joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10008af0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x10111040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
lea edx, [ebp - 8]
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov esi, 4
mov eax, dword [edi + 0xe4]
mov ebx, dword [edi + 0xec]
mov ebx, dword [ebx + eax*4 - 4]
not ebx
nop dword [eax + eax]
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x100f4090]
sub esi, 1
jne 0x10008b30
mov eax, dword [edi]
not ebx
cmp dword [eax + 0x3e94], ebx
jne 0x10008b67
push ecx
push dword [ebp - 0xc]
lea edx, [esi + 0xc]
mov ecx, ebx
call fcn.10025610
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10093c50
mov esp, ebp
pop ebp
ret 4

Function at 0x10008b80
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x10111040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
lea edx, [ebp - 8]
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov esi, 4
mov eax, dword [edi + 0xe4]
mov ebx, dword [edi + 0xec]
mov ebx, dword [ebx + eax*4 - 4]
not ebx
nop dword [eax + eax]
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x100f4090]
sub esi, 1
jne 0x10008bc0
mov eax, dword [edi]
not ebx
cmp dword [eax + 0x3e94], ebx
jne 0x10008bf7
push ecx
push dword [ebp - 0xc]
lea edx, [esi + 4]
mov ecx, ebx
call fcn.10025610
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10093c50
mov esp, ebp
pop ebp
ret 4

Function at 0x10008c10
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x10111040]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov edx, ecx
push esi
push edi
lea esi, [ebp - 0x18]
mov edi, 0x10
movss xmm1, dword [edx + 0x100]
movss xmm0, dword [eax]
movss xmm2, dword [edx + 0x104]
subss xmm0, xmm1
mov ecx, dword [edx + 0xe4]
movss dword [ebp - 0x18], xmm0
movss xmm0, dword [eax + 4]
subss xmm0, xmm2
movss dword [ebp - 0x14], xmm0
movss xmm0, dword [eax + 8]
subss xmm0, xmm1
movss dword [ebp - 0x10], xmm0
movss xmm0, dword [eax + 0xc]
mov eax, dword [edx + 0xec]
subss xmm0, xmm2
mov edx, dword [eax + ecx*4 - 4]
movss dword [ebp - 0xc], xmm0
not edx
nop dword [eax + eax]
movzx eax, byte [esi]
lea esi, [esi + 1]
movzx ecx, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x100f4090]
sub edi, 1
jne 0x10008c90
mov ecx, dword [ebp - 8]
not edx
pop edi
xor ecx, ebp
mov eax, edx
pop esi
call fcn.10093c50
mov esp, ebp
pop ebp
ret 4
Function at 0x1000ade0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [0x10117114]
mov ebx, edx
push edi
mov edi, ecx
mov dword [ebp - 0xc], edi
mov eax, dword [esi + 0x47ec]
mov edx, dword [eax]
inc dword [esi + 0xa8]
mov ecx, dword [edi + 0x264]
mov dword [ebp - 4], edx
cmp dword [ecx + 0x7c], 1
jle 0x1000ae1f
push ecx
add ecx, 0x78
call fcn.1005c8d0
mov edx, dword [ebp - 4]
mov edi, dword [edi + 0x264]
mov esi, dword [edx + ebx*4 + 0x70]
mov eax, dword [edi]
test eax, eax
je 0x1000ae92
cmp eax, 1
jne 0x1000ae43
mov eax, dword [edi + 8]
cmp dword [eax + 0x1c], 0
jne 0x1000ae43
cmp dword [eax + 0x20], 0
je 0x1000ae92
mov eax, dword [esi]
mov ecx, dword [esi + 4]
cmp eax, ecx
jne 0x1000ae79
lea edx, [eax + 1]
mov dword [ebp - 8], edx
test ecx, ecx
je 0x1000ae64
mov eax, ecx
cdq
sub eax, edx
mov edx, dword [ebp - 8]
sar eax, 1
add eax, ecx
jmp 0x1000ae69
mov eax, 8
cmp eax, edx
mov ecx, esi
cmovg edx, eax
push edx
call fcn.100265b0
mov edx, dword [ebp - 4]
mov ecx, dword [esi]
mov eax, dword [esi + 8]
mov dword [eax + ecx*4], edi
inc dword [esi]
inc dword [edx + 0x3c]
mov eax, dword [edi + 0x18]
add dword [edx + 0x44], eax
mov eax, dword [edi + 0xc]
add dword [edx + 0x40], eax
mov eax, dword [ebp - 0xc]
mov esi, dword [eax + 0x188]
mov eax, dword [eax + 0x180]
lea edi, [esi + eax*4]
cmp esi, edi
je 0x1000aed2
nop dword [eax + eax]
mov ecx, dword [esi]
cmp byte [ecx + 0xaa], 0
je 0x1000aecb
cmp byte [ecx + 0xb1], 0
jne 0x1000aecb
mov edx, ebx
call fcn.1000ade0
add esi, 4
cmp esi, edi
jne 0x1000aeb0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000c910
Capabilities:
Hash data with crc32

Disassembly:
mov eax, ecx
or ecx, 0xffffffff
push ebx
push esi
mov bl, byte [eax]
lea esi, [eax + 1]
test bl, bl
je 0x1000c94d
push edi
or edi, 0xffffffff
cmp bl, 0x23
jne 0x1000c933
cmp byte [esi], bl
jne 0x1000c933
cmp byte [esi + 1], bl
cmove ecx, edi
movzx edx, cl
movzx eax, bl
mov bl, byte [esi]
xor edx, eax
shr ecx, 8
inc esi
xor ecx, dword [edx*4 + 0x100f4090]
test bl, bl
jne 0x1000c924
pop edi
pop esi
not ecx
pop ebx
jmp fcn.1000c8b0
Function at 0x1001c0f0
Capabilities:
Hash data with crc32

Disassembly:
push ebx
mov bl, byte [ecx]
or eax, 0xffffffff
push esi
lea esi, [ecx + 1]
push edi
mov edi, dword [0x10117114]
test bl, bl
je 0x1001c136
or edi, 0xffffffff
cmp bl, 0x23
jne 0x1001c117
cmp byte [esi], bl
jne 0x1001c117
cmp byte [esi + 1], bl
cmove eax, edi
movzx edx, al
movzx ecx, bl
mov bl, byte [esi]
xor edx, ecx
shr eax, 8
inc esi
xor eax, dword [edx*4 + 0x100f4090]
test bl, bl
jne 0x1001c108
mov edi, dword [0x10117114]
mov ecx, dword [edi + 0x5a8c]
not eax
mov edx, dword [edi + 0x5a94]
pop edi
pop esi
lea ecx, [ecx + ecx*8]
lea ecx, [edx + ecx*4]
pop ebx
cmp edx, ecx
je 0x1001c15d
cmp dword [edx + 4], eax
je 0x1001c160
add edx, 0x24
cmp edx, ecx
jne 0x1001c151
xor eax, eax
ret
mov eax, edx
ret
Function at 0x10059030
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x10059066
mov eax, dword [0x10117114]
mov dword [esi + 4], 0
mov dword [esi], 0
test eax, eax
je 0x10059056
dec dword [eax + 0xb0]
push ecx
call fcn.100acf90
add esp, 4
mov dword [esi + 8], 0
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x1005909a
mov eax, dword [0x10117114]
mov dword [esi + 0x10], 0
mov dword [esi + 0xc], 0
test eax, eax
je 0x1005908a
dec dword [eax + 0xb0]
push ecx
call fcn.100acf90
add esp, 4
mov dword [esi + 0x14], 0
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x100590ce
mov eax, dword [0x10117114]
mov dword [esi + 0x1c], 0
mov dword [esi + 0x18], 0
test eax, eax
je 0x100590be
dec dword [eax + 0xb0]
push ecx
call fcn.100acf90
add esp, 4
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov ecx, dword [esi + 0x44]
test ecx, ecx
je 0x1005911e
mov eax, dword [0x10117114]
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
test eax, eax
je 0x1005910e
dec dword [eax + 0xb0]
push ecx
call fcn.100acf90
add esp, 4
mov dword [esi + 0x44], 0
mov ecx, dword [esi + 0x50]
test ecx, ecx
je 0x10059152
mov eax, dword [0x10117114]
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
test eax, eax
je 0x10059142
dec dword [eax + 0xb0]
push ecx
call fcn.100acf90
add esp, 4
mov dword [esi + 0x50], 0
mov ecx, dword [esi + 0x5c]
test ecx, ecx
je 0x10059186
mov eax, dword [0x10117114]
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0
test eax, eax
je 0x10059176
dec dword [eax + 0xb0]
push ecx
call fcn.100acf90
add esp, 4
mov dword [esi + 0x5c], 0
lea ecx, [esi + 0x78]
pop esi
jmp fcn.1005c680
Function at 0x1007e190
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
or eax, 2
mov dword [ebp + 8], eax
pop ebp
jmp fcn.1007e2b0
Function at 0x10087210
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, dword [0x10117114]
xorps xmm5, xmm5
or edx, 0xffffffff
mov esi, 0x100f2015
movss xmm4, dword [edi + 0x37c8]
movss xmm1, dword [edi + 0x3850]
mov eax, dword [edi + 0x47ec]
subss xmm1, xmm4
movss xmm0, dword [edi + 0x384c]
addss xmm4, xmm4
mov ebx, dword [eax]
mov al, 0x23
maxss xmm1, xmm5
mov dword [ebp - 4], ebx
addss xmm4, dword [edi + 0x3bcc]
movss dword [edi + 0x476c], xmm0
or ebx, 0xffffffff
movss dword [edi + 0x4770], xmm1
cmp al, 0x23
jne 0x10087284
cmp byte [esi], al
jne 0x10087284
cmp byte [esi + 1], al
cmove edx, ebx
movzx ecx, dl
movzx eax, al
xor ecx, eax
shr edx, 8
mov al, byte [esi]
inc esi
xor edx, dword [ecx*4 + 0x100f4090]
test al, al
jne 0x10087276
not edx
mov ecx, edx
call fcn.1000c8b0
mov ebx, dword [ebp - 4]
test eax, eax
je 0x100872bb
cmp word [eax + 0xb6], 0
jne 0x10087360
test ebx, ebx
jne 0x100872c7
mov eax, dword [edi + 0x47ec]
mov ebx, dword [eax]
movss xmm1, dword [ebx + 0x94]
movss xmm0, dword [ebx + 0xc]
movaps xmm3, xmm1
addss xmm3, dword [ebx + 4]
movss xmm2, dword [ebx + 0x98]
subss xmm0, xmm1
addss xmm2, dword [ebx + 8]
addss xmm0, dword [ebx + 0x9c]
or dword [edi + 0x4714], 3
movss dword [edi + 0x4724], xmm3
movss dword [edi + 0x4728], xmm2
mov dword [edi + 0x472c], 0
maxss xmm5, xmm0
mov dword [edi + 0x4730], 0
mov dword [edi + 0x4718], 1
movss dword [edi + 0x4738], xmm4
mov dword [edi + 0x471c], 1
addss xmm5, xmm3
subss xmm5, xmm3
movss dword [edi + 0x4734], xmm5
addss xmm4, dword [ebx + 0x98]
movss dword [ebx + 0x98], xmm4
movss xmm0, dword [edi + 0x3798]
lea eax, [ebp - 0x10]
push eax
lea ecx, [edi + 0x4780]
mov dword [ebp - 0x10], 3
movss dword [ebp - 0xc], xmm0
call fcn.10026430
mov esi, dword [0x10117114]
lea eax, [ebp - 0x10]
mov dword [edi + 0x3798], 0
push eax
mov dword [ebp - 0x10], 5
movss xmm1, dword [esi + 0x37a0]
lea ecx, [esi + 0x4780]
movss xmm0, dword [esi + 0x37a4]
movss dword [ebp - 0xc], xmm1
movss dword [ebp - 8], xmm0
call fcn.10026430
push 0x50f
xor edx, edx
mov dword [esi + 0x37a0], 0
mov ecx, str.MainMenuBar
mov dword [esi + 0x37a4], 0
call fcn.1000ece0
add esp, 4
mov ecx, 2
mov bl, al
call fcn.10005ae0
mov dword [edi + 0x476c], 0
mov dword [edi + 0x4770], 0
test bl, bl
je 0x1008741d
call fcn.10086d40
mov al, bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.10011690
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10089d10
Capabilities:
Hash data with crc32

Disassembly:
push ecx
test dword [ecx + 0xc], 0x100000
push ebx
push esi
push edi
mov edi, edx
je 0x10089d82
mov cl, byte [edi]
lea esi, [edi + 1]
or eax, 0xffffffff
test cl, cl
je 0x10089d58
or edi, 0xffffffff
nop
cmp cl, 0x23
jne 0x10089d3f
cmp byte [esi], cl
jne 0x10089d3f
cmp byte [esi + 1], cl
cmove eax, edi
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x100f4090]
test cl, cl
jne 0x10089d30
mov ecx, dword [0x10117114]
not eax
cmp dword [ecx + 0x3eac], eax
jne 0x10089d6e
mov dword [ecx + 0x3eb0], eax
cmp dword [ecx + 0x3ed4], eax
jne 0x10089dc8
mov byte [ecx + 0x3ed8], 1
pop edi
pop esi
pop ebx
pop ecx
ret
mov eax, dword [0x10117114]
xor edx, edx
mov esi, dword [eax + 0x3e60]
mov ecx, dword [esi + 0xe4]
mov eax, dword [esi + 0xec]
push dword [eax + ecx*4 - 4]
mov ecx, edi
call fcn.10003ad0
mov ecx, dword [esi]
mov ebx, eax
add esp, 4
cmp dword [ecx + 0x3e94], ebx
jne 0x10089dc6
push ecx
push edi
mov edx, 0xb
mov ecx, ebx
call fcn.10025610
add esp, 8
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x10093bf0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub eax, 0
je 0x10093c2d
sub eax, 1
jne 0x10093c24
mov eax, dword [ebp + 8]
push eax
mov dword [0x1011714c], eax
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
push 0
push 0
push 0
push 0x10093940
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
pop ebp
ret 0xc
call fcn.100627f0
call fcn.10062bb0
call fcn.100071a0
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FreeLibraryAndExitThread]

Function at 0x10095360
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
sub eax, 0x10000
push eax
call fcn.10095510
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jbe 0x1009542d
mov edx, dword [ebp - 4]
cmp edx, dword [0x10111088]
jb 0x100953aa
mov eax, dword [ebp - 4]
cmp eax, dword [0x1011108c]
ja 0x100953aa
mov ecx, dword [ebp - 4]
sub ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x1009537a
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call fcn.10098d00
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x100953d0
jmp 0x1009542d
cmp dword [ebp - 0x14], 0x10000
jne 0x10095413
cmp dword [ebp - 0x18], 0x10000
jb 0x10095413
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10095406
mov eax, dword [ebp - 8]
jmp 0x1009542f
mov eax, dword [ebp - 4]
sub eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x10095428
mov ecx, dword [ebp - 0x20]
sub ecx, 0x10000
push ecx
call fcn.10095510
add esp, 4
mov dword [ebp - 4], eax
jmp 0x1009537a
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x10095440
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push eax
call fcn.10095540
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x10095505
mov edx, dword [ebp - 4]
cmp edx, dword [0x10111088]
jb 0x10095485
mov eax, dword [ebp - 4]
cmp eax, dword [0x1011108c]
ja 0x10095485
mov ecx, dword [ebp - 4]
add ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x10095455
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call fcn.10098d00
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x100954ab
jmp 0x10095505
cmp dword [ebp - 0x14], 0x10000
jne 0x100954ee
cmp dword [ebp - 0x18], 0x10000
jb 0x100954ee
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x100954e1
mov eax, dword [ebp - 8]
jmp 0x10095507
mov eax, dword [ebp - 4]
add eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x10095500
mov ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 0x18]
push ecx
call fcn.10095540
add esp, 4
mov dword [ebp - 4], eax
jmp 0x10095455
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10095570
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.10095960
add esp, 0xc
mov dword [ebp - 4], 0
cmp dword [0x10116344], 0
jne 0x100955ad
cmp dword [0x10116340], 0
je 0x100955ad
mov eax, dword [0x10116340]
mov dword [0x10116344], eax
cmp dword [0x10116344], 0
je 0x1009562a
mov ecx, dword [0x10116344]
cmp dword [ecx + 8], 0
je 0x1009562a
mov edx, dword [0x10116344]
mov eax, dword [edx + 8]
cmp eax, dword [ebp - 0x10]
jb 0x1009562a
mov ecx, dword [0x10116344]
mov edx, dword [ecx + 8]
cmp edx, dword [ebp - 0xc]
ja 0x1009562a
mov eax, dword [0x10116344]
mov ecx, dword [eax + 8]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
cmp edx, dword [ebp - 0x10]
jb 0x100955f9
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0xc]
jbe 0x10095600
xor eax, eax
jmp 0x10095749
mov ecx, dword [0x10116344]
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x40]
mov dword [ecx + 8], eax
push 0x48
push 0xcc
mov ecx, dword [ebp - 4]
push ecx
call fcn.10098d00
add esp, 0xc
mov eax, dword [ebp - 4]
jmp 0x10095749
mov edx, dword [0x10116340]
mov dword [0x10116344], edx
jmp 0x10095646
mov eax, dword [0x10116344]
mov ecx, dword [eax + 4]
mov dword [0x10116344], ecx
cmp dword [0x10116344], 0
je 0x10095686
cmp dword [0x10116344], 0
je 0x10095684
mov edx, dword [0x10116344]
cmp dword [edx + 8], 0
je 0x10095684
mov eax, dword [0x10116344]
mov ecx, dword [eax + 8]
cmp ecx, dword [ebp - 0x10]
jb 0x10095684
mov edx, dword [0x10116344]
mov eax, dword [edx + 8]
cmp eax, dword [ebp - 0xc]
ja 0x10095684
jmp 0x100955de
jmp 0x10095638
mov ecx, dword [ebp + 8]
and ecx, 0xffff
mov edx, dword [ebp + 8]
sub edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.10095750
add esp, 0xc
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x10095747
mov eax, dword [ebp - 0x18]
mov dword [0x10116344], eax
mov ecx, dword [0x10116344]
mov dword [ecx], 0x52727464
mov edx, dword [0x10116344]
mov dword [edx + 8], 0
mov eax, dword [0x10116344]
mov ecx, dword [0x10116340]
mov dword [eax + 4], ecx
mov edx, dword [0x10116344]
mov dword [0x10116340], edx
mov dword [ebp - 0x14], 0
mov eax, dword [0x10116344]
add eax, 0x48
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0x38c
jmp 0x10095717
mov ecx, dword [ebp - 8]
sub ecx, 1
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 1
jle 0x10095737
imul edx, dword [ebp - 8], 0x48
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x14]
mov dword [eax + edx + 0x40], ecx
imul edx, dword [ebp - 8], 0x48
add edx, dword [ebp - 4]
mov dword [ebp - 0x14], edx
jmp 0x1009570e
mov eax, dword [0x10116344]
mov ecx, dword [ebp - 0x14]
mov dword [eax + 8], ecx
jmp 0x100955de
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x1009ba00
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.1009b620
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1009ba32
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 8]
call dword [0x100e020c]
call dword [ebp - 8]
jmp 0x1009ba3c
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esp, ebp
pop ebp
ret
Function at 0x100bfa60
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.100bf420
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x100bfa94
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 8]
call dword [0x100e020c]
call dword [ebp - 8]
jmp 0x100bfa9a
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov esp, ebp
pop ebp
ret 4

Function at 0x100bfaf0
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.100bf460
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x100bfb24
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 8]
call dword [0x100e020c]
call dword [ebp - 8]
jmp 0x100bfb2e
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esp, ebp
pop ebp
ret 4

Function at 0x100bfb40
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.100bf480
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x100bfb78
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
call dword [0x100e020c]
call dword [ebp - 8]
jmp 0x100bfb86
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov esp, ebp
pop ebp
ret 8
Function at 0x100c10b0
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1434
call fcn.100da200
mov eax, dword [0x10111040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
sar eax, 6
mov ecx, dword [ebp + 0xc]
and ecx, 0x3f
imul edx, ecx, 0x38
mov eax, dword [eax*4 + 0x10116588]
mov ecx, dword [eax + edx + 0x18]
mov dword [ebp - 0x1434], ecx
mov edx, dword [ebp + 0x10]
add edx, dword [ebp + 0x14]
mov dword [ebp - 0x1424], edx
xor eax, eax
mov dword [ebp - 0x1410], eax
mov dword [ebp - 0x140c], eax
mov dword [ebp - 0x1408], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x1420], ecx
mov edx, dword [ebp - 0x1420]
cmp edx, dword [ebp - 0x1424]
jae 0x100c1288
lea eax, [ebp - 5]
mov dword [ebp - 0x1430], eax
lea ecx, [ebp - 0x1404]
mov dword [ebp - 0x1418], ecx
mov edx, dword [ebp - 0x1418]
cmp edx, dword [ebp - 0x1430]
jae 0x100c11d7
mov eax, dword [ebp - 0x1420]
cmp eax, dword [ebp - 0x1424]
jae 0x100c11d7
mov ecx, dword [ebp - 0x1420]
mov dl, byte [ecx]
mov byte [ebp - 0x1419], dl
mov eax, dword [ebp - 0x1420]
add eax, 1
mov dword [ebp - 0x1420], eax
mov cl, byte [ebp - 0x1419]
mov byte [ebp - 0x1411], cl
movsx edx, byte [ebp - 0x1411]
cmp edx, 0xa
jne 0x100c11b5
mov eax, dword [ebp - 0x1408]
add eax, 1
mov dword [ebp - 0x1408], eax
mov ecx, dword [ebp - 0x1418]
mov byte [ecx], 0xd
mov edx, dword [ebp - 0x1418]
add edx, 1
mov dword [ebp - 0x1418], edx
mov eax, dword [ebp - 0x1418]
mov cl, byte [ebp - 0x1411]
mov byte [eax], cl
mov edx, dword [ebp - 0x1418]
add edx, 1
mov dword [ebp - 0x1418], edx
jmp 0x100c1139
mov eax, dword [ebp - 0x1418]
lea ecx, [ebp - 0x1404]
sub eax, ecx
mov dword [ebp - 0x142c], eax
push 0
lea edx, [ebp - 0x1428]
push edx
mov eax, dword [ebp - 0x142c]
push eax
lea ecx, [ebp - 0x1404]
push ecx
mov edx, dword [ebp - 0x1434]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x100c1241
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1410], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x1410]
mov dword [eax], ecx
mov edx, dword [ebp - 0x140c]
mov dword [eax + 4], edx
mov ecx, dword [ebp - 0x1408]
mov dword [eax + 8], ecx
mov eax, dword [ebp + 8]
jmp 0x100c12a8
mov edx, dword [ebp - 0x140c]
add edx, dword [ebp - 0x1428]
mov dword [ebp - 0x140c], edx
mov eax, dword [ebp - 0x1428]
cmp eax, dword [ebp - 0x142c]
jae 0x100c1283
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x1410]
mov dword [ecx], edx
mov eax, dword [ebp - 0x140c]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x1408]
mov dword [ecx + 8], edx
mov eax, dword [ebp + 8]
jmp 0x100c12a8
jmp 0x100c1112
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x1410]
mov dword [eax], ecx
mov edx, dword [ebp - 0x140c]
mov dword [eax + 4], edx
mov ecx, dword [ebp - 0x1408]
mov dword [eax + 8], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10093c50
mov esp, ebp
pop ebp
ret