joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1008e88d
Capabilities:
Query or enumerate registry key

Disassembly:
push 0x238
mov eax, 0x100e509b
call fcn.10001af6
mov edi, ecx
lea ecx, [ebp - 0x21c]
call fcn.10005575
mov ebx, 0x10178fec
mov esi, 0x104
mov ecx, ebx
call sym.fpsrvutl.dll_Ordinal_2694
cmp eax, 2
mov ecx, 0x208
cmove esi, ecx
cmp esi, dword [ebp - 0x18]
jle 0x1008e8d8
push 1
push esi
lea ecx, [ebp - 0x21c]
call fcn.1000b2b4
xor esi, esi
mov ecx, ebx
mov dword [ebp - 4], esi
call sym.fpsrvutl.dll_Ordinal_2694
cmp eax, 2
mov eax, dword [ebp - 0x18]
jne 0x1008e8ee
shr eax, 1
mov ebx, dword [edi + 0xc]
mov ecx, 0x10178fec
mov dword [ebp - 0x220], eax
call sym.fpsrvutl.dll_Ordinal_2694
cmp eax, 2
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0x238]
push eax
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x23c]
push eax
push esi
lea eax, [ebp - 0x220]
push eax
push dword [ebp - 0x1c]
push ebx
jne 0x1008e952
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
jmp 0x1008e958
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
je 0x1008e967
mov ecx, eax
call fcn.1008d65e
mov esi, eax
jmp 0x1008e97b
mov eax, dword [ebp - 0x224]
inc eax
mov dword [edi + 0x5c], esi
mov dword [edi + 0x58], eax
mov byte [edi + 0x35], 1
mov dword [edi + 0x54], esi
lea ecx, [ebp - 0x21c]
call fcn.100057a4
mov eax, esi
call fcn.10001b2d
ret

Function at 0x1008e98e
Capabilities:
Query or enumerate registry key

Disassembly:
push 0x224
mov eax, 0x100e5155
call fcn.10001af6
mov edi, ecx
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x21c]
mov esi, dword [edi + 0x58]
mov dword [ebp - 0x228], eax
call fcn.10005575
xor ebx, ebx
push ebx
push esi
call fcn.1000b2b4
mov ecx, 0x10178fec
mov dword [ebp - 4], ebx
call sym.fpsrvutl.dll_Ordinal_2694
cmp eax, 2
mov eax, dword [ebp - 0x18]
jne 0x1008e9d6
shr eax, 1
mov ecx, dword [ebp - 0x228]
push 0x100ea6e8
mov dword [ebp - 0x220], eax
call fcn.1000b2b4
mov eax, dword [edi + 0xc]
mov ecx, 0x10178fec
mov esi, dword [edi + 0x54]
mov dword [ebp - 0x224], eax
call sym.fpsrvutl.dll_Ordinal_2694
cmp eax, 2
lea eax, [ebp - 0x230]
push eax
push ebx
push ebx
push ebx
lea eax, [ebp - 0x220]
push eax
push dword [ebp - 0x1c]
push esi
push dword [ebp - 0x224]
jne 0x1008ea2a
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x1008ea30
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x1008ea4d
mov ecx, dword [ebp - 0x228]
lea eax, [ebp - 0x21c]
push eax
call fcn.1000b2b4
inc dword [edi + 0x54]
mov bl, 1
jmp 0x1008ea50
mov byte [edi + 0x35], bl
lea ecx, [ebp - 0x21c]
call fcn.100057a4
mov al, bl
call fcn.10001b2d
ret 4
Function at 0x10094be4
Capabilities:
Compare security identifiers

Disassembly:
push 0x2c
mov eax, 0x100e57cf
call fcn.1000131b
mov ebx, ecx
push ecx
lea ecx, [ebp - 0x14]
call fcn.10001e74
and dword [ebp - 4], 0
lea eax, [ebp - 0x18]
and dword [ebp - 0x18], 0
add ebx, 0x1c
push eax
mov eax, dword [ebp + 8]
mov ecx, ebx
mov dword [ebp - 0x1c], ebx
push dword [eax]
call fcn.1000b2b4
mov edi, dword [ebp - 0x18]
xor ecx, ecx
test eax, eax
cmovne edi, ecx
sete byte [ebp - 0xd]
jne 0x10094c7f
lea ecx, [edi + 0xc]
call fcn.1000b2b4
mov ecx, dword [ebp + 0xc]
lea eax, [edi + 0x18]
push eax
call fcn.1000b2b4
mov ecx, dword [ebp + 0x10]
lea eax, [edi + 0x1c]
push eax
call fcn.1000b2b4
mov eax, dword [ebp + 0x14]
lea ecx, [edi + 0xc]
mov edx, dword [edi + 0x24]
mov dword [eax], edx
call fcn.1000b2b4
or eax, 0xffffffff
lock xadd dword [edi + 4], eax
dec eax
push 1
pop ebx
jne 0x10094d2a
test edi, edi
je 0x10094d2a
mov eax, dword [edi]
mov ecx, edi
push ebx
call dword [eax]
jmp 0x10094d2a
and dword [ebp - 0x38], ecx
lea eax, [ebp - 0x38]
and dword [ebp - 0x34], ecx
mov ecx, ebx
movaps xmm0, xmmword [0x1012c1e0]
or dword [ebp - 0x20], 0xffffffff
push eax
movups xmmword [ebp - 0x30], xmm0
call fcn.1000b2b4
test eax, eax
jne 0x10094d1c
mov edi, dword [ebp - 0x1c]
xor ebx, ebx
inc ebx
mov esi, dword [ebp - 0x30]
test esi, esi
je 0x10094cbe
mov eax, dword [ebp - 0x2c]
cmp eax, 6
ja 0x10094cbe
mov esi, dword [esi + eax*4 + 0x20]
jmp 0x10094cc0
xor esi, esi
lea ecx, [esi + 0xc]
call fcn.1000b2b4
mov eax, dword [ebp + 8]
push dword [esi + 0x20]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x10094cfd
mov ecx, dword [ebp + 0xc]
lea eax, [esi + 0x18]
push eax
call fcn.1000b2b4
mov ecx, dword [ebp + 0x10]
lea eax, [esi + 0x1c]
push eax
call fcn.1000b2b4
mov ecx, dword [ebp + 0x14]
mov eax, dword [esi + 0x24]
mov byte [ebp - 0xd], bl
mov dword [ecx], eax
lea ecx, [esi + 0xc]
call fcn.1000b2b4
cmp byte [ebp - 0xd], 0
jne 0x10094d1a
lea eax, [ebp - 0x38]
mov ecx, edi
push eax
call fcn.1000b2b4
test eax, eax
je 0x10094ca9
mov ebx, edi
lea eax, [ebp - 0x38]
mov ecx, ebx
push eax
call fcn.1000b2b4
mov bl, byte [ebp - 0xd]
lea ecx, [ebp - 0x14]
call fcn.1000221e
mov al, bl
call fcn.100013b7
ret 0x10
Function at 0x10096d8a
Capabilities:
Encode data using base64 via winapi

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
xor esi, esi
push edi
mov edi, ecx
mov dword [ebp - 4], esi
cmp dword [ebp + 0xc], esi
jne 0x10096da3
xor eax, eax
jmp 0x10096e4c
lea eax, [ebp - 4]
push eax
push esi
push 0x40000001
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.CRYPT32.dll_CryptBinaryToStringW]
test eax, eax
je 0x10096e32
mov eax, dword [ebp - 4]
mov ecx, dword [edi + 0x408]
add eax, ecx
mov edx, dword [edi + 0x40c]
cmp eax, edx
jbe 0x10096de2
sub eax, edx
mov ecx, edi
push eax
call fcn.1000b2b4
mov ecx, dword [edi + 0x408]
mov eax, dword [edi]
lea eax, [eax + ecx*2]
lea ecx, [ebp - 4]
push ecx
push eax
push 0x40000001
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.CRYPT32.dll_CryptBinaryToStringW]
test eax, eax
je 0x10096e1c
mov eax, dword [edi + 0x408]
mov esi, dword [ebp - 4]
add eax, esi
cmp eax, dword [edi + 0x40c]
ja 0x10096e4a
mov dword [edi + 0x408], eax
jmp 0x10096e4a
mov eax, dword [vtable.VprocessGlobals.0]
push str.Unable_to_write_base_64_encoded_value.
push esi
push esi
push 0x10178fec
call dword [eax + 0x24]
jmp 0x10096e47
mov ecx, dword [vtable.VprocessGlobals.0]
push str.Unable_to_determine_size_of_base_64_encoded_value.
push esi
push esi
push 0x10178fec
call dword [ecx + 0x24]
add esp, 0x10
mov eax, esi
pop edi
pop esi
leave
ret 8
Function at 0x10097396
Capabilities:
Get thread local storage value

Disassembly:
push 0xc
mov eax, 0x100e58bf
call fcn.1000131b
mov edi, dword [ebp + 0x14]
xor ebx, ebx
mov dword [ebp - 0x18], ebx
push dword [0x10150ddc]
movzx esi, di
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x1009749e
cmp dword [ebp + 8], 0x80001
je 0x1009749e
test di, di
jne 0x100973d7
movzx edi, word [eax + 0x68]
mov eax, 0x409
cmp di, ax
je 0x1009749e
test si, si
je 0x100973fb
push edi
lea eax, [ebp - 0x14]
push eax
call fcn.100893c6
mov esi, eax
xor eax, eax
inc eax
jmp 0x10097408
lea ecx, [ebp + 0x14]
call fcn.100ab1e5
push 2
mov esi, eax
pop eax
mov esi, dword [esi]
mov dword [ebp - 0x18], esi
lea ebx, [esi - 0xc]
lock inc dword [ebx]
mov dword [ebp - 4], 1
test al, 2
je 0x10097432
mov ecx, dword [ebp + 0x14]
and eax, 0xfffffffd
mov dword [ebp - 0x10], eax
lea ecx, [ecx - 0xc]
call sym.fpsrvutl.dll_Ordinal_5727
mov eax, dword [ebp - 0x10]
mov byte [ebp - 4], 2
test al, 1
je 0x10097445
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0xc]
call sym.fpsrvutl.dll_Ordinal_5727
cmp dword [esi - 4], 0
je 0x10097495
test di, di
jne 0x10097467
push 0x5c
mov ecx, ebx
call fcn.1000b2b4
add eax, 0xfffffffc
add eax, esi
push eax
call fcn.1000b2b4
movzx edi, ax
mov eax, 0x409
cmp di, ax
je 0x10097495
push dword [ebp + 0x10]
lea edx, [ebp - 0x18]
mov ecx, edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.1009754d
mov esi, eax
test esi, esi
je 0x10097495
mov ecx, ebx
call sym.fpsrvutl.dll_Ordinal_5727
mov eax, esi
jmp 0x100974ce
mov ecx, ebx
call sym.fpsrvutl.dll_Ordinal_5727
xor ebx, ebx
mov ecx, dword [ebp + 8]
call fcn.100978aa
test eax, eax
js 0x100974cc
push 0xffffffffffffffff
push dword [eax*8 + 0x1014b384]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy_s]
add esp, 0x10
push dword [ebp + 0xc]
call fcn.1000b2b4
mov ebx, eax
mov eax, ebx
call fcn.100013b7
ret 0x10
Function at 0x100988dd
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x14c
mov eax, 0x100e5a6a
call fcn.10001af6
mov edi, ecx
mov eax, dword [edi + 0x68]
xor ebx, ebx
cmp dword [eax - 4], ebx
je 0x10098903
cmp dword [edi], ebx
je 0x10098903
mov al, 1
jmp 0x10098aa5
push 0x124
lea eax, [ebp - 0x13c]
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x13c]
mov edx, 0x1011ff30
mov ecx, str.042F907C_714C_41C0_ABDC_004DD2497A1C
push eax
call fcn.1000b2b4
lea eax, [ebp - 0x13c]
push eax
lea ecx, [ebp - 0x140]
call fcn.1000b2b4
push 0x100ea6e8
lea eax, [ebp - 0x13c]
mov dword [ebp - 4], ebx
push eax
call fcn.1000b2b4
test eax, eax
je 0x100989d2
push str.msstko32.dll
lea ecx, [ebp - 0x144]
call fcn.1000b2b4
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x140]
mov esi, dword [ebp - 0x144]
mov eax, dword [ebp - 0x140]
push dword [esi - 4]
push esi
push ebx
push dword [eax - 4]
call fcn.1000b2b4
lea ecx, [esi - 0xc]
mov byte [ebp - 4], bl
call sym.fpsrvutl.dll_Ordinal_5727
lea eax, [ebp - 0x140]
push eax
lea ecx, [ebp - 0x158]
call sym.fpsrvutl.dll_Ordinal_4804
mov ecx, eax
mov byte [ebp - 4], 2
call sym.fpsrvutl.dll_Ordinal_542
lea ecx, [ebp - 0x158]
mov byte [ebp - 4], 0
mov bl, al
call sym.fpsrvutl.dll_Ordinal_974
test bl, bl
je 0x100989d0
xor ebx, ebx
inc ebx
jmp 0x10098a73
xor ebx, ebx
lea eax, [ebp - 0x148]
mov dword [ebp - 0x144], 0x124
push eax
push 0x20019
push ebx
push str.SOFTWAREMicrosoftShared_ToolsProofing_Tools_stemmer1042Normal
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10098a20
lea eax, [ebp - 0x144]
push eax
lea eax, [ebp - 0x13c]
push eax
push ebx
push ebx
push str.Engine
push dword [ebp - 0x148]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
lea eax, [ebp - 0x13c]
sete bh
push eax
lea ecx, [ebp - 0x158]
call sym.fpsrvutl.dll_Ordinal_1980
mov ecx, eax
mov byte [ebp - 4], 3
call sym.fpsrvutl.dll_Ordinal_542
lea ecx, [ebp - 0x158]
mov byte [ebp - 4], 0
mov bl, al
call sym.fpsrvutl.dll_Ordinal_974
xor eax, eax
movzx ecx, bh
test bl, bl
cmove ecx, eax
lea eax, [ebp - 0x13c]
mov bl, cl
lea ecx, [ebp - 0x140]
push eax
call fcn.1000b2b4
test bl, bl
je 0x10098a95
lea eax, [ebp - 0x140]
push eax
lea ecx, [edi + 0x68]
call fcn.1000b2b4
cmp dword [edi], 0
jne 0x10098a95
push dword [ebp - 0x140]
call dword [sym.imp.kernel32.dll_LoadLibraryA]
mov dword [edi], eax
mov ecx, dword [ebp - 0x140]
add ecx, 0xfffffff4
call sym.fpsrvutl.dll_Ordinal_5727
mov al, bl
call fcn.10001b2d
ret
Function at 0x10098aab
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x14c
mov eax, 0x100e5a6a
call fcn.10001af6
lea edi, [ecx + 0x6c]
mov eax, dword [edi]
cmp dword [eax - 4], 0
je 0x10098acc
mov al, 1
jmp 0x10098c5c
push 0x124
xor ebx, ebx
lea eax, [ebp - 0x13c]
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x13c]
mov edx, str.1042Normal
mov ecx, str.CB4C9D1A_87CD_4CB9_A669_00AE2FE75DA5
push eax
call fcn.1000b2b4
lea eax, [ebp - 0x13c]
push eax
lea ecx, [ebp - 0x140]
call fcn.1000b2b4
push 0x100ea6e8
lea eax, [ebp - 0x13c]
mov dword [ebp - 4], ebx
push eax
call fcn.1000b2b4
test eax, eax
je 0x10098b9d
push str.mssp3ko.lex
lea ecx, [ebp - 0x144]
call fcn.1000b2b4
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x140]
mov esi, dword [ebp - 0x144]
mov eax, dword [ebp - 0x140]
push dword [esi - 4]
push esi
push ebx
push dword [eax - 4]
call fcn.1000b2b4
lea ecx, [esi - 0xc]
mov byte [ebp - 4], bl
call sym.fpsrvutl.dll_Ordinal_5727
lea eax, [ebp - 0x140]
push eax
lea ecx, [ebp - 0x158]
call sym.fpsrvutl.dll_Ordinal_4804
mov ecx, eax
mov byte [ebp - 4], 2
call sym.fpsrvutl.dll_Ordinal_542
lea ecx, [ebp - 0x158]
mov byte [ebp - 4], 0
mov bl, al
call sym.fpsrvutl.dll_Ordinal_974
test bl, bl
je 0x10098b9b
xor ebx, ebx
inc ebx
jmp 0x10098c3e
xor ebx, ebx
lea eax, [ebp - 0x148]
mov dword [ebp - 0x144], 0x124
push eax
push 0x20019
push ebx
push str.SOFTWAREMicrosoftShared_ToolsProofing_Tools_stemmer1042Normal
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10098beb
lea eax, [ebp - 0x144]
push eax
lea eax, [ebp - 0x13c]
push eax
push ebx
push ebx
push str.Dictionary
push dword [ebp - 0x148]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
lea eax, [ebp - 0x13c]
sete bh
push eax
lea ecx, [ebp - 0x158]
call sym.fpsrvutl.dll_Ordinal_1980
mov ecx, eax
mov byte [ebp - 4], 3
call sym.fpsrvutl.dll_Ordinal_542
lea ecx, [ebp - 0x158]
mov byte [ebp - 4], 0
mov bl, al
call sym.fpsrvutl.dll_Ordinal_974
xor eax, eax
movzx ecx, bh
test bl, bl
cmove ecx, eax
lea eax, [ebp - 0x13c]
mov bl, cl
lea ecx, [ebp - 0x140]
push eax
call fcn.1000b2b4
test bl, bl
je 0x10098c4c
lea eax, [ebp - 0x140]
mov ecx, edi
push eax
call fcn.1000b2b4
mov ecx, dword [ebp - 0x140]
add ecx, 0xfffffff4
call sym.fpsrvutl.dll_Ordinal_5727
mov al, bl
call fcn.10001b2d
ret
Function at 0x100a8405
Capabilities:
Get common file path

Disassembly:
push ecx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ecx, 0x10178fec
call sym.fpsrvutl.dll_Ordinal_2694
mov ecx, dword [esi + 0x200]
push ecx
push edi
cmp eax, 2
jne 0x100a842b
call dword [sym.imp.kernel32.dll_GetCurrentDirectoryW]
jmp 0x100a8431
call dword [sym.imp.kernel32.dll_GetCurrentDirectoryA]
pop edi
pop esi
pop ecx
ret

Function at 0x100a8435
Capabilities:
Set current directory

Disassembly:
push esi
mov esi, ecx
mov ecx, 0x10178fec
call sym.fpsrvutl.dll_Ordinal_2694
mov ecx, dword [esi + 0x200]
push ecx
cmp eax, 2
jne 0x100a8456
call dword [sym.imp.kernel32.dll_SetCurrentDirectoryW]
pop esi
ret
call dword [sym.imp.kernel32.dll_SetCurrentDirectoryA]
pop esi
ret

Function at 0x100a8d84
Capabilities:
Enumerate files on windows

Disassembly:
push 0x67c
mov eax, 0x100e76f4
call fcn.10001af6
mov edi, ecx
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x220]
mov dword [ebp - 0x688], eax
call fcn.10005575
mov ebx, 0x10178fec
mov esi, 0x104
mov ecx, ebx
call sym.fpsrvutl.dll_Ordinal_2694
cmp eax, 2
mov ecx, 0x208
cmove esi, ecx
cmp esi, dword [ebp - 0x1c]
jle 0x100a8dd8
push 1
push esi
lea ecx, [ebp - 0x220]
call fcn.1000b2b4
and dword [ebp - 4], 0
mov ecx, ebx
call sym.fpsrvutl.dll_Ordinal_2694
mov ecx, dword [ebp - 0x1c]
cmp eax, 2
jne 0x100a8ded
shr ecx, 1
lea edx, [ebp - 0x220]
call fcn.100a8405
test eax, eax
je 0x100a8f3e
lea ecx, [ebp - 0x680]
call fcn.10005575
push edi
call fcn.1000b2b4
lea ecx, [ebp - 0x680]
mov byte [ebp - 4], 1
call fcn.100a8435
test eax, eax
je 0x100a8f24
mov dword [ebp - 0x684], 0x1017c79c
lock inc dword [0x1017c790]
mov ecx, ebx
mov byte [ebp - 4], 2
call sym.fpsrvutl.dll_Ordinal_2694
cmp eax, 2
lea eax, [ebp - 0x470]
push eax
jne 0x100a8e5d
push 0x100ef5a0
call dword [sym.imp.kernel32.dll_FindFirstFileW]
jmp 0x100a8e68
push 0x100efcd4
call dword [sym.imp.kernel32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x100a8f16
mov bl, byte [ebp + 0xc]
mov edi, dword [ebp - 0x688]
test byte [ebp - 0x470], 0x10
jne 0x100a8ee2
mov ecx, 0x10178fec
call sym.fpsrvutl.dll_Ordinal_2694
cmp eax, 2
lea eax, [ebp - 0x444]
jne 0x100a8ea8
push eax
lea ecx, [ebp - 0x684]
call sym.fpsrvutl.dll_Ordinal_3753
jmp 0x100a8ec3
push 0
push eax
call fcn.1000b2b4
push eax
lea eax, [ebp - 0x444]
push eax
lea ecx, [ebp - 0x684]
call sym.fpsrvutl.dll_Ordinal_1496
mov ecx, dword [ebp - 0x684]
mov dl, bl
call fcn.100a8f53
test al, al
je 0x100a8ee2
lea eax, [ebp - 0x684]
mov ecx, edi
push eax
call fcn.1000b2b4
mov ecx, 0x10178fec
call sym.fpsrvutl.dll_Ordinal_2694
cmp eax, 2
lea eax, [ebp - 0x470]
push eax
push esi
jne 0x100a8f01
call dword [sym.imp.kernel32.dll_FindNextFileW]
jmp 0x100a8f07
call dword [sym.imp.kernel32.dll_FindNextFileA]
test eax, eax
jne 0x100a8e7c
push esi
call dword [sym.imp.kernel32.dll_FindClose]
mov ecx, dword [ebp - 0x684]
lea ecx, [ecx - 0xc]
call sym.fpsrvutl.dll_Ordinal_5727
lea ecx, [ebp - 0x680]
mov byte [ebp - 4], 0
call fcn.100057a4
lea ecx, [ebp - 0x220]
call fcn.100a8435
lea ecx, [ebp - 0x220]
call fcn.100057a4
call fcn.10001b2d
ret 8
Function at 0x100aa45b
Capabilities:
Set thread local storage value

Disassembly:
push 0x10
mov eax, 0x100e7a12
call fcn.1000131b
mov ebx, ecx
mov ecx, dword [ebx + 0x5c]
xor edi, edi
test ecx, ecx
je 0x100aa4d8
mov eax, dword [vtable.VprocessGlobals.0]
mov edi, dword [eax + 0x24]
call fcn.100ab8dd
mov ecx, dword [ebx + 0x5c]
mov esi, eax
lea eax, [ebp - 0x10]
push eax
mov edx, dword [ecx]
call dword [edx + 0xc]
and dword [ebp - 4], 0
push esi
push dword [eax]
mov esi, 0x10178fec
push str.The_error___s__with_hr:_d_in_the_thread_context_was_not_processed_before_thread_detach._The_full_error_log_entry_follows.
push 1
push 0
push esi
call edi
or dword [ebp - 4], 0xffffffff
add esp, 0x18
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0xc]
call sym.fpsrvutl.dll_Ordinal_5727
push dword [ebx + 0x5c]
mov eax, dword [vtable.VprocessGlobals.0]
mov ecx, esi
push 1
call dword [eax + 0xc]
mov ecx, dword [ebx + 0x5c]
test ecx, ecx
je 0x100aa4d3
mov eax, dword [ecx]
push 1
call dword [eax]
xor edi, edi
mov dword [ebx + 0x5c], edi
mov esi, dword [ebx + 0x30]
test esi, esi
je 0x100aa515
lea eax, [ebp - 0x1c]
mov dword [ebp - 4], 1
push eax
push 0x100209e6
mov ecx, esi
mov dword [ebp - 0x1c], 0x100706e5
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], edi
call fcn.1000b2b4
mov ecx, esi
call sym.fpsrvutl.dll_Ordinal_4537
or dword [ebp - 4], 0xffffffff
push esi
call fcn.1000b2b4
pop ecx
mov dword [ebx + 0x30], edi
cmp dword [ebx + 0x74], edi
jle 0x100aa52b
mov ecx, ebx
mov dword [ebx + 0x74], 1
call sym.fpsrvutl.dll_Ordinal_2309
push edi
push dword [0x10150ddc]
call dword [sym.imp.kernel32.dll_TlsSetValue]
call fcn.100013b7
ret

Function at 0x100ab1e5
Capabilities:
Get thread local storage value

Disassembly:
push 0xc
mov eax, 0x100e2f44
call fcn.1000131b
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], 0x1017c79c
lock inc dword [0x1017c790]
and dword [ebp - 4], 0
push dword [0x10150ddc]
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov edi, eax
test edi, edi
je 0x100ab238
lea eax, [edi + 0x60]
mov ecx, dword [eax]
cmp dword [ecx - 4], 0
je 0x100ab238
push eax
lea ecx, [ebp - 0x10]
call fcn.1000b2b4
mov eax, dword [edi + 0x2c]
shr eax, 2
and al, 1
jmp 0x100ab261
lea eax, [ebp - 0x14]
push eax
call fcn.1000b2b4
push eax
lea ecx, [ebp - 0x10]
call fcn.1000b2b4
mov eax, dword [ebp - 0x14]
lea ecx, [eax - 0xc]
call sym.fpsrvutl.dll_Ordinal_5727
push 0
call fcn.100047aa
mov al, byte [0x1017ca42]
test al, al
jne 0x100ab27a
mov dword [esi], 0x1017c79c
lock inc dword [0x1017c790]
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0xc]
jmp 0x100ab285
mov eax, dword [ebp - 0x10]
mov dword [esi], eax
lea ecx, [eax - 0xc]
lock inc dword [ecx]
call sym.fpsrvutl.dll_Ordinal_5727
mov eax, esi
call fcn.100013b7
ret
Function at 0x100ab801
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
xor eax, eax
push esi
mov esi, ecx
mov word [esi], ax
test ebx, ebx
je 0x100ab84c
push edi
push dword [0x10150ddc]
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov edi, eax
test edi, edi
je 0x100ab84b
movzx ecx, word [edi + 0x68]
movzx eax, bx
mov word [esi], cx
cmp cx, ax
jne 0x100ab83d
xor eax, eax
mov word [esi], ax
jmp 0x100ab84b
push eax
call fcn.1000b2b4
push eax
mov ecx, edi
call fcn.1000b2b4
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x100ab99f
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
lea edi, [esi + 0xc]
lock inc dword [edi]
lea eax, [ebp - 4]
xor ebx, ebx
push eax
push ebx
push esi
push 0x100aba0a
push ebx
push ebx
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov ecx, dword [ebp - 4]
add esp, 0x18
mov dword [esi + 8], ecx
test eax, eax
jne 0x100ab9eb
mov dword [esi + 4], ebx
or eax, 0xffffffff
lock xadd dword [edi], eax
dec eax
test eax, eax
jg 0x100ab9e7
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax]
xor al, al
jmp 0x100ab9f0
mov dword [esi + 4], eax
mov al, 1
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x100ab9f7
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
push dword [ecx + 4]
call dword [sym.imp.kernel32.dll_TerminateThread]
pop ebp
ret 4
Function at 0x100aec97
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
mov edi, ecx
xor ebx, ebx
movsx eax, byte [edi + 8]
push eax
push dword [edi + 0x50]
mov eax, dword [vtable.VprocessGlobals.0]
push str.VdirectUpdateLock::endUpdate__InFilePath___s__Locked___d_n
push 3
push ebx
push 0x10178fec
call dword [eax + 0x24]
add esp, 0x18
cmp dword [edi + 0xb0], ebx
jne 0x100aece6
mov eax, dword [edi]
push 8
pop ecx
mov edx, dword [eax + 0x14]
xor eax, eax
cmp byte [ebp + 8], al
cmovne eax, ecx
mov ecx, edi
push eax
call edx
test eax, eax
jne 0x100aed84
mov eax, dword [edi + 0x12c]
push esi
cmp eax, 0xffffffff
je 0x100aed66
push ebx
push ebx
push ebx
push eax
call dword [sym.imp.kernel32.dll_SetFilePointer]
test eax, eax
jne 0x100aed8a
push ebx
lea eax, [ebp - 4]
push eax
push dword [edi + 0x134]
push dword [edi + 0x124]
push dword [edi + 0x12c]
call dword [sym.imp.kernel32.dll_WriteFile]
test eax, eax
je 0x100aed8a
mov eax, dword [ebp - 4]
cmp eax, dword [edi + 0x134]
jne 0x100aed8a
cmp byte [edi + 0x130], bl
jne 0x100aed48
push dword [edi + 0x12c]
call dword [sym.imp.kernel32.dll_SetEndOfFile]
test eax, eax
je 0x100aed8a
push dword [edi + 0x12c]
call dword [sym.imp.kernel32.dll_CloseHandle]
test eax, eax
jne 0x100aed5f
mov esi, 0x20006
jmp 0x100aed8f
or dword [edi + 0x12c], 0xffffffff
push dword [edi + 0x124]
call fcn.1000b2b4
mov dword [edi + 0x124], ebx
xor eax, eax
mov byte [edi + 8], bl
mov dword [edi + 0xb0], ebx
pop ecx
pop esi
pop edi
pop ebx
leave
ret 4
mov esi, 0x2000c
mov ebx, dword [edi + 0x68]
call dword [sym.imp.kernel32.dll_GetLastError]
push ebx
mov edx, eax
mov ecx, esi
call fcn.1005ca7d
mov edx, dword [edi]
mov ecx, edi
mov esi, eax
call dword [edx + 8]
push dword [edi + 0x124]
call fcn.1000b2b4
and dword [edi + 0x124], 0
mov eax, esi
jmp 0x100aed82