joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002b430
Capabilities:
Read file on windows

Disassembly:
push ebx
push edi
push esi
sub esp, 0x18
cmp dword [edx], 0
mov edi, edx
jne 0x1002b501
mov ebx, dword [edi + 0xc]
mov esi, ecx
mov edx, dword [ebx]
test edx, edx
jne 0x1002b459
mov eax, dword [ebx + 8]
xor edx, edx
lea ecx, [eax + 0xf]
cmp ecx, 0xf
jbe 0x1002b4d0
mov eax, dword [ebx + 8]
cmp edx, eax
je 0x1002b4eb
mov ecx, dword [edi + 8]
sub edx, eax
add eax, dword [ebx + 4]
mov dword [esp], 0
mov ebx, esp
push ecx
push ebx
push edx
push eax
push dword [edi + 0x10]
call dword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
je 0x1002b494
mov eax, dword [esp]
mov ecx, 2
test eax, eax
jne 0x1002b4ad
jmp 0x1002b4b9
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x6d
je 0x1002b4b9
cmp eax, 0x3e5
jne 0x1002b4c0
mov ecx, 1
xor eax, eax
mov dword [edi], ecx
mov dword [edi + 4], eax
mov word [esi], 0x104
jmp 0x1002b4c9
mov word [esi], 4
jmp 0x1002b4c9
mov dword [esi], 0
mov dword [esi + 4], eax
add esp, 0x18
pop esi
pop edi
pop ebx
ret
mov edx, eax
mov ecx, ebx
push 0x10
call fcn.10052f20
add esp, 4
mov edx, dword [ebx]
mov eax, dword [ebx + 8]
cmp edx, eax
jne 0x1002b464
mov ecx, ebx
push 1
call fcn.10052f20
add esp, 4
mov edx, dword [ebx]
mov eax, dword [ebx + 8]
jmp 0x1002b464
mov edx, esp
mov ecx, edi
mov dword [esp], 0
call fcn.10052da0
int3

Function at 0x1002b7f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x10034850
lea eax, [ebp - 0x18]
mov ecx, dword fs:[0]
test esi, esi
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
je 0x1002b84a
js 0x1002b8ba
movzx eax, byte [0x1006b9a9]
push 1
push esi
call fcn.1000f0c0
add esp, 8
mov edi, eax
test eax, eax
jne 0x1002b84f
push esi
push 1
call fcn.100536e0
mov edi, 1
mov ebx, dword [ebp + 8]
push esi
push dword [ebp + 0xc]
push edi
call fcn.10045a70
add esp, 0xc
mov edx, dword [ebx + 0x30]
cmp edx, dword [ebx + 0x28]
jne 0x1002b887
lea ecx, [ebx + 0x28]
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x10], 0
call fcn.1001bce0
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp - 0x20]
mov edx, dword [eax + 0x30]
mov ebx, eax
mov eax, dword [ebx + 0x2c]
lea ecx, [edx + edx*4]
inc edx
mov dword [eax + ecx*4], 0
mov dword [eax + ecx*4 + 4], esi
mov dword [eax + ecx*4 + 8], edi
mov dword [eax + ecx*4 + 0xc], esi
mov byte [eax + ecx*4 + 0x10], 0
mov dword [ebx + 0x30], edx
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.1003b3e0
nop
push ebp
sub esp, 0xc
add ebp, 0xc
cmp dword [ebp + 0x10], 0
je 0x1002b8dd
push 1
push dword [ebp + 0x10]
push dword [ebp - 0x20]
call fcn.1000f0d0
add esp, 0xc
add esp, 0xc
pop ebp
ret
Function at 0x1002edd0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x24
mov esi, ecx
lea ecx, [esp + 0xc]
push dword [esp + 0x38]
call fcn.10031300
add esp, 4
mov eax, dword [esp + 0xc]
cmp eax, 0x80000000
jne 0x1002ee0d
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov dword [esp + 8], ecx
mov dword [esp + 4], eax
mov dword [esp], 0x80000000
jmp 0x1002ee37
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov dword [esp + 0x18], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x1c], ecx
mov ecx, esp
lea edx, [esp + 0x18]
call fcn.10027c30
mov edi, dword [esp]
cmp edi, 0x80000000
jne 0x1002ee49
mov ecx, esp
call fcn.100187d0
mov dword [esi], 0x80000000
add esp, 0x24
jmp 0x1002ee82
mov ebx, dword [esp + 4]
mov ebp, dword [esp + 8]
push ebx
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1002ee6a
mov dword [esi], edi
mov dword [esi + 4], ebx
mov dword [esi + 8], ebp
add esp, 0x24
jmp 0x1002ee82
test edi, edi
mov dword [esi], 0x80000000
je 0x1002ee65
add edi, edi
push 2
push edi
push ebx
call fcn.1000f0d0
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1002fea0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov esi, esp
mov dword [esi + 0x48], ebp
mov dword [esi + 0x4c], esp
mov dword [esi + 0x58], 0xffffffff
mov dword [esi + 0x54], 0x100348a0
mov edi, ecx
lea eax, [esi + 0x50]
xorps xmm0, xmm0
mov ecx, dword fs:[0]
mov dword [esi + 0x50], ecx
mov dword fs:[0], eax
movaps xmmword [esi + 0x10], xmm0
lea eax, [esi + 0x10]
push 0x10
push eax
call dword [sym.imp.advapi32.dll_SystemFunction036]
test al, al
je 0x1002ff1e
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
mov edx, dword [esi + 0x18]
mov ebx, dword [esi + 0x1c]
mov dword [esi + 4], eax
mov eax, dword [esi + 0x50]
mov dword fs:[0], eax
mov dword [edi + 0xc], ebx
mov dword [edi + 8], edx
mov dword [edi + 4], ecx
mov eax, dword [esi + 4]
mov dword [edi], eax
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
call dword [sym.imp.kernel32.dll_GetLastError]
mov byte [esi + 8], 0
mov dword [esi + 0xc], eax
lea eax, [esi + 8]
mov dword [esi + 0x30], 0x1005c310
mov dword [esi + 0x34], 1
mov dword [esi + 0x40], 0
mov dword [esi + 0x58], 0
mov dword [esi + 0x28], eax
lea eax, [esi + 0x28]
mov dword [esi + 0x2c], fcn.1001e4a0
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], 1
lea eax, [esi + 0x30]
push 0x1005c340
push eax
call fcn.10053770
add esp, 8
ud2
Function at 0x100306e0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x100348c0
lea eax, [ebp - 0x18]
mov ebx, dword [ebp + 0x10]
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
movzx eax, byte [0x1006b9a9]
push 4
push 8
call fcn.1000f0c0
add esp, 8
test eax, eax
je 0x100307c2
mov esi, eax
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x14]
mov dword [esi], ebx
mov dword [esi + 4], ecx
push 0
push 0x10000
push esi
push 0x10030840
push eax
push 0
call dword [sym.imp.kernel32.dll_CreateThread]
test eax, eax
je 0x1003075d
mov dword [edi + 4], eax
mov byte [edi], 4
jmp 0x100307af
mov eax, dword [esi]
mov ecx, dword [esi + 4]
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x10], 1
mov dword [ebp - 0x24], eax
push eax
mov dword [ebp - 0x20], ecx
call dword [ecx]
add esp, 4
mov ecx, dword [ebp - 0x20]
mov edi, dword [ebp + 8]
mov eax, dword [ecx + 4]
test eax, eax
je 0x10030794
push dword [ecx + 8]
push eax
push dword [ebp - 0x24]
call fcn.1000f0d0
add esp, 0xc
push 4
push 8
push dword [ebp - 0x28]
call fcn.1000f0d0
add esp, 0xc
call dword [sym.imp.kernel32.dll_GetLastError]
mov byte [edi], 0
mov dword [edi + 4], eax
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, edi
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x10], 0
push 8
push 4
call fcn.100536e0
add esp, 8
ud2
Function at 0x100309f0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x100348e0
lea eax, [ebp - 0x18]
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
movzx eax, byte [0x1006ba48]
test al, al
je 0x10030bc1
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x10030a3c
cmp eax, 3
jne 0x10030bba
mov ebx, dword [0x1006ba4c]
test ebx, ebx
je 0x10030bba
mov dword [ebp - 0x20], 0
jmp 0x10030a67
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x10030a98
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x10030c0b
dec esi
push esi
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x10030a60
push 0
push esi
mov esi, eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x10030a60
test byte [ebp - 0x20], 1
je 0x10030bba
mov ebx, dword [0x1006ba4c]
test ebx, ebx
je 0x10030bba
mov dword [ebp - 0x20], 0
jmp 0x10030ac7
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x10030af8
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x10030c0b
dec esi
push esi
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x10030ac0
push 0
push esi
mov esi, eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x10030ac0
test byte [ebp - 0x20], 1
je 0x10030bba
mov ebx, dword [0x1006ba4c]
test ebx, ebx
je 0x10030bba
mov dword [ebp - 0x20], 0
jmp 0x10030b27
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x10030b58
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x10030c0b
dec esi
push esi
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x10030b20
push 0
push esi
mov esi, eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x10030b20
test byte [ebp - 0x20], 1
je 0x10030bba
mov ebx, dword [0x1006ba4c]
test ebx, ebx
je 0x10030bba
mov dword [ebp - 0x20], 0
jmp 0x10030b87
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x10030bb4
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x10030c0b
dec esi
push esi
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x10030b80
push 0
push esi
mov esi, eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x10030b80
test byte [ebp - 0x20], 1
jne 0x10030bd4
movzx eax, byte [0x10067600]
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
mov ebx, dword [0x1006ba4c]
jmp 0x10030bdf
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x10030bba
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x10030c0b
dec esi
push esi
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x10030bdc
push 0
push esi
mov esi, eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
push esi
call edi
add esp, 4
jmp 0x10030bdc
mov dword [ebp - 0x10], 0
push 0x1005c67c
call fcn.10053740
add esp, 4
ud2
Function at 0x10033cf0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
mov eax, dword [0x1006b04c]
mov esi, ecx
test eax, eax
je 0x10033d16
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jb 0x10033d2f
cmp dword [eax + 4], 0
je 0x10033d2f
add eax, 8
pop esi
pop edi
ret
push 0x1006b04c
call fcn.10053240
add esp, 4
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jae 0x10033d0a
mov eax, dword [0x1006b04c]
test eax, eax
je 0x10033dc9
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x10033de6
test eax, eax
jne 0x10033d90
movzx eax, byte [0x1006b9a9]
push 4
push 0x10
call fcn.1000f0c0
add esp, 8
test eax, eax
je 0x10033e00
mov dword [eax], 0x1006b04c
mov dword [eax + 4], 0
mov ecx, dword [0x1006b04c]
test ecx, ecx
je 0x10033deb
dec ecx
push eax
push ecx
mov edi, eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov eax, edi
test esi, esi
je 0x10033db0
mov edx, dword [esi]
xor ecx, ecx
mov dword [esi], 0
cmp edx, 1
mov edx, 0
jne 0x10033db4
mov ecx, dword [esi + 4]
mov edx, dword [esi + 8]
jmp 0x10033db4
xor ecx, ecx
xor edx, edx
lea esi, [eax + 8]
mov dword [eax + 4], 1
mov dword [eax + 8], ecx
mov byte [eax + 0xc], dl
mov eax, esi
pop esi
pop edi
ret
push 0x1006b04c
call fcn.10053240
add esp, 4
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jne 0x10033d4d
xor eax, eax
pop esi
pop edi
ret
push 0x1006b04c
mov edi, eax
call fcn.10053240
add esp, 4
mov ecx, eax
mov eax, edi
jmp 0x10033d84
push 0x10
push 4
call fcn.100536e0
int3
Function at 0x10033e10
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x10034990
mov esi, ecx
lea eax, [ebp - 0x18]
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
mov eax, dword [0x1006b05c]
test eax, eax
je 0x10033f23
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jb 0x10033e63
cmp dword [eax + 4], 0
jne 0x10033f1e
mov eax, dword [0x1006b05c]
test eax, eax
je 0x10033f45
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x10033f62
test eax, eax
jne 0x10033ed8
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x28], 0x1006b05c
movzx eax, byte [0x1006b9a9]
push 4
push 0xc
call fcn.1000f0c0
add esp, 8
test eax, eax
je 0x10033f8e
mov ecx, dword [ebp - 0x20]
movsd xmm0, qword [ebp - 0x28]
mov dword [eax + 8], ecx
movsd qword [eax], xmm0
mov ecx, dword [0x1006b05c]
test ecx, ecx
je 0x10033f76
dec ecx
push eax
push ecx
mov edi, eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov eax, edi
test esi, esi
je 0x10033eed
mov ecx, dword [esi]
mov dword [esi], 0
test ecx, ecx
je 0x10033eef
mov ecx, dword [esi + 4]
jmp 0x10033eef
xor ecx, ecx
mov esi, dword [eax + 4]
mov edx, dword [eax + 8]
test esi, esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], edx
mov dword [eax + 4], 1
mov dword [eax + 8], ecx
je 0x10033f1e
test edx, edx
je 0x10033f1e
lock dec dword [edx]
jne 0x10033f1e
lea ecx, [ebp - 0x24]
mov esi, eax
call fcn.1001b9a0
mov eax, esi
add eax, 8
jmp 0x10033f64
push 0x1006b05c
call fcn.10053240
add esp, 4
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jae 0x10033e59
jmp 0x10033e63
push 0x1006b05c
call fcn.10053240
add esp, 4
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jne 0x10033e81
xor eax, eax
mov ecx, dword [ebp - 0x18]
mov dword fs:[0], ecx
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x1006b05c
mov edi, eax
call fcn.10053240
add esp, 4
mov ecx, eax
mov eax, edi
jmp 0x10033ecc
mov dword [ebp - 0x10], 0
push 0xc
push 4
call fcn.100536e0
add esp, 8
ud2
Function at 0x10033fd0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
mov eax, dword [0x1006b06c]
mov esi, ecx
test eax, eax
je 0x10033ff6
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jb 0x1003400f
cmp byte [eax + 4], 0
je 0x1003400f
add eax, 5
pop esi
pop edi
ret
push 0x1006b06c
call fcn.10053240
add esp, 4
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jae 0x10033fea
mov eax, dword [0x1006b06c]
test eax, eax
je 0x10034085
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x1003409e
test eax, eax
jne 0x10034061
movzx eax, byte [0x1006b9a9]
push 4
push 8
call fcn.1000f0c0
add esp, 8
test eax, eax
je 0x100340b8
mov dword [eax], 0x1006b06c
mov byte [eax + 4], 0
mov ecx, dword [0x1006b06c]
test ecx, ecx
je 0x100340a3
dec ecx
push eax
push ecx
mov edi, eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov eax, edi
xor ecx, ecx
test esi, esi
je 0x10034076
cmp byte [esi], 0
mov byte [esi], 0
movzx edx, byte [esi + 1]
cmove edx, ecx
mov ecx, edx
lea edx, [eax + 5]
mov byte [eax + 4], 1
mov byte [eax + 5], cl
mov eax, edx
pop esi
pop edi
ret
push 0x1006b06c
call fcn.10053240
add esp, 4
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jne 0x10034025
xor eax, eax
pop esi
pop edi
ret
push 0x1006b06c
mov edi, eax
call fcn.10053240
add esp, 4
mov ecx, eax
mov eax, edi
jmp 0x10034055
push 8
push 4
call fcn.100536e0
int3
Function at 0x100340d0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x100349a0
mov esi, ecx
lea eax, [ebp - 0x18]
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
mov eax, dword [0x1006b07c]
test eax, eax
je 0x100341e3
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jb 0x10034123
cmp dword [eax + 4], 0
jne 0x100341de
mov eax, dword [0x1006b07c]
test eax, eax
je 0x10034205
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x10034222
test eax, eax
jne 0x10034198
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x28], 0x1006b07c
movzx eax, byte [0x1006b9a9]
push 4
push 0xc
call fcn.1000f0c0
add esp, 8
test eax, eax
je 0x1003424e
mov ecx, dword [ebp - 0x20]
movsd xmm0, qword [ebp - 0x28]
mov dword [eax + 8], ecx
movsd qword [eax], xmm0
mov ecx, dword [0x1006b07c]
test ecx, ecx
je 0x10034236
dec ecx
push eax
push ecx
mov edi, eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov eax, edi
test esi, esi
je 0x100341ad
mov ecx, dword [esi]
mov dword [esi], 0
test ecx, ecx
je 0x100341af
mov ecx, dword [esi + 4]
jmp 0x100341af
xor ecx, ecx
mov esi, dword [eax + 4]
mov edx, dword [eax + 8]
test esi, esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], edx
mov dword [eax + 4], 1
mov dword [eax + 8], ecx
je 0x100341de
test edx, edx
je 0x100341de
lock dec dword [edx]
jne 0x100341de
lea ecx, [ebp - 0x24]
mov esi, eax
call fcn.1001b9e0
mov eax, esi
add eax, 8
jmp 0x10034224
push 0x1006b07c
call fcn.10053240
add esp, 4
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jae 0x10034119
jmp 0x10034123
push 0x1006b07c
call fcn.10053240
add esp, 4
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jne 0x10034141
xor eax, eax
mov ecx, dword [ebp - 0x18]
mov dword fs:[0], ecx
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x1006b07c
mov edi, eax
call fcn.10053240
add esp, 4
mov ecx, eax
mov eax, edi
jmp 0x1003418c
mov dword [ebp - 0x10], 0
push 0xc
push 4
call fcn.100536e0
add esp, 8
ud2
Function at 0x10043250
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword [esp + 0x14]
test eax, eax
je 0x100432a8
mov esi, dword [esp + 0x18]
lea edi, [edx + eax*2]
xor ebx, ebx
movzx eax, byte [edx + 1]
cmp byte [edx], ch
lea edx, [edx + 2]
lea ebp, [ebx + eax]
jne 0x100432a0
cmp ebx, ebp
ja 0x10043316
cmp ebp, dword [esp + 0x1c]
ja 0x10043322
add ebx, esi
nop word [eax + eax]
test eax, eax
je 0x100432a2
dec eax
cmp byte [ebx], cl
lea ebx, [ebx + 1]
jne 0x10043290
jmp 0x100432ff
ja 0x100432a8
cmp edx, edi
mov ebx, ebp
jne 0x10043265
mov edx, dword [esp + 0x24]
test edx, edx
je 0x10043303
mov esi, dword [esp + 0x20]
movzx ecx, cx
mov al, 1
add edx, esi
nop dword [eax + eax]
movzx ebx, byte [esi]
lea edi, [esi + 1]
test bl, bl
js 0x100432e0
mov esi, edi
sub ecx, ebx
jns 0x100432f7
jmp 0x10043305
cmp edi, edx
je 0x1004330c
movzx edi, byte [esi + 1]
and ebx, 0x7f
add esi, 2
shl ebx, 8
or ebx, edi
sub ecx, ebx
js 0x10043305
xor al, 1
cmp esi, edx
jne 0x100432c0
jmp 0x10043305
xor eax, eax
jmp 0x10043305
mov al, 1
and al, 1
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x1005ed24
call fcn.10053740
push 0x1005ed34
push ebp
push ebx
call fcn.10053bd0
push 0x1005ed34
push dword [esp + 0x20]
push ebp
call fcn.10053bb0
int3

Function at 0x10049762
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
test eax, eax
je 0x100497a1
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x100497a1
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x100497a1
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x100497a1
cmp dword [ecx + 0x74], 0xe
jbe 0x100497a1
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x1004c72e
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10063d50
push 0x10063d48
push str.FlsAlloc
push 0x1f
call fcn.1004c64a
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1004c762
push dword [ebp + 8]
mov ecx, esi
call dword [0x1005420c]
call esi
jmp 0x1004c768
call dword [sym.imp.kernel32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1004c7ac
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10063d60
push 0x10063d58
push str.FlsGetValue
push 0x21
call fcn.1004c64a
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1004c7e3
push dword [ebp + 8]
mov ecx, esi
call dword [0x1005420c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.kernel32.dll_TlsGetValue]

Function at 0x1004c7eb
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10063d68
push 0x10063d60
push str.FlsSetValue
push 0x22
call fcn.1004c64a
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1004c825
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x1005420c]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.kernel32.dll_TlsSetValue]
Function at 0x10051ec0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10051eed
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10051eed
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x10053240
Capabilities:
Allocate thread local storage

Disassembly:
push ebx
push edi
push esi
sub esp, 0x20
mov esi, dword [esp + 0x30]
cmp dword [esi + 4], 0
je 0x100532c3
lea edi, [esi + 0xc]
mov dword [esp + 4], 0
lea eax, [esp + 4]
push 0
push eax
push 0
push edi
call dword [sym.imp.kernel32.dll_InitOnceBeginInitialize]
cmp eax, 1
mov dword [esp], eax
jne 0x100532fe
cmp dword [esp + 4], 0
je 0x100532e5
call dword [sym.imp.kernel32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x1005331c
mov ebx, eax
inc eax
mov dword [esi], eax
mov eax, dword [0x1006ba4c]
nop word [eax + eax]
mov dword [esi + 8], eax
lock cmpxchg dword [0x1006ba4c], esi
jne 0x100532a0
mov byte [0x1006ba48], 1
push 0
push 0
push edi
call dword [sym.imp.kernel32.dll_InitOnceComplete]
mov eax, ebx
jmp 0x100532f7
call dword [sym.imp.kernel32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [esp], eax
je 0x1005335e
mov ecx, eax
xor eax, eax
inc ecx
lock cmpxchg dword [esi], ecx
jne 0x100532e9
mov eax, dword [esp]
jmp 0x100532f7
mov eax, dword [esi]
jmp 0x100532f6
push dword [esp]
mov esi, eax
call dword [sym.imp.kernel32.dll_TlsFree]
mov eax, esi
dec eax
add esp, 0x20
pop esi
pop edi
pop ebx
ret
mov dword [esp + 8], 0
lea eax, [esp + 8]
mov ecx, esp
mov edx, 0x1005c1b8
push 0x1005c658
push eax
call fcn.10052d40
push 0
push 4
push edi
call dword [sym.imp.kernel32.dll_InitOnceComplete]
mov dword [esp + 8], 0x1005c60c
mov dword [esp + 0xc], 1
mov dword [esp + 0x18], 0
mov dword [esp + 0x10], str._rustc_a4472498d7e88041f6206faf4503eb1f246fd427librarycore_srcio_borrowed_buf.rs
mov dword [esp + 0x14], 0
lea eax, [esp + 8]
push 0x1005c648
push eax
call fcn.10053770
mov ecx, esp
lea edx, [esp + 8]
mov dword [esp + 8], 0x1005c60c
mov dword [esp + 0xc], 1
mov dword [esp + 0x10], str._rustc_a4472498d7e88041f6206faf4503eb1f246fd427librarycore_srcio_borrowed_buf.rs
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call fcn.10052d70
int3