + 0x10], xmm0
movsd xmm0, qword [esi + 8]
movsd xmm1, qword [esi + 0x10]
movsd qword [eax + 8], xmm1
movsd qword [eax], xmm0
mov ecx, dword [esi + 0x30]
mov dword fs:[0], ecx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret