joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001a33f
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
mov ecx, dword [eax + 0x3c]
add ecx, eax
push esi
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
xor edx, edx
add eax, ecx
push edi
test ebx, ebx
je 0x1001a380
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x1001a378
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jae 0x1001a378
pop edi
pop esi
pop ebx
pop ebp
ret
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x1001a363
xor eax, eax
jmp 0x1001a373

Function at 0x1001a434
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1005d021
mov ecx, dword [eax + 0x3c]
add ecx, eax
xor eax, eax
cmp dword [ecx], 0x4550
jne 0x1001a463
mov edx, 0x10b
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x10022cc8
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov edi, 0x811c9dc5
xor esi, esi
movzx eax, byte [esi + ecx]
xor edi, eax
imul edi, edi, 0x1000193
inc esi
cmp esi, 4
jb 0x10022cd4
mov eax, edi
xor edx, edx
div ebx
pop edi
pop esi
pop ebx
mov eax, edx
ret
Function at 0x10024418
Capabilities:
Allocate thread local storage

Disassembly:
push 0x24
mov eax, 0x100c5331
call fcn.1001517a
mov ebx, ecx
mov dword [ebp - 0x14], ebx
push dword [0x100c9590]
xor esi, esi
mov dword [ebx], 0x10024e98
lea eax, [ebx + 0x2c]
mov dword [ebx + 4], esi
mov dword [ebx + 8], esi
mov dword [ebx + 0xc], 0x10
mov dword [ebx + 0x10], esi
mov dword [ebx + 0x24], esi
push eax
mov dword [ebx + 0x28], esi
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
jmp 0x1004e3e4
mov cl, 1
mov byte [ebp - 4], 2
call fcn.10023b65
mov ecx, ebx
call fcn.100235ac
jmp 0x1004e45e
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [ebx + 0x50], eax
mov eax, dword [ebx + 0xc]
xor ecx, ecx
mul esi
seto cl
neg ecx
or ecx, eax
push ecx
call sym.MSVCR110.dll_void____cdecl_operator_new___unsigned_int_
mov dword [ebx + 0x54], eax
pop ecx
mov eax, ebx
call fcn.100151ad
ret
mov dword [ebp - 4], esi
push dword [0x100c9590]
mov dword [ebx + 0x44], esi
mov dword [ebx + 0x48], esi
mov dword [ebx + 0x4c], esi
mov dword [ebx + 0x50], esi
mov dword [ebx + 0x54], esi
mov dword [ebx + 0x58], esi
mov dword [ebx + 0x5c], esi
mov dword [ebx + 0x60], esi
mov dword [ebx + 0x64], esi
lea esi, [ebx + 0x68]
mov dword [ebp - 0x10], esi
and dword [esi], 0
and dword [esi + 4], 0
lea eax, [esi + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [esi + 8], eax
cmp eax, 0xffffffff
jne 0x1002445c
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x1004e447
movzx eax, ax
or eax, 0x80070000
push eax
lea ecx, [ebp - 0x30]
call sym.MSVCR110.dll_public:_void___thiscall_Concurrency::scheduler_resource_allocation_error::constructor_long_int_
push 0x100c6790
lea eax, [ebp - 0x30]
push eax
call sym.MSVCR110.dll__CxxThrowException
cmp dword [0x100c9900], 3
push 4
pop esi
jl 0x1004e477
xor eax, eax
mov dword [ebx + 0x8c], eax
jmp 0x10024473
push esi
push 0x3000
push 0x1000
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebx + 0x8c], eax
test eax, eax
jne 0x1004e4ba
push 1
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x10], 0x100151c4
call sym.MSVCR110.dll_public:_void___thiscall_std::exception::constructor_char_const__const_const___int_
mov dword [ebp - 0x20], 0x10027638
push 0x10027448
lea eax, [ebp - 0x20]
jmp 0x1004e458
mov byte [eax], 1
xor eax, eax
jmp 0x10024473

Function at 0x10024576
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x100c9920], eax
cmp eax, 0xffffffff
je 0x1004fd00
leave
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x1004fd12
movzx eax, ax
or eax, 0x80070000
push eax
lea ecx, [ebp - 0x10]
call sym.MSVCR110.dll_public:_void___thiscall_Concurrency::scheduler_resource_allocation_error::constructor_long_int_
push 0x100c6790
lea eax, [ebp - 0x10]
push eax
call sym.MSVCR110.dll__CxxThrowException
int3
Function at 0x10024592
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10
call fcn.10022a6e
xor ecx, ecx
inc ecx
cmp ecx, eax
sbb eax, eax
and eax, 0xfa0
mov dword [0x100c9590], eax
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x100c8d6c], eax
cmp eax, 0xffffffff
je 0x1004f234
call fcn.10024576
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x1004f246
movzx eax, ax
or eax, 0x80070000
push eax
lea ecx, [esp + 4]
call sym.MSVCR110.dll_public:_void___thiscall_Concurrency::scheduler_resource_allocation_error::constructor_long_int_
push 0x100c6790
lea eax, [esp + 4]
push eax
call sym.MSVCR110.dll__CxxThrowException
int3

Function at 0x10024cf0
Capabilities:
Set thread local storage value

Disassembly:
push dword [ebp + 8]
mov ecx, esi
call fcn.10024289
mov esi, eax
push esi
push dword [0x100c8d6c]
mov dword [esi + 0x24], edi
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop edi
mov eax, esi
pop esi
leave
ret 4
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
mov esi, ecx
call fcn.10024ce3
mov edi, eax
test edi, edi
je 0x1004f48a
jmp 0x1004f46e
stosb byte es:[edi], al
pop eax
cmp dword [edi + 0x1c], esi
je 0x1004f4a3
cmp byte [edi + 0x4c], 0
jne 0x10030b67
lea ecx, [edi - 4]
call fcn.10068c92
jmp 0x10030b67
xor ecx, ecx
lea eax, [esi + 0x184]
inc ecx
lock xadd dword [eax], ecx
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x10]
jmp 0x10024311
lea ecx, [ebp - 0xc]
call sym.MSVCR110.dll_public:_void___thiscall_std::exception::constructor_void_
push 0x100c6844
lea eax, [ebp - 0xc]
push eax
mov dword [ebp - 0xc], 0x10061ec4
call sym.MSVCR110.dll__CxxThrowException
int3
Function at 0x10026890
Capabilities:
Get common file path
Set current directory
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x100c87c8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
and dword [ebp - 0x21c], 0
push ebx
or ebx, 0xffffffff
push esi
lea esi, [ebp - 0x218]
test eax, eax
je 0x10050ad6
push edi
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
je 0x1002695a
lea eax, [ebp - 0x218]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov edi, eax
cmp edi, 0x104
jg 0x10050af3
test edi, edi
je 0x1002695a
movzx eax, word [esi]
cmp eax, 0x5c
je 0x10026952
cmp eax, 0x2f
je 0x10026952
push 0x3d
pop eax
mov word [ebp - 0xc], ax
movzx eax, word [esi]
push eax
call sym.MSVCR110.dll_towupper
pop ecx
push 0x3a
mov word [ebp - 0xa], ax
pop eax
mov word [ebp - 8], ax
xor eax, eax
mov word [ebp - 6], ax
push esi
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
test eax, eax
je 0x1002695a
xor ebx, ebx
cmp dword [ebp - 0x21c], 0
pop edi
jne 0x10050b3a
mov ecx, dword [ebp - 4]
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.10011bae
leave
ret
cmp ax, word [esi + 2]
je 0x10026932
jmp 0x10026901
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x10050b2e
call sym.MSVCR110.dll___doserrno
and dword [eax], 0
call sym.MSVCR110.dll__errno
mov dword [eax], 0x16
call sym.MSVCR110.dll__invalid_parameter_noinfo
jmp 0x10026942
lea eax, [edi + 1]
push 2
push eax
call sym.MSVCR110.dll__calloc_crt
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x1002695a
mov dword [ebp - 0x21c], 1
test edi, edi
je 0x1002695a
push esi
lea eax, [edi + 1]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov edi, eax
jmp 0x100268f0
push eax
call sym.MSVCR110.dll__dosmaperr
pop ecx
jmp 0x10026934
push esi
call sym.MSVCR110.dll_free
pop ecx
jmp 0x10026942

Function at 0x10027b6a
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov edi, eax
xor eax, eax
test edi, edi
je 0x10027be2
push esi
mov esi, edi
cmp word [edi], ax
je 0x10027b95
add esi, 2
cmp word [esi], ax
jne 0x10027b85
add esi, 2
cmp word [esi], ax
jne 0x10027b85
push ebx
push eax
push eax
push eax
sub esi, edi
push eax
sar esi, 1
inc esi
push esi
push edi
push eax
push eax
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 4], eax
test eax, eax
je 0x10027be5
push eax
call sym.MSVCR110.dll__malloc_crt
mov ebx, eax
pop ecx
test ebx, ebx
je 0x10027be5
xor eax, eax
push eax
push eax
push dword [ebp - 4]
push ebx
push esi
push edi
push eax
push eax
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
je 0x1005bcc8
push edi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop ebx
pop esi
pop edi
leave
ret
push edi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x1005bcd6
push ebx
call sym.MSVCR110.dll_free
pop ecx
xor ebx, ebx
jmp 0x10027bd7
xor eax, eax
jmp 0x10027be0
Function at 0x10029221
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push edi
cmp dword [0x100c87cc], 1
jb 0x10031829
mov edi, dword [ebp + 8]
ja 0x100317a8
movzx edx, byte [ebp + 0xc]
mov eax, edx
shl edx, 8
or edx, eax
movd xmm3, edx
pshuflw xmm3, xmm3, 0
movlhps xmm3, xmm3
mov ecx, 0xf
and ecx, edi
or eax, 0xffffffff
shl eax, cl
sub edi, ecx
xor edx, edx
movdqu xmm1, xmmword [edi]
pxor xmm2, xmm2
pcmpeqb xmm2, xmm1
pcmpeqb xmm1, xmm3
pmovmskb ecx, xmm2
and ecx, eax
jne 0x10029292
pmovmskb ecx, xmm1
and ecx, eax
bsr eax, ecx
add eax, edi
test ecx, ecx
cmovne edx, eax
or eax, 0xffffffff
add edi, 0x10
jmp 0x10029262
push ebx
pmovmskb ebx, xmm1
and ebx, eax
shl ecx, 1
xor eax, eax
sub eax, ecx
and ecx, eax
dec ecx
and ecx, ebx
pop ebx
bsr eax, ecx
add eax, edi
test ecx, ecx
cmove eax, edx
pop edi
leave
ret
add dword [eax], eax
add byte [ebp - 0x3337b], cl
call dword [eax + 0x6a]
add bh, bh
xchg ebp, eax
enter 0xfffffffffffffffa, 0xffffffffffffffff
das
Function at 0x1002f213
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0x10]
push edi
xor edi, edi
test ebx, ebx
je 0x10050421
push esi
push 0x3bc
push 1
call sym.MSVCR110.dll__calloc_crt
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x10050440
call sym.MSVCR110.dll__getptd
push dword [eax + 0x6c]
push esi
call sym.MSVCR110.dll__initptd
mov eax, dword [ebp + 0x14]
or dword [esi + 4], 0xffffffff
mov dword [esi + 0x58], eax
mov eax, dword [ebp + 0x1c]
pop ecx
pop ecx
mov dword [esi + 0x54], ebx
test eax, eax
jne 0x1002f265
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0x18]
push esi
push 0x1002f28e
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x10050438
pop esi
pop edi
pop ebx
pop ebp
ret
call sym.MSVCR110.dll__errno
mov dword [eax], 0x16
call sym.MSVCR110.dll__invalid_parameter_noinfo
xor eax, eax
jmp 0x1002f284
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push esi
call sym.MSVCR110.dll_free
pop ecx
test edi, edi
je 0x10050452
push edi
call sym.MSVCR110.dll__dosmaperr
pop ecx
xor eax, eax
jmp 0x1002f283

Function at 0x10030945
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x10030980
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x10030967
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x10030978
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x10030982
inc edi
add eax, 0x28
cmp edi, esi
jb 0x1003095d
xor eax, eax
pop edi
pop esi
ret

Function at 0x10030c00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.10030905
mov esi, 0x8d51da8d
inc ebp
rcl byte [eax - 0x18], 0xc5
cld
invalid
Function at 0x10030fa8
Capabilities:
Inspect section memory permissions

Disassembly:
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
mov eax, esi
pop esi
ret
push esi
call fcn.1000e560
mov esi, eax
test esi, esi
je 0x1005055b
mov eax, esi
pop esi
ret
cmp dword [eax], ebx
je 0x10030fb9
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x10030fb4
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x10030f9e
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
xor al, 3
into
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x10030fa6
cmp edx, ebx
jne 0x100310f4
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x10030f75
add eax, dword [eax + 4]
jmp 0x10030f62
mov dword [ebp + 0xc], ebx
jmp 0x10030fc4
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x10030fdc
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x10030ffa
movzx eax, ax
lea eax, [eax + eax*4]
invalid
invalid

Function at 0x100311db
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add byte [edx + 0x40], ch
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
mov byte [ebp - 0x3b6], 0xf
mov byte [ebp - 0x3b5], 0xa
mov byte [ebp - 0x3b4], 3
test dword [esp + edi*8 - 1], ecx
inc dword [ebx]
Function at 0x10031852
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test dword [ecx + 0x30fffffc], ebx
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
invalid
invalid
invalid
cld
invalid

Function at 0x10032ad6
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edi, eax
mov eax, dword [edi + 0x3c]
mov edx, dword [edi + eax + 0x78]
add edx, edi
mov ecx, dword [edx + 0x18]
mov ebx, dword [edx + 0x20]
add ebx, edi
call fcn.10030905
push esi
push esp
push 0x348b494f
mov eax, dword [ebx]
idiv dword [eax + 0x50746547]
dec ecx
mov esi, dword [ebx + ecx*4]
add esi, edi
mov eax, 0x50746547
cmp dword [esi], eax
jne 0x10032af2
mov eax, 0x41636f72
cmp dword [esi + 4], eax
jne 0x10032af2
call fcn.10030905
add bh, bl
lds edi, [ebx + ecx*4 - 0x20fcdba6]
mov cx, word [ebx + ecx*2]
mov ebx, dword [edx + 0x1c]
add ebx, edi
mov eax, dword [ebx + ecx*4]
add eax, edi
push eax
call fcn.10030905
movsb byte es:[edi], byte cs:[esi]
inc esi
loope 0x10032b31
cmc
invalid
push dword [ebp + 8]
jne 0x10032b3c
push dword [ebp + 4]
push dword [ebp]
call fcn.10031105
push ss
in eax, 0xff
call dword [esi]
and eax, 0x80000000
je 0x10032b0c
fstp st(0)
fld xword [0x10060320]
mov eax, 1
jmp 0x10032b78
cmp dword [0x100ccc40], 0
jne 0x10042581
lea ecx, str.log10
mov edx, 0x1b
call fcn.1004249c
pop edx
ret
Function at 0x10044b0d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
pextrw eax, xmm0, 3
and ax, 0x7fff
sub ax, 0x3030
cmp ax, 0x10c5
ja 0x10044c66
movlpd xmm1, qword [0x100454e0]
mulsd xmm1, xmm0
movlpd xmm2, qword [0x100454e8]
cvtsd2si edx, xmm1
addsd xmm1, xmm2
movlpd xmm3, qword [0x10045500]
subsd xmm1, xmm2
movapd xmm2, xmmword [0x100454f0]
mulsd xmm3, xmm1
unpcklpd xmm1, xmm1
add edx, 0x1c7610
movsd xmm4, xmm0
and edx, 0x3f
movapd xmm5, xmmword [0x100454d0]
lea eax, [0x10044ca0]
shl edx, 5
add eax, edx
mulpd xmm2, xmm1
subsd xmm0, xmm3
mulsd xmm1, qword [0x10045508]
subsd xmm4, xmm3
movlpd xmm7, qword [eax + 8]
unpcklpd xmm0, xmm0
movsd xmm3, xmm4
subsd xmm4, xmm2
mulpd xmm5, xmm0
subpd xmm0, xmm2
movapd xmm6, xmmword [0x100454b0]
mulsd xmm7, xmm4
subsd xmm3, xmm4
mulpd xmm5, xmm0
mulpd xmm0, xmm0
subsd xmm3, xmm2
movapd xmm2, xmmword [eax]
subsd xmm1, xmm3
movlpd xmm3, qword [eax + 0x18]
addsd xmm2, xmm3
subsd xmm7, xmm2
mulsd xmm2, xmm4
mulpd xmm6, xmm0
mulsd xmm3, xmm4
mulpd xmm2, xmm0
mulpd xmm0, xmm0
addpd xmm5, xmmword [0x100454c0]
mulsd xmm4, qword [eax]
addpd xmm6, xmmword [0x100454a0]
mulpd xmm5, xmm0
movsd xmm0, xmm3
addsd xmm3, qword [eax + 8]
mulsd xmm1, xmm7
movsd xmm7, xmm4
addsd xmm4, xmm3
addpd xmm6, xmm5
movlpd xmm5, qword [eax + 8]
subsd xmm5, xmm3
subsd xmm3, xmm4
addsd xmm1, qword [eax + 0x10]
mulpd xmm6, xmm2
addsd xmm5, xmm0
addsd xmm3, xmm7
addsd xmm1, xmm5
addsd xmm1, xmm3
addsd xmm1, xmm6
unpckhpd xmm6, xmm6
addsd xmm1, xmm6
sub esp, 0x10
addsd xmm4, xmm1
movlpd qword [esp + 4], xmm4
fld qword [esp + 4]
add esp, 0x10
ret
jg fcn.10032775
pextrw eax, xmm0, 3
and ax, 0x7fff
pinsrw xmm0, eax, 3
sub esp, 0x10
movlpd xmm1, qword [0x10045510]
subsd xmm1, xmm0
movlpd qword [esp + 4], xmm1
fld qword [esp + 4]
add esp, 0x10
ret
Function at 0x10066225
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x100c4ed0
mov eax, dword fs:[0]
push eax
sub esp, 0x48
push esi
mov eax, dword [0x100c87c8]
xor eax, esp
push eax
lea eax, [esp + 0x50]
mov dword fs:[0], eax
mov esi, ecx
push 0
lea ecx, [esp + 0x28]
call fcn.10066004
lea eax, [esi + 4]
push eax
lea ecx, [esp + 0xc]
call sym.MSVCR110.dll_public:_void___thiscall_Concurrency::critical_section::scoped_lock::constructor_class_Concurrency::critical_section__
and dword [esp + 0x58], 0
mov ecx, dword [esi]
mov dl, 1
call fcn.10066f91
mov ecx, dword [ebp + 8]
mov dword [esp + 0x30], eax
lea eax, [esp + 0x30]
mov dword [esi], eax
call sym.MSVCR110.dll_public:_void___thiscall_Concurrency::critical_section::unlock_void_
or dword [esp + 0x58], 0xffffffff
mov ecx, dword [esp + 8]
call sym.MSVCR110.dll_public:_void___thiscall_Concurrency::critical_section::unlock_void_
call sym.MSVCR110.dll_public:_static_void___cdecl_Concurrency::Context::Block_void_
mov ecx, dword [ebp + 8]
call sym.MSVCR110.dll_public:_void___thiscall_Concurrency::critical_section::lock_void_
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x10067630
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x100c87c8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
mov edx, dword [ebx + 0x30]
lea eax, [edx + 1]
mov dword [ebx + 0x30], eax
test edx, edx
jne 0x10067708
cmp dword [ebx + 0x1c], edx
mov ecx, dword [ebx + 0x14]
setne al
push esi
mov byte [ebp - 0x1d], al
cmp dword [ebx + 0x18], edx
jne 0x100676e0
test al, al
sete al
movzx eax, al
push eax
push dword [ebx + 0x28]
push dword [ebx + 0x24]
call fcn.10070a52
cmp byte [ebp - 0x1d], 0
jne 0x100676ec
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov esi, eax
push esi
lea ecx, [ebp - 0x1c]
call fcn.1006a83e
mov cx, word [eax + 4]
mov word [ebx + 0xc], cx
mov ecx, dword [eax]
mov dword [ebx + 8], ecx
mov ecx, dword [ebx + 0x24]
mov eax, dword [ebx + 0x14]
imul ecx, ecx, 0x34
mov eax, dword [eax + 0x10]
lea edi, [ebp - 0x10]
mov edx, dword [eax + ecx]
movzx ecx, word [ecx + eax + 0xc]
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov word [ebp - 0xc], cx
push esi
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x10], edx
call fcn.1006a892
mov ecx, dword [ebx + 0x14]
push ebx
call fcn.10071024
mov ecx, dword [ebx + 0x14]
push ebx
call fcn.10070c5f
pop edi
jmp 0x100676ec
push ebx
add ecx, 0xc4
call fcn.100225de
mov eax, dword [ebx + 0x14]
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0x70]
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push ebx
push esi
mov dword [ebx + 0x20], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.10011bae
leave
ret
Function at 0x10067715
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ebx
push esi
mov esi, ecx
dec dword [esi + 0x30]
jne 0x100677ab
mov eax, dword [esi + 0x14]
push dword [esi + 0x20]
mov eax, dword [eax + 0xc]
cmp dword [esi + 0x1c], 0
push dword [eax + 0x70]
setne bl
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [esi + 0x18]
and dword [esi + 0x20], 0
test ecx, ecx
jne 0x1006778a
mov ecx, dword [esi + 0x14]
test bl, bl
sete al
movzx eax, al
push eax
push dword [esi + 0x28]
push dword [esi + 0x24]
call fcn.10070ad4
test bl, bl
jne 0x100677ab
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
lea ecx, [esi + 8]
call fcn.1006a892
mov ecx, dword [esi + 0x14]
push esi
call fcn.10071080
mov ecx, dword [esi + 0x14]
push esi
call fcn.10070f97
jmp 0x100677ab
call fcn.10067715
mov ecx, dword [esi + 0x14]
push esi
add ecx, 0xc4
call fcn.10071282
push esi
mov dword [esi], 0x10025190
call sym.MSVCR110.dll_free
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1006a8c7
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov ebx, ecx
call sym.MSVCR110.dll_enum_Concurrency::IResourceManager::OSVersion___cdecl_Concurrency::GetOSVersion_void_
cmp eax, 4
jl 0x1006a939
mov eax, dword [0x100c92f4]
xor eax, dword [0x100ccc6c]
lea ecx, [ebp - 4]
push ecx
call eax
movzx ecx, byte [ebp - 2]
movzx esi, word [ebp - 4]
xor eax, eax
inc eax
shl eax, cl
mov dword [ebp - 8], ecx
mov ecx, dword [ebx + 0x48]
xor edx, edx
mov dword [ebp - 0xc], eax
cmp dword [ecx + 0xc], esi
jne 0x1006a933
test dword [ecx], eax
je 0x1006a933
xor edi, edi
cmp dword [ecx + 4], edi
jbe 0x1006a933
mov esi, dword [ecx + 0x20]
add esi, 8
movzx eax, byte [esi]
cmp eax, dword [ebp - 8]
je 0x1006a99c
inc edi
add esi, 0x24
cmp edi, dword [ecx + 4]
jb 0x1006a91b
mov eax, dword [ebp - 0xc]
movzx esi, word [ebp - 4]
inc edx
add ecx, 0x28
jmp 0x1006a905
call sym.MSVCR110.dll_enum_Concurrency::IResourceManager::OSVersion___cdecl_Concurrency::GetOSVersion_void_
cmp eax, 2
je 0x1006a95a
call sym.MSVCR110.dll_enum_Concurrency::IResourceManager::OSVersion___cdecl_Concurrency::GetOSVersion_void_
cmp eax, 3
je 0x1006a95a
cmp dword [0x100c9900], 1
jne 0x1006a9a5
xor eax, eax
jmp 0x1006a99e
call fcn.1009fb25
mov ecx, eax
xor eax, eax
inc eax
shl eax, cl
mov dword [ebp - 0xc], ecx
mov ecx, dword [ebx + 0x48]
xor edx, edx
mov dword [ebp - 8], eax
test dword [ecx], eax
je 0x1006a996
xor edi, edi
cmp dword [ecx + 4], edi
jbe 0x1006a996
mov esi, dword [ecx + 0x20]
add esi, 8
movzx eax, byte [esi]
cmp eax, dword [ebp - 0xc]
je 0x1006a99c
inc edi
add esi, 0x24
cmp edi, dword [ecx + 4]
jb 0x1006a982
mov eax, dword [ebp - 8]
inc edx
add ecx, 0x28
jmp 0x1006a971
mov eax, edx
pop edi
pop esi
pop ebx
leave
ret 4
lea ecx, [ebp - 0x18]
call sym.MSVCR110.dll_public:_void___thiscall_std::exception::constructor_void_
push 0x100c6828
lea eax, [ebp - 0x18]
push eax
mov dword [ebp - 0x18], 0x10062044
call sym.MSVCR110.dll__CxxThrowException
int3