joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45859f
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
cmp eax, ebx
push edi
mov dword [ebp - 0x10], ebx
jne 0x4585b8
or eax, 0xffffffff
jmp 0x458619
push esi
mov esi, dword [eax]
cmp esi, ebx
mov dword [ebp - 4], esi
je 0x458615
push 0x3d
push esi
call fcn.0045880b
cmp eax, ebx
pop ecx
pop ecx
mov dword [ebp - 0xc], eax
je 0x458615
cmp esi, eax
je 0x458615
xor ecx, ecx
cmp byte [eax + 1], bl
mov eax, dword [0x4c2138]
sete cl
cmp eax, dword [0x4c213c]
mov dword [ebp - 8], ecx
jne 0x4585fb
mov edi, eax
call fcn.0045853e
mov dword [0x4c2138], eax
cmp eax, ebx
jne 0x458654
cmp dword [ebp + 0xc], ebx
je 0x45861d
cmp dword [0x4c2140], ebx
je 0x45861d
call fcn.00457c60
test eax, eax
je 0x458654
or eax, 0xffffffff
pop esi
pop edi
pop ebx
leave
ret
cmp dword [ebp - 8], ebx
je 0x458626
xor eax, eax
jmp 0x458618
push 4
call fcn.0044db34
cmp eax, ebx
pop ecx
mov dword [0x4c2138], eax
je 0x458615
mov dword [eax], ebx
cmp dword [0x4c2140], ebx
jne 0x458654
push 4
call fcn.0044db34
cmp eax, ebx
pop ecx
mov dword [0x4c2140], eax
je 0x458615
mov dword [eax], ebx
mov edi, dword [ebp - 0xc]
sub edi, dword [ebp - 4]
push dword [ebp - 4]
mov esi, dword [0x4c2138]
call fcn.004584f1
mov edi, eax
cmp edi, ebx
pop ecx
jl 0x4586b5
cmp dword [esi], ebx
je 0x4586b5
lea esi, [esi + edi*4]
push dword [esi]
call fcn.0044dbb0
cmp dword [ebp - 8], ebx
pop ecx
jne 0x458698
mov eax, dword [ebp - 4]
mov dword [esi], eax
mov eax, dword [ebp + 8]
mov dword [eax], ebx
jmp 0x4586f6
mov eax, dword [esi + 4]
mov dword [esi], eax
inc edi
add esi, 4
cmp dword [esi], ebx
jne 0x45868f
mov eax, edi
shl eax, 2
push eax
push dword [0x4c2138]
call fcn.00454082
cmp eax, ebx
pop ecx
pop ecx
je 0x4586f6
jmp 0x4586f1
cmp dword [ebp - 8], ebx
jne 0x458761
cmp edi, ebx
jge 0x4586c4
neg edi
lea eax, [edi*4 + 8]
push eax
push dword [0x4c2138]
call fcn.00454082
cmp eax, ebx
pop ecx
pop ecx
je 0x458615
mov edx, dword [ebp - 4]
lea ecx, [eax + edi*4]
mov dword [ecx], edx
mov dword [ecx + 4], ebx
mov ecx, dword [ebp + 8]
mov dword [ecx], ebx
mov dword [0x4c2138], eax
cmp dword [ebp + 0xc], ebx
je 0x45874b
push dword [ebp - 4]
call fcn.0044cc70
inc eax
inc eax
push eax
call fcn.0044db34
mov esi, eax
cmp esi, ebx
pop ecx
pop ecx
je 0x45874b
push dword [ebp - 4]
push esi
call fcn.0044ceb0
mov eax, esi
sub eax, dword [ebp - 4]
pop ecx
add eax, dword [ebp - 0xc]
pop ecx
mov ecx, dword [ebp - 8]
mov byte [eax], bl
inc eax
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
test eax, eax
jne 0x458744
or dword [ebp - 0x10], 0xffffffff
push esi
call fcn.0044dbb0
pop ecx
cmp dword [ebp - 8], ebx
je 0x458759
push dword [ebp - 4]
call fcn.0044dbb0
pop ecx
mov eax, dword [ebp - 0x10]
jmp 0x458618
push dword [ebp - 4]
call fcn.0044dbb0
mov eax, dword [ebp + 8]
pop ecx
mov dword [eax], ebx
jmp 0x458622
Function at 0x45888c
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test eax, eax
je 0x4588ba
add al, 0x40
mov byte [ebp + 8], al
lea eax, [ebp + 8]
push eax
mov byte [ebp + 9], 0x3a
mov byte [ebp + 0xa], 0x5c
mov byte [ebp + 0xb], 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
test eax, eax
je 0x4588bf
cmp eax, 1
je 0x4588bf
xor eax, eax
inc eax
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x4588c3
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x4ac8b8]
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
mov dword [ebp - 4], eax
je 0x45893b
push ebx
call fcn.0045888c
test eax, eax
pop ecx
jne 0x45890a
call fcn.0044ffb3
mov dword [eax], 0xf
call 0x44ffaa
mov dword [eax], 0xd
xor eax, eax
mov ecx, dword [ebp - 4]
pop ebx
call fcn.00454074
leave
ret
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x108]
push eax
push 0x104
lea eax, [ebp + 8]
add bl, 0x40
push eax
mov byte [ebp + 8], bl
mov byte [ebp + 9], 0x3a
mov byte [ebp + 0xa], 0x2e
mov byte [ebp + 0xb], 0
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
jmp 0x45894d
lea eax, [ebp - 0x108]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x4588fd
inc eax
cmp eax, 0x104
ja 0x4588fd
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jne 0x458985
cmp eax, dword [ebp + 0x10]
jg 0x458968
mov eax, dword [ebp + 0x10]
push eax
call fcn.0044db34
pop ecx
mov ecx, eax
test ecx, ecx
jne 0x45899a
call 0x44ffaa
mov dword [eax], 0xc
jmp 0x4588fd
cmp eax, dword [ebp + 0x10]
jle 0x45899a
call 0x44ffaa
mov dword [eax], 0x22
jmp 0x4588fd
lea eax, [ebp - 0x108]
push eax
push ecx
call fcn.0044ceb0
pop ecx
pop ecx
jmp 0x4588ff
Function at 0x401fc0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov esi, ecx
push edi
mov eax, dword [esi]
cmp eax, 0x270
jne 0x40200f
lea edx, [esi + 8]
mov edi, eax
mov ecx, dword [edx]
lea edx, [edx + 4]
xor ecx, dword [edx - 8]
and ecx, 0x7fffffff
xor ecx, dword [edx - 8]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x62c]
xor eax, ecx
mov dword [edx + 0x9b8], eax
sub edi, 1
jne 0x401fd2
mov eax, dword [esi]
jmp 0x4020f8
cmp eax, 0x4e0
jb 0x4020f8
push ebx
mov ebx, dword [esi + 0x9c4]
lea edi, [esi + 0x9c4]
push ebp
mov ebp, 0xe3
nop dword [eax]
lea edx, [edi]
mov eax, ebx
mov ebx, dword [edx + 4]
lea edi, [edx + 4]
mov ecx, ebx
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x634]
xor eax, ecx
mov dword [edx - 0x9c0], eax
sub ebp, 1
jne 0x402030
mov ebx, dword [esi + 0xd50]
lea edi, [esi + 0xd50]
mov ebp, 0x18c
nop dword [eax]
mov eax, ebx
lea edx, [edi]
mov ebx, dword [edx + 4]
lea edi, [edx + 4]
mov ecx, eax
xor ecx, ebx
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx - 0xd4c]
xor eax, ecx
mov dword [edx - 0x9c0], eax
sub ebp, 1
jne 0x402080
mov eax, dword [esi + 0x1380]
mov ecx, dword [esi + 4]
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop ebp
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0x634]
xor eax, ecx
mov dword [esi + 0x9c0], eax
xor eax, eax
pop ebx
mov dword [esi], 0
mov edx, dword [esi + eax*4 + 4]
inc eax
mov dword [esi], eax
mov ecx, edx
mov eax, dword [esi + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
pop edi
xor eax, edx
pop esi
ret

Function at 0x4037e9
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x403828
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x403828
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x403828
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x403828
cmp dword [ecx + 0x74], 0xe
jbe 0x403828
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x408475
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4122b4
push 0x4122ac
push str.FlsAlloc
push 0x1f
call fcn.00408351
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4084a9
push dword [ebp + 8]
mov ecx, esi
call dword [0x410150]
call esi
jmp 0x4084af
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4
Function at 0x4084f3
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4122c4
push 0x4122bc
push str.FlsGetValue
push 0x21
call fcn.00408351
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40852a
push dword [ebp + 8]
mov ecx, esi
call dword [0x410150]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x408532
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4122cc
push 0x4122c4
push str.FlsSetValue
push 0x22
call fcn.00408351
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40856c
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x410150]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x40a52c
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x40a5c9
push ebx
push esi
call fcn.0040a4f5
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0040a489
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x40a576
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40a5c8
push edi
push eax
call fcn.00408fbd
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x40a596
call fcn.00407bd5
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40a5c7
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0040a489
add esp, 0x20
test eax, eax
jne 0x40a5b5
push edi
call fcn.00407bd5
jmp 0x40a5bd
push ebx
call fcn.00407bd5
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x40f490
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40f4bd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40f4bd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x1005de21
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x1010e2b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
test edi, edi
je 0x1005de7b
mov esi, edi
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x1005de41
sub esi, ecx
lea ebx, [esi + 1]
test ebx, ebx
je 0x1005de7b
lea eax, [ebx + ebx]
call fcn.1005cea0
mov eax, esp
push esi
push edi
push ebx
push eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
call sym.ucrtbase.dll_mbstowcs_s
add esp, 0x14
test eax, eax
jne 0x1005de7b
push dword [ebp - 8]
call dword [sym.imp.api_ms_win_core_debug_l1_1_0.dll_OutputDebugStringW]
lea esp, [ebp - 0x18]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1005cc20
mov esp, ebp
pop ebp
ret

Function at 0x1005e267
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push esi
mov esi, ecx
mov eax, dword [esi + 4]
mov ecx, dword [esi]
mov edx, dword [eax]
mov ecx, dword [ecx]
mov edx, dword [edx + 0x4c]
call fcn.100300c2
mov eax, dword [esi + 0x10]
mov edx, dword [esi + 0xc]
mov ecx, dword [esi]
push dword [eax]
mov edx, dword [edx]
mov ecx, dword [ecx]
call fcn.1002fd50
pop ecx
mov ecx, dword [esi + 8]
mov dword [ecx], eax
test eax, eax
je 0x1005e340
mov eax, dword [esi + 0x10]
mov eax, dword [eax]
test eax, eax
je 0x1005e2e6
mov edx, 0x1010e3a0
push edi
mov di, word [eax]
xor ecx, ecx
inc ecx
cmp di, word [edx]
jne 0x1005e2d6
test di, di
je 0x1005e2d2
mov di, word [eax + 2]
cmp di, word [edx + 2]
jne 0x1005e2d6
add eax, 4
add edx, 4
test di, di
jne 0x1005e2ad
xor eax, eax
jmp 0x1005e2da
sbb eax, eax
or eax, ecx
pop edi
test eax, eax
je 0x1005e2e6
mov eax, 0x1010fa10
xchg dword [eax], ecx
mov eax, dword [esi + 4]
mov edx, dword [esi]
mov ecx, dword [eax]
mov edx, dword [edx]
add ecx, 0x4c
call fcn.10030780
mov ecx, dword [esi]
mov ecx, dword [ecx]
call fcn.10030870
mov eax, dword [esi + 4]
mov eax, dword [eax]
test byte [eax + 0x350], 2
jne 0x1005e353
test byte [0x1010ead0], 1
jne 0x1005e353
call fcn.10028920
lea ecx, [eax*4 + 0x1010f370]
mov eax, dword [esi + 4]
mov edx, dword [eax]
mov edx, dword [edx + 0x4c]
call fcn.10030780
call fcn.10028920
call fcn.10028920
pop esi
jmp fcn.10028920
mov ecx, dword [esi]
mov ecx, dword [ecx]
call fcn.10030870
mov ecx, dword [esi]
pop esi
mov ecx, dword [ecx]
jmp fcn.1002f3a0
pop esi
ret

Function at 0x1005ff4c
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push esi
mov esi, ecx
push dword [esi + 8]
push dword [esi + 0xc]
call dword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_GetCurrentDirectoryW]
test eax, eax
jne 0x1005ff77
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ecx, eax
call fcn.1003779a
call sym.ucrtbase.dll__errno
mov eax, dword [eax]
jmp 0x1005ff9d
cmp eax, dword [esi + 0xc]
jbe 0x1005ff98
push eax
mov ecx, esi
call fcn.1005d9f3
test eax, eax
jne 0x1005ff9d
push dword [esi + 8]
push dword [esi + 0xc]
call dword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_GetCurrentDirectoryW]
test eax, eax
je 0x1005ff61
mov dword [esi + 0x10], eax
xor eax, eax
pop esi
ret 4
Function at 0x100604b0
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x100fbfa0
push 0x1005ccd0
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x1010e2b0]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
fstp xword [ebp - 0x28]
mov edi, dword [0x1010e2c4]
mov eax, dword [0x1010f3b8]
mov esi, dword [0x1010e2b0]
mov ecx, esi
and ecx, 0x1f
xor esi, eax
ror esi, cl
cmp esi, 0xffffffff
je 0x1007e3a5
test esi, esi
je 0x1007e379
push 1
push edi
mov ecx, esi
call dword [0x10110268]
call esi
wait
mov dword [ebp - 4], 0
fld xword [ebp - 0x28]
call sym.ucrtbase.dll__CIsqrt
fstp xword [ebp - 0x28]
wait
mov dword [ebp - 4], 0xfffffffe
call fcn.1006055f
fld xword [ebp - 0x28]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.1005cc20
mov esp, ebp
pop ebp
ret
mov esi, 0x10006a9c
mov ecx, dword [esi]
call fcn.10032fe0
test eax, eax
jne 0x1007e3b3
add esi, 4
cmp esi, 0x10006aa4
jne 0x1007e37e
push 0xffffffffffffffff
call fcn.10032d19
add esp, 4
mov ecx, 0x1010f3b8
xchg dword [ecx], eax
push 1
push edi
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsSetValue]
jmp 0x10060520
push 0x10006b48
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_1_0.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x1007e394
push esi
call fcn.10032d19
add esp, 4
mov ecx, 0x1010f3b8
xchg dword [ecx], eax
test esi, esi
je 0x1007e3a5
jmp 0x10060513

Function at 0x1006055f
Capabilities:
Set thread local storage value

Disassembly:
mov edi, dword [0x1010e2c4]
mov esi, dword [0x1010f3b8]
mov ecx, dword [0x1010e2b0]
and ecx, 0x1f
xor esi, dword [0x1010e2b0]
ror esi, cl
cmp esi, 0xffffffff
je 0x1007e40f
test esi, esi
je 0x1007e3e3
push 0
push edi
mov ecx, esi
call dword [0x10110268]
call esi
ret
mov esi, 0x10006a9c
mov ecx, dword [esi]
call fcn.10032fe0
test eax, eax
jne 0x1007e419
add esi, 4
cmp esi, 0x10006aa4
jne 0x1007e3e8
push 0xffffffffffffffff
call fcn.10032d19
add esp, 4
mov ecx, 0x1010f3b8
xchg dword [ecx], eax
push 0
push edi
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsSetValue]
ret
push 0x10006b48
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_1_0.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x1007e3fe
push esi
call fcn.10032d19
add esp, 4
mov ecx, 0x1010f3b8
xchg dword [ecx], eax
test esi, esi
je 0x1007e40f
jmp 0x1006058d
Function at 0x100605a0
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x100fbfe0
push 0x1005ccd0
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x1010e2b0]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
fstp xword [ebp - 0x28]
mov edi, dword [0x1010e2c4]
mov eax, dword [0x1010f3b8]
mov esi, dword [0x1010e2b0]
mov ecx, esi
and ecx, 0x1f
xor esi, eax
ror esi, cl
cmp esi, 0xffffffff
je 0x1007e770
test esi, esi
je 0x1007e744
push 1
push edi
mov ecx, esi
call dword [0x10110268]
call esi
wait
mov dword [ebp - 4], 0
fld xword [ebp - 0x28]
call sym.ucrtbase.dll__CIsin
fstp xword [ebp - 0x28]
wait
mov dword [ebp - 4], 0xfffffffe
call fcn.1006064f
fld xword [ebp - 0x28]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.1005cc20
mov esp, ebp
pop ebp
ret
mov esi, 0x10006a9c
mov ecx, dword [esi]
call fcn.10032fe0
test eax, eax
jne 0x1007e77e
add esi, 4
cmp esi, 0x10006aa4
jne 0x1007e749
push 0xffffffffffffffff
call fcn.10032d19
add esp, 4
mov ecx, 0x1010f3b8
xchg dword [ecx], eax
push 1
push edi
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsSetValue]
jmp 0x10060610
push 0x10006b48
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_1_0.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x1007e75f
push esi
call fcn.10032d19
add esp, 4
mov ecx, 0x1010f3b8
xchg dword [ecx], eax
test esi, esi
je 0x1007e770
jmp 0x10060603

Function at 0x1006064f
Capabilities:
Set thread local storage value

Disassembly:
mov edi, dword [0x1010e2c4]
mov esi, dword [0x1010f3b8]
mov ecx, dword [0x1010e2b0]
and ecx, 0x1f
xor esi, dword [0x1010e2b0]
ror esi, cl
cmp esi, 0xffffffff
je 0x1007e7da
test esi, esi
je 0x1007e7ae
push 0
push edi
mov ecx, esi
call dword [0x10110268]
call esi
ret
mov esi, 0x10006a9c
mov ecx, dword [esi]
call fcn.10032fe0
test eax, eax
jne 0x1007e7e4
add esi, 4
cmp esi, 0x10006aa4
jne 0x1007e7b3
push 0xffffffffffffffff
call fcn.10032d19
add esp, 4
mov ecx, 0x1010f3b8
xchg dword [ecx], eax
push 0
push edi
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsSetValue]
ret
push 0x10006b48
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_1_0.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x1007e7c9
push esi
call fcn.10032d19
add esp, 4
mov ecx, 0x1010f3b8
xchg dword [ecx], eax
test esi, esi
je 0x1007e7da
jmp 0x1006067d
Function at 0x10060690
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x100fc000
push 0x1005ccd0
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x1010e2b0]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
fstp xword [ebp - 0x28]
mov edi, dword [0x1010e2c4]
mov eax, dword [0x1010f3b8]
mov esi, dword [0x1010e2b0]
mov ecx, esi
and ecx, 0x1f
xor esi, eax
ror esi, cl
cmp esi, 0xffffffff
je 0x1007e83b
test esi, esi
je 0x1007e80f
push 1
push edi
mov ecx, esi
call dword [0x10110268]
call esi
wait
mov dword [ebp - 4], 0
fld xword [ebp - 0x28]
call sym.ucrtbase.dll__CIcos
fstp xword [ebp - 0x28]
wait
mov dword [ebp - 4], 0xfffffffe
call fcn.1006073f
fld xword [ebp - 0x28]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.1005cc20
mov esp, ebp
pop ebp
ret
mov esi, 0x10006a9c
mov ecx, dword [esi]
call fcn.10032fe0
test eax, eax
jne 0x1007e849
add esi, 4
cmp esi, 0x10006aa4
jne 0x1007e814
push 0xffffffffffffffff
call fcn.10032d19
add esp, 4
mov ecx, 0x1010f3b8
xchg dword [ecx], eax
push 1
push edi
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsSetValue]
jmp 0x10060700
push 0x10006b48
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_1_0.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x1007e82a
push esi
call fcn.10032d19
add esp, 4
mov ecx, 0x1010f3b8
xchg dword [ecx], eax
test esi, esi
je 0x1007e83b
jmp 0x100606f3

Function at 0x1006073f
Capabilities:
Set thread local storage value

Disassembly:
mov edi, dword [0x1010e2c4]
mov esi, dword [0x1010f3b8]
mov ecx, dword [0x1010e2b0]
and ecx, 0x1f
xor esi, dword [0x1010e2b0]
ror esi, cl
cmp esi, 0xffffffff
je 0x1007e8a5
test esi, esi
je 0x1007e879
push 0
push edi
mov ecx, esi
call dword [0x10110268]
call esi
ret
mov esi, 0x10006a9c
mov ecx, dword [esi]
call fcn.10032fe0
test eax, eax
jne 0x1007e8af
add esi, 4
cmp esi, 0x10006aa4
jne 0x1007e87e
push 0xffffffffffffffff
call fcn.10032d19
add esp, 4
mov ecx, 0x1010f3b8
xchg dword [ecx], eax
push 0
push edi
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsSetValue]
ret
push 0x10006b48
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_1_0.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x1007e894
push esi
call fcn.10032d19
add esp, 4
mov ecx, 0x1010f3b8
xchg dword [ecx], eax
test esi, esi
je 0x1007e8a5
jmp 0x1006076d
Function at 0x10060780
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x100fc060
push 0x1005ccd0
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x1010e2b0]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
fstp xword [ebp - 0x28]
mov edi, dword [0x1010e2c4]
mov eax, dword [0x1010f3b8]
mov esi, dword [0x1010e2b0]
mov ecx, esi
and ecx, 0x1f
xor esi, eax
ror esi, cl
cmp esi, 0xffffffff
je 0x1007e983
test esi, esi
je 0x1007e957
push 1
push edi
mov ecx, esi
call dword [0x10110268]
call esi
wait
mov dword [ebp - 4], 0
fld xword [ebp - 0x28]
call sym.ucrtbase.dll__CIexp
fstp xword [ebp - 0x28]
wait
mov dword [ebp - 4], 0xfffffffe
call fcn.1006082f
fld xword [ebp - 0x28]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.1005cc20
mov esp, ebp
pop ebp
ret
mov esi, 0x10006a9c
mov ecx, dword [esi]
call fcn.10032fe0
test eax, eax
jne 0x1007e991
add esi, 4
cmp esi, 0x10006aa4
jne 0x1007e95c
push 0xffffffffffffffff
call fcn.10032d19
add esp, 4
mov ecx, 0x1010f3b8
xchg dword [ecx], eax
push 1
push edi
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsSetValue]
jmp 0x100607f0
push 0x10006b48
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_1_0.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x1007e972
push esi
call fcn.10032d19
add esp, 4
mov ecx, 0x1010f3b8
xchg dword [ecx], eax
test esi, esi
je 0x1007e983
jmp 0x100607e3

Function at 0x1006082f
Capabilities:
Set thread local storage value

Disassembly:
mov edi, dword [0x1010e2c4]
mov esi, dword [0x1010f3b8]
mov ecx, dword [0x1010e2b0]
and ecx, 0x1f
xor esi, dword [0x1010e2b0]
ror esi, cl
cmp esi, 0xffffffff
je 0x1007e9ed
test esi, esi
je 0x1007e9c1
push 0
push edi
mov ecx, esi
call dword [0x10110268]
call esi
ret
mov esi, 0x10006a9c
mov ecx, dword [esi]
call fcn.10032fe0
test eax, eax
jne 0x1007e9f7
add esi, 4
cmp esi, 0x10006aa4
jne 0x1007e9c6
push 0xffffffffffffffff
call fcn.10032d19
add esp, 4
mov ecx, 0x1010f3b8
xchg dword [ecx], eax
push 0
push edi
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsSetValue]
ret
push 0x10006b48
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_1_0.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x1007e9dc
push esi
call fcn.10032d19
add esp, 4
mov ecx, 0x1010f3b8
xchg dword [ecx], eax
test esi, esi
je 0x1007e9ed
jmp 0x1006085d

Function at 0x1006112c
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x10061167
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x1006114e
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x1006115f
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x10061169
inc edi
add eax, 0x28
cmp edi, esi
jb 0x10061144
xor eax, eax
pop edi
pop esi
ret