joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100fecdc
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xc0
mov esi, ecx
mov eax, dword [0x101b9014]
xor eax, ebp
mov dword [esp + 0xb8], eax
cmp byte [ecx + 0xb], 0
mov eax, ecx
jns 0x100fed05
mov eax, dword [esi]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov bl, 1
test eax, eax
jne 0x100feddd
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x100fed43
mov ecx, esi
call fcn.100fedf5
mov ebx, eax
mov ecx, dword [esp + 0xb8]
xor ecx, ebp
call fcn.101465a3
mov eax, ebx
jmp 0x100feded
cmp dword [0x101bee4c], 2
jg 0x100feddb
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [esp + 0x10]
push eax
push 2
push 0x267
push str....._third_partycrashpadcrashpadclientcrash_report_database_win.cc
call fcn.10066f30
lea eax, [esp + 0x18]
push 0x10
push str.CreateDirectory
push eax
call fcn.10034b83
add esp, 0xc
mov edi, eax
movzx eax, byte [esi + 0xb]
test al, al
jns 0x100fed8f
mov eax, dword [esi + 4]
mov esi, dword [esi]
xor ecx, ecx
mov ebx, esp
mov dword [ebx + 4], ecx
mov dword [ebx], ecx
mov dword [ebx + 8], ecx
push ebx
push eax
push esi
call fcn.10078390
add esp, 0xc
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x100fedb5
mov eax, dword [esp + 4]
mov ebx, dword [esp]
push eax
push ebx
push edi
call fcn.10034b83
add esp, 0xc
cmp byte [esp + 0xb], 0
jns 0x100fedd2
push dword [esp]
call fcn.10145bd4
add esp, 4
lea ecx, [esp + 0x10]
call fcn.100670a0
xor ebx, ebx
mov ecx, dword [esp + 0xb8]
xor ecx, ebp
call fcn.101465a3
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x100fedf5
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xc0
mov esi, ecx
mov eax, dword [0x101b9014]
xor eax, ebp
mov dword [esp + 0xb8], eax
cmp byte [ecx + 0xb], 0
mov eax, ecx
jns 0x100fee1e
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x100feede
mov bl, 1
test al, 0x10
jne 0x100fef78
cmp dword [0x101bee4c], 2
jg 0x100fef76
lea ecx, [esp + 0x10]
push 2
push 0x256
push str....._third_partycrashpadcrashpadclientcrash_report_database_win.cc
call fcn.100661d0
lea eax, [esp + 0x18]
push 0x12
push str.GetFileAttributes
push eax
call fcn.10034b83
add esp, 0xc
mov edi, eax
movzx eax, byte [esi + 0xb]
test al, al
jns 0x100fee7d
mov eax, dword [esi + 4]
mov esi, dword [esi]
xor ecx, ecx
mov ebx, esp
mov dword [ebx + 4], ecx
mov dword [ebx], ecx
mov dword [ebx + 8], ecx
push ebx
push eax
push esi
call fcn.10078390
add esp, 0xc
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x100feea3
mov eax, dword [esp + 4]
mov ebx, dword [esp]
push eax
push ebx
push edi
call fcn.10034b83
add esp, 0xc
push 0x11
push str.:_not_a_directory
push eax
call fcn.10034b83
add esp, 0xc
cmp byte [esp + 0xb], 0
jns 0x100feed0
push dword [esp]
call fcn.10145bd4
add esp, 4
lea ecx, [esp + 0x10]
call fcn.10066600
jmp 0x100fef76
cmp dword [0x101bee4c], 2
jg 0x100fef76
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [esp + 0x10]
push eax
push 2
push 0x252
push str....._third_partycrashpadcrashpadclientcrash_report_database_win.cc
call fcn.10066f30
lea eax, [esp + 0x18]
push 0x12
push str.GetFileAttributes
push eax
call fcn.10034b83
add esp, 0xc
mov edi, eax
movzx eax, byte [esi + 0xb]
test al, al
jns 0x100fef2a
mov eax, dword [esi + 4]
mov esi, dword [esi]
xor ecx, ecx
mov ebx, esp
mov dword [ebx + 4], ecx
mov dword [ebx], ecx
mov dword [ebx + 8], ecx
push ebx
push eax
push esi
call fcn.10078390
add esp, 0xc
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x100fef50
mov eax, dword [esp + 4]
mov ebx, dword [esp]
push eax
push ebx
push edi
call fcn.10034b83
add esp, 0xc
cmp byte [esp + 0xb], 0
jns 0x100fef6d
push dword [esp]
call fcn.10145bd4
add esp, 4
lea ecx, [esp + 0x10]
call fcn.100670a0
xor ebx, ebx
mov ecx, dword [esp + 0xb8]
xor ecx, ebp
call fcn.101465a3
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10100608
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, dword [0x101b9014]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [ecx + 0x28]
mov ecx, dword [ecx + 0x2c]
movdqu xmm0, xmmword [edx]
movdqu xmmword [ebp - 0x20], xmm0
cmp eax, ecx
je 0x1010068d
mov edi, dword [ebp + 8]
add eax, 0x10
movdqu xmm0, xmmword [eax - 0x10]
movdqu xmm1, xmmword [ebp - 0x20]
pcmpeqb xmm1, xmm0
pmovmskb edx, xmm1
cmp edx, 0xffff
je 0x1010065c
lea edx, [eax + 0x58]
add eax, 0x48
cmp eax, ecx
mov eax, edx
jne 0x10100634
jmp 0x1010068d
lea ebx, [eax - 0x10]
cmp ebx, ecx
je 0x1010068d
cmp byte [eax + 0xb], 0
jns 0x1010066b
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, eax
shr ecx, 3
and ecx, 2
xor esi, esi
inc esi
cmp eax, 0xffffffff
cmovne esi, ecx
test esi, esi
jne 0x10100690
mov dword [edi], ebx
xor esi, esi
jmp 0x10100690
xor esi, esi
inc esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.101465a3
mov eax, esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10101dcc
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ecx + 0x50]
cmp eax, edx
jne 0x10101de1
cmp byte [ecx + 0x1b], 0
jns 0x10101def
mov ecx, dword [ecx + 0x10]
jmp 0x10101df2
xor ecx, ecx
cmp eax, 1
sete cl
lea eax, [ecx + ecx*2]
inc eax
jmp 0x10101e0c
add ecx, 0x10
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, eax
mov edx, eax
shr edx, 3
and edx, 2
xor eax, eax
inc eax
cmp ecx, 0xffffffff
cmovne eax, edx
pop ebp
ret
Function at 0x10107860
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x140
mov eax, dword [0x101b9014]
xor eax, ebp
mov dword [esp + 0x138], eax
mov eax, dword [0x102ce798]
test eax, eax
jne 0x10107899
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 1
call esi
mov eax, dword [0x102ce798]
test eax, eax
je 0x1010788c
cmp eax, 2
jne 0x101078f2
cmp dword [0x101bee4c], 2
jg 0x101078d9
lea esi, [esp + 0xc]
mov ecx, esi
push 2
push 0xe7
push str....._third_partycrashpadcrashpadclientcrashpad_client_win.cc
call fcn.100661d0
lea eax, [esp + 0x14]
push 0x2f
push str.crash_server_failed_to_launch__self_terminating
push eax
call fcn.10034b83
add esp, 0xc
mov ecx, esi
call fcn.10066600
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0xffff7001
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
xor esi, esi
jmp 0x10107a4f
mov dword [esp + 8], 0
xorps xmm0, xmm0
movaps xmmword [esp + 0x120], xmm0
movaps xmmword [esp + 0x110], xmm0
movaps xmmword [esp + 0x100], xmm0
movaps xmmword [esp + 0xf0], xmm0
movaps xmmword [esp + 0xe0], xmm0
movaps xmmword [esp + 0xd0], xmm0
movaps xmmword [esp + 0xc0], xmm0
movaps xmmword [esp + 0xb0], xmm0
mov dword [esp + 4], 0x20
push 0x1019d274
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.GetUnhookErrorAndBlockedDlls
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1010797f
mov ecx, eax
call dword [section..00cfg]
lea eax, [esp + 4]
lea edx, [esp + 0xb0]
lea esi, [esp + 8]
push eax
push edx
push esi
call ecx
add esp, 0xc
mov edi, dword [ebp + 8]
xor ebx, ebx
inc ebx
mov eax, ebx
lock xadd dword [0x102ce7b4], eax
test eax, eax
jle 0x1010799d
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_SleepEx]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [0x101ce768], eax
xor esi, esi
mov dword [0x101ce764], esi
mov dword [0x101ce760], edi
push 0x80000
push esi
push 0x101ce77c
call fcn.10149430
add esp, 0xc
push dword [0x101bce24]
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0xea60
push dword [0x101bce28]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x10107a2c
mov ebx, 0xffff7001
cmp dword [0x101bee4c], 2
jg 0x10107a41
lea edi, [esp + 0xc]
mov ecx, edi
push 2
push 0x120
push str....._third_partycrashpadcrashpadclientcrashpad_client_win.cc
call fcn.100661d0
lea eax, [esp + 0x14]
push 0x2e
push str.crash_server_did_not_respond__self_terminating
push eax
call fcn.10034b83
add esp, 0xc
mov ecx, edi
call fcn.10066600
jmp 0x10107a41
mov esi, ebx
call fcn.100821e0
xor ebx, ebx
test edi, edi
je 0x10107a41
mov eax, dword [edi]
test eax, eax
je 0x10107a41
mov ebx, dword [eax]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [esp + 0x138]
xor ecx, ebp
call fcn.101465a3
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x10111230
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov eax, edx
cmp edx, 4
jb 0x10111268
imul esi, dword [ecx], 0x5bd1e995
mov edi, esi
shr edi, 0x18
xor edi, esi
imul esi, edi, 0x5bd1e995
imul eax, eax, 0x5bd1e995
xor eax, esi
add ecx, 4
add edx, 0xfffffffc
cmp edx, 3
ja 0x10111242
cmp edx, 1
je 0x10111289
cmp edx, 2
je 0x10111280
cmp edx, 3
jne 0x10111294
movzx edx, byte [ecx + 2]
shl edx, 0x10
xor eax, edx
movzx edx, byte [ecx + 1]
shl edx, 8
xor eax, edx
movzx ecx, byte [ecx]
xor ecx, eax
imul eax, ecx, 0x5bd1e995
mov ecx, eax
shr ecx, 0xd
xor ecx, eax
imul ecx, ecx, 0x5bd1e995
mov eax, ecx
shr eax, 0xf
xor eax, ecx
pop esi
pop edi
pop ebp
ret 8

Function at 0x10115ba0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
mov eax, dword [0x102ce7d8]
mov ecx, dword [0x101bd164]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x10115c54
mov esi, dword [ebp + 8]
push dword [0x101bac5c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
and eax, 0xfffffffc
je 0x10115bf9
mov ecx, dword [0x102ce7d0]
mov edx, dword [eax + ecx*8 + 4]
cmp edx, dword [0x102ce7d4]
jne 0x10115bf9
test esi, esi
je 0x10115bf9
cmp dword [eax + ecx*8], 0
je 0x10115bf9
xor eax, eax
jmp 0x10115c46
mov eax, dword [0x102ce7d8]
mov ecx, dword [0x101bd164]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x10115ca0
push dword [0x101bac5c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
and eax, 0xfffffffc
je 0x10115c49
mov ecx, dword [0x102ce7d0]
mov dword [eax + ecx*8], esi
mov ecx, dword [0x102ce7d4]
mov edx, dword [0x102ce7d0]
mov dword [eax + edx*8 + 4], ecx
mov al, 1
pop esi
pop ebp
ret
test esi, esi
je 0x10115c44
call fcn.1007a6e0
jmp 0x10115c2b
push 0x102ce7d8
call fcn.10145c47
add esp, 4
cmp dword [0x102ce7d8], 0xffffffff
jne 0x10115bc5
mov dword [0x102ce7d4], 0
mov dword [0x102ce7d0], 0xffffffff
mov ecx, 0x102ce7d0
push 0
call fcn.1007a5a0
push 0x102ce7d8
call fcn.10145cbd
add esp, 4
jmp 0x10115bc5
push 0x102ce7d8
call fcn.10145c47
add esp, 4
cmp dword [0x102ce7d8], 0xffffffff
jne 0x10115c1a
mov dword [0x102ce7d4], 0
mov dword [0x102ce7d0], 0xffffffff
mov ecx, 0x102ce7d0
push 0
call fcn.1007a5a0
push 0x102ce7d8
call fcn.10145cbd
add esp, 4
jmp 0x10115c1a
Function at 0x101168e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov ecx, dword [ecx + 0x30]
test ecx, ecx
je 0x101168f5
mov dword [esi + 0x34], ecx
call fcn.100e9130
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x10116904
mov dword [esi + 0x24], ecx
call fcn.100e9130
mov ecx, dword [esi + 0x10]
test ecx, ecx
je 0x10116913
mov dword [esi + 0x14], ecx
call fcn.100e9130
mov ecx, dword [esi]
test ecx, ecx
je 0x10116923
mov dword [esi + 4], ecx
pop esi
pop ebp
jmp fcn.100e9130
pop esi
pop ebp
ret

Function at 0x10119040
Capabilities:
Reference processor manufacturer constants

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov edi, ecx
xor eax, eax
xor ecx, ecx
cpuid
test eax, eax
jle 0x1011914b
mov esi, eax
mov dword [ebp - 0x14], edi
mov eax, 1
xor ecx, ecx
cpuid
mov edi, eax
mov dword [ebp - 0x10], ecx
mov ecx, 0
cmp esi, 7
mov ebx, 0
jb 0x10119091
mov eax, 7
xor ecx, ecx
mov esi, edx
cpuid
mov edx, esi
and ebx, 0x20
shr cl, 3
and cl, 1
mov esi, ecx
mov ecx, dword [ebp - 0x14]
mov dword [ecx], edi
mov eax, edi
and eax, 0xf
mov dword [ecx + 8], eax
shr edi, 0xc
and edi, 3
mov dword [ecx + 4], edi
mov edi, ecx
mov eax, edx
shr eax, 0x17
and al, 1
mov byte [ecx + 0xc], al
mov eax, edx
shr eax, 0x19
and al, 1
mov byte [ecx + 0xd], al
shr edx, 0x1a
and dl, 1
mov byte [ecx + 0xe], dl
mov ecx, dword [ebp - 0x10]
mov eax, ecx
and al, 1
mov byte [edi + 0xf], al
mov eax, ecx
shr eax, 9
and al, 1
mov byte [edi + 0x10], al
mov eax, ecx
shr eax, 0x13
and al, 1
mov byte [edi + 0x11], al
mov eax, ecx
shr eax, 0x14
and al, 1
mov byte [edi + 0x12], al
mov eax, ecx
shr eax, 0x17
and al, 1
mov byte [edi + 0x13], al
mov eax, ecx
shr eax, 0x1f
mov byte [edi + 0x1a], al
mov eax, ecx
not eax
test eax, 0x1c000000
jne 0x1011911b
xor ecx, ecx
xgetbv
not eax
test al, 6
sete al
jmp 0x1011911d
xor eax, eax
mov byte [edi + 0x14], al
mov edx, dword [ebp - 0x10]
mov ecx, edx
shr ecx, 0x19
and cl, 1
mov byte [edi + 0x17], cl
shr edx, 0xc
and dl, 1
mov byte [edi + 0x15], dl
test al, al
setne al
test ebx, ebx
setne cl
and cl, al
mov byte [edi + 0x16], cl
mov eax, esi
mov byte [edi + 0x18], al
mov eax, 0x80000000
xor ecx, ecx
cpuid
cmp eax, 0x80000006
jle 0x10119170
mov eax, 0x80000007
xor ecx, ecx
cpuid
and dh, 1
mov byte [edi + 0x19], dh
test dh, dh
jne 0x101191a2
jmp 0x10119177
mov dh, byte [edi + 0x19]
test dh, dh
jne 0x101191a2
cmp byte [edi + 0x1a], 0
je 0x101191a2
mov eax, 0x40000000
xor ecx, ecx
cpuid
cmp ebx, 0x7263694d
jne 0x101191a2
cmp ecx, 0x666f736f
jne 0x101191a2
cmp edx, 0x76482074
jne 0x101191a2
mov byte [edi + 0x19], 1
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1011a3e0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x48
mov edi, dword [ebp + 0xc]
mov eax, dword [0x101b9014]
xor eax, ebp
mov dword [esp + 0x40], eax
test byte [0x101bb2dc], 0x19
jne 0x1011a507
cmp dword [edi + 0x34], 0
je 0x1011a422
mov ecx, dword [esp + 0x40]
xor ecx, ebp
call fcn.101465a3
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
mov eax, dword [0x102ce848]
mov ecx, dword [0x101bd164]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x1011a5a7
mov eax, dword [0x101bac5c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
and eax, 0xfffffffc
je 0x1011a47e
mov ecx, dword [0x102ce840]
mov edx, dword [eax + ecx*8 + 4]
cmp edx, dword [0x102ce844]
jne 0x1011a47e
mov eax, dword [eax + ecx*8]
test eax, eax
je 0x1011a47e
mov ecx, dword [eax + 8]
mov dword [edi + 0x48], ecx
mov eax, dword [eax + 4]
mov dword [edi + 0x44], eax
mov eax, dword [0x102ce828]
mov ecx, dword [0x101bd164]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x1011a5f9
mov eax, dword [0x101bac5c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
and eax, 0xfffffffc
je 0x1011a40d
mov ecx, dword [0x102ce820]
mov edx, dword [eax + ecx*8 + 4]
cmp edx, dword [0x102ce824]
jne 0x1011a40d
mov eax, dword [eax + ecx*8]
test eax, eax
je 0x1011a40d
mov ecx, dword [eax + 0x10]
mov dword [edi + 0x34], ecx
movsd xmm0, qword [eax + 0x34]
mov ecx, dword [eax + 0x3c]
mov dword [edi + 0x40], ecx
movsd qword [edi + 0x38], xmm0
mov cl, 1
cmp byte [eax + 0x50], 0
jne 0x1011a4ff
cmp dword [eax + 0x40], 0
setne cl
mov byte [edi + 0x50], cl
jmp 0x1011a40d
mov esi, ecx
mov ebx, dword [edi + 0x4c]
xor esi, dword [0x101be248]
xor ebx, dword [0x101be24c]
mov dword [esp + 0x38], 0x10095cf0
mov dword [esp + 0x3c], 0x101a52a0
mov dword [esp], 8
call fcn.10145ba4
mov dword [eax + 4], ebx
mov dword [eax], esi
mov dword [esp + 0x30], eax
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
movsd xmm0, qword [esp + 0x20]
movsd qword [esp + 0x10], xmm0
lea eax, [esp + 0x2c]
mov dword [esp + 0x18], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x10178420
mov dword [esp + 4], 0x101bb2dc
mov dword [esp], 0x49
call fcn.10095de0
mov eax, dword [esp + 0x3c]
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x1011a407
mov esi, dword [esp + 0x30]
call dword [section..00cfg]
mov dword [esp], esi
call ecx
jmp 0x1011a407
mov dword [esp], 0x102ce848
call fcn.10145c47
cmp dword [0x102ce848], 0xffffffff
jne 0x1011a443
mov dword [0x102ce844], 0
mov dword [0x102ce840], 0xffffffff
mov dword [esp], 0
mov ecx, 0x102ce840
call fcn.1007a5a0
sub esp, 4
mov dword [esp], 0x102ce848
call fcn.10145cbd
jmp 0x1011a443
mov dword [esp], 0x102ce828
call fcn.10145c47
cmp dword [0x102ce828], 0xffffffff
jne 0x1011a49f
mov dword [0x102ce824], 0
mov dword [0x102ce820], 0xffffffff
mov dword [esp], 0
mov ecx, 0x102ce820
call fcn.1007a5a0
sub esp, 4
mov dword [esp], 0x102ce828
call fcn.10145cbd
jmp 0x1011a49f
Function at 0x1011a650
Capabilities:
Access peb ldr_data
Get ntdll base address
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x38
mov edi, dword [ebp + 8]
mov eax, dword [0x101b9014]
xor eax, ebp
mov dword [esp + 0x30], eax
mov dword [esp + 4], 0xffffffff
mov dword [esp + 8], 0xffffffff
mov dword [esp + 0xc], 0xffffffff
call fcn.10065990
mov ecx, dword [edi + 0x4c]
mov dword [esp + 0x10], ecx
sar ecx, 0x1f
mov dword [esp + 0x14], ecx
lea esi, [esp + 0x10]
lea ecx, [esp + 4]
push 1
push esi
push 0x10
push dword [edi + 0x10]
push eax
call fcn.1005f070
mov dword [esp + 0x10], 0xd017d00d
mov dword [esp + 0x2c], 0x1d178119
mov eax, dword [edi + 0x10]
mov dword [esp + 0x14], eax
movups xmm0, xmmword [edi + 0x34]
movups xmmword [esp + 0x18], xmm0
mov eax, dword [edi + 0x44]
mov dword [esp + 0x28], eax
push esi
call fcn.10012050
add esp, 4
mov eax, dword [0x102ce828]
mov ecx, dword [0x101bd164]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x1011a803
push dword [0x101bac5c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
xor ebx, ebx
and eax, 0xfffffffc
je 0x1011a724
mov ecx, dword [0x102ce820]
mov edx, dword [eax + ecx*8 + 4]
cmp edx, dword [0x102ce824]
jne 0x1011a724
mov ebx, dword [eax + ecx*8]
push dword [0x101bac5c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
and eax, 0xfffffffc
je 0x1011a7e6
mov ecx, dword [0x102ce820]
mov dword [eax + ecx*8], edi
mov ecx, dword [0x102ce824]
mov edx, dword [0x102ce820]
mov dword [eax + edx*8 + 4], ecx
mov esi, dword [edi]
mov dword [edi], 0
mov ecx, dword [esi + 4]
call dword [section..00cfg]
push esi
call ecx
add esp, 4
test esi, esi
je 0x1011a781
lock dec dword [esi]
jne 0x1011a781
mov ecx, dword [esi + 8]
call dword [section..00cfg]
push esi
call ecx
add esp, 4
push dword [0x101bac5c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
and eax, 0xfffffffc
je 0x1011a7f8
mov ecx, dword [0x102ce820]
mov dword [eax + ecx*8], ebx
mov ecx, dword [0x102ce824]
mov edx, dword [0x102ce820]
mov dword [eax + edx*8 + 4], ecx
mov dword [esp + 0x10], 0
mov dword [esp + 0x2c], 0
lea eax, [esp + 0x10]
push eax
call fcn.10012050
add esp, 4
lea ecx, [esp + 4]
call fcn.1005f380
mov ecx, dword [esp + 0x30]
xor ecx, ebp
call fcn.101465a3
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 4
test edi, edi
je 0x1011a752
call fcn.1007a6e0
jmp 0x1011a739
test ebx, ebx
je 0x1011a7ab
call fcn.1007a6e0
jmp 0x1011a792
push 0x102ce828
call fcn.10145c47
add esp, 4
cmp dword [0x102ce828], 0xffffffff
jne 0x1011a6fc
mov dword [0x102ce824], 0
mov dword [0x102ce820], 0xffffffff
mov ecx, 0x102ce820
push 0
call fcn.1007a5a0
push 0x102ce828
call fcn.10145cbd
add esp, 4
jmp 0x1011a6fc
Function at 0x1011ad80
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x10
mov esi, ecx
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov edi, dword [0x101b9014]
xor edi, ebp
mov dword [esp + 0xc], edi
mov dword [esi], edx
mov dword [esi + 0xc], 0
mov dword [esi + 8], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x24], ecx
mov dword [esi + 0x28], eax
mov eax, dword [0x102ce838]
mov ecx, dword [0x101bd164]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x1011aee4
push dword [0x101bac5c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
xor edi, edi
and eax, 0xfffffffc
je 0x1011ae16
mov ecx, dword [0x102ce830]
mov edx, dword [eax + ecx*8 + 4]
cmp edx, dword [0x102ce834]
jne 0x1011ae16
mov edi, dword [eax + ecx*8]
mov eax, dword [esi + 0x14]
mov ecx, eax
shr ecx, 0xe
mov edx, eax
shr edx, 0x13
mov edx, dword [edx*4 + 0x101c1e84]
bt edx, ecx
jae 0x1011ae38
push eax
call fcn.10069280
add esp, 4
mov eax, edi
shr eax, 0xe
mov ecx, edi
shr ecx, 0x13
mov ecx, dword [ecx*4 + 0x101c1e84]
bt ecx, eax
jae 0x1011ae59
push edi
call fcn.10069180
add esp, 4
jmp 0x1011ae65
mov eax, edi
shr eax, 0x15
mov byte [eax + 0x101c9e84], 1
mov dword [esi + 0x14], edi
test byte [0x101bb204], 9
jne 0x1011aeb5
mov byte [esi + 0x10], 0
push dword [0x101bac5c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
and eax, 0xfffffffc
je 0x1011aed9
mov ecx, dword [0x102ce830]
mov dword [eax + ecx*8], esi
mov ecx, dword [0x102ce834]
mov edx, dword [0x102ce830]
mov dword [eax + edx*8 + 4], ecx
mov ecx, dword [esp + 0xc]
xor ecx, ebp
call fcn.101465a3
mov eax, esi
lea esp, [ebp - 8]
pop esi
pop edi
pop ebp
ret 0xc
mov byte [esi + 0x10], 1
mov ecx, dword [0x101bac60]
call dword [section..00cfg]
mov eax, esp
push eax
call ecx
add esp, 4
movsd xmm0, qword [esp]
movsd qword [esi + 8], xmm0
jmp 0x1011ae75
test esi, esi
je 0x1011ae9f
call fcn.1007a6e0
jmp 0x1011ae86
push 0x102ce838
call fcn.10145c47
add esp, 4
cmp dword [0x102ce838], 0xffffffff
jne 0x1011adee
mov dword [0x102ce834], 0
mov dword [0x102ce830], 0xffffffff
mov ecx, 0x102ce830
push 0
call fcn.1007a5a0
push 0x102ce838
call fcn.10145cbd
add esp, 4
jmp 0x1011adee