joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001200
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x10015004]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x10]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x10001237
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100019fb
mov esp, ebp
pop ebp
ret
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 2
push dword [ebp - 0x10]
call esi
test eax, eax
jne 0x10001276
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x10001276
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100019fb
mov esp, ebp
pop ebp
ret
push edi
push dword [ebp - 0x14]
call fcn.10004e86
mov edi, eax
add esp, 4
test edi, edi
je 0x100012df
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x14]
push edi
push 2
push dword [ebp - 0x10]
call esi
test eax, eax
je 0x100012d6
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0
push eax
mov word [ebp - 8], 0x500
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
jne 0x100012fa
push edi
call fcn.10004e81
add esp, 4
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100019fb
mov esp, ebp
pop ebp
ret
xor esi, esi
mov byte [ebp - 0x19], 0
cmp dword [edi], esi
jbe 0x1000132e
push ebx
lea ebx, [edi + 4]
nop dword [eax + eax]
push dword [ebx]
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x10001329
inc esi
add ebx, 8
cmp esi, dword [edi]
jb 0x10001310
jmp 0x1000132d
mov byte [ebp - 0x19], 1
pop ebx
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
push edi
call fcn.10004e81
add esp, 4
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov al, byte [ebp - 0x19]
xor ecx, ebp
pop edi
pop esi
call fcn.100019fb
mov esp, ebp
pop ebp
ret
Function at 0x100014c0
Capabilities:
Create thread
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x10015004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
cmp eax, 1
jne 0x1000153f
push ecx
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
push 0x104
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x10012a98
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x10016274], eax
test eax, eax
je 0x10001552
call fcn.10001000
test eax, eax
je 0x10001552
push 0
push 0
push 0
push 0x10001360
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x10001552
test eax, eax
jne 0x10001552
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebp - 4]
mov eax, 1
xor ecx, ebp
call fcn.100019fb
mov esp, ebp
pop ebp
ret 0xc
Function at 0x406234
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x406243
pop dword [ebp - 8]
mov eax, 0x552f5b2a
sub eax, 0x54eef8e7
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0x77c9f3e0
sub dword [ebp - 0x18], 0x2977ae95
mov dword [ebp - 0x14], 0x5aa59f8a
sub dword [ebp - 0x14], 0x28725345
mov dword [ebp - 0x10], 0x53115ab0
sub dword [ebp - 0x10], 0x6c51682
mov dword [ebp - 0xc], 0x875489aa
sub dword [ebp - 0xc], 0x875489aa
lea eax, [ebp - 0x18]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0x90b782ff
add dword [ebp - 0x18], 0xe3bae657
mov dword [ebp - 0x14], 0x9c0d163
sub dword [ebp - 0x14], 0xc8546fee
mov dword [ebp - 0x10], 0x73e6842c
sub dword [ebp - 0x10], 0x107717c0
mov dword [ebp - 0xc], 0x92fbe711
sub dword [ebp - 0xc], 0x92fbe711
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, 0xab252e9
add eax, 0xf58e2e17
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x3621b
push 0
call eax
mov ecx, 0xc90bc0e0
add ecx, 0x36f4838f
xor esi, esi
add esi, eax
mov edi, 0xe54b8abe
add edi, 0x1afb5942
add edi, dword [ebp - 8]
mov edx, 0x674c564c
sub dword [ebp - 4], 0x29d96113
mov ebx, dword [edi]
xor dword [ebp - 4], esi
xor ebx, edx
add dword [ebp - 4], eax
mov dword [esi], ebx
sub dword [ebp - 4], 0x118a5f67
add esi, 0x159ba498
add esi, 0xea645b6c
add edi, 0x6c74e8a1
add edi, 0x938b1763
loop 0x40635c
add eax, 0xda41cbb1
sub eax, 0xda40c722
mov ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 8]
call ebx
leave
ret

Function at 0x40669d
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x427dcc], 0
push esi
jne 0x4066d4
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4066ae
mov dword [ecx*4 + 0x427dc8], eax
inc ecx
cmp ecx, 0x100
jl 0x4066a9
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406705
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x427dc8]
xor eax, esi
inc ecx
dec edx
jne 0x4066e7
pop edi
not eax
pop esi
ret 0xc
Function at 0x401a57
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x401a96
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x401a96
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x401a96
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x401a96
cmp dword [ecx + 0x74], 0xe
jbe 0x401a96
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x40743c
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x4074d9
push ebx
push esi
call fcn.00407405
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.00407399
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x407486
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x4074d8
push edi
push eax
call fcn.00407ccf
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x4074a6
call fcn.00405ee1
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x4074d7
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.00407399
add esp, 0x20
test eax, eax
jne 0x4074c5
push edi
call fcn.00405ee1
jmp 0x4074cd
push ebx
call fcn.00405ee1
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x4083d5
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x40ffc0
push 0x40ffb8
push str.FlsAlloc
push 0x1f
call fcn.004082f1
mov esi, eax
add esp, 0x10
test esi, esi
je 0x408409
push dword [ebp + 8]
mov ecx, esi
call dword [0x40e10c]
call esi
jmp 0x40840f
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x408453
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x40ffd0
push 0x40ffc8
push str.FlsGetValue
push 0x21
call fcn.004082f1
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40848a
push dword [ebp + 8]
mov ecx, esi
call dword [0x40e10c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x408492
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x40ffd8
push 0x40ffd0
push str.FlsSetValue
push 0x22
call fcn.004082f1
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4084cc
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x40e10c]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x40d380
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40d3ad
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40d3ad
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x4040b0
Capabilities:
Persist via winlogon helper dll registry key
Set registry value

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x118
lea ecx, [esp + 4]
push edi
push eax
push str.Explorer.exe__s
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea edx, [esp + 4]
push edx
push 0x20006
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea edi, [esp + 8]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esp + 8]
push ecx
mov ecx, dword [esp + 8]
push eax
push 1
push 0
push str.Shell
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
add esp, 0x118
ret

Function at 0x416a8a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ecx + 8]
mov eax, edx
push edi
mov edi, dword [ebp + 8]
xor edx, edx
mov dword [ebp - 4], eax
test edi, edi
jle 0x416abe
push ebx
mov ebx, dword [ecx]
mov al, byte [edx + eax]
xor byte [ebx + esi], al
lea eax, [esi + 1]
xor esi, esi
cmp eax, dword [ecx + 4]
cmovl esi, eax
mov eax, dword [ebp - 4]
inc edx
cmp edx, edi
jl 0x416aa4
pop ebx
add dword [ecx + 0xc], edi
pop edi
mov dword [ecx + 8], esi
pop esi
leave
ret

Function at 0x10002aa9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x10002ab8
pop dword [ebp - 0x38]
mov eax, 0x10002ab8
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0x128f460c
add dword [ebp - 0x48], 0x3bc2ff3f
mov dword [ebp - 0x44], 0xe8cb3989
add dword [ebp - 0x44], 0x496812bc
mov dword [ebp - 0x40], 0x7d289241
add dword [ebp - 0x40], 0xcf23b1ed
mov dword [ebp - 0x3c], 0xc8e06b25
sub dword [ebp - 0x3c], 0xc8e06b25
lea eax, [ebp - 0x48]
push eax
mov eax, 0xfe205eb
add eax, 0x1f9a1d
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0x408b7b
add dword [ebp - 0x48], 0x7431dddb
mov dword [ebp - 0x44], 0x4d1319ac
add dword [ebp - 0x44], 0xf45947c9
mov dword [ebp - 0x40], 0x16927f16
sub dword [ebp - 0x40], 0xb32312aa
mov dword [ebp - 0x3c], 0x5976033
add dword [ebp - 0x3c], 0xfa689fcd
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, 0x82e2c044
sub eax, 0x72e12038
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x398f4
push 0
call eax
mov ecx, 0x114c81d2
sub ecx, 0x114c3cc5
xor esi, esi
add esi, eax
mov edx, 0x6fa39d5b
add edx, 0xa05eaca5
add edx, dword [ebp - 0x38]
mov ebx, 0x5b3ac5a4
add ebx, 0x67b172e2
xor dword [ebp - 0x24], edx
mov edi, dword [edx]
sub dword [ebp - 0x2c], edx
sub edi, ebx
mov dword [esi], edi
add esi, 0xd4b6955c
sub esi, 0xd4b69558
add edx, 0x2fddf0a9
add edx, 0xd0220f5b
loop 0x10002bd7
add eax, 0x10707
mov ebx, eax
add eax, 0xeec1b366
add eax, 0x113e4c9f
mov ecx, 0x4e72ae97
add ecx, 0xc18d5169
add ecx, dword [ebp - 0x38]
call ebx
leave
ret
Function at 0x10009510
Capabilities:
Encode data using xor

Disassembly:
add byte [edi + 0x60d8af66], bh
int1
mov ch, 0xee
mov ebx, 0x952a1342
test dword [eax + 0x5245dead], ecx
mov al, byte [ebx]
in al, dx
lea esp, [eax - 7]
xchg ebp, eax
adc al, 9
int3
dec ebp
xchg ebp, eax
add eax, dword fs:[ebx - 0x69013a87]
push ds
push eax
mov dh, 0xf5
jne 0x100094bc
mov dword [0xf93081fd], eax
loope 0x10009562
out dx, al
inc edx
cmp dword [ebx - 0xf3032ed], 0xbed24ea6
fisubr dword [edi]
shr byte [eax + ebp*4], cl
sbb byte [edi - 0x2ddcfe7d], 0xdd
hlt
aam 0x7e
or dword [ecx], 0xee01329c
add ebp, dword [ecx + 0x5d156ab2]
lodsb al, byte [esi]
cmp al, 0x25
adc ebp, dword [ecx + 0x3aedef67]
and byte [edi], 0xdf
xor dl, ah
invalid

Function at 0x103d76a0
Capabilities:
Encode data using xor

Disassembly:
jmp 0x103d76aa
pushal
call 0x103d76b0
pop ebp
sub ebp, 0x10
sub ebp, 0x3d76a0
mov al, byte [esp + 0x28]
cmp al, 1
je 0x103d76d4
popal
xor eax, eax
inc eax
ret 0xc
jmp 0x103d76dd
mov eax, 0x3d76a0
add eax, ebp
add eax, 0x63
mov ecx, 0x5e5
mov edx, 0x95079a39
xor byte [eax], dl
inc eax
dec ecx
jne 0x103d76f4
jmp 0x103d7707
mov dl, 0xf4
mov dl, 0xb0
add eax, 0xb8393939
clc
sar dword [ecx], 0x39
cmp dword [edx], edi
hlt
Function at 0x10002be0
Capabilities:
Check for time delay via gettickcount
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov ecx, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
lea eax, [ecx + 1]
cmp eax, 1
ja 0x10002c07
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x10002d81
mov ecx, dword [0x1007f298]
test ecx, ecx
je 0x10002c26
call dword [0x1007d68c]
call ecx
mov esi, eax
xor edi, edi
mov dword [esp], 0
jmp 0x10002ca0
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x10002c8a
mov edi, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
cmp edi, 1
mov dword [esp], eax
sbb eax, 0
jl 0x10002c96
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x10002c96
mov eax, dword [esp + 8]
mov dword [esp + 4], eax
mov esi, dword [esp + 0xc]
push 0
push 0x3e8
push dword [esp + 8]
push edi
call fcn.10044ac8
add esp, 0x10
push edx
push eax
push esi
push dword [esp + 0x10]
call fcn.100449c8
add esp, 0x10
mov esi, eax
jmp 0x10002ca0
mov edi, 0xffffffff
mov dword [esp], 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
xor edx, edx
mov eax, dword [ebp + 0xc]
add esi, eax
adc edx, 0
mov dword [esp + 4], edx
push eax
nop dword [eax]
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x10002d81
mov ecx, dword [0x1007f298]
test ecx, ecx
je 0x10002ce0
call dword [0x1007d68c]
call ecx
jmp 0x10002d68
mov eax, edi
mov ecx, dword [esp]
or eax, ecx
jne 0x10002d00
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x10002d50
mov edi, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
cmp edi, 1
mov dword [esp], ecx
mov eax, ecx
sbb eax, 0
jl 0x10002d60
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x10002d60
mov eax, dword [esp + 8]
mov dword [esp + 0x18], eax
mov ebx, dword [esp + 0xc]
push 0
push 0x3e8
push dword [esp + 8]
push edi
call fcn.10044ac8
add esp, 0x10
push edx
push eax
push ebx
push dword [esp + 0x24]
mov ebx, dword [ebp + 8]
call fcn.100449c8
add esp, 0x10
jmp 0x10002d68
mov edi, 0xffffffff
mov dword [esp], 0xffffffff
nop dword [eax]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor edx, edx
mov ecx, dword [esp + 4]
cmp eax, esi
sbb edx, ecx
jae 0x10002d7c
mov ecx, esi
sub ecx, eax
push ecx
jmp 0x10002cb0
mov eax, 0x102
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10002d90
Capabilities:
Check for time delay via gettickcount
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov ecx, dword [ebp + 0x14]
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
lea eax, [ecx + 1]
cmp eax, 1
ja 0x10002dbe
push ecx
push dword [ebp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
jmp 0x10002f64
mov ecx, dword [0x1007f298]
test ecx, ecx
je 0x10002de6
call dword [0x1007d68c]
call ecx
mov esi, eax
mov dword [esp + 4], 0
mov dword [esp], 0
jmp 0x10002e68
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x10002e4f
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov dword [esp + 4], eax
cmp eax, 1
mov dword [esp], ecx
mov eax, ecx
sbb eax, 0
jl 0x10002e5e
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x10002e5e
mov esi, dword [esp + 8]
mov edi, dword [esp + 0xc]
push 0
push 0x3e8
push dword [esp + 8]
push dword [esp + 0x10]
call fcn.10044ac8
add esp, 0x10
push edx
push eax
push edi
mov edi, dword [ebp + 0xc]
push esi
call fcn.100449c8
add esp, 0x10
mov esi, eax
jmp 0x10002e68
mov dword [esp + 4], 0xffffffff
mov dword [esp], 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
xor edx, edx
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x14]
add esi, ecx
adc edx, 0
mov dword [esp + 0x18], edx
push ecx
push eax
nop dword [eax]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
cmp eax, 0x102
jne 0x10002f64
mov ecx, dword [0x1007f298]
test ecx, ecx
je 0x10002eb0
call dword [0x1007d68c]
call ecx
jmp 0x10002f48
mov ecx, dword [esp + 4]
mov eax, ecx
mov edx, dword [esp]
or eax, edx
jne 0x10002ed4
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x10002f27
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov dword [esp + 4], ecx
cmp ecx, 1
mov dword [esp], edx
mov eax, edx
sbb eax, 0
jl 0x10002f40
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x10002f40
mov ebx, dword [esp + 8]
mov edi, dword [esp + 0xc]
push 0
push 0x3e8
push dword [esp + 8]
push dword [esp + 0x10]
call fcn.10044ac8
add esp, 0x10
push edx
push eax
push edi
mov edi, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
call fcn.100449c8
add esp, 0x10
jmp 0x10002f48
mov dword [esp + 4], 0xffffffff
mov dword [esp], 0xffffffff
nop word cs:[eax + eax]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor edx, edx
mov ecx, dword [esp + 0x18]
cmp eax, esi
sbb edx, ecx
jae 0x10002f5f
mov ecx, esi
sub ecx, eax
push ecx
push dword [ebp + 0x10]
jmp 0x10002e80
mov eax, 0x102
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10003f50
Capabilities:
Get thread local storage value
Print debug messages
Set thread local storage value

Disassembly:
push esi
sub esp, 0x38
mov eax, dword [esp + 0x44]
cmp eax, 3
je 0x10003fcc
cmp eax, 1
je 0x10003fa2
test eax, eax
jne 0x10004078
cmp dword [esp + 0x48], 0
jne 0x10004078
mov esi, dword [0x1007f2d0]
test esi, esi
je 0x10004078
mov ecx, dword [0x1007f2a8]
test ecx, ecx
je 0x1000406e
call dword [0x1007d68c]
push esi
call ecx
add esp, 4
jmp 0x1000406e
mov ecx, dword [0x1007f2a4]
test ecx, ecx
je 0x1000406e
call dword [0x1007d68c]
push 0x100065e0
push 1
call ecx
add esp, 8
mov dword [0x1007f2d0], eax
jmp 0x10004078
mov eax, dword [0x1007f01c]
cmp eax, 0xffffffff
je 0x10004078
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x10004078
mov esi, eax
test byte [eax + 0x20], 0x30
je 0x1000407f
push dword [esi + 0xb4]
call fcn.10004c20
add esp, 4
mov eax, dword [esi + 0x14]
test eax, eax
je 0x1000402d
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi + 0x18]
test eax, eax
je 0x1000401f
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x18], 0
mov dword [esi + 0x14], 0
lea eax, [esi + 0x1c]
push eax
call fcn.10003260
add esp, 4
mov eax, esi
add eax, 0x38
push eax
call fcn.10003e20
add esp, 4
cmp eax, 1
je 0x10004117
mov dword [esi + 0x38], 0xffffffff
mov ecx, esi
call fcn.10004f50
push 0
push dword [0x1007f01c]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
jmp 0x10004078
mov dword [0x1007f2d0], 0
add esp, 0x38
pop esi
ret 0xc
cmp dword [esi + 0x68], 0
mov eax, dword [esi + 0x18]
je 0x1000409c
test eax, eax
je 0x10004093
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x18], 0
jmp 0x100040c9
test eax, eax
je 0x100040a7
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x18], 0
mov dword [esi + 0x68], 1
push dword [esi + 0xb4]
call fcn.10004c20
add esp, 4
test byte [esi + 0x24], 4
jne 0x100040e1
lea eax, [esi + 0x1c]
push eax
call fcn.10003260
add esp, 4
add esi, 0x38
mov ecx, esi
call fcn.10005e20
jmp 0x10004078
mov dword [esi], 0xdeadbeef
mov eax, dword [esi + 0x14]
test eax, eax
je 0x100040f5
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x14], 0
lea eax, [esi + 0x1c]
push eax
call fcn.10003260
add esp, 4
mov ecx, esi
add ecx, 0x38
call fcn.10005e20
jmp 0x10004057
xorps xmm0, xmm0
movsd qword [esp + 0x2d], xmm0
xorps xmm0, xmm0
movups xmmword [esp + 0x20], xmm0
movups xmmword [esp + 0x10], xmm0
movups xmmword [esp], xmm0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
sub esp, 0x10
mov dword [esp + 0xc], eax
lea esi, [esp + 0x10]
mov dword [esp], esi
call fcn.10006770
add esp, 0x10
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call sub.msvcrt.dll_abort
nop dword [eax]
mov eax, dword [esp + 4]
mov dword [0x1007f2ac], eax
ret
Function at 0x100043d0
Capabilities:
Get thread local storage value
Print debug messages
Set thread local storage value

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x3c
call fcn.10005960
push dword [0x1007f01c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test eax, eax
jne 0x100044be
call fcn.10005d80
test eax, eax
je 0x100044bc
mov esi, eax
mov dword [eax + 0x24], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [esi + 0x3c], eax
sub esp, 0x10
movaps xmm0, xmmword [0x100741d0]
movups xmmword [esp], xmm0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], 0xffffffff
lea eax, [esi + 0x38]
push eax
call fcn.10003e20
add esp, 4
cmp eax, 1
je 0x100044c8
mov dword [esi + 0x38], 0xffffffff
mov dword [esi + 0x64], 0
mov ebp, esi
add ebp, 0x14
mov dword [esi + 0x14], 0
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call edi
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov ebx, eax
call edi
push 2
push 0
push 0
push ebp
push eax
push ebx
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x10004506
push dword [esi + 0x14]
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], 0
mov eax, dword [esi + 0x20]
and eax, 0xffffffcf
or eax, 0x10
mov dword [esi + 0x20], eax
push esi
push dword [0x1007f01c]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x100044be
jmp 0x10004506
xor esi, esi
mov eax, esi
add esp, 0x3c
pop esi
pop edi
pop ebx
pop ebp
ret
xorps xmm0, xmm0
movsd qword [esp + 0x31], xmm0
xorps xmm0, xmm0
movups xmmword [esp + 0x24], xmm0
movups xmmword [esp + 0x14], xmm0
movups xmmword [esp + 4], xmm0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
sub esp, 0x10
mov dword [esp + 0xc], eax
lea esi, [esp + 0x14]
mov dword [esp], esi
call fcn.10006770
add esp, 0x10
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call sub.msvcrt.dll_abort
nop dword [eax + eax]