joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100027d0
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
push 0
push 0x80
push 4
push 0
push 1
push 0x40000000
push str.c:_nNetLib.log
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x1000283e
push 2
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, edi
mov dword [esp + 4], 0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10002810
push 0
lea ecx, [esp + 8]
push ecx
sub eax, edx
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push esi
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop ecx
ret
Function at 0x10002d80
Capabilities:
Connect pipe
Create pipe

Disassembly:
push ecx
push ebp
push edi
mov edi, ecx
xor ebp, ebp
cmp dword [edi + 4], ebp
jne 0x10002d94
pop edi
xor eax, eax
pop ebp
pop ecx
ret 4
cmp dword [edi + 8], ebp
jne 0x10002dc1
push 0x30
call fcn.1000c136
add esp, 4
cmp eax, ebp
je 0x10002db5
mov dword [eax + 0x20], ebp
mov dword [eax + 0x24], ebp
mov dword [eax + 0x28], ebp
mov dword [eax + 0x2c], ebp
jmp 0x10002db7
xor eax, eax
mov ecx, eax
mov dword [edi + 8], eax
call fcn.10004250
mov eax, dword [edi + 8]
push ebx
push eax
mov eax, dword [edi + 4]
push 0xbb8
push ebp
push ebp
push 0xff
push ebp
push 0x40000003
push eax
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x10002df2
pop ebx
pop edi
xor eax, eax
pop ebp
pop ecx
ret 4
xor ecx, ecx
push esi
mov esi, dword [esp + 0x18]
cmp esi, ebp
setne cl
mov dword [esp + 0x18], ebp
mov dword [esp + 0x10], ecx
cmp esi, ebp
jne 0x10002e4a
push ebp
push 0xa0
push ebp
call fcn.100094a0
add esp, 0xc
cmp eax, ebp
je 0x10002e30
mov dword [eax + 0x34], ebp
mov dword [eax + 0x38], ebp
mov dword [eax + 0x3c], ebp
mov dword [eax + 0x40], ebp
mov dword [eax + 0x44], ebp
mov esi, eax
jmp 0x10002e32
xor esi, esi
test byte [edi + 0x74], 1
je 0x10002e46
cmp esi, ebp
je 0x10002eb4
lea edx, [edi + 0x78]
push edx
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
cmp esi, ebp
je 0x10002eb4
mov eax, esi
call fcn.10002780
mov dword [esi + 0x20], ebp
mov dword [esi + 0x14], edi
mov dword [esi + 0x24], 1
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x28], 2
mov eax, dword [edi]
mov edx, dword [eax + 0x14]
push esi
mov ecx, edi
call edx
push ebp
push 0x100028a0
push ebx
call dword [sym.imp.KERNEL32.dll_BindIoCompletionCallback]
test eax, eax
je 0x10002ea7
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
jne 0x10002ec9
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x10002ec9
push ebx
call dword [sym.imp.KERNEL32.dll_CancelIo]
mov dword [esp + 0x18], ebp
cmp dword [esp + 0x10], ebp
jne 0x10002eb4
mov eax, edi
call fcn.10003ae0
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [esp + 0x18]
mov eax, esi
pop esi
pop ebx
pop edi
pop ebp
pop ecx
ret 4
add edi, 0x64
push edi
mov esi, 1
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov eax, esi
pop esi
pop ebx
pop edi
pop ebp
pop ecx
ret 4
Function at 0x10002f00
Capabilities:
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
sub esp, 8
push ebp
push esi
push edi
push 1
push 0
push 0
push 6
push 1
push 2
mov esi, eax
mov edi, ecx
call dword [sym.imp.WS2_32.dll_WSASocketW]
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x10002f2c
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 8
ret
push ebx
mov ebx, dword [sym.imp.WS2_32.dll_setsockopt]
push 4
lea eax, [esp + 0x14]
push eax
push 0xffffff7f
push 0xffff
push ebp
mov dword [esp + 0x24], 0
call ebx
push 4
lea ecx, [esp + 0x18]
push ecx
push 1
push 6
push ebp
mov dword [esp + 0x28], 1
call ebx
cmp eax, 0xffffffff
je 0x10002fb2
xor ebx, ebx
cmp esi, ebx
jne 0x10002fc3
push ebx
push 0xa0
push ebx
call fcn.100094a0
add esp, 0xc
cmp eax, ebx
je 0x10002f96
mov dword [eax + 0x34], ebx
mov dword [eax + 0x38], ebx
mov dword [eax + 0x3c], ebx
mov dword [eax + 0x40], ebx
mov dword [eax + 0x44], ebx
mov esi, eax
jmp 0x10002f98
xor esi, esi
test byte [edi + 0x74], 1
je 0x10002fae
cmp esi, ebx
je 0x10002fb2
lea edx, [edi + 0x78]
push edx
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
xor ebx, ebx
cmp esi, ebx
jne 0x10002fc3
push ebp
call dword [sym.imp.WS2_32.dll_closesocket]
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 8
ret
mov eax, esi
call fcn.10002780
mov dword [esi + 0x14], edi
mov dword [esi + 0x1c], ebp
mov dword [esi + 0x24], 1
lea ebx, [esi + 0x28]
mov dword [ebx], 2
mov eax, dword [edi]
mov edx, dword [eax + 0x14]
push esi
mov ecx, edi
call edx
mov edx, dword [edi + 0x14]
push esi
lea eax, [esi + 0x9c]
push eax
mov eax, dword [edi + 0xc]
push 0x20
push 0x20
push 0
lea ecx, [esi + 0x5c]
push ecx
push ebp
push edx
call eax
mov ebp, eax
test ebp, ebp
jne 0x10003031
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x10003031
push ebx
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
mov eax, edi
call fcn.10003ae0
pop ebx
pop edi
pop esi
mov eax, ebp
pop ebp
add esp, 8
ret
add edi, 0x5c
push edi
mov ebp, 1
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
pop ebx
pop edi
pop esi
mov eax, ebp
pop ebp
add esp, 8
ret

Function at 0x10003150
Capabilities:
Send data
Send data on socket

Disassembly:
cmp dword [eax + 0x20], 2
je 0x1000315c
mov eax, 0xfffffffe
ret
mov edx, dword [eax + 0x54]
add edx, 0xfffffff0
cmp dword [eax + 0x58], edx
lea ecx, [eax + 0x58]
jbe 0x1000316c
mov dword [ecx], edx
mov edx, dword [ecx]
push 0
push 0
mov dword [eax + 0x48], edx
mov edx, dword [eax + 0x3c]
push edx
lea edx, [eax + 0x2c]
push edx
mov edx, dword [eax + 0x1c]
push 0
push ecx
push 2
lea ecx, [eax + 0x40]
push ecx
push edx
call dword [sym.imp.WS2_32.dll_WSASendTo]
ret
Function at 0x100036b0
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
push esi
mov esi, eax
lea ebx, [esi + 0x28]
push ebx
mov dword [esp + 0xc], 0
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
test eax, eax
jg 0x100036d8
push ebx
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
pop esi
xor eax, eax
pop ebx
pop ecx
ret
push edi
mov edi, 0x200
mov dword [esi + 0x24], 2
call fcn.10003a60
mov ecx, dword [esi + 0x38]
mov eax, dword [esi + 0x3c]
push esi
sub eax, ecx
lea edx, [esp + 0x10]
push edx
push eax
mov eax, dword [esi + 0x34]
add eax, ecx
mov ecx, dword [esi + 0x1c]
push eax
push ecx
mov dword [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov esi, eax
pop edi
test esi, esi
jne 0x1000373e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x1000372c
cmp eax, 0xea
jne 0x10003737
mov esi, 1
mov eax, esi
pop esi
pop ebx
pop ecx
ret
push ebx
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
mov eax, esi
pop esi
pop ebx
pop ecx
ret

Function at 0x10003750
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ecx
cmp dword [esi + 0x50], 0
push ebx
push ebp
push edi
jne 0x10003797
push 0
push 0x2000
push 0
call fcn.100094a0
add esp, 0xc
mov dword [esi + 0x50], eax
test eax, eax
je 0x100037f0
mov dword [esi + 0x44], eax
add eax, 0x10
mov dword [esi + 0x54], 0x2000
mov dword [esi + 0x58], 0
mov dword [esi + 0x40], 0x10
mov dword [esi + 0x4c], eax
mov dword [esi + 0x48], 0x1ff0
lea ebp, [esi + 0x3c]
lea ebx, [esi + 0x5c]
lea edi, [esi + 0x58]
mov eax, dword [esi + 0x54]
mov ecx, dword [esi + 0x1c]
push 0
push esi
push ebp
mov dword [edi], eax
lea eax, [esi + 0x2c]
push eax
push ebx
push edi
push 2
lea eax, [esi + 0x40]
push eax
push ecx
mov dword [ebx], 0
call dword [sym.imp.WS2_32.dll_WSARecvFrom]
test eax, eax
jne 0x100037cd
mov eax, dword [edi]
test eax, eax
jle 0x1000380c
mov ecx, dword [esi + 0x20]
sub ecx, 2
je 0x100037f9
dec ecx
jne 0x100037f0
cmp eax, 0x10
jb 0x100037a0
mov edx, dword [esp + 0x14]
push esi
push edx
mov ecx, eax
call fcn.100031a0
test eax, eax
jne 0x100037a0
xor eax, eax
pop edi
pop ebp
pop ebx
pop ecx
ret 4
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx]
mov edx, dword [edx + 0x10]
push eax
mov eax, dword [esi + 0x50]
push eax
push esi
call edx
jmp 0x100037a0
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
jne 0x100037f0
pop edi
pop ebp
mov eax, 1
pop ebx
pop ecx
ret 4

Function at 0x10003c20
Capabilities:
Write file on windows

Disassembly:
push edi
xor edi, edi
test eax, eax
je 0x10003c8a
push esi
push eax
mov eax, dword [esp + 0x10]
push eax
push ecx
call fcn.100035d0
mov esi, eax
test esi, esi
je 0x10003c83
mov eax, dword [esi + 0x30]
mov ecx, dword [esi + 0x2c]
push esi
lea edx, [esi + 0x34]
push edx
mov edx, dword [esi + 0x1c]
push eax
push ecx
mov dword [esi + 0x24], 3
push edx
mov dword [esi + 0x28], 1
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, eax
test edi, edi
jne 0x10003c75
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x10003c7a
lea eax, [edi + 1]
pop esi
pop edi
ret 4
push esi
call fcn.10009960
add esp, 4
pop esi
mov eax, edi
pop edi
ret 4
mov eax, edi
pop edi
ret 4
Function at 0x10004c60
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x118
mov eax, dword [0x1001b2a8]
xor eax, esp
mov dword [esp + 0x114], eax
push esi
lea eax, [esp + 0x14]
push edi
push eax
mov esi, ecx
call fcn.10009b50
add esp, 4
lea eax, [esp + 0x18]
call fcn.10002a60
call fcn.10005890
mov edi, dword [sym.imp.USER32.dll_SetTimer]
push 0
push 0x1388
push 1
push eax
mov dword [esi + 0x7c], eax
call edi
mov ecx, dword [esi + 0x7c]
push 0
push 0x1f40
push 2
push ecx
call edi
lea eax, [esp + 0xc]
push eax
mov dword [esp + 0x10], 0x3a0047
mov dword [esp + 0x14], 0x5c
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 2
je 0x10004cec
cmp eax, 3
je 0x10004cec
cmp eax, 4
je 0x10004cec
cmp eax, 6
jne 0x10004cf8
push 6
push esi
lea eax, [esp + 0x14]
call fcn.10004e20
mov ecx, dword [esp + 0x11c]
pop edi
pop esi
xor ecx, esp
xor eax, eax
call fcn.1000c11c
mov esp, ebp
pop ebp
ret

Function at 0x10004d80
Capabilities:
Get disk information

Disassembly:
sub esp, 0x10
mov eax, dword [0x1001b2a8]
xor eax, esp
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x14]
push ebx
mov ebx, ecx
cmp eax, 0x8000
je 0x10004dbe
jle 0x10004dff
cmp eax, 0x8004
jg 0x10004dff
mov eax, esi
call fcn.10004ea0
pop ebx
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.1000c11c
add esp, 0x10
ret 4
lea eax, [ebx + 0x41]
mov word [esp + 4], ax
lea ecx, [esp + 4]
xor eax, eax
push ecx
mov dword [esp + 0xa], 0x5c003a
mov word [esp + 0xe], ax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 2
je 0x10004df4
cmp eax, 3
je 0x10004df4
cmp eax, 4
je 0x10004df4
cmp eax, 6
jne 0x10004dff
push ebx
push esi
lea eax, [esp + 0xc]
call fcn.10004e20
mov ecx, dword [esp + 0x10]
pop ebx
xor ecx, esp
call fcn.1000c11c
add esp, 0x10
ret 4
Function at 0x10004f90
Capabilities:
Create directory
Get disk information
Set file attributes

Disassembly:
sub esp, 0x47c
mov eax, dword [0x1001b2a8]
xor eax, esp
mov dword [esp + 0x474], eax
push esi
mov esi, ecx
cmp dword [esi], 0x1a
push edi
jle 0x10004fcb
mov dword [esi + 4], 1
pop edi
pop esi
mov ecx, dword [esp + 0x474]
xor ecx, esp
call fcn.1000c11c
add esp, 0x47c
ret
mov ax, word [esi]
push 0x24c
lea edx, [esp + 0x18]
add ax, 0x41
push 0
push edx
mov word [esp + 0x270], ax
mov dword [esp + 0x272], 0x5c003a
mov dword [esp + 0x276], 0x2a
mov dword [esp + 0x1c], 0
call fcn.10012d20
add esp, 0xc
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x268]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
je 0x100050e8
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov dx, word [esi]
xor eax, eax
mov word [esp + 0x272], ax
add dx, 0x41
lea eax, [esp + 0x270]
mov word [esp + 0x270], dx
add eax, 0xfffffffe
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x10005052
mov ecx, dword [0x10019438]
mov dx, word [0x1001943c]
push 0
push 0
push 0
mov dword [eax], ecx
push 0
mov word [eax + 4], dx
lea eax, [esp + 0x1c]
push eax
push 0
push 0
lea ecx, [esp + 0x28c]
push ecx
mov dword [esp + 0x2c], 0
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
jne 0x100050a4
mov dword [esp + 0xc], 0x83345681
lea edi, [esp + 0x270]
add edi, 0xfffffffe
mov edi, edi
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x100050b0
push 0
lea edx, [esp + 0x274]
mov ecx, 7
mov esi, str.:360SANDBOX_
push edx
rep movsd dword es:[edi], dword [esi]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 6
lea eax, [esp + 0x274]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov ecx, dword [esp + 0x47c]
pop edi
pop esi
xor ecx, esp
call fcn.1000c11c
add esp, 0x47c
ret
Function at 0x10005600
Capabilities:
Create shortcut via ishelllink
Set file attributes

Disassembly:
sub esp, 0x82c
mov eax, dword [0x1001b2a8]
xor eax, esp
mov dword [esp + 0x828], eax
push esi
push edi
push 0x203
lea eax, [esp + 0x14]
push ebx
push eax
mov edi, ecx
call fcn.1000caa1
lea eax, [esp + 0x1c]
add esp, 0xc
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10005632
sub eax, edx
sar eax, 1
mov esi, eax
cmp esi, 1
jl 0x100057fb
movzx eax, word [esp + esi*2 + 0xe]
cmp eax, 0x5c
je 0x1000565b
cmp eax, 0x2f
jne 0x10005663
dec esi
xor ecx, ecx
mov word [esp + esi*2 + 0x10], cx
push 0x207
lea edx, [esp + 0x424]
push edi
push edx
call fcn.1000caa1
lea eax, [esi - 1]
add esp, 0xc
test eax, eax
js 0x100056fc
movzx ecx, word [esp + eax*2 + 0x10]
cmp ecx, 0x5c
je 0x10005698
cmp ecx, 0x2f
je 0x10005698
dec eax
jns 0x10005684
jmp 0x100056fc
lea edi, [esp + 0x420]
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x100056a2
mov ecx, dword [0x10019488]
lea eax, [esp + eax*2 + 0x12]
mov dword [edi], ecx
mov edx, eax
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x100056c0
lea edi, [esp + 0x420]
sub eax, edx
add edi, 0xfffffffe
jmp 0x100056e0
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x100056e0
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [esp + 0x10]
add eax, 0xfffffffe
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x10005703
mov edx, dword [0x1001948c]
mov ecx, dword [0x10019490]
mov esi, dword [sym.imp.ole32.dll_CoCreateInstance]
mov dword [eax], edx
mov dx, word [0x10019494]
mov dword [eax + 4], ecx
mov word [eax + 8], dx
lea eax, [esp + 8]
push eax
push 0x10017290
push 1
push 0
push 0x100172a0
call esi
cmp eax, 0x800401f0
jne 0x1000576a
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
lea ecx, [esp + 8]
push ecx
push 0x10017290
push 1
push 0
push 0x100172a0
call esi
test eax, eax
js 0x100057fb
mov eax, dword [esp + 8]
mov edx, dword [eax]
push str._windir__system32_rundll32.exe
push eax
mov eax, dword [edx + 0x50]
call eax
mov eax, dword [esp + 8]
mov ecx, dword [eax]
lea edx, [esp + 0x420]
push edx
push eax
mov eax, dword [ecx + 0x2c]
call eax
mov eax, dword [esp + 8]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x44]
push 3
push str._SystemRoot__system32SHELL32.dll
push eax
call edx
mov eax, dword [esp + 8]
mov ecx, dword [eax]
lea edx, [esp + 0xc]
push edx
push 0x100172b0
push eax
mov eax, dword [ecx]
call eax
test eax, eax
js 0x100057ef
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
push 0
lea edx, [esp + 0x14]
push edx
push eax
mov eax, dword [ecx + 0x18]
call eax
test eax, eax
js 0x100057e3
push 6
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 8]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov ecx, dword [esp + 0x830]
pop edi
pop esi
xor ecx, esp
call fcn.1000c11c
add esp, 0x82c
ret
Function at 0x10005820
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x10
push esi
lea eax, [esp + 8]
push edi
push eax
lea edx, [esp + 0x14]
lea ecx, [esp + 0x18]
mov dword [esp + 0x10], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
call fcn.10009e70
mov edi, eax
add esp, 4
test edi, edi
je 0x10005887
mov ecx, dword [esp + 0x1c]
push 0x1001951c
push ecx
call fcn.1000cc63
mov esi, eax
add esp, 8
test esi, esi
je 0x10005887
mov edx, dword [esp + 0xc]
push esi
push 1
push edx
push edi
call fcn.1000cdd1
push esi
call fcn.1000ceb8
add esp, 0x14
pop edi
pop esi
add esp, 0x10
ret 4
Function at 0x10006140
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x24
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov esi, dword [sym.imp.KERNEL32.dll_SleepEx]
mov edi, eax
xor ebx, ebx
mov eax, dword [0x1001d720]
test eax, eax
je 0x1000616f
cmp dword [0x1001d768], edi
jne 0x1000617f
inc dword [0x1001d764]
jmp 0x1000619d
mov ecx, 1
mov edx, 0x1001d720
xchg dword [edx], ecx
test ecx, ecx
je 0x1000618d
inc ebx
test bl, 0x3f
jne 0x10006156
push 0
push 0
call esi
jmp 0x10006156
mov dword [0x1001d768], edi
mov dword [0x1001d764], 1
mov eax, dword [0x1001d2bc]
test eax, eax
jne 0x1000621f
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [esp + 0x28]
mov esi, 0x100000
cmp eax, 0x100000
jb 0x100061c3
mov esi, eax
mov edi, dword [esp + 0x10]
lea edx, [esi - 1]
mov dword [0x1001cdc8], eax
test esi, edx
jne 0x100061da
lea eax, [edi - 1]
test edi, eax
je 0x100061df
call fcn.1000cf2c
mov dword [0x1001d2c4], esi
mov dword [0x1001d2c0], edi
mov dword [0x1001d2c8], 0x40000
mov dword [0x1001d2cc], 0x200000
mov dword [0x1001d2d0], 7
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor eax, 0x55555550
and eax, 0xfffffff8
or eax, 8
mov dword [0x1001d2bc], eax
dec dword [0x1001d764]
pop edi
pop esi
pop ebx
jne 0x1000623d
mov dword [0x1001d768], 0
xor ecx, ecx
mov edx, 0x1001d720
xchg dword [edx], ecx
mov eax, 1
add esp, 0x24
ret
Function at 0x10008c70
Capabilities:
Set thread local storage value

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebp, dword [sym.imp.KERNEL32.dll_SleepEx]
mov esi, eax
xor ebx, ebx
mov eax, dword [edi]
test eax, eax
je 0x10008c97
cmp dword [edi + 0x48], esi
jne 0x10008ca4
inc dword [edi + 0x44]
jmp 0x10008cbc
mov ecx, 1
mov edx, edi
xchg dword [edx], ecx
test ecx, ecx
je 0x10008cb2
inc ebx
test bl, 0x3f
jne 0x10008c87
push 0
push 0
call ebp
jmp 0x10008c87
mov dword [edi + 0x48], esi
mov dword [edi + 0x44], 1
xor ecx, ecx
lea eax, [edi + 0x58]
cmp dword [eax - 4], 0
je 0x10008cf3
cmp dword [eax], 0
je 0x10008ce8
cmp dword [eax + 4], 0
je 0x10008ceb
cmp dword [eax + 8], 0
je 0x10008cf0
add ecx, 4
add eax, 0x10
cmp ecx, 0x100
jl 0x10008cc1
jmp 0x10008cf3
inc ecx
jmp 0x10008cf3
add ecx, 2
jmp 0x10008cf3
add ecx, 3
mov dword [esp + 0x10], ecx
cmp ecx, 0x100
jne 0x10008d17
dec dword [edi + 0x44]
jne 0x10008d0f
mov dword [edi + 0x48], 0
xor eax, eax
xchg dword [edi], eax
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
mov esi, dword [edi + 0x458]
push 1
push 0x68
mov eax, esi
call fcn.10007fd0
add esp, 8
test eax, eax
je 0x10008da6
mov ecx, dword [eax - 4]
test cl, 3
mov edx, 0
sete dl
and ecx, 0xfffffff8
lea edx, [edx*4 + 8]
sub ecx, edx
mov edx, dword [0x1001cdcc]
test edx, edx
je 0x10008d58
cmp dword [esi + 0x10], edx
jae 0x10008d61
mov edx, dword [esi + 0x10]
mov dword [0x1001cdcc], edx
mov edx, dword [0x1001d26c]
test edx, edx
je 0x10008d6f
cmp ecx, edx
jbe 0x10008d82
mov edx, dword [0x1001d2c0]
add ecx, edx
dec edx
not edx
and ecx, edx
mov dword [0x1001d26c], ecx
mov ebx, eax
mov edx, dword [esp + 0x10]
xor esi, esi
mov dword [edi + edx*4 + 0x54], ebx
cmp ebx, esi
jne 0x10008daa
dec dword [edi + 0x44]
jne 0x10008d9e
mov dword [edi + 0x48], esi
xor eax, eax
xchg dword [edi], eax
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
xor ebx, ebx
jmp 0x10008d84
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebx + 4], eax
cmp dword [edi + 0x458], esi
je 0x10008dca
lea ecx, [edi + 0x458]
add ecx, 4
inc esi
cmp dword [ecx], 0
jne 0x10008dc1
cdq
xor eax, edx
sub eax, edx
cdq
idiv esi
dec dword [edi + 0x44]
mov dword [ebx], edx
jne 0x10008de6
mov dword [edi + 0x48], 0
xor ecx, ecx
mov edx, edi
xchg dword [edx], ecx
mov eax, dword [esp + 0x10]
mov ecx, dword [edi + 0x454]
inc eax
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x10008e02
call fcn.1000cf2c
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
pop ecx
ret
Function at 0x10008f70
Capabilities:
Allocate thread local storage

Disassembly:
mov eax, dword [0x1001d2bc]
test eax, eax
jne 0x10008f7e
call fcn.10006140
push ebx
push ebp
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edi, dword [sym.imp.KERNEL32.dll_SleepEx]
xor ebp, ebp
mov esi, eax
xor ebx, ebx
mov ecx, dword [0x1001d720]
test ecx, ecx
je 0x10008fae
cmp dword [0x1001d768], esi
jne 0x10008fbe
inc dword [0x1001d764]
jmp 0x10008fda
mov edx, 1
mov eax, 0x1001d720
xchg dword [eax], edx
test edx, edx
je 0x10008fca
inc ebx
test bl, 0x3f
jne 0x10008f94
push ebp
push ebp
call edi
jmp 0x10008f94
mov dword [0x1001d768], esi
mov dword [0x1001d764], 1
mov edi, dword [esp + 0x14]
cmp dword [edi + 0x50], ebp
jne 0x1000909a
mov dword [edi + 0x48], ebp
mov dword [edi + 0x44], ebp
mov dword [edi], ebp
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [edi + 0x454], eax
cmp eax, 0xffffffff
je 0x10009013
mov esi, dword [esp + 0x18]
call fcn.10007e80
mov dword [edi + 0x458], eax
cmp eax, ebp
jne 0x10009078
cmp dword [esp + 0x1c], ebp
jge 0x1000901e
call fcn.1000cf2c
mov eax, edi
call fcn.10008c30
mov eax, dword [edi + 0x458]
cmp eax, ebp
je 0x1000903a
call fcn.10007f00
mov dword [edi + 0x458], ebp
mov eax, dword [edi + 0x454]
cmp eax, ebp
je 0x1000905a
push eax
call dword [sym.imp.KERNEL32.dll_TlsFree]
test eax, eax
jne 0x10009054
call fcn.1000cf2c
mov dword [edi + 0x454], ebp
dec dword [0x1001d764]
jne 0x10009071
mov dword [0x1001d768], ebp
xor ecx, ecx
mov edx, 0x1001d720
xchg dword [edx], ecx
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
mov dword [eax + 0x218], edi
mov eax, dword [esp + 0x1c]
cmp eax, 0x10
jle 0x1000908e
mov eax, 0x10
jmp 0x10009097
cmp eax, ebp
jne 0x10009097
mov eax, 4
mov dword [edi + 0x50], eax
mov eax, 1
sub dword [0x1001d764], eax
jne 0x100090b6
mov dword [0x1001d768], ebp
xor ecx, ecx
mov edx, 0x1001d720
xchg dword [edx], ecx
pop edi
pop esi
pop ebp
pop ebx
ret