joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10021fa0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov eax, 0x2800
call fcn.10039ee0
mov eax, dword [esp + 0x2804]
push ebx
push ebp
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [esp + 0x1810]
push eax
push ecx
call edi
lea edx, [esp + 0x1810]
push edx
call fcn.10016ee0
push 0
lea eax, [esp + 0x1018]
push 0
lea ecx, [esp + 0x201c]
push eax
lea edx, [esp + 0x1820]
push ecx
push edx
call fcn.10033490
push 0
lea eax, [esp + 0x102c]
push 0
lea ecx, [esp + 0x2030]
push eax
lea edx, [esp + 0x834]
push ecx
push edx
call fcn.10033640
add esp, 0x2c
lea eax, [esp + 0x810]
lea ecx, [esp + 0x1010]
push eax
push ecx
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
lea edx, [esp + 0x810]
push 0x5c
push edx
call fcn.10033450
test eax, eax
je 0x10022064
mov byte [eax], 0
lea eax, [esp + 0x810]
push eax
call esi
cmp eax, 0xffffffff
je 0x10022030
lea ecx, [esp + 0x810]
lea edx, [esp + 0x10]
push ecx
push edx
jmp 0x10022071
lea eax, [esp + 0x810]
lea ecx, [esp + 0x10]
push eax
push ecx
call edi
lea edx, [esp + 0x10]
push 0x100596b4
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x1010]
lea ecx, [esp + 0x810]
push eax
push ecx
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
lea edx, [esp + 0x10]
push edx
call ebx
mov esi, eax
lea eax, [esp + 0x810]
push eax
call ebx
cmp esi, eax
jge 0x10022144
mov ebp, dword [sym.imp.KERNEL32.dll_IsDBCSLeadByte]
lea ecx, [esp + 0x10]
push ecx
call ebx
lea edx, [esp + 0x10]
lea edi, [esp + eax + 0x10]
push edx
call ebx
lea esi, [esp + eax + 0x810]
mov al, byte [esp + eax + 0x810]
test al, al
je 0x10022105
cmp al, 0x5c
je 0x10022105
mov byte [edi], al
mov al, byte [esi]
push eax
inc edi
call ebp
test eax, eax
je 0x100220f6
mov cl, byte [esi + 1]
mov byte [edi], cl
inc edi
push esi
call dword [sym.imp.USER32.dll_CharNextA]
mov esi, eax
mov al, byte [esi]
test al, al
jne 0x100220e0
lea edx, [esp + 0x10]
push 0
push edx
mov byte [edi], 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x10022151
lea eax, [esp + 0x10]
push 0x100596b4
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [esp + 0x10]
push ecx
call ebx
lea edx, [esp + 0x810]
mov esi, eax
push edx
call ebx
cmp esi, eax
jl 0x100220bc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x2800
ret
pop edi
pop esi
pop ebp
mov eax, 0xf
pop ebx
add esp, 0x2800
ret

Function at 0x100221d0
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 8]
push esi
mov esi, dword [esp + 8]
mov edx, dword [ecx + 0x48]
mov eax, edx
xor eax, esi
and eax, 0xff
shr edx, 8
mov eax, dword [eax*4 + 0x10059c24]
xor eax, edx
mov edx, dword [ecx + 0x4c]
mov dword [ecx + 0x48], eax
and eax, 0xff
add eax, edx
mov edx, dword [ecx + 0x50]
imul eax, eax, 0x8088405
inc eax
mov esi, edx
mov dword [ecx + 0x4c], eax
and esi, 0xff
shr eax, 0x18
xor eax, esi
pop esi
shr edx, 8
mov eax, dword [eax*4 + 0x10059c24]
xor eax, edx
mov dword [ecx + 0x50], eax
ret
Function at 0x10022be0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
push esi
cmp ebx, 1
push edi
jge 0x10022bf4
mov ebx, 1
jmp 0x10022bfe
cmp ebx, 9
jle 0x10022bfe
mov ebx, 9
mov esi, dword [esp + 0x1c]
xor ebp, ebp
mov eax, dword [esi + 0x68]
mov dword [esi + 0x70], ebp
cmp eax, ebp
jne 0x10022c1c
mov dword [esi + 0x70], 1
mov dword [esi + 0x68], 0x10000
cmp dword [esi + 0x54], ebp
jne 0x10022c51
push 2
push 0x8000
call fcn.1003b0d0
add esp, 8
cmp eax, ebp
mov dword [esi + 0x54], eax
jne 0x10022c51
push esi
push ebp
push 0x17c
call fcn.10020fb0
add esp, 8
push eax
push 4
call fcn.1001b780
add esp, 0xc
cmp dword [esi + 0x58], ebp
jne 0x10022c9c
push 2
push 0x8000
call fcn.1003b0d0
push 2
push 0x4000
mov dword [esi + 0x58], eax
call fcn.1003b0d0
mov ecx, dword [esi + 0x58]
add esp, 0x10
cmp ecx, ebp
mov dword [esi + 0x5c], eax
je 0x10022c82
cmp eax, ebp
jne 0x10022c9c
push esi
push ebp
push 0x186
call fcn.10020fb0
add esp, 8
push eax
push 4
call fcn.1001b780
add esp, 0xc
mov eax, dword [esi + 0x5c]
mov ecx, 0x1fff
xor edx, edx
mov word [eax + 0x7ffe], bp
mov edi, dword [esi + 0x5c]
xor eax, eax
rep stosd dword es:[edi], eax
xor ecx, ecx
stosw word es:[edi], ax
mov cx, word [ebx*8 + 0x1005988a]
xor eax, eax
mov dword [esi + 0x90], ecx
mov dx, word [ebx*8 + 0x10059888]
mov dword [esi + 0x94], edx
mov ax, word [ebx*8 + 0x1005988c]
xor ecx, ecx
mov dword [esi + 0x98], eax
mov cx, word [ebx*8 + 0x1005988e]
cmp ebx, 1
mov dword [esi + 0x8c], ecx
jne 0x10022d02
mov eax, dword [esp + 0x18]
or byte [eax], 4
jmp 0x10022d0e
cmp ebx, 9
jne 0x10022d0e
mov eax, dword [esp + 0x18]
or byte [eax], 2
mov edx, dword [esi + 0x54]
push esi
push 0x8000
push edx
mov dword [esi + 0x7c], ebp
mov dword [esi + 0x6c], ebp
call dword [esi + 0xc7b0]
add esp, 0xc
cmp eax, ebp
mov dword [esi + 0x88], eax
jne 0x10022d46
mov dword [esi + 0x84], 1
mov dword [esi + 0x88], ebp
pop edi
pop esi
pop ebp
pop ebx
ret
mov edi, 0x106
mov dword [esi + 0x84], ebp
cmp eax, edi
jae 0x10022d70
cmp dword [esi + 0x84], ebp
jne 0x10022d70
push esi
call fcn.10022df0
mov eax, dword [esi + 0x88]
add esp, 4
cmp eax, edi
jb 0x10022d55
mov ecx, dword [esi + 0x54]
mov dword [esi + 0x74], ebp
xor eax, eax
mov edi, dword [esi + 0x74]
xor edx, edx
mov dl, byte [ecx + eax]
and edi, 0x1ff
and edx, 0x3fff
shl edi, 5
xor edx, edi
inc eax
cmp eax, 2
mov dword [esi + 0x74], edx
jb 0x10022d78
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x10026350
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
push esi
cmp ebx, 1
push edi
jge 0x10026364
mov ebx, 1
jmp 0x1002636e
cmp ebx, 9
jle 0x1002636e
mov ebx, 9
mov esi, dword [esp + 0x1c]
xor ebp, ebp
mov eax, dword [esi + 0x68]
mov dword [esi + 0x70], ebp
cmp eax, ebp
jne 0x1002638c
mov dword [esi + 0x70], 1
mov dword [esi + 0x68], 0x2fff6
cmp dword [esi + 0x54], ebp
jne 0x100263c1
push 1
push 0x2fff6
call fcn.1003b0d0
add esp, 8
cmp eax, ebp
mov dword [esi + 0x54], eax
jne 0x100263c1
push esi
push ebp
push 0x17c
call fcn.10020fb0
add esp, 8
push eax
push 4
call fcn.1001b780
add esp, 0xc
cmp dword [esi + 0x60], ebp
jne 0x1002640c
push 4
push 0x10000
call fcn.1003b0d0
push 4
push 0x8000
mov dword [esi + 0x60], eax
call fcn.1003b0d0
mov ecx, dword [esi + 0x60]
add esp, 0x10
cmp ecx, ebp
mov dword [esi + 0x64], eax
je 0x100263f2
cmp eax, ebp
jne 0x1002640c
push esi
push ebp
push 0x186
call fcn.10020fb0
add esp, 8
push eax
push 4
call fcn.1001b780
add esp, 0xc
mov eax, dword [esi + 0x64]
mov ecx, 0x7fff
xor edx, edx
mov dword [eax + 0x1fffc], ebp
mov edi, dword [esi + 0x64]
xor eax, eax
rep stosd dword es:[edi], eax
xor ecx, ecx
mov cx, word [ebx*8 + 0x1005988a]
mov dword [esi + 0x90], ecx
mov dx, word [ebx*8 + 0x10059888]
mov dword [esi + 0x94], edx
mov ax, word [ebx*8 + 0x1005988c]
xor ecx, ecx
mov dword [esi + 0x98], eax
mov cx, word [ebx*8 + 0x1005988e]
cmp ebx, 2
mov dword [esi + 0x8c], ecx
jg 0x1002646d
mov eax, dword [esp + 0x18]
or byte [eax], 4
jmp 0x10026479
cmp ebx, 8
jl 0x10026479
mov eax, dword [esp + 0x18]
or byte [eax], 2
mov edx, dword [esi + 0x54]
push esi
push 0x2fff6
push edx
mov dword [esi + 0x7c], ebp
mov dword [esi + 0x6c], ebp
call dword [esi + 0xc7b0]
add esp, 0xc
cmp eax, ebp
mov dword [esi + 0x88], eax
jne 0x100264b1
mov dword [esi + 0x84], 1
mov dword [esi + 0x88], ebp
pop edi
pop esi
pop ebp
pop ebx
ret
cmp eax, 0xfff6
mov dword [esi + 0x84], ebp
jae 0x100264c7
push esi
call fcn.10026550
add esp, 4
mov ecx, dword [esi + 0x54]
mov dword [esi + 0x74], ebp
xor eax, eax
mov edi, dword [esi + 0x74]
xor edx, edx
mov dl, byte [ecx + eax]
and edi, 0x3ff
and edx, 0x7fff
shl edi, 5
xor edx, edi
inc eax
cmp eax, 2
mov dword [esi + 0x74], edx
jb 0x100264cf
mov dword [esi + 0x80], ebp
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x10028ad0
Capabilities:
Get disk information
Get thread local storage value

Disassembly:
push ecx
mov ecx, dword [0x10063c04]
mov eax, dword [0x1005bad8]
push ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je case.0x10028b2e.3
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x10028af9
mov eax, 1
pop ecx
ret
mov eax, dword [esp + 8]
test eax, eax
jl case.0x10028b2e.3
cmp eax, 0x1a
jg case.0x10028b2e.3
test eax, eax
jne 0x10028b0f
call fcn.1001ff40
mov cl, byte [esp]
dec al
lea edx, [esp]
add cl, al
push edx
mov byte [esp + 4], cl
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
add eax, 0xfffffffe
cmp eax, 3
ja case.0x10028b2e.3
jmp dword [eax*4 + 0x10028b40]
mov eax, 1
pop ecx
ret
xor eax, eax
pop ecx
ret

Function at 0x10028be0
Capabilities:
Get thread local storage value

Disassembly:
push ecx
mov eax, dword [0x10063c04]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x10028c42
mov ecx, dword [eax + 0x3d08]
push ebx
push 0
push 0
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
call fcn.1002f640
mov bl, al
call fcn.1002f640
mov byte [esp + 6], al
call fcn.1002f640
mov byte [esp + 7], al
call fcn.1002f640
cmp bl, 0x50
pop ebx
jne 0x10028c42
cmp byte [esp + 2], 0x4b
jne 0x10028c42
cmp byte [esp + 3], 1
jne 0x10028c42
cmp al, 2
jne 0x10028c42
mov eax, 1
pop ecx
ret
xor eax, eax
pop ecx
ret
Function at 0x10029570
Capabilities:
Get thread local storage value
Read file on windows

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
cmp ebp, 0x7ff
jle 0x10029584
mov ebp, 0x7ff
mov eax, dword [0x10063c04]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test ebx, ebx
je 0x10029608
lea esi, [ebx + 0x15fb8]
push edi
mov ecx, 0x200
xor eax, eax
mov edi, esi
push eax
rep stosd dword es:[edi], eax
mov edx, dword [ebx + 0x3d08]
lea ecx, [esp + 0x18]
push ecx
push ebp
push esi
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
pop edi
je 0x10029608
cmp dword [esp + 0x10], ebp
jne 0x10029608
test byte [ebx + 0x4e9a], 8
je 0x100295f9
push 0x2e
push esi
call fcn.1003b220
add esp, 8
test eax, eax
je 0x100295f2
push 0x2e
push esi
mov byte [eax], 0x20
call fcn.1003b220
add esp, 8
test eax, eax
jne 0x100295e0
mov byte [ebx + 0x15fc3], 0
mov eax, dword [ebx + 0x34]
test eax, eax
jne 0x10029608
push esi
push esi
call dword [sym.imp.USER32.dll_OemToCharA]
pop esi
pop ebp
pop ebx
ret

Function at 0x10029610
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
mov esi, dword [esp + 0x1c]
push edi
lea edi, [ebp + 0x45de]
mov edx, 1
mov ecx, 8
xor eax, eax
mov dword [esp + 0x14], edi
cmp esi, 4
mov dword [esp + 0x10], edx
rep stosd dword es:[edi], eax
jle 0x10029700
push esi
call fcn.10039ff8
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x100296f6
mov ecx, dword [ebp + 0x3d08]
lea eax, [esp + 0x1c]
push 0
push eax
push esi
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x100296d9
cmp dword [esp + 0x1c], esi
jne 0x100296d9
add esi, 0xfffffffc
xor edx, edx
mov dword [esp + 0x20], esi
xor ebp, ebp
test ebp, ebp
jne 0x100296e1
cmp dx, word [esp + 0x20]
ja 0x100296e1
mov eax, edx
and eax, 0xffff
add eax, ebx
cmp word [eax], 1
jne 0x100296cd
mov ax, word [eax + 2]
mov ebp, 1
add ax, 4
cmp ax, 0x20
ja 0x100296d9
mov edi, dword [esp + 0x14]
mov ecx, eax
and ecx, 0xffff
mov esi, ebx
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x10029682
mov cx, word [eax + 2]
add cx, 4
add edx, ecx
jmp 0x10029682
mov dword [esp + 0x10], 0
push ebx
call fcn.10039f0f
mov eax, dword [esp + 0x14]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret
pop edi
pop esi
pop ebp
mov eax, edx
pop ebx
add esp, 8
ret

Function at 0x10029750
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x10063c04]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x10029768
or eax, 0xffffffff
pop esi
ret
call fcn.10029710
push 0
push 0x8000080
push 3
push 0
push 3
lea ecx, [esi + 0x14f64]
push 0x80000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [esi + 0x3d08], eax
pop esi
ret
Function at 0x100297a0
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x10063c04]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x100297ba
mov eax, 9
pop esi
ret
mov eax, dword [esi + 0x4c]
mov dword [esi + 0x167c8], 0
test eax, eax
mov dword [esi + 0x167cc], 0
jne 0x10029842
push ebx
push edi
push 0
push 0x80
push 3
push 0
lea ebx, [esi + 0x14f64]
push 3
push 0x80000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x10029829
push edi
call fcn.10034940
add esp, 4
mov dword [esi + 0x167c8], eax
mov dword [esi + 0x167cc], edx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esi + 0x15f64]
push ecx
push ebx
call fcn.10031a90
add esp, 8
mov edx, dword [esi + 0x167c8]
mov eax, dword [esi + 0x167cc]
or edx, eax
pop edi
pop ebx
jne 0x10029842
mov eax, 9
pop esi
ret
xor eax, eax
pop esi
ret

Function at 0x10029850
Capabilities:
Get thread local storage value

Disassembly:
push ecx
mov eax, dword [0x10063c04]
push ebx
push eax
mov dword [esp + 8], 1
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test ebx, ebx
jne 0x1002986f
pop ebx
pop ecx
ret
push ebp
mov ebp, dword [esp + 0x14]
push esi
push edi
lea edi, [ebx + 0x15fb8]
push ebp
mov byte [edi], 0
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov esi, eax
test esi, esi
je 0x100298f2
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x18]
push ecx
push edx
call fcn.10029900
lea eax, [esi + eax + 0x2e]
xor esi, esi
mov si, word [ebx + 0x4e90]
add esp, 8
cmp esi, 0x104
jge 0x100298e3
lea ecx, [esi + 1]
push ecx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov byte [esi + edi], 0
mov eax, dword [ebx + 0x34]
test eax, eax
jne 0x100298eb
push edi
push edi
call dword [sym.imp.USER32.dll_OemToCharA]
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov dword [esp + 0x10], 0
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x10029af0
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x10063c04]
push ebx
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
xor edi, edi
cmp esi, edi
jne 0x10029b17
mov ecx, dword [esp + 0x10]
mov eax, 4
mov dword [ecx + 0x4c], edi
pop edi
pop esi
pop ebx
ret
lea edx, [esi + 0x348]
mov dword [esi + 0x3d18], edi
push edx
call fcn.1002ee40
mov ebx, eax
add esp, 4
cmp ebx, edi
je 0x10029b59
mov esi, dword [esp + 0x10]
mov eax, dword [esi + 0x28]
push eax
push 2
push 0x66
call fcn.10033300
add esp, 8
push eax
push ebx
call fcn.10028a10
add esp, 0xc
mov dword [esi + 0x4c], edi
mov eax, ebx
pop edi
pop esi
pop ebx
ret
push edi
call fcn.1002eff0
add esp, 4
mov dword [esi + 0x3d00], edi
cmp eax, edi
mov dword [esi + 0x3d14], eax
mov dword [esi + 0x3d04], edi
je 0x10029bd7
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 0x28]
mov dword [eax + 0x4c], edi
push ecx
push 2
push 0x67
call fcn.10033300
mov edx, dword [esi + 0x3d14]
add esp, 8
push eax
push edx
call fcn.10028a10
mov eax, dword [esi + 0x14f48]
add esp, 0xc
mov dword [esi + 0x3d00], edi
cmp eax, edi
mov dword [esi + 0x3d04], edi
je 0x10029bc4
push eax
call fcn.10039f0f
add esp, 4
mov dword [esi + 0x14f48], edi
mov eax, dword [esi + 0x15fac]
cmp eax, edi
je 0x10029c75
jmp 0x10029c66
cmp dword [esi + 0x3c], edi
je 0x10029c2a
mov ebx, dword [esp + 0x10]
mov dword [ebx + 0x4c], edi
call fcn.1002a150
cmp eax, edi
mov dword [esi + 0x3d14], eax
jne 0x10029c19
push ebp
lea ebp, [esi + 0x15fb8]
push ebp
call fcn.10030170
add esp, 4
test eax, eax
jne 0x10029c09
inc dword [ebx + 0x4c]
call fcn.1002a150
cmp eax, edi
mov dword [esi + 0x3d14], eax
je 0x10029bf9
pop ebp
cmp dword [esi + 0x3d14], 2
jne 0x10029c37
mov dword [esi + 0x3d14], edi
jmp 0x10029c37
mov ecx, dword [esp + 0x10]
mov eax, dword [esi + 0x4e3e]
mov dword [ecx + 0x4c], eax
mov eax, dword [esi + 0x14f48]
mov dword [esi + 0x3d00], edi
cmp eax, edi
mov dword [esi + 0x3d04], edi
je 0x10029c5c
push eax
call fcn.10039f0f
add esp, 4
mov dword [esi + 0x14f48], edi
mov eax, dword [esi + 0x15fac]
cmp eax, edi
je 0x10029c75
push eax
call fcn.10039f0f
add esp, 4
mov dword [esi + 0x15fac], edi
mov eax, dword [esi + 0x3d14]
pop edi
pop esi
pop ebx
ret
Function at 0x10029c80
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x10063c04]
sub esp, 0x868
push ebx
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0x10029cb2
mov ecx, dword [esp + 0x878]
pop edi
pop esi
pop ebx
mov dword [ecx + 0x4c], eax
mov eax, 4
add esp, 0x868
ret
mov esi, dword [esp + 0x878]
add eax, 0x348
test eax, eax
mov edi, dword [esi + 0x10]
je 0x10029db6
test edi, edi
je 0x10029db6
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
call ebx
test eax, eax
je 0x10029d8c
push edi
call ebx
test eax, eax
je 0x10029d8c
push esi
call fcn.10029af0
add esp, 4
test eax, eax
jne 0x10029dd6
mov eax, dword [esi + 0x4c]
test eax, eax
jne 0x10029d11
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x868
ret
xor ebx, ebx
lea edx, [esp + 0xc]
push esi
mov dword [esi + 0xc], ebx
mov dword [esi + 0x8e], edx
call fcn.1002ad70
mov edi, eax
add esp, 4
test edi, edi
jne 0x10029d3f
push esi
inc ebx
call fcn.1002ad70
mov edi, eax
add esp, 4
test edi, edi
je 0x10029d2f
cmp edi, 0x30
je 0x10029d73
cmp edi, 2
push esi
jne 0x10029d6b
call fcn.10029af0
add esp, 4
mov edi, eax
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x8e], 0
pop edi
pop esi
pop ebx
add esp, 0x868
ret
call fcn.10029af0
add esp, 4
mov eax, edi
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x8e], 0
pop edi
pop esi
pop ebx
add esp, 0x868
ret
mov eax, dword [esi + 0x28]
push eax
push 2
push 0x69
call fcn.10033300
add esp, 8
push eax
push 0xb
call fcn.10028a10
add esp, 0xc
mov eax, 0x2f
pop edi
pop esi
pop ebx
add esp, 0x868
ret
mov ecx, dword [esi + 0x28]
push ecx
push 2
push 0x68
call fcn.10033300
add esp, 8
push eax
push 0xb
call fcn.10028a10
add esp, 0xc
mov eax, 0xb
pop edi
pop esi
pop ebx
add esp, 0x868
ret
Function at 0x1002b770
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x10063c04]
push ebx
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
xor ebx, ebx
cmp esi, ebx
jne 0x1002b790
pop edi
pop esi
mov eax, 4
pop ebx
ret
lea eax, [esi + 0x348]
cmp eax, ebx
jne 0x1002b7c5
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 0x28]
mov dword [eax + 0x4c], ebx
push ecx
push 2
push 0x71
call fcn.10033300
add esp, 8
push eax
push 0x2f
call fcn.10028a10
add esp, 0xc
mov eax, 0x2f
pop edi
pop esi
pop ebx
ret
push eax
call fcn.1002ee40
mov edi, eax
add esp, 4
cmp edi, ebx
je 0x1002b7fb
mov esi, dword [esp + 0x10]
mov edx, dword [esi + 0x28]
push edx
push 2
push 0x6c
call fcn.10033300
add esp, 8
push eax
push edi
call fcn.10028a10
add esp, 0xc
mov eax, edi
mov dword [esi + 0x4c], ebx
pop edi
pop esi
pop ebx
ret
mov eax, dword [esi + 0x14f48]
cmp eax, ebx
je 0x1002b814
push eax
call fcn.10039f0f
add esp, 4
mov dword [esi + 0x14f48], ebx
mov eax, dword [esi + 0x15fac]
cmp eax, ebx
je 0x1002b82d
push eax
call fcn.10039f0f
add esp, 4
mov dword [esi + 0x15fac], ebx
push 1
call fcn.1002eff0
add esp, 4
cmp eax, ebx
mov dword [esi + 0x3d14], eax
je 0x1002b872
mov eax, dword [esp + 0x10]
mov dword [eax + 0x4c], ebx
mov eax, dword [eax + 0x28]
push eax
push 2
push 0x72
call fcn.10033300
mov ecx, dword [esi + 0x3d14]
add esp, 8
push eax
push ecx
call fcn.10028a10
mov eax, dword [esi + 0x3d14]
add esp, 0xc
pop edi
pop esi
pop ebx
ret
mov eax, dword [esp + 0x10]
xor edx, edx
mov dx, word [esi + 0x4e1c]
pop edi
mov dword [eax + 0x4c], edx
pop esi
xor eax, eax
pop ebx
ret
Function at 0x1002c0d0
Capabilities:
Encode data using xor
Get thread local storage value

Disassembly:
mov eax, dword [0x10063c04]
push ebx
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test ebx, ebx
jne 0x1002c0ec
pop edi
pop esi
or eax, 0xffffffff
pop ebx
ret
lea ecx, [ebx + 0x4ee4]
push ebp
push ecx
call fcn.10034d90
mov ebp, dword [esp + 0x18]
add esp, 4
xor edi, edi
call fcn.10034ce0
xor edx, edx
mov esi, eax
mov dl, byte [edi + ebp]
xor esi, edx
push esi
call fcn.10034d10
add esp, 4
inc edi
cmp edi, 0xc
jl 0x1002c102
mov al, byte [ebx + 0x45c6]
pop ebp
test al, 8
je 0x1002c138
xor eax, eax
mov ax, word [ebx + 0x45ca]
shr eax, 8
jmp 0x1002c14d
mov eax, dword [ebx + 0x4e84]
xor ecx, ecx
shr eax, 0x10
mov cl, ah
and ecx, 0xff
mov eax, ecx
and esi, 0xffff
cmp esi, eax
je 0x1002c15e
pop edi
pop esi
or eax, 0xffffffff
pop ebx
ret
mov edx, dword [ebx + 0x454c]
mov eax, dword [ebx + 0x14f50]
xor ecx, ecx
cmp ecx, edx
jl 0x1002c180
jg 0x1002c17a
cmp eax, dword [ebx + 0x4548]
jbe 0x1002c180
mov eax, dword [ebx + 0x4548]
mov esi, dword [ebx + 0x14f4c]
mov edx, eax
dec eax
test edx, edx
je 0x1002c1ac
lea edi, [eax + 1]
call fcn.10034ce0
mov ebx, eax
xor eax, eax
mov al, byte [esi]
xor ebx, eax
push ebx
call fcn.10034d10
add esp, 4
mov byte [esi], bl
inc esi
dec edi
jne 0x1002c190
pop edi
pop esi
xor eax, eax
pop ebx
ret

Function at 0x1002c1c0
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x10063c04]
sub esp, 0x10
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
test edi, edi
jne 0x1002c1e0
mov eax, 4
pop edi
add esp, 0x10
ret
push esi
mov dword [edi + 0x4ee0], 0
xor esi, esi
lea ecx, [esp + 0xa]
push edi
push ecx
call fcn.10033820
mov dl, byte [esp + 0x12]
add esp, 8
mov byte [esp + esi + 0xc], dl
inc esi
cmp esi, 0xc
jl 0x1002c1ed
mov al, byte [edi + 0x4ee4]
mov dword [edi + 0x4ee0], 1
test al, al
pop esi
je 0x1002c234
lea eax, [esp + 8]
push eax
call fcn.1002c0d0
add esp, 4
test eax, eax
jne 0x1002c234
pop edi
add esp, 0x10
ret
mov eax, 0x2c
pop edi
add esp, 0x10
ret
Function at 0x1002c4a0
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x10063c04]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x1002c4ba
mov eax, 9
pop esi
ret
mov ecx, dword [esp + 8]
push 0
push 0x8000080
push 3
push 0
push 3
push 0x80000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
xor edx, edx
cmp eax, 0xffffffff
setne dl
dec edx
mov dword [esi + 0x14f60], eax
and edx, 9
pop esi
mov eax, edx
ret