joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001e50
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
sub esp, 8
push edi
mov edi, dword [esp + 0x10]
test edi, edi
je 0x10001fd6
push ebx
push ebp
push esi
mov dword [esp + 0x10], 0
lea ebx, [edi + 0x28]
mov edi, edi
mov edx, dword [esp + 0x10]
inc edx
push ebx
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], edx
call fcn.10001830
mov eax, dword [edi + 0x84]
push ebx
mov dword [edi + 0x88], eax
call fcn.10001990
push ebx
call fcn.10001830
mov esi, dword [edi + 0x88]
add esp, 0xc
test esi, esi
je 0x10001fbe
mov ecx, dword [esi + 4]
add ecx, 8
push ecx
call fcn.10001a10
add esp, 4
cmp eax, 0x10
jne 0x10001eda
push ebx
call fcn.10001990
add esp, 4
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10001fa4
mov edx, dword [esi + 8]
mov dword [edi + 0x88], edx
mov edi, dword [esi + 4]
mov eax, dword [edi]
mov ebp, dword [edi + 4]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [edi]
push 0
push ecx
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test ebx, ebx
je 0x10001f2e
cmp dword [esp + 0x10], 4
jg 0x10001f2e
mov eax, dword [esp + 0x1c]
add eax, 0x28
push eax
call fcn.10001990
add edi, 8
push edi
call fcn.10001990
mov edx, dword [esp + 0x1c]
inc edx
push ebx
mov dword [esp + 0x20], edx
call ebp
jmp 0x10001f9d
mov ecx, dword [esi + 0x10]
test ecx, ecx
mov eax, dword [esi + 8]
je 0x10001f3b
mov dword [ecx + 8], eax
test eax, eax
je 0x10001f42
mov dword [eax + 0x10], ecx
mov ecx, dword [esi]
cmp dword [ecx + 0x84], esi
jne 0x10001f52
mov dword [ecx + 0x84], eax
mov ecx, dword [esi]
cmp dword [ecx + 0x88], esi
jne 0x10001f62
mov dword [ecx + 0x88], eax
mov eax, dword [esi + 0x14]
test eax, eax
mov ecx, dword [esi + 0xc]
je 0x10001f6f
mov dword [eax + 0xc], ecx
test ecx, ecx
je 0x10001f76
mov dword [ecx + 0x14], eax
mov eax, dword [esi + 4]
cmp dword [eax + 0xc], esi
jne 0x10001f81
mov dword [eax + 0xc], ecx
push esi
call fcn.102142a5
mov eax, dword [esp + 0x20]
add eax, 0x28
push eax
call fcn.10001990
add edi, 8
push edi
call fcn.10001990
mov edi, dword [esp + 0x28]
add esp, 0xc
lea ebx, [edi + 0x28]
push ebx
call fcn.10001830
mov esi, dword [edi + 0x88]
add esp, 4
test esi, esi
jne 0x10001eb0
push ebx
call fcn.10001990
mov eax, dword [esp + 0x18]
add esp, 4
test eax, eax
jne 0x10001e70
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret

Function at 0x10002040
Capabilities:
Get thread local storage value

Disassembly:
push esi
mov esi, dword [0x103e97a4]
test esi, esi
jne 0x1000204f
xor eax, eax
pop esi
ret
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
call sub.WS2_32.dll_WSAGetLastError
mov ebx, eax
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
push ebx
call sub.WS2_32.dll_WSASetLastError
test esi, esi
pop edi
pop ebx
je 0x100020a7
mov eax, dword [esp + 8]
test eax, eax
je 0x10002095
mov eax, dword [esi]
test eax, eax
je 0x10002095
mov ecx, dword [esi + 4]
push ecx
call eax
add esp, 4
mov edx, dword [esi + 8]
mov eax, dword [0x103e97a4]
push edx
push eax
call fcn.10001d30
add esp, 8
mov eax, esi
pop esi
ret
Function at 0x100020b0
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
push ebp
push esi
mov esi, dword [esp + 0xc]
mov dword [esi], eax
mov dword [esi + 4], ecx
mov eax, dword [0x103e97a4]
test eax, eax
mov ebp, eax
je 0x100020fa
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
call sub.WS2_32.dll_WSAGetLastError
mov edx, dword [ebp]
push edx
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
push ebx
call sub.WS2_32.dll_WSASetLastError
pop edi
pop ebx
mov dword [esi + 8], ebp
mov eax, dword [0x103e97a4]
push esi
push eax
call fcn.10001d30
add esp, 8
pop esi
pop ebp
ret

Function at 0x10002760
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
push edi
lea ebx, [ebx]
mov esi, dword [0x103e97a4]
test esi, esi
je 0x100027cc
call ebp
mov edi, eax
call sub.WS2_32.dll_WSAGetLastError
mov ebx, eax
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
push ebx
call sub.WS2_32.dll_WSASetLastError
test esi, esi
je 0x100027cc
mov eax, dword [esp + 0x14]
test eax, eax
je 0x100027b8
mov eax, dword [esi]
test eax, eax
je 0x100027b8
mov ecx, dword [esi + 4]
push ecx
call eax
add esp, 4
mov edx, dword [esi + 8]
mov eax, dword [0x103e97a4]
push edx
push eax
call fcn.10001d30
add esp, 8
jmp 0x10002770
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x100029d0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov eax, dword [0x103e979c]
test eax, eax
je 0x10002a71
push esi
mov esi, dword [0x103e97a0]
test esi, esi
je 0x10002a77
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
call sub.WS2_32.dll_WSAGetLastError
mov ebx, eax
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
push ebx
call sub.WS2_32.dll_WSASetLastError
test esi, esi
je 0x10002a68
mov ecx, dword [esi + 0xc]
mov edx, dword [esi + 8]
push ecx
push edx
call fcn.10001e50
lea edi, [esi + 0x30]
push edi
call fcn.10001830
push edi
mov dword [esi + 0x14], 6
call fcn.10001990
mov eax, dword [esi + 0x24]
add esp, 0x10
cmp eax, 1
jne 0x10002a68
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 8]
push eax
push ecx
call fcn.100026f0
mov edx, dword [0x103e97a0]
mov eax, dword [edx]
add esp, 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop edi
pop ebx
mov eax, 1
pop esi
ret
mov eax, 1
ret
mov eax, 1
pop esi
ret
Function at 0x10002b30
Capabilities:
Allocate thread local storage

Disassembly:
mov eax, dword [0x103e979c]
test eax, eax
je 0x10002b3f
mov eax, 1
ret
push esi
push edi
push 0x10
push 1
mov dword [0x103e979c], 1
xor edi, edi
call fcn.1021e288
mov esi, eax
add esp, 8
test esi, esi
jne 0x10002b66
mov edi, 0xc
jmp 0x10002b83
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [esi], eax
jne 0x10002b83
push esi
mov edi, 0xb
call fcn.102142a5
add esp, 4
xor esi, esi
test edi, edi
mov dword [0x103e97a0], esi
jne 0x10002b9f
push edi
push 0x103e97a4
call fcn.100014c0
add esp, 8
test eax, eax
je 0x10002ba4
call fcn.10002620
mov esi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x103ee040
call esi
push 0x103ee080
call esi
push 0x103ee000
call esi
push 0x103ee060
call esi
push 0x103ee020
call esi
push 0x103edfe0
call esi
mov eax, dword [0x103e979c]
pop edi
pop esi
ret

Function at 0x10002c90
Capabilities:
Get thread local storage value
Terminate process

Disassembly:
push ebx
push esi
mov esi, dword [0x103e97a0]
test esi, esi
push edi
je 0x10002cc4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
call sub.WS2_32.dll_WSAGetLastError
mov ebx, eax
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
push ebx
call sub.WS2_32.dll_WSASetLastError
mov ebx, dword [esp + 0x10]
cmp ebx, 2
je 0x10002cd9
cmp ebx, 1
je 0x10002cd9
push 1
call fcn.1022401c
test esi, esi
je 0x10002ce6
test byte [esi + 0x80], 1
je 0x10002d06
mov eax, ebx
xor edi, edi
dec eax
je 0x10002cf5
dec eax
jne 0x10002cf8
or edi, 0xffffffff
jmp 0x10002cf8
mov edi, dword [esi + 0x18]
call fcn.100029d0
push edi
call fcn.10223d6d
add esp, 4
push 1
call fcn.10002760
add esp, 4
push ebx
add esi, 0x40
push esi
call fcn.1020ea5b
int3
Function at 0x10002f40
Capabilities:
Resume thread
Suspend thread

Disassembly:
push ebx
push esi
push edi
push 0x103ee040
xor edi, edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, dword [esp + 0x10]
test esi, esi
mov ebx, dword [esp + 0x14]
je 0x10002f68
cmp ebx, dword [esi + 0xc]
jne 0x10002f68
mov eax, dword [esi + 4]
test eax, eax
jne 0x10002f6d
mov edi, 3
push 0x103ee040
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test edi, edi
mov dword [esp + 0x10], edi
je 0x10002f86
mov eax, edi
pop edi
pop esi
pop ebx
ret
call fcn.10001750
test eax, eax
jne 0x10002f98
pop edi
pop esi
mov eax, 0xc
pop ebx
ret
cmp esi, eax
jne 0x10002fa7
cmp ebx, edx
jne 0x10002fa7
mov edi, 1
jmp 0x10002fa9
xor edi, edi
push ebp
lea ebx, [esi + 0x30]
push ebx
call fcn.10001830
mov eax, dword [esi + 0x38]
add esp, 4
test eax, eax
mov ebp, 4
jne 0x10003037
mov eax, dword [esi + 0x34]
test eax, eax
jne 0x10003037
cmp dword [esi + 0x14], ebp
jge 0x10003037
test edi, edi
je 0x10002fec
push ebx
mov dword [esi + 0x14], ebp
mov dword [esi + 0x34], 1
call fcn.10001990
add esp, 4
push 2
call fcn.10002c90
mov edi, dword [esi + 4]
push edi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push 0
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x1000307a
push 0
push edi
push 0x10002ed0
mov dword [esi + 0x14], ebp
mov dword [esi + 0x34], 1
call dword [0x103e97c0]
push ebx
call fcn.10001990
add esp, 0x10
push edi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [esp + 0x14]
pop ebp
pop edi
pop esi
pop ebx
ret
mov eax, dword [esi + 0x14]
mov edi, 3
cmp eax, edi
jge 0x10003068
mov eax, dword [esi + 0x3c]
push eax
mov dword [esi + 0x14], edi
call dword [sym.imp.KERNEL32.dll_SetEvent]
test eax, eax
jne 0x10003071
push ebx
mov dword [esp + 0x18], edi
call fcn.10001990
add esp, 4
pop ebp
mov eax, edi
pop edi
pop esi
pop ebx
ret
cmp dword [esi + 0x14], ebp
jl 0x10003071
mov dword [esp + 0x14], edi
push ebx
call fcn.10001990
add esp, 4
mov eax, dword [esp + 0x14]
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x100030e0
Capabilities:
Create thread
Resume thread

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x14]
push ebx
push ebp
xor ebx, ebx
push esi
mov dword [eax + 4], ebx
mov eax, dword [esp + 0x24]
push edi
xor edi, edi
cmp eax, ebx
mov dword [esp + 0x10], 0xb
je 0x10003104
mov ebx, dword [eax]
call fcn.10001540
mov esi, eax
test esi, esi
mov ebp, edx
mov dword [esp + 0x1c], ebp
je 0x100031d0
mov ecx, dword [esi + 0x2c]
push 0x10
mov dword [esp + 0x2c], ecx
call fcn.10215ade
mov edi, eax
add esp, 4
test edi, edi
je 0x100031d0
test ebx, ebx
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x30]
mov dword [edi], esi
mov dword [edi + 4], ebp
mov dword [edi + 8], edx
mov dword [edi + 0xc], eax
je 0x10003174
mov ecx, dword [ebx + 0xc]
mov ebp, dword [ebx + 8]
mov dword [esi + 0x24], ecx
mov eax, dword [ebx + 0x14]
test eax, eax
mov edx, dword [ebx + 0x10]
mov dword [esp + 0x28], edx
jne 0x10003176
call fcn.10001750
mov eax, dword [eax + 0x2c]
mov dword [esp + 0x14], edx
mov dword [esp + 0x28], eax
jmp 0x10003176
xor ebp, ebp
push esi
push 4
push edi
xor eax, eax
push 0x10002be0
push ebp
push eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x84], eax
call fcn.10223ce0
mov ebp, eax
add esp, 0x18
test ebp, ebp
mov dword [esi + 4], ebp
je 0x100031bd
test ebx, ebx
je 0x100031b6
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x1c]
push ecx
push 0
push edx
push esi
call fcn.10001a90
add esp, 0x10
push ebp
call dword [sym.imp.KERNEL32.dll_ResumeThread]
xor ebx, ebx
test ebp, ebp
setne bl
dec ebx
and ebx, 0xb
je 0x100031f5
mov ebp, dword [esp + 0x1c]
jmp 0x100031d4
mov ebx, dword [esp + 0x10]
push ebp
push esi
call fcn.100026f0
add esp, 8
test edi, edi
je 0x10003202
push edi
call fcn.102142a5
add esp, 4
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x10
ret
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x1c]
mov dword [eax], esi
mov dword [eax + 4], ecx
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x10
ret
Function at 0x1000bcb0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
movzx eax, word [ebp + 8]
mov dword [ebp + 8], eax
pop ebp
jmp fcn.100dc745
Function at 0x1000f110
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x1000f169
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x1000f169
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x1000f15a
cmp esi, edx
jae 0x1000f169
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x1000f148
cmp esi, edx
jae 0x1000f169
cmp word [esi], 0
je 0x1000f169
mov eax, esi
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret
Function at 0x10010c20
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1023b39d
mov eax, dword fs:[0]
push eax
sub esp, 0x154
push ebx
push esi
push edi
mov eax, dword [0x102e1e14]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], 0
call fcn.100e0285
push eax
lea ecx, [ebp - 0xd]
call fcn.100d3311
cmp byte [0x102e90b0], 0
mov dword [ebp - 4], 0
jne 0x10010c7a
mov esi, 1
jmp 0x10010dc2
mov edi, dword [ebp + 8]
test edi, edi
jne 0x10010c89
lea esi, [edi + 3]
jmp 0x10010dc2
call fcn.100d36c4
mov eax, dword [eax + 0xc]
test eax, eax
je 0x10010c9f
call fcn.100d36c4
mov esi, dword [eax + 0xc]
jmp 0x10010cad
mov esi, dword [0x102e90fc]
call fcn.100d36c4
mov dword [eax + 0xc], esi
push 5
push 0x64
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ecx, dword [ebp + 0xc]
mov esi, eax
test ecx, ecx
je 0x10010cdd
push ecx
lea ecx, [ebp - 0x20]
call fcn.1000a800
mov byte [ebp - 4], 1
mov ebx, 1
jmp 0x10010cfb
push 0x2da
lea eax, [ebp - 0x1c]
push edi
push eax
call fcn.1000c020
add esp, 0xc
mov dword [ebp - 4], 2
mov ebx, 2
mov eax, dword [eax]
sub eax, 0x10
mov dword [ebp - 0x14], ebx
push eax
call fcn.1000bbc0
add eax, 0x10
add esp, 4
mov dword [ebp - 0x18], eax
or ecx, 0xffffffff
mov dword [ebp - 4], 4
test bl, 2
je 0x10010d44
mov edx, dword [ebp - 0x1c]
and ebx, 0xfffffffd
mov dword [ebp - 0x14], ebx
add edx, 0xfffffff0
mov eax, ecx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10010d44
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
or ecx, 0xffffffff
mov byte [ebp - 4], 5
test bl, 1
je 0x10010d67
mov edx, dword [ebp - 0x20]
mov eax, ecx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10010d67
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 0
lea eax, [ebp - 0x18]
push eax
push edi
lea ecx, [ebp - 0x160]
call fcn.1000f6a0
push 0
push esi
lea ecx, [ebp - 0x160]
mov byte [ebp - 4], 6
call fcn.100dcdf7
lea ecx, [ebp - 0x160]
call fcn.100dcae0
lea ecx, [ebp - 0x160]
xor esi, esi
call fcn.1000f800
mov edi, dword [ebp - 0x18]
or eax, 0xffffffff
mov byte [ebp - 4], 0
add edi, 0xfffffff0
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x10010dc2
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
lea ecx, [ebp - 0xd]
call fcn.1000f170
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100198b0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1023c0b0
mov eax, dword fs:[0]
push eax
sub esp, 0x30
push ebx
push esi
push edi
mov eax, dword [0x102e1e14]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [edi + 0x80], 0
je 0x10019986
movss xmm1, dword [ebp + 8]
xorps xmm0, xmm0
cvtps2pd xmm2, xmm1
comisd xmm0, xmm2
ja 0x1001990a
comisd xmm2, xmmword [0x10263120]
jbe 0x10019912
movss xmm0, dword [0x10263128]
movss dword [ebp + 8], xmm0
movaps xmm1, xmm0
movss xmm0, dword [edi + 0x140]
mov ebx, dword [ebp + 0x10]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x10019940
push dword [ebp + 0xc]
lea ecx, [edi + 0x144]
call fcn.10016870
test al, al
jne 0x10019940
cmp dword [edi + 0x150], ebx
je 0x10019986
lea ecx, [edi + 0x108]
call fcn.10036db0
movss xmm0, dword [ebp + 8]
lea ecx, [edi + 0x144]
push dword [ebp + 0xc]
movss dword [edi + 0x140], xmm0
call fcn.100165d0
mov eax, dword [edi + 0x104]
lea ecx, [edi + 0x108]
or eax, 2
mov dword [edi + 0x150], ebx
mov dword [edi + 0x104], eax
call fcn.10036dc0
push str.AudioDecoder
lea ecx, [ebp - 0x18]
call fcn.10016440
mov ecx, dword [edi + 0xfc]
lea edx, [ebp - 0x18]
push edx
mov dword [ebp - 4], 0
mov eax, dword [ecx]
call dword [eax + 0xc]
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], 0xffffffff
call fcn.100165a0
push str.Decoding_progress
lea ecx, [ebp - 0x24]
call fcn.10016440
movss xmm0, dword [edi + 0x140]
lea edx, [ebp - 0x24]
mov ecx, dword [edi + 0xfc]
sub esp, 8
cvtps2pd xmm0, xmm0
mov dword [ebp - 4], 1
mov eax, dword [ecx]
movsd qword [esp], xmm0
push edx
call dword [eax + 0x2c]
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], 0xffffffff
call fcn.100165a0
push str.File_name
lea ecx, [ebp - 0x30]
call fcn.10016440
mov ecx, dword [edi + 0xfc]
lea eax, [edi + 0x144]
push eax
lea eax, [ebp - 0x30]
mov dword [ebp - 4], 2
push eax
mov edx, dword [ecx]
call dword [edx + 0x28]
lea ecx, [ebp - 0x30]
mov dword [ebp - 4], 0xffffffff
call fcn.100165a0
push str.File_type
lea ecx, [ebp - 0x3c]
call fcn.10016440
mov ecx, dword [edi + 0xfc]
lea edx, [ebp - 0x3c]
push dword [edi + 0x150]
mov dword [ebp - 4], 3
push edx
mov eax, dword [ecx]
call dword [eax + 0x30]
lea ecx, [ebp - 0x3c]
mov dword [ebp - 4], 0xffffffff
call fcn.100165a0
mov ecx, dword [edi + 0xfc]
mov eax, dword [ecx]
call dword [eax + 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x1001c6d0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1023c27f
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
push edi
mov eax, dword [0x102e1e14]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
push 0x3c
call fcn.100d1d56
mov edi, eax
add esp, 4
mov dword [ebp - 0x14], edi
mov dword [ebp - 4], 0
test edi, edi
je 0x1001c753
mov ecx, edi
call fcn.10016520
movsd xmm0, qword [0x10263130]
mov byte [edi + 0x10], 0xff
mov dword [edi + 0x11], 0xffffffff
mov dword [edi + 0x15], 0xffffffff
mov dword [edi + 0x19], 0xffffffff
movsd qword [edi + 0x1d], xmm0
mov dword [edi + 0x25], 0xffffffff
mov dword [edi + 0x29], 0xffffffff
jmp 0x1001c755
xor edi, edi
push dword [ebp + 8]
mov ecx, edi
mov dword [ebp - 4], 0xffffffff
call fcn.100165d0
mov eax, dword [ebp + 0xc]
lea ecx, [esi + 0x108]
mov dword [edi + 0xc], eax
movups xmm0, xmmword [ebp + 0x10]
movups xmmword [edi + 0x10], xmm0
movups xmm0, xmmword [ebp + 0x20]
movups xmmword [edi + 0x20], xmm0
movq xmm0, qword [ebp + 0x30]
movq qword [edi + 0x30], xmm0
mov al, byte [ebp + 0x38]
mov byte [edi + 0x38], al
call fcn.10036db0
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x24]
push eax
add ecx, 0xe8
mov dword [ebp - 0x24], 0x1001d700
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], edi
call fcn.1001dc60
lea ecx, [esi + 0x108]
call fcn.10036dc0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x3c

Function at 0x100326d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x10032709
mov eax, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
movzx ecx, byte [edi]
lea edi, [edi + 1]
mov edx, eax
shl eax, 8
shr edx, 8
xor edx, ecx
movzx ecx, dl
xor ax, word [ecx*2 + section..data]
movzx eax, ax
sub esi, 1
jne 0x100326e2
pop edi
pop esi
pop ebp
ret
mov ax, word [ebp + 8]
pop esi
pop ebp
ret
Function at 0x10036b70
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov eax, dword [0x103e979c]
test eax, eax
je 0x100029bf
push esi
mov esi, dword [0x103e97a0]
test esi, esi
je 0x1000297d
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
call sub.WS2_32.dll_WSAGetLastError
mov ebx, eax
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
push ebx
call sub.WS2_32.dll_WSASetLastError
test esi, esi
pop edi
pop ebx
je 0x1000297d
cmp dword [esi + 0x24], 1
jne 0x1000297d
mov ecx, dword [esi + 0xc]
mov edx, dword [esi + 8]
push ecx
push edx
call fcn.100026f0
mov eax, dword [0x103e97a0]
mov ecx, dword [eax]
add esp, 8
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
call fcn.10002620
mov eax, dword [0x103e9794]
test eax, eax
mov esi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
je 0x100029ac
push str.QueueUserAPCEx_Fini
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100029a3
call eax
mov edx, dword [0x103e9794]
push edx
call esi
mov eax, dword [0x103e9798]
test eax, eax
je 0x100029b8
push eax
call esi
mov eax, 1
pop esi
ret
mov eax, 1
ret
jmp 0x10002910
Function at 0x10043350
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x102e1e14]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x38], 0
je 0x100433f1
cmp byte [esi + 0x3d], 0
je 0x100433f1
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x100433a7
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
mov edx, dword [ecx]
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x100433b9
sub eax, 1
je 0x100433bd
sub eax, 2
je 0x100433f1
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1020a080
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x100433da
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.1021d3ed
add esp, 0x10
cmp edi, eax
jne 0x100433a7
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1020a080
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
xor ecx, ebp
pop esi
call fcn.1020a080
mov esp, ebp
pop ebp
ret
Function at 0x10043870
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1023ffe8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x102e1e14]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 8
mov dword [esi + 0x30], 0
mov dword [esi + 8], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0x201
mov dword [esi + 0x18], 6
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0xc], 0
call fcn.100d1d56
mov edi, eax
add esp, 4
test edi, edi
je 0x1004390d
push 1
mov dword [ebp - 4], 0
call fcn.1020bab5
add esp, 4
mov dword [edi + 4], eax
jmp 0x1004390f
xor edi, edi
mov eax, dword [ebp + 8]
mov dword [esi + 0x30], edi
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], 0
mov edi, dword [edi + 4]
mov ecx, edi
mov dword [ebp - 4], 1
mov dword [ebp - 0x10], edi
mov eax, dword [edi]
call dword [eax + 4]
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 2
push eax
call fcn.100417b0
add esp, 4
mov ecx, eax
mov edx, dword [eax]
push 0x20
mov eax, dword [edx + 0x20]
call eax
mov bl, al
mov dword [ebp - 4], 3
test edi, edi
je 0x10043971
mov edx, dword [edi]
mov ecx, edi
call dword [edx + 8]
test eax, eax
je 0x10043971
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
cmp dword [esi + 0x38], 0
mov dword [ebp - 4], 0xffffffff
mov byte [esi + 0x40], bl
jne 0x10043994
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x10]
and eax, 0x13
or eax, 4
mov dword [esi + 0xc], eax
and ecx, eax
jne 0x100439b7
cmp byte [ebp + 0xc], 0
je 0x100439a3
push esi
call fcn.1020bd38
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
test cl, 4
je 0x100439c3
mov esi, str.ios_base::badbit_set
jmp 0x100439d3
test cl, 2
mov esi, str.ios_base::failbit_set
mov eax, str.ios_base::eofbit_set
cmove esi, eax
lea eax, [ebp - 0x1c]
push 1
push eax
call fcn.10043a00
add esp, 8
lea ecx, [ebp - 0x30]
push eax
push esi
call fcn.10041de0
push 0x102be0a0
lea eax, [ebp - 0x30]
push eax
call fcn.1020df63
int3