joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003e2b0
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 0x10]
push esi
push edi
test ecx, ecx
je 0x10082e97
mov edx, dword [ebp + 0x14]
call fcn.1003e316
mov esi, eax
test esi, esi
je 0x1003e312
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x18]
push esi
push 0x1003e130
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateThread]
mov edi, eax
test edi, edi
je 0x10082f74
mov ecx, dword [ebp + 0x1c]
test ecx, ecx
je 0x1003e300
mov eax, dword [ebp - 4]
mov dword [ecx], eax
xor esi, esi
test esi, esi
jne 0x10082f86
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
xor edi, edi
jmp 0x1003e302
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ecx, dword [0x1010e2c0]
mov esi, eax
cmp ecx, 0xffffffff
je 0x10082ee2
call fcn.10029fa0
mov edi, eax
test edi, edi
je 0x10082edc
cmp edi, 0xffffffff
jne 0x10082f42
push esi
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
mov eax, 0x1010eac0
mov dword [eax], 0x16
call sym.ucrtbase.dll__invalid_parameter_noinfo
xor eax, eax
jmp 0x1003e30c
mov ecx, dword [0x1010e2c0]
or edx, 0xffffffff
call fcn.10032a89
test eax, eax
je 0x10082ebe
push 0x364
push 2
call sym.ucrtbase.dll__calloc_base
pop ecx
mov edi, eax
pop ecx
mov ecx, dword [0x1010e2c0]
test edi, edi
jne 0x10082f28
xor edx, edx
call fcn.10032a89
push edi
jmp 0x10082f20
mov ecx, dword [0x1010e2c0]
xor edx, edx
call fcn.10032a89
push edi
call sym.ucrtbase.dll__free_base
pop ecx
jmp 0x10082ebe
mov edx, edi
call fcn.10032a89
test eax, eax
je 0x10082f12
mov ecx, edi
call fcn.10031ad6
push 0
call sym.ucrtbase.dll__free_base
pop ecx
test edi, edi
je 0x10082ebe
mov ecx, dword [0x1010e2c4]
call fcn.10029fa0
imul eax, eax, 0x364
push esi
add edi, eax
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
test edi, edi
je 0x10082ec5
lea eax, [edi + 0x10]
jmp 0x10082eca
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ecx, eax
call fcn.1003779a
jmp 0x1003e312
cmp dword [esi + 8], 0
je 0x10082f95
push dword [esi + 8]
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
cmp dword [esi + 0xc], 0
je 0x10082fa4
push dword [esi + 0xc]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_1_0.dll_FreeLibrary]
push esi
call sym.ucrtbase.dll__free_base
pop ecx
jmp 0x1003e30a

Function at 0x10044810
Capabilities:
Check if file exists

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
pop ebp
jmp fcn.10044821
Function at 0x10045cd0
Capabilities:
Create thread
Resume thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 8]
push esi
push edi
test ecx, ecx
je 0x10089c59
mov edx, dword [ebp + 0x10]
call fcn.1003e316
mov esi, eax
test esi, esi
je 0x10045d3b
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 4
push esi
push 0x10045c80
push dword [ebp + 0xc]
push 0
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateThread]
mov edi, eax
test edi, edi
je 0x10089d37
push edi
mov dword [esi + 8], edi
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_ResumeThread]
cmp eax, 0xffffffff
je 0x10089d37
xor esi, esi
test esi, esi
jne 0x10089d49
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
or edi, 0xffffffff
jmp 0x10045d2b
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ecx, dword [0x1010e2c0]
mov esi, eax
cmp ecx, 0xffffffff
je 0x10089ca5
call fcn.10029fa0
mov edi, eax
test edi, edi
je 0x10089c9f
cmp edi, 0xffffffff
jne 0x10089d05
push esi
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
mov eax, 0x1010eac0
mov dword [eax], 0x16
call sym.ucrtbase.dll__invalid_parameter_noinfo
or eax, 0xffffffff
jmp 0x10045d35
mov ecx, dword [0x1010e2c0]
or edx, 0xffffffff
call fcn.10032a89
test eax, eax
je 0x10089c80
push 0x364
push 2
call sym.ucrtbase.dll__calloc_base
pop ecx
mov edi, eax
pop ecx
mov ecx, dword [0x1010e2c0]
test edi, edi
jne 0x10089ceb
xor edx, edx
call fcn.10032a89
push edi
jmp 0x10089ce3
mov ecx, dword [0x1010e2c0]
xor edx, edx
call fcn.10032a89
push edi
call sym.ucrtbase.dll__free_base
pop ecx
jmp 0x10089c80
mov edx, edi
call fcn.10032a89
test eax, eax
je 0x10089cd5
mov ecx, edi
call fcn.10031ad6
push 0
call sym.ucrtbase.dll__free_base
pop ecx
test edi, edi
je 0x10089c80
mov ecx, dword [0x1010e2c4]
call fcn.10029fa0
imul eax, eax, 0x364
push esi
add edi, eax
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
test edi, edi
je 0x10089c87
lea eax, [edi + 0x10]
jmp 0x10089c8c
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ecx, eax
call fcn.1003779a
jmp 0x10045d3b
cmp dword [esi + 8], 0
je 0x10089d58
push dword [esi + 8]
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
cmp dword [esi + 0xc], 0
je 0x10089d67
push dword [esi + 0xc]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_1_0.dll_FreeLibrary]
push esi
call sym.ucrtbase.dll__free_base
pop ecx
jmp 0x10045d33

Function at 0x100527e0
Capabilities:
Hash data using fnv

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov edx, 0x811c9dc5
lea ecx, [eax + 5]
jmp 0x100527fe
movzx eax, al
xor eax, edx
imul edx, eax, 0x1000193
inc ecx
mov al, byte [ecx]
test al, al
jne 0x100527f2
mov eax, edx
pop ebp
ret
Function at 0x1005c6c3
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x1010e2b0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x10008e38
push 0x10008e30
push 0x10006aa4
push 2
call fcn.1005c599
add esp, 0x10
mov esi, eax
push dword [ebp + 8]
test esi, esi
je 0x1005c702
mov ecx, esi
call dword [0x10110268]
call esi
jmp 0x1005c708
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsGetValue]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1005cc20
mov esp, ebp
pop ebp
ret

Function at 0x1005d110
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x1005d14e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x1005d146
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x1005d150
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x1005d136
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x1005d160
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
je 0x1005d176
xor eax, eax
pop ebp
ret
mov ecx, dword [eax + 0x3c]
add ecx, eax
xor eax, eax
cmp dword [ecx], 0x4550
jne 0x1005d191
mov edx, 0x10b
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret

Function at 0x1005da48
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x48
push ebx
xor ebx, ebx
push esi
push ecx
mov esi, edx
mov dword [esp + 0x3c], ebx
push ecx
lea edx, [esp + 0x40]
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x50], ebx
mov byte [esp + 0x54], bl
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
mov byte [esp + 0x3c], bl
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov byte [esp + 0x24], bl
call fcn.1005d97f
pop ecx
pop ecx
test eax, eax
jne 0x1005db02
push ecx
push ecx
lea edx, [esp + 0x28]
mov ecx, esi
call fcn.1005d97f
pop ecx
pop ecx
test eax, eax
jne 0x1005db02
push ecx
push ecx
mov ecx, dword [ebp + 0x1c]
lea edx, [esp + 0x10]
call fcn.1005d97f
pop ecx
pop ecx
test eax, eax
jne 0x1005db02
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [esp + 0x18]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esp + 0x48]
push dword [esp + 0x64]
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateProcessW]
mov ebx, eax
lea ecx, [esp + 8]
call fcn.1005f7d2
lea ecx, [esp + 0x20]
call fcn.1005f7d2
lea ecx, [esp + 0x38]
call fcn.1005f7d2
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1005de21
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x1010e2b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
test edi, edi
je 0x1005de7b
mov esi, edi
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x1005de41
sub esi, ecx
lea ebx, [esi + 1]
test ebx, ebx
je 0x1005de7b
lea eax, [ebx + ebx]
call fcn.1005cea0
mov eax, esp
push esi
push edi
push ebx
push eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
call sym.ucrtbase.dll_mbstowcs_s
add esp, 0x14
test eax, eax
jne 0x1005de7b
push dword [ebp - 8]
call dword [sym.imp.api_ms_win_core_debug_l1_1_0.dll_OutputDebugStringW]
lea esp, [ebp - 0x18]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1005cc20
mov esp, ebp
pop ebp
ret

Function at 0x1005e267
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push esi
mov esi, ecx
mov eax, dword [esi + 4]
mov ecx, dword [esi]
mov edx, dword [eax]
mov ecx, dword [ecx]
mov edx, dword [edx + 0x4c]
call fcn.100300c2
mov eax, dword [esi + 0x10]
mov edx, dword [esi + 0xc]
mov ecx, dword [esi]
push dword [eax]
mov edx, dword [edx]
mov ecx, dword [ecx]
call fcn.1002fd50
pop ecx
mov ecx, dword [esi + 8]
mov dword [ecx], eax
test eax, eax
je 0x1005e340
mov eax, dword [esi + 0x10]
mov eax, dword [eax]
test eax, eax
je 0x1005e2e6
mov edx, 0x1010e3a0
push edi
mov di, word [eax]
xor ecx, ecx
inc ecx
cmp di, word [edx]
jne 0x1005e2d6
test di, di
je 0x1005e2d2
mov di, word [eax + 2]
cmp di, word [edx + 2]
jne 0x1005e2d6
add eax, 4
add edx, 4
test di, di
jne 0x1005e2ad
xor eax, eax
jmp 0x1005e2da
sbb eax, eax
or eax, ecx
pop edi
test eax, eax
je 0x1005e2e6
mov eax, 0x1010fa10
xchg dword [eax], ecx
mov eax, dword [esi + 4]
mov edx, dword [esi]
mov ecx, dword [eax]
mov edx, dword [edx]
add ecx, 0x4c
call fcn.10030780
mov ecx, dword [esi]
mov ecx, dword [ecx]
call fcn.10030870
mov eax, dword [esi + 4]
mov eax, dword [eax]
test byte [eax + 0x350], 2
jne 0x1005e353
test byte [0x1010ead0], 1
jne 0x1005e353
call fcn.10028920
lea ecx, [eax*4 + 0x1010f370]
mov eax, dword [esi + 4]
mov edx, dword [eax]
mov edx, dword [edx + 0x4c]
call fcn.10030780
call fcn.10028920
call fcn.10028920
pop esi
jmp fcn.10028920
mov ecx, dword [esi]
mov ecx, dword [ecx]
call fcn.10030870
mov ecx, dword [esi]
pop esi
mov ecx, dword [ecx]
jmp fcn.1002f3a0
pop esi
ret

Function at 0x1005e360
Capabilities:
Terminate process

Disassembly:
mov edi, edi
push esi
push 0x17
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_1.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x1005e374
push 5
pop ecx
int 0x29
push ecx
mov esi, 0xc0000417
push 2
mov edx, esi
pop ecx
call fcn.10062482
pop ecx
push esi
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
push eax
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TerminateProcess]
pop esi
ret
Function at 0x1005ff4c
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push esi
mov esi, ecx
push dword [esi + 8]
push dword [esi + 0xc]
call dword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_GetCurrentDirectoryW]
test eax, eax
jne 0x1005ff77
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ecx, eax
call fcn.1003779a
call sym.ucrtbase.dll__errno
mov eax, dword [eax]
jmp 0x1005ff9d
cmp eax, dword [esi + 0xc]
jbe 0x1005ff98
push eax
mov ecx, esi
call fcn.1005d9f3
test eax, eax
jne 0x1005ff9d
push dword [esi + 8]
push dword [esi + 0xc]
call dword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_GetCurrentDirectoryW]
test eax, eax
je 0x1005ff61
mov dword [esi + 0x10], eax
xor eax, eax
pop esi
ret 4

Function at 0x100604b0
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x100fbfa0
push 0x1005ccd0
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x1010e2b0]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
fstp xword [ebp - 0x28]
mov edi, dword [0x1010e2c4]
mov eax, dword [0x1010f3b8]
mov esi, dword [0x1010e2b0]
mov ecx, esi
and ecx, 0x1f
xor esi, eax
ror esi, cl
cmp esi, 0xffffffff
je 0x1007e3a5
test esi, esi
je 0x1007e379
push 1
push edi
mov ecx, esi
call dword [0x10110268]
call esi
wait
mov dword [ebp - 4], 0
fld xword [ebp - 0x28]
call sym.ucrtbase.dll__CIsqrt
fstp xword [ebp - 0x28]
wait
mov dword [ebp - 4], 0xfffffffe
call fcn.1006055f
fld xword [ebp - 0x28]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.1005cc20
mov esp, ebp
pop ebp
ret
mov esi, 0x10006a9c
mov ecx, dword [esi]
call fcn.10032fe0
test eax, eax
jne 0x1007e3b3
add esi, 4
cmp esi, 0x10006aa4
jne 0x1007e37e
push 0xffffffffffffffff
call fcn.10032d19
add esp, 4
mov ecx, 0x1010f3b8
xchg dword [ecx], eax
push 1
push edi
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsSetValue]
jmp 0x10060520
push 0x10006b48
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_1_0.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x1007e394
push esi
call fcn.10032d19
add esp, 4
mov ecx, 0x1010f3b8
xchg dword [ecx], eax
test esi, esi
je 0x1007e3a5
jmp 0x10060513
Function at 0x1006055f
Capabilities:
Set thread local storage value

Disassembly:
mov edi, dword [0x1010e2c4]
mov esi, dword [0x1010f3b8]
mov ecx, dword [0x1010e2b0]
and ecx, 0x1f
xor esi, dword [0x1010e2b0]
ror esi, cl
cmp esi, 0xffffffff
je 0x1007e40f
test esi, esi
je 0x1007e3e3
push 0
push edi
mov ecx, esi
call dword [0x10110268]
call esi
ret
mov esi, 0x10006a9c
mov ecx, dword [esi]
call fcn.10032fe0
test eax, eax
jne 0x1007e419
add esi, 4
cmp esi, 0x10006aa4
jne 0x1007e3e8
push 0xffffffffffffffff
call fcn.10032d19
add esp, 4
mov ecx, 0x1010f3b8
xchg dword [ecx], eax
push 0
push edi
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsSetValue]
ret
push 0x10006b48
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_1_0.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x1007e3fe
push esi
call fcn.10032d19
add esp, 4
mov ecx, 0x1010f3b8
xchg dword [ecx], eax
test esi, esi
je 0x1007e40f
jmp 0x1006058d

Function at 0x100605a0
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x100fbfe0
push 0x1005ccd0
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x1010e2b0]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
fstp xword [ebp - 0x28]
mov edi, dword [0x1010e2c4]
mov eax, dword [0x1010f3b8]
mov esi, dword [0x1010e2b0]
mov ecx, esi
and ecx, 0x1f
xor esi, eax
ror esi, cl
cmp esi, 0xffffffff
je 0x1007e770
test esi, esi
je 0x1007e744
push 1
push edi
mov ecx, esi
call dword [0x10110268]
call esi
wait
mov dword [ebp - 4], 0
fld xword [ebp - 0x28]
call sym.ucrtbase.dll__CIsin
fstp xword [ebp - 0x28]
wait
mov dword [ebp - 4], 0xfffffffe
call fcn.1006064f
fld xword [ebp - 0x28]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.1005cc20
mov esp, ebp
pop ebp
ret
mov esi, 0x10006a9c
mov ecx, dword [esi]
call fcn.10032fe0
test eax, eax
jne 0x1007e77e
add esi, 4
cmp esi, 0x10006aa4
jne 0x1007e749
push 0xffffffffffffffff
call fcn.10032d19
add esp, 4
mov ecx, 0x1010f3b8
xchg dword [ecx], eax
push 1
push edi
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsSetValue]
jmp 0x10060610
push 0x10006b48
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_1_0.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x1007e75f
push esi
call fcn.10032d19
add esp, 4
mov ecx, 0x1010f3b8
xchg dword [ecx], eax
test esi, esi
je 0x1007e770
jmp 0x10060603
Function at 0x1006064f
Capabilities:
Set thread local storage value

Disassembly:
mov edi, dword [0x1010e2c4]
mov esi, dword [0x1010f3b8]
mov ecx, dword [0x1010e2b0]
and ecx, 0x1f
xor esi, dword [0x1010e2b0]
ror esi, cl
cmp esi, 0xffffffff
je 0x1007e7da
test esi, esi
je 0x1007e7ae
push 0
push edi
mov ecx, esi
call dword [0x10110268]
call esi
ret
mov esi, 0x10006a9c
mov ecx, dword [esi]
call fcn.10032fe0
test eax, eax
jne 0x1007e7e4
add esi, 4
cmp esi, 0x10006aa4
jne 0x1007e7b3
push 0xffffffffffffffff
call fcn.10032d19
add esp, 4
mov ecx, 0x1010f3b8
xchg dword [ecx], eax
push 0
push edi
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsSetValue]
ret
push 0x10006b48
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_1_0.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x1007e7c9
push esi
call fcn.10032d19
add esp, 4
mov ecx, 0x1010f3b8
xchg dword [ecx], eax
test esi, esi
je 0x1007e7da
jmp 0x1006067d

Function at 0x10060690
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x100fc000
push 0x1005ccd0
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x1010e2b0]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
fstp xword [ebp - 0x28]
mov edi, dword [0x1010e2c4]
mov eax, dword [0x1010f3b8]
mov esi, dword [0x1010e2b0]
mov ecx, esi
and ecx, 0x1f
xor esi, eax
ror esi, cl
cmp esi, 0xffffffff
je 0x1007e83b
test esi, esi
je 0x1007e80f
push 1
push edi
mov ecx, esi
call dword [0x10110268]
call esi
wait
mov dword [ebp - 4], 0
fld xword [ebp - 0x28]
call sym.ucrtbase.dll__CIcos
fstp xword [ebp - 0x28]
wait
mov dword [ebp - 4], 0xfffffffe
call fcn.1006073f
fld xword [ebp - 0x28]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.1005cc20
mov esp, ebp
pop ebp
ret
mov esi, 0x10006a9c
mov ecx, dword [esi]
call fcn.10032fe0
test eax, eax
jne 0x1007e849
add esi, 4
cmp esi, 0x10006aa4
jne 0x1007e814
push 0xffffffffffffffff
call fcn.10032d19
add esp, 4
mov ecx, 0x1010f3b8
xchg dword [ecx], eax
push 1
push edi
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsSetValue]
jmp 0x10060700
push 0x10006b48
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_1_0.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x1007e82a
push esi
call fcn.10032d19
add esp, 4
mov ecx, 0x1010f3b8
xchg dword [ecx], eax
test esi, esi
je 0x1007e83b
jmp 0x100606f3
Function at 0x1006073f
Capabilities:
Set thread local storage value

Disassembly:
mov edi, dword [0x1010e2c4]
mov esi, dword [0x1010f3b8]
mov ecx, dword [0x1010e2b0]
and ecx, 0x1f
xor esi, dword [0x1010e2b0]
ror esi, cl
cmp esi, 0xffffffff
je 0x1007e8a5
test esi, esi
je 0x1007e879
push 0
push edi
mov ecx, esi
call dword [0x10110268]
call esi
ret
mov esi, 0x10006a9c
mov ecx, dword [esi]
call fcn.10032fe0
test eax, eax
jne 0x1007e8af
add esi, 4
cmp esi, 0x10006aa4
jne 0x1007e87e
push 0xffffffffffffffff
call fcn.10032d19
add esp, 4
mov ecx, 0x1010f3b8
xchg dword [ecx], eax
push 0
push edi
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsSetValue]
ret
push 0x10006b48
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_1_0.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x1007e894
push esi
call fcn.10032d19
add esp, 4
mov ecx, 0x1010f3b8
xchg dword [ecx], eax
test esi, esi
je 0x1007e8a5
jmp 0x1006076d

Function at 0x10060780
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x100fc060
push 0x1005ccd0
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x1010e2b0]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
fstp xword [ebp - 0x28]
mov edi, dword [0x1010e2c4]
mov eax, dword [0x1010f3b8]
mov esi, dword [0x1010e2b0]
mov ecx, esi
and ecx, 0x1f
xor esi, eax
ror esi, cl
cmp esi, 0xffffffff
je 0x1007e983
test esi, esi
je 0x1007e957
push 1
push edi
mov ecx, esi
call dword [0x10110268]
call esi
wait
mov dword [ebp - 4], 0
fld xword [ebp - 0x28]
call sym.ucrtbase.dll__CIexp
fstp xword [ebp - 0x28]
wait
mov dword [ebp - 4], 0xfffffffe
call fcn.1006082f
fld xword [ebp - 0x28]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.1005cc20
mov esp, ebp
pop ebp
ret
mov esi, 0x10006a9c
mov ecx, dword [esi]
call fcn.10032fe0
test eax, eax
jne 0x1007e991
add esi, 4
cmp esi, 0x10006aa4
jne 0x1007e95c
push 0xffffffffffffffff
call fcn.10032d19
add esp, 4
mov ecx, 0x1010f3b8
xchg dword [ecx], eax
push 1
push edi
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsSetValue]
jmp 0x100607f0
push 0x10006b48
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_1_0.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x1007e972
push esi
call fcn.10032d19
add esp, 4
mov ecx, 0x1010f3b8
xchg dword [ecx], eax
test esi, esi
je 0x1007e983
jmp 0x100607e3
Function at 0x1006082f
Capabilities:
Set thread local storage value

Disassembly:
mov edi, dword [0x1010e2c4]
mov esi, dword [0x1010f3b8]
mov ecx, dword [0x1010e2b0]
and ecx, 0x1f
xor esi, dword [0x1010e2b0]
ror esi, cl
cmp esi, 0xffffffff
je 0x1007e9ed
test esi, esi
je 0x1007e9c1
push 0
push edi
mov ecx, esi
call dword [0x10110268]
call esi
ret
mov esi, 0x10006a9c
mov ecx, dword [esi]
call fcn.10032fe0
test eax, eax
jne 0x1007e9f7
add esi, 4
cmp esi, 0x10006aa4
jne 0x1007e9c6
push 0xffffffffffffffff
call fcn.10032d19
add esp, 4
mov ecx, 0x1010f3b8
xchg dword [ecx], eax
push 0
push edi
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsSetValue]
ret
push 0x10006b48
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_1_0.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x1007e9dc
push esi
call fcn.10032d19
add esp, 4
mov ecx, 0x1010f3b8
xchg dword [ecx], eax
test esi, esi
je 0x1007e9ed
jmp 0x1006085d

Function at 0x1009f3ec
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, edx
push edi
test ecx, ecx
je 0x1009f4ad
xor ebx, ebx
cmp word [ecx], bx
je 0x1009f4ad
mov edx, 0x1000a218
mov eax, ecx
mov di, word [eax]
cmp di, word [edx]
jne 0x1009f437
test di, di
je 0x1009f433
mov di, word [eax + 2]
cmp di, word [edx + 2]
jne 0x1009f437
add eax, 4
add edx, 4
test di, di
jne 0x1009f411
mov eax, ebx
jmp 0x1009f43c
sbb eax, eax
or eax, 1
test eax, eax
je 0x1009f4ad
mov edx, 0x1000a220
mov eax, ecx
mov di, word [eax]
cmp di, word [edx]
jne 0x1009f46d
test di, di
je 0x1009f469
mov di, word [eax + 2]
cmp di, word [edx + 2]
jne 0x1009f46d
add eax, 4
add edx, 4
test di, di
jne 0x1009f447
mov eax, ebx
jmp 0x1009f472
sbb eax, eax
or eax, 1
test eax, eax
jne 0x1009f493
push 2
lea eax, [ebp - 4]
push eax
push 0x2000000b
push dword [esi + 8]
call dword [sym.imp.api_ms_win_core_localization_l1_2_0.dll_GetLocaleInfoW]
test eax, eax
je 0x1009f4c5
mov eax, dword [ebp - 4]
jmp 0x1009f4d6
push ecx
push ecx
mov eax, esp
push 1
push 0xa
pop edx
mov dword [eax], ecx
xor ecx, ecx
mov dword [eax + 4], ebx
call fcn.1002cb30
add esp, 0xc
jmp 0x1009f4d6
push 2
lea eax, [ebp - 4]
push eax
push 0x20001004
push dword [esi + 8]
call dword [sym.imp.api_ms_win_core_localization_l1_2_0.dll_GetLocaleInfoW]
test eax, eax
jne 0x1009f4c9
xor eax, eax
jmp 0x1009f4d6
mov eax, dword [ebp - 4]
test eax, eax
jne 0x1009f4d6
call dword [sym.imp.api_ms_win_core_localization_l1_2_0.dll_GetACP]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret