joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42d77b
Capabilities:
Parse credit card information

Disassembly:
push ebx
push ebp
push esi
xor al, al
mov bl, 1
mov ebp, 0xffff
jmp 0x42d8f8
cmp ecx, 0x7c
je 0x42d903
cmp ecx, 0x29
jne 0x42d7bb
cmp dword [edi + 0x10], 0
jne 0x42d903
mov eax, 0x10000000
test dword [edi + 0x44], eax
jne 0x42d7c0
push 5
call fcn.00478e13
pop ecx
jmp 0x42d8ed
mov eax, 0x10000000
cmp ecx, 0x2e
jne 0x42d7dc
push 5
lea eax, [edi + 0x18]
push eax
call fcn.0042da19
mov eax, edi
call fcn.0042d74f
jmp 0x42d8ed
cmp ecx, 0x5c
jne 0x42d83d
mov eax, edi
call fcn.0042d74f
mov eax, dword [edi + 0x44]
and eax, 0x80
je 0x42d810
cmp word [edi + 0x3e], 0x62
jne 0x42d810
push 4
lea eax, [edi + 0x18]
push eax
call fcn.0042da19
mov eax, edi
call fcn.0042d74f
jmp 0x42d8f4
test eax, eax
je 0x42d831
cmp word [edi + 0x3e], 0x42
jne 0x42d831
push 4
lea eax, [edi + 0x18]
push eax
call fcn.0042da19
mov eax, dword [edi + 0x1c]
add eax, 8
or dword [eax], 1
jmp 0x42d804
mov eax, edi
call fcn.0042df73
jmp 0x42d8ed
cmp ecx, 0x5b
jne 0x42d860
mov eax, edi
call fcn.0042d74f
mov eax, edi
call fcn.0042df28
push 4
push 0x5d
mov esi, edi
call fcn.0042df0b
jmp 0x42d8ed
cmp ecx, 0x28
jne 0x42d882
mov eax, edi
call fcn.0042d74f
mov eax, edi
call fcn.0042e00c
push 5
push 0x29
mov esi, edi
mov bl, al
call fcn.0042df0b
jmp 0x42d8e9
cmp ecx, 0x5e
jne 0x42d88e
push 2
jmp 0x42d7fb
cmp ecx, 0x24
jne 0x42d89a
push 3
jmp 0x42d7fb
cmp ecx, 0x2a
je 0x42d8e1
cmp ecx, 0x2b
je 0x42d8e1
cmp ecx, 0x3f
je 0x42d8e1
cmp ecx, 0x7b
je 0x42d8e1
cmp ecx, 0x7d
jne 0x42d8bf
test dword [edi + 0x44], eax
jne 0x42d8bf
push 6
jmp 0x42d7b0
cmp ecx, 0x5d
jne 0x42d8d0
test dword [edi + 0x44], eax
jne 0x42d8d0
push 4
jmp 0x42d7b0
mov ax, word [edi + 0x3e]
lea esi, [edi + 0x18]
call fcn.0042e1a7
jmp 0x42d7d0
push 0xa
call fcn.00478e13
pop ecx
test bl, bl
je 0x42d8f4
mov eax, edi
call fcn.0042e093
mov al, 1
mov bl, al
mov ecx, dword [edi + 0x40]
cmp ecx, ebp
jne 0x42d78c
pop esi
pop ebp
pop ebx
ret
Function at 0x43c17d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
mov edx, dword [ebp + 8]
push esi
mov esi, eax
test esi, esi
je 0x43c28a
push ebx
push edi
mov ecx, 0x4ed850
push 0x12
mov eax, edx
sub ecx, edx
pop edi
mov ebx, dword [ecx + eax]
mov dword [eax], ebx
add eax, 4
dec edi
jne 0x43c19d
mov eax, 0x4ed898
lea ecx, [edx + 0x48]
mov edi, 0x100
mov ebx, dword [eax]
mov dword [ecx], ebx
add eax, 4
add ecx, 4
dec edi
jne 0x43c1b5
cmp eax, 0x4ee898
jl 0x43c1b0
mov edi, dword [ebp + 0xc]
xor ecx, ecx
mov dword [ebp - 4], ecx
jmp 0x43c1d6
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
lea eax, [edx + eax*4]
mov dword [ebp + 0xc], eax
lea eax, [ecx + 1]
cdq
idiv edi
movzx eax, byte [ecx + esi]
shl eax, 8
movzx ebx, byte [edx + esi]
or ebx, eax
lea eax, [ecx + 2]
cdq
idiv edi
shl ebx, 8
movzx eax, byte [edx + esi]
or ebx, eax
lea eax, [ecx + 3]
cdq
idiv edi
shl ebx, 8
movzx eax, byte [edx + esi]
or ebx, eax
mov eax, dword [ebp + 0xc]
xor dword [eax], ebx
lea eax, [ecx + 4]
cdq
idiv edi
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x12
mov ecx, edx
jl 0x43c1d3
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [ebp + 0xc], edi
mov dword [ebp - 4], edi
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 0xc]
push eax
mov eax, esi
call fcn.0043ba69
mov eax, dword [ebp + 0xc]
mov dword [esi + edi*4], eax
mov eax, dword [ebp - 4]
mov dword [esi + edi*4 + 4], eax
inc edi
inc edi
cmp edi, 0x12
jl 0x43c231
lea edi, [esi + 0x4c]
mov dword [ebp + 8], 4
mov ebx, 0x80
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 0xc]
push eax
mov eax, esi
call fcn.0043ba69
mov eax, dword [ebp + 0xc]
mov dword [edi - 4], eax
mov eax, dword [ebp - 4]
mov dword [edi], eax
add edi, 8
dec ebx
jne 0x43c263
dec dword [ebp + 8]
jne 0x43c25e
pop edi
pop ebx
pop esi
leave
ret 8
Function at 0x44d2d0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4af32b
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x4ec340]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
push str.____________________Entrance____________________
lea ecx, [esp + 0x20]
lea eax, [esi + 0x1f0]
push ecx
push eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x28], str.DeleteParts
call fcn.004522fe
add esp, 0xc
and dword [esp + 0x30], 0
mov eax, dword [esi + 0x1d0]
mov dword [esp + 0x14], eax
test eax, eax
je 0x44d351
lea ecx, [esp + 0x14]
call fcn.0045db54
mov edi, dword [eax]
test edi, edi
je 0x44d34a
call fcn.0044ba06
cmp dword [esp + 0x14], 0
jne 0x44d336
mov esi, dword [esi + 0x14]
test esi, esi
je 0x44d3b0
lea ebx, [esi + 0x64]
cmp dword [ebx + 4], 0
je 0x44d3b0
mov ecx, 0x4f18d8
lea esi, [esp + 0x14]
call fcn.0040555d
mov eax, ebx
mov byte [esp + 0x30], 1
call fcn.00454a52
mov dword [esp + 0x18], eax
test eax, eax
je 0x44d3a4
push ebx
lea edi, [esp + 0x1c]
call fcn.0044db79
lea edi, [esp + 0x14]
call fcn.00407053
mov esi, edi
call fcn.0044e8e6
cmp dword [esp + 0x18], 0
jne 0x44d383
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
call fcn.004016b3
or dword [esp + 0x30], 0xffffffff
push str.______________________Exit______________________
lea eax, [esp + 0x20]
push eax
push dword [esp + 0x28]
call fcn.004522fe
add esp, 0xc
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x451cdd
Capabilities:
Write file on windows

Disassembly:
push 0x54
mov eax, 0x4a85ae
call fcn.00480765
mov edi, ecx
cmp dword [edi + 0x3c], 0
mov dword [ebp - 0x38], edi
je 0x451ded
cmp byte [edi + 0x41], 0
je 0x451ded
mov eax, dword [edi]
push 0xffffffffffffffff
call dword [eax + 4]
cmp eax, 0xffffffff
jne 0x451d15
xor al, al
jmp 0x451def
lea eax, [ebp - 0x30]
call fcn.0041d477
and dword [ebp - 4], 0
lea eax, [edi + 0x44]
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x48]
lea ecx, [ebp - 0x30]
call fcn.0041d4d7
mov esi, eax
call fcn.0041decd
mov ebx, dword [ebp - 0x1c]
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x60]
lea ecx, [ebp - 0x30]
call fcn.0041d4d7
mov esi, eax
call fcn.0041decd
mov ecx, dword [edi + 0x3c]
mov edx, dword [ecx]
lea esi, [ebp - 0x34]
push esi
mov esi, dword [ebp - 0x40]
add ebx, esi
push ebx
push eax
push dword [ebp - 0x3c]
call dword [edx + 0x18]
sub eax, 0
je 0x451d85
dec eax
je 0x451d89
dec eax
dec eax
je 0x451de9
xor bl, bl
push 0
push 1
lea ecx, [ebp - 0x30]
call fcn.004051e6
mov al, bl
jmp 0x451def
mov byte [edi + 0x41], 0
lea eax, [ebp - 0x58]
lea ecx, [ebp - 0x30]
call fcn.0041d4d7
mov esi, eax
call fcn.0041decd
mov ebx, dword [ebp - 0x34]
sub ebx, eax
je 0x451dc7
lea eax, [ebp - 0x50]
lea ecx, [ebp - 0x30]
call fcn.0041d4d7
mov esi, eax
call fcn.0041decd
push dword [edi + 0x4c]
push ebx
push 1
push eax
call fcn.0047c926
add esp, 0x10
cmp ebx, eax
jne 0x451d73
cmp byte [edi + 0x41], 0
je 0x451de9
test ebx, ebx
jne 0x451d27
push ebx
push 8
pop ebx
lea edi, [ebp - 0x30]
call fcn.0041d493
mov edi, dword [ebp - 0x38]
jmp 0x451d27
mov bl, 1
jmp 0x451d75
mov al, 1
call fcn.004807e8
ret

Function at 0x46016f
Capabilities:
Create thread

Disassembly:
mov eax, esi
call fcn.00460225
test eax, eax
je 0x46017e
xor eax, eax
inc eax
ret
lea eax, [esi + 0x24]
push eax
push 0
push esi
push 0x4601a3
push 0
push 0
call fcn.0047f780
xor ecx, ecx
add esp, 0x18
test eax, eax
setne cl
mov dword [esi + 0x20], eax
mov eax, ecx
ret
Function at 0x7b8320
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x20f000]
mov dword [edi + 0x2cd47c], 0x88f013c
push edi
jmp 0x7b834a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x7b8351
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x7b8340
mov eax, 1
add ebx, ebx
jne 0x7b8363
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x7b8374
jne 0x7b8393
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x7b8393
dec eax
add ebx, ebx
jne 0x7b8380
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x7b8358
add ebx, ebx
jne 0x7b838f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x7b83e5
xor ecx, ecx
sub eax, 3
jb 0x7b83ab
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x7b841a
sar eax, 1
mov ebp, eax
jmp 0x7b83b6
add ebx, ebx
jne 0x7b83b6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x7b8384
inc ecx
add ebx, ebx
jne 0x7b83c4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x7b8384
add ebx, ebx
jne 0x7b83d1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x7b83c6
jne 0x7b83e2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x7b83c6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x7b8404
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x7b83f6
jmp 0x7b8346
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x7b8404
add edi, ecx
jmp 0x7b8346
pop esi
mov edi, esi
mov ecx, 0xef8c
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x7b8422
cmp byte [edi], 0x26
jne 0x7b8422
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x7b8427
lea edi, [esi + 0x3a7000]
mov eax, dword [edi]
or eax, eax
je 0x7b849f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x3e9c9c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x3e9e70]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x7b8454
mov ecx, edi
jns 0x7b8483
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x3e9e78]
or eax, eax
je 0x7b8499
mov dword [ebx], eax
add ebx, 4
jmp 0x7b8471
call dword [esi + 0x3e9e74]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x7b84d0
cmp al, 0xef
ja 0x7b84c3
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x7b84a5
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x7b84b2
mov ebp, dword [esi + 0x3e9e7c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x26f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x7b8504
sub esp, 0xffffff80
jmp 0x5c9f5a
Function at 0x10012d35
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x10012d74
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10012d74
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10012d74
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x10012d74
cmp dword [ecx + 0x74], 0xe
jbe 0x10012d74
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x10015a8a
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x10015b27
push ebx
push esi
call fcn.10015a53
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.100159e7
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x10015ad4
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10015b26
push edi
push eax
call fcn.10016a45
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x10015af4
call fcn.100145b1
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10015b25
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.100159e7
add esp, 0x20
test eax, eax
jne 0x10015b13
push edi
call fcn.100145b1
jmp 0x10015b1b
push ebx
call fcn.100145b1
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x10015d94
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1001e348
push 0x1001e340
push str.FlsAlloc
push 0x1f
call fcn.10015cb0
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10015dc8
push dword [ebp + 8]
mov ecx, esi
call dword [0x1001c150]
call esi
jmp 0x10015dce
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x10015e12
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1001e358
push 0x1001e350
push str.FlsGetValue
push 0x21
call fcn.10015cb0
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10015e49
push dword [ebp + 8]
mov ecx, esi
call dword [0x1001c150]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x10015e51
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1001e360
push 0x1001e358
push str.FlsSetValue
push 0x22
call fcn.10015cb0
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10015e8b
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x1001c150]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x1001b3b0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1001b3dd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1001b3dd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x10005070
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x100131b4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push edi
push dword [0x100131bc]
mov dword [ebp - 0x18], eax
xor edi, edi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0x100050b1
mov eax, dword [ebp + 0xc]
neg eax
sbb eax, eax
and eax, 0x7fffbffb
add eax, 0x80004005
jmp 0x10005145
push ebx
push dword [0x100131bc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, dword [eax + 0x40]
mov eax, dword [ebp + 0xc]
sub eax, edi
je 0x100050ea
sub eax, 1
je 0x100050de
sub eax, 1
jne 0x10005142
push dword [ebp + 8]
mov ecx, ebx
call fcn.10006210
jmp 0x100050e6
push dword [ebp + 8]
call fcn.1000618f
mov edi, eax
jmp 0x10005142
push esi
mov esi, dword [0x100136a8]
mov ecx, esi
push 1
push 0x10
push dword [ebp - 0x18]
call dword [0x100142a8]
call esi
mov esi, eax
lea edi, [ebp - 0x14]
lea eax, [ebp - 0x1c]
mov ecx, ebx
push eax
lea eax, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
push eax
push dword [ebp + 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.10006015
push eax
call sym.OLETHK32.dll_TransformHRESULT_3216
mov esi, dword [0x100136a8]
mov edi, eax
push 1
push 0x10
push dword [ebp - 0x18]
mov ecx, esi
call dword [0x100142a8]
call esi
mov ecx, dword [ebp - 0x1c]
pop esi
mov dword [eax], ecx
mov eax, edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.100120c0
leave
ret 0xc
Function at 0x100057b0
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0x28
xor esi, esi
call dword [sym.imp.ole32.dll_CoTaskMemAlloc]
test eax, eax
je 0x100057d4
push ecx
mov ecx, eax
call fcn.10006ffe
mov dword [ebp - 4], eax
jmp 0x100057d7
mov dword [ebp - 4], esi
push 0x28
call dword [sym.imp.ole32.dll_CoTaskMemAlloc]
test eax, eax
je 0x100057ef
push ecx
mov ecx, eax
call fcn.10006ffe
mov ebx, eax
jmp 0x100057f1
mov ebx, esi
push 0x28
call dword [sym.imp.ole32.dll_CoTaskMemAlloc]
test eax, eax
je 0x10005809
push ecx
mov ecx, eax
call fcn.10006ffe
mov edi, eax
jmp 0x1000580b
mov edi, esi
mov eax, dword [ebp - 4]
test eax, eax
je 0x10005870
test ebx, ebx
je 0x10005860
test edi, edi
je 0x10005860
push 0x24
call dword [sym.imp.ole32.dll_CoTaskMemAlloc]
test eax, eax
je 0x1000585d
push dword [0x100131bc]
xor ecx, ecx
mov dword [eax + 8], esi
inc ecx
mov dword [eax + 0x1c], esi
mov dword [eax + 4], ecx
mov dword [eax + 0xc], ecx
mov ecx, dword [ebp - 4]
mov dword [eax + 0x20], esi
mov esi, eax
mov dword [eax], 0x10001008
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ebx
mov dword [eax + 0x18], edi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [eax + 0x40], esi
jmp 0x10005894
mov eax, dword [ebp - 4]
mov ecx, eax
call fcn.1001177a
push dword [ebp - 4]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
test ebx, ebx
je 0x10005882
mov ecx, ebx
call fcn.1001177a
push ebx
call dword [sym.imp.ole32.dll_CoTaskMemFree]
test edi, edi
je 0x10005894
mov ecx, edi
call fcn.1001177a
push edi
call dword [sym.imp.ole32.dll_CoTaskMemFree]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x10006015
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
sub esp, 0x14
push ebx
push esi
push edi
push dword [0x100131bc]
xor edi, edi
mov ebx, ecx
and dword [eax], edi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, dword [ebp + 0xc]
test dword [eax + 0x44], 0x1000000
je 0x1000605b
mov edx, 0x10003048
xor ecx, ecx
mov eax, dword [esi + ecx*4]
cmp eax, dword [edx + ecx*4]
jne 0x1000605b
inc ecx
cmp ecx, 4
jne 0x10006048
mov esi, 0x10003058
mov ecx, esi
mov dword [ebp - 8], esi
call fcn.10007960
mov dword [ebp - 0xc], eax
shr eax, 0x10
mov dword [ebp - 0x10], eax
test ax, ax
je 0x10006089
push esi
mov ecx, ebx
call fcn.10005bd2
test eax, eax
jne 0x10006089
mov eax, 0x8007000e
jmp 0x10006182
mov esi, dword [0x100136a8]
mov ecx, esi
push 1
push 0x24
push dword [ebp + 8]
call dword [0x100142a8]
call esi
test byte [eax + 0x1c], 2
mov ecx, dword [eax + 0x10]
mov dword [ebp - 0x14], ecx
mov ecx, dword [eax + 0x20]
je 0x100060b1
mov ecx, dword [ecx]
test byte [eax + 0x1c], 0x10
je 0x100060cf
cmp dword [ebp - 0xc], edi
jne 0x100060cf
mov esi, dword [ebp + 8]
push esi
call fcn.1000618f
mov eax, dword [ebp + 0x10]
mov dword [eax], esi
jmp 0x1000616f
mov eax, dword [ecx]
mov esi, dword [eax]
lea eax, [ebp - 4]
push eax
push dword [ebp - 8]
push ecx
mov ecx, esi
call dword [0x100142a8]
call esi
mov edi, eax
test edi, edi
js 0x1000616f
cmp dword [ebp - 4], 0
je 0x1000616a
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x1000610c
mov al, byte [ecx + 4]
and al, 2
movzx eax, al
neg eax
sbb eax, eax
not eax
and ecx, eax
lea eax, [ebp - 0x14]
mov dword [ebx + 8], 2
push eax
push dword [ebp - 0xc]
push ecx
push dword [ebp - 4]
mov ecx, ebx
push 0
call fcn.10005d56
test eax, eax
je 0x1000614c
test byte [ebp - 0x14], 3
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
je 0x10006151
cmp word [ebp - 0x10], 0
je 0x10006151
push eax
mov ecx, ebx
call fcn.10006210
mov edi, 0x80004002
jmp 0x10006151
mov edi, 0x8007000e
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 8]
mov ecx, esi
call dword [0x100142a8]
call esi
and dword [ebx + 8], 0
jmp 0x1000616f
mov edi, 0x80004002
cmp word [ebp - 0x10], 0
je 0x10006180
push dword [ebp + 0xc]
mov ecx, ebx
call fcn.10005c06
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x100072e1
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x100131b4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov eax, 0x9c
mov dword [ebp - 8], edx
mov esi, ecx
call fcn.10012c00
mov edi, esp
test edi, edi
jne 0x10007314
mov eax, 0x8007000e
jmp 0x10007451
mov eax, dword [ebp + 8]
lea ebx, [edi + 0x5c]
push dword [0x100131bc]
and dword [edi + 0x78], 0
and dword [edi + 0x7c], 0
mov dword [edi + 0x68], eax
mov dword [edi + 0x6c], eax
lea eax, [edi + 0x1c]
mov dword [ebx], eax
mov dword [edi + 0x60], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [edi + 0x98], eax
test eax, eax
je 0x1000744c
mov eax, dword [eax + 0x40]
mov ecx, esi
mov dword [edi + 0x84], eax
shl ecx, 4
mov eax, dword [ecx + 0x10001b78]
sub eax, 0xc
mov dword [edi + 4], eax
mov eax, dword [ecx + 0x10001b7c]
mov dword [edi + 8], eax
mov eax, dword [edi + 0x6c]
mov dword [edi + 0x64], 1
mov edx, dword [eax]
add eax, 4
mov dword [edi + 0x94], edx
mov dword [edi + 0x6c], eax
test byte [edx + 0x1c], 4
jne 0x1000744c
mov dword [edi + 0x80], edx
mov ecx, ebx
mov edx, dword [edx + 0x20]
push 4
mov dword [edi + 0x10], edx
call fcn.10007d64
mov dword [edi + 0x18], eax
test eax, eax
jne 0x100073b3
mov eax, dword [edi + 0x78]
jmp 0x10007451
mov edx, dword [eax]
mov ecx, ebx
mov eax, dword [edi + 8]
shl eax, 2
push eax
mov dword [edi + 0x14], edx
call fcn.10007d64
mov dword [edi + 0xc], eax
test eax, eax
je 0x100073ab
cmp dword [edi + 0x64], 0
mov eax, dword [edi + 0x60]
mov ecx, dword [edi + 0x10]
jge 0x100073e3
add eax, 0xfffffffc
mov dword [edi + 0x60], eax
mov dword [eax], ecx
jmp 0x100073e9
mov dword [eax], ecx
add dword [edi + 0x60], 4
mov ecx, dword [ebp - 8]
mov eax, dword [edi + 4]
push ebx
mov eax, dword [eax + ecx*4]
mov dword [edi], eax
mov dword [edi + 0x70], eax
mov eax, dword [edi + 0xc]
mov eax, dword [eax + ecx*4]
mov dword [edi + 0x74], eax
mov eax, dword [edi + 0x94]
mov dword [edi + 0x90], eax
mov eax, dword [edi + 0x84]
mov dword [edi + 0x88], esi
mov dword [edi + 0x8c], ecx
mov dword [eax + 8], 4
mov eax, dword [edi + 0x70]
movzx eax, byte [eax]
and eax, 0x3f
mov esi, dword [eax*4 + 0x100010f8]
mov ecx, esi
call dword [0x100142a8]
call esi
mov ecx, dword [edi + 0x84]
and dword [ecx + 8], 0
jmp 0x10007451
mov eax, 0x80004005
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100120c0
leave
ret 4
Function at 0x1000746b
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 4], 0
mov eax, edx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], ecx
cmp edi, 0x10
ja 0x100074b8
mov esi, dword [0x100136c4]
lea edx, [ebp - 4]
push edx
push eax
push edi
push 1
push ecx
mov ecx, esi
call dword [0x100142a8]
call esi
test eax, eax
jne 0x100074b0
mov eax, 0x8000ffff
jmp 0x10007548
mov eax, dword [ebp - 4]
jmp 0x10007548
push ebx
push dword [0x100131bc]
lea ebx, [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push ebx
mov ecx, eax
call fcn.10011532
mov ebx, eax
test ebx, ebx
jne 0x100074dd
mov eax, 0x8007000e
jmp 0x10007547
mov esi, dword [0x100136a8]
lea eax, [edi + 0xc]
push 1
push eax
push ebx
mov ecx, esi
call dword [0x100142a8]
call esi
mov ecx, dword [ebp - 8]
push edi
push dword [ebp - 0xc]
mov dword [eax + edi], ecx
push eax
mov dword [eax + edi + 4], ebx
mov dword [eax + edi + 8], edi
call sub.msvcrt.dll_memcpy
mov esi, dword [0x100136c0]
lea eax, [ebx + edi]
add esp, 0xc
mov ecx, esi
push eax
push dword [0x10013584]
call dword [0x100142a8]
call esi
push dword [0x100131bc]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
lea ecx, [edi + 0xc]
push ecx
push ecx
mov ecx, eax
call fcn.1001161f
mov eax, dword [ebp - 4]
pop ebx
pop edi
pop esi
leave
ret 4
Function at 0x10008610
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push dword [0x100131bc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, eax
pop ebp
jmp fcn.1001161f