joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1008260c
Capabilities:
Get file size
Read file via mapping

Disassembly:
push 0x28
push 0x100946d0
call fcn.10068f85
xor esi, esi
mov dword [ebp - 0x34], esi
mov edi, 0x80030002
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], esi
push esi
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetFileSize]
mov ebx, eax
mov dword [ebp - 0x30], ebx
test ebx, ebx
je 0x10082828
push esi
push esi
push esi
push 2
push esi
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_CreateFileMappingW]
mov dword [ebp - 0x38], eax
test eax, eax
je 0x1008281e
push esi
push esi
push esi
push 4
push eax
call dword [sym.imp.kernel32.dll_MapViewOfFile]
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x1008280b
mov dword [ebp - 4], esi
lea ecx, [ebp - 0x24]
push ecx
push eax
push ebx
push dword [ebp + 0xc]
call fcn.1007f185
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x2c], esi
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0x1c]
push ebx
push dword [ebp - 0x24]
call fcn.1007f185
mov edi, eax
mov dword [ebp - 0x20], edi
test edi, edi
js 0x100826e6
push dword [ebp - 0x2c]
push esi
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov ebx, eax
mov dword [ebp - 0x28], ebx
test ebx, ebx
je 0x100826de
push ebx
push dword [ebp - 0x2c]
push dword [ebp - 0x1c]
push dword [ebp - 0x30]
push esi
push dword [ebp - 0x24]
call fcn.1007f185
mov edi, eax
mov dword [ebp - 0x20], edi
test edi, edi
jns 0x100826e6
push ebx
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [ebp - 0x28], esi
jmp 0x100826e6
mov edi, 0x8007000e
mov dword [ebp - 0x20], edi
push dword [ebp - 0x1c]
call dword [sym.imp.kernel32.dll_UnmapViewOfFile]
mov dword [ebp - 4], 0xfffffffe
jmp 0x10082813
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
push dword [ebp - 0x38]
call dword [sym.imp.kernel32.dll_CloseHandle]
jmp 0x10082838
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
jmp 0x10082838
push 0x10001964
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [ebp - 0x28], eax
mov edi, esi
test esi, esi
je 0x1008284c
mov edi, esi
jle 0x1008284c
and edi, 0xffff
or edi, 0x80070000
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp - 0x28]
mov dword [ecx], eax
mov ecx, dword [ebp + 0x14]
test ecx, ecx
je 0x10082860
mov eax, dword [ebp - 0x24]
mov dword [ecx], eax
mov eax, edi
call fcn.10068fca
ret 0x10
Function at 0x10008f53
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
xor ebp, ebp
push 0x1000
mov dword [esp + 0x14], ebp
call sub.glib_lite.dll_Ordinal_418
mov esi, dword [esp + 0x1c]
mov edi, eax
mov ebx, dword [esp + 0x20]
pop ecx
mov dword [ebx], ebp
mov ecx, dword [esi + 0x118]
sub ecx, dword [esi + 0x110]
mov eax, dword [esi + 0x11c]
sbb eax, dword [esi + 0x114]
add ecx, 0xffffffff
adc eax, 0xffffffff
cmp eax, ebp
ja 0x10008faf
jb 0x10008fa1
cmp ecx, 0xffe
ja 0x10008faf
mov eax, dword [esi + 0x118]
sub eax, dword [esi + 0x110]
jmp 0x10008fb4
mov eax, 0x1000
test edi, edi
je 0x1000902a
push ebp
lea ecx, [esp + 0x14]
push ecx
push eax
push edi
push dword [esi + 0x104]
call dword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
je 0x10009023
push sub.glib_lite.dll_Ordinal_110
push edi
push dword [esp + 0x18]
push ebp
push 0x1000
push edi
push ebp
call sub.gstreamer_lite.dll_Ordinal_25
add esp, 0x1c
mov dword [ebx], eax
test eax, eax
je 0x10009002
mov ecx, dword [esi + 0x110]
mov edx, dword [esi + 0x114]
mov dword [eax + 0x40], ecx
mov dword [eax + 0x44], edx
mov eax, dword [esp + 0x10]
add eax, dword [esi + 0x110]
push 0
pop edx
adc edx, dword [esi + 0x114]
mov dword [esi + 0x110], eax
mov dword [esi + 0x114], edx
jmp 0x1000902e
push edi
call sub.glib_lite.dll_Ordinal_110
pop ecx
xor eax, eax
xor edx, edx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x10009034
Capabilities:
Read file on windows

Disassembly:
push ecx
mov eax, dword [esp + 0x18]
push ebp
push esi
mov esi, dword [esp + 0x10]
and dword [eax], 0
push 0xfffffffffffffffb
pop ebp
push dword [esp + 0x18]
push dword [esp + 0x18]
push esi
call fcn.10009133
add esp, 0xc
test eax, eax
je 0x100090f2
and dword [esp + 8], 0
push ebx
mov ebx, dword [esp + 0x20]
push edi
push ebx
call sub.glib_lite.dll_Ordinal_418
mov edi, eax
pop ecx
test edi, edi
je 0x100090f0
push 0
lea eax, [esp + 0x14]
push eax
push ebx
push edi
push dword [esi + 0x104]
call dword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
je 0x100090e9
cmp dword [esp + 0x10], ebx
jne 0x100090cf
push sub.glib_lite.dll_Ordinal_110
push edi
push dword [esp + 0x18]
push 0
push ebx
push edi
push 0
call sub.gstreamer_lite.dll_Ordinal_25
mov edx, eax
add esp, 0x1c
mov eax, dword [esp + 0x28]
mov dword [eax], edx
test edx, edx
je 0x100090d6
mov eax, dword [esi + 0x110]
xor ebp, ebp
mov ecx, dword [esi + 0x114]
mov dword [edx + 0x40], eax
mov dword [edx + 0x44], ecx
jmp 0x100090d6
push edi
call sub.glib_lite.dll_Ordinal_110
pop ecx
mov eax, dword [esp + 0x10]
add dword [esi + 0x110], eax
adc dword [esi + 0x114], 0
jmp 0x100090f0
push edi
call sub.glib_lite.dll_Ordinal_110
pop ecx
pop edi
pop ebx
pop esi
mov eax, ebp
pop ebp
pop ecx
ret
Function at 0x10009251
Capabilities:
Get common file path

Disassembly:
push ebp
push edi
push pe_nt_image_headers32
call sub.glib_lite.dll_Ordinal_418
mov edi, eax
pop ecx
test edi, edi
je 0x100092db
push edi
xor ebp, ebp
push ebp
push 0x1001d824
push 0x10023878
call dword [sym.imp.kernel32.dll_GetTempFileNameA]
test eax, eax
je 0x100092e0
push ebx
push ebp
mov ebx, 0x4000100
push ebx
push 2
push ebp
push 5
push 0xc0000000
push edi
call dword [sym.imp.kernel32.dll_CreateFileA]
push ebp
push ebx
push 3
push ebp
push 7
push Ordinal_2
push edi
mov dword [edi + 0x108], eax
call dword [sym.imp.kernel32.dll_CreateFileA]
cmp dword [edi + 0x108], 0xffffffff
mov dword [edi + 0x104], eax
pop ebx
je 0x100092e0
cmp eax, 0xffffffff
je 0x100092e0
mov dword [edi + 0x118], ebp
mov dword [edi + 0x11c], ebp
mov dword [edi + 0x110], ebp
mov dword [edi + 0x114], ebp
mov eax, edi
pop edi
pop ebp
ret
push edi
call sub.glib_lite.dll_Ordinal_110
pop ecx
xor eax, eax
jmp 0x100092dd

Function at 0x1001064f
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
push ebx
push ebp
mov ebp, dword [esp + 0x10]
mov edx, dword [eax*4 + 0x1001e2c0]
push esi
push edi
push 0xffffffffffffff80
mov dword [esp + 0x18], edx
lea edi, [edx + edx]
pop esi
mov ebx, esi
xor ecx, ecx
sar ebx, 0x1f
mov eax, ebx
xor eax, esi
sub eax, ebx
cmp eax, edi
cmovl ecx, eax
sub ecx, edx
mov edx, ecx
sar edx, 0x1f
mov al, dl
xor al, cl
sub dl, al
add dl, bl
add dl, byte [esp + 0x14]
xor dl, bl
mov byte [esi + ebp], dl
inc esi
mov edx, dword [esp + 0x14]
cmp esi, 0x80
jle 0x1001066c
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x10013bb7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x10013bc6
pop dword [ebp - 0x14]
mov eax, 0x19e02016
add eax, 0xf6211bb0
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0xe0b2f715
sub dword [ebp - 0x24], 0x9260b1ca
mov dword [ebp - 0x20], 0xb0242509
sub dword [ebp - 0x20], 0x7df0d8c4
mov dword [ebp - 0x1c], 0xf3ce2d4d
sub dword [ebp - 0x1c], 0xa781e91f
mov dword [ebp - 0x18], 0xbf16c7f5
sub dword [ebp - 0x18], 0xbf16c7f5
lea eax, [ebp - 0x24]
push eax
mov eax, 0x334b7a49
sub eax, 0x2349ba49
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0x1697101d
add dword [ebp - 0x24], 0x5ddb5939
mov dword [ebp - 0x20], 0x992f18a5
sub dword [ebp - 0x20], 0x57c2b730
mov dword [ebp - 0x1c], 0x5ca6a4e8
add dword [ebp - 0x1c], 0x6c8c784
mov dword [ebp - 0x18], 0x41dc2d2
add dword [ebp - 0x18], 0xfbe23d2e
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, 0xdcd1ee87
add eax, 0x332fd1fd
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x36d41
push 0
call eax
mov ecx, 0x45c4
mov edi, eax
mov ebx, 0x10026800
add ebx, dword [ebp - 0x14]
mov edx, 0x7ef13eaa
xor dword [ebp - 4], 0x7f759281
mov esi, dword [ebx]
add dword [ebp - 4], edi
add esi, edx
add dword [ebp - 8], eax
mov dword [edi], esi
add edi, 4
add ebx, 0xc0ebe47f
add ebx, 0x3f141b85
loop 0x10013cd6
add eax, 0x109e3
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xb34ac10
add ecx, 0x4cb53f0
add ecx, dword [ebp - 0x14]
call ebx
leave
ret
Function at 0x10017afc
Capabilities:
Create thread

Disassembly:
push ecx
push ebx
mov ebx, ecx
push esi
push edi
lea esi, [ebx + 0x18]
push esi
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
xor edi, edi
cmp dword [ebx + 0x14], edi
jne 0x10017b2f
lea eax, [esp + 0xc]
push eax
push edi
push ebx
push 0x10017b50
push edi
push edi
call dword [sym.imp.kernel32.dll_CreateThread]
mov dword [ebx + 0x14], eax
test eax, eax
je 0x10017b2f
inc edi
push esi
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
mov eax, edi
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x10017c32
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x28
mov eax, dword [esp + 0x2c]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x48]
xor ebp, ebp
push edi
mov edi, dword [esp + 0x40]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], esi
cmp edi, 0xffffffff
je 0x10017c60
test edi, edi
je 0x10017c60
call dword [sym.imp.kernel32.dll_GetTickCount]
jmp 0x10017c64
mov eax, dword [esp + 0x48]
xor ebx, ebx
mov dword [esp + 0x3c], eax
push 0
test esi, esi
lea eax, [esp + 0x18]
push 0
setne bl
push eax
inc ebx
push ebx
call dword [sym.imp.kernel32.dll_WaitForMultipleObjects]
mov esi, eax
cmp esi, ebx
jb 0x10017df1
cmp dword [esp + 0x44], ebp
push 0x48
pop ecx
push 0x40
pop eax
cmove ecx, eax
push 0xa
mov dword [esp + 0x14], ecx
pop edx
cmp edi, edx
mov eax, edi
push ecx
cmova eax, edx
push eax
mov dword [esp + 0x48], eax
lea eax, [esp + 0x1c]
push 0
push eax
push ebx
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
mov esi, eax
cmp esi, ebx
je 0x10017cd5
cmp esi, 0x102
jne 0x10017d84
cmp dword [esp + 0x40], edi
je 0x10017d84
mov esi, dword [esp + 0x44]
test esi, esi
je 0x10017d04
jmp 0x10017cea
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
push 1
push dword [esp + 0x4c]
lea eax, [esp + 0x24]
push dword [esp + 0x50]
push esi
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
jne 0x10017cdf
xor esi, esi
lea eax, [esp + 0x1c]
push esi
push esi
push esi
push esi
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
cmp edi, 0xffffffff
je 0x10017d3b
test edi, edi
je 0x10017d3b
call dword [sym.imp.kernel32.dll_GetTickCount]
mov edx, eax
mov ecx, edi
sub edx, dword [esp + 0x3c]
mov dword [esp + 0x3c], eax
sub ecx, edx
xor eax, eax
cmp edx, edi
cmovbe eax, ecx
mov edi, eax
test ebp, ebp
jne 0x10017d65
mov ebp, dword [sym.imp.kernel32.dll_GetCurrentThread]
call ebp
push eax
call dword [sym.imp.kernel32.dll_GetThreadPriority]
mov dword [esp + 0x4c], eax
cmp eax, 2
jae 0x10017d62
push 2
call ebp
push eax
call dword [sym.imp.kernel32.dll_SetThreadPriority]
xor ebp, ebp
inc ebp
push esi
push esi
lea eax, [esp + 0x1c]
push eax
push ebx
call dword [sym.imp.kernel32.dll_WaitForMultipleObjects]
mov ecx, dword [esp + 0x10]
mov esi, eax
push 0xa
pop edx
cmp esi, ebx
jae 0x10017c9e
test ebp, ebp
je 0x10017df1
push dword [esp + 0x4c]
call dword [sym.imp.kernel32.dll_GetCurrentThread]
push eax
call dword [sym.imp.kernel32.dll_SetThreadPriority]
push 8
call dword [sym.imp.USER32.dll_GetQueueStatus]
shr eax, 0x10
test al, 8
je 0x10017df1
mov eax, dword [0x1002399c]
test eax, eax
jne 0x10017dc5
push str.AMUnblock
call dword [sym.imp.USER32.dll_RegisterWindowMessageA]
mov dword [0x1002399c], eax
test eax, eax
je 0x10017ddf
push 1
push eax
push eax
push 0xffffffffffffffff
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
mov eax, dword [0x1002399c]
jne 0x10017dc5
push 0
push 0
push eax
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_PostThreadMessageA]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret 0x14
Function at 0x78ab07a7
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x78b53610]
jne sym.MSVCR100.dll___report_gsfailure
repz ret

Function at 0x78ab203f
Capabilities:
Accept command line arguments
Get thread local storage value

Disassembly:
push 8
push 0x78ab20e0
call fcn.78ab0c80
mov eax, dword [ebp + 8]
cmp eax, 1
je 0x78abb235
xor edi, edi
cmp eax, edi
je 0x78ac8065
cmp eax, 2
jne 0x78ab25a7
call sym.MSVCR100.dll___set_flsgetvalue
push dword [0x78b538b4]
push dword [0x78b538b8]
call dword [sym.imp.kernel32.dll_TlsGetValue]
call eax
test eax, eax
jne 0x78ab20d1
push 0x214
push 1
call fcn.78b25c3e
pop ecx
pop ecx
mov esi, eax
cmp esi, edi
je 0x78ac80ab
push esi
push dword [0x78b538b4]
push dword [0x78b53e58]
call dword [sym.imp.kernel32.dll_DecodePointer]
call eax
test eax, eax
je 0x78ad7484
push edi
push esi
call sym.MSVCR100.dll__initptd
pop ecx
pop ecx
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
mov dword [esi], eax
or dword [esi + 4], 0xffffffff
call fcn.78ab2038
xor eax, eax
inc eax
call fcn.78ab0cc5
ret
cmp eax, 3
jne 0x78ab20d1
push edi
call fcn.78b25c3e
pop ecx
jmp 0x78ab20d1
call fcn.78abad05
test eax, eax
je 0x78ac80ab
call fcn.78abb398
test eax, eax
je 0x78ad7437
call fcn.78b25c3e
test eax, eax
js 0x78ad7441
call fcn.78b25c3e
mov dword [0x78b54470], eax
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [sym.MSVCR100.dll__acmdln], eax
call dword [sym.imp.kernel32.dll_GetCommandLineW]
mov dword [sym.MSVCR100.dll__wcmdln], eax
call fcn.78abb22a
call fcn.78abb2a9
test eax, eax
js 0x78ac80b2
push 0
call fcn.78b25c3e
pop ecx
test eax, eax
jne 0x78ac80b2
inc dword [0x78b5446c]
jmp 0x78ab20d1
cmp dword [0x78b5446c], edi
jle 0x78ac80ab
dec dword [0x78b5446c]
mov dword [ebp - 4], edi
cmp dword [0x78b54eb4], edi
je 0x78ad7448
call fcn.78ac7ffb
cmp dword [ebp + 0xc], edi
je 0x78ad7452
mov dword [ebp - 4], 0xfffffffe
call fcn.78ac80a1
jmp 0x78ab20d1
xor eax, eax
jmp 0x78ab20d9
call fcn.78b26ca8
jmp 0x78ad7441
call fcn.78b265ea
jmp 0x78ac80ab
call fcn.78afc86f
jmp 0x78ad7437
call sym.MSVCR100.dll__cexit
jmp 0x78ac8082
call fcn.78b26ca8
call fcn.78afc86f
call fcn.78b265ea
jmp 0x78ac8090
push esi
call fcn.78b25c3e
pop ecx
jmp 0x78ac80ab

Function at 0x78ab27b6
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
je 0x78ad7b05
test dword [ebp + 0xc], 0xfffffff9
jne 0x78ad7b05
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x78abfa08
test al, 0x10
jne 0x78ab27f8
test al, 1
je 0x78ab27f8
test byte [ebp + 0xc], 2
jne 0x78ad7b22
xor eax, eax
pop esi
pop ebp
ret
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
call fcn.78b25c3e
pop ecx
call sym.MSVCR100.dll__errno
mov eax, dword [eax]
jmp 0x78ab27fa
call sym.MSVCR100.dll___doserrno
mov dword [eax], esi
call sym.MSVCR100.dll__errno
push 0x16
pop esi
mov dword [eax], esi
call sym.MSVCR100.dll__invalid_parameter_noinfo
mov eax, esi
jmp 0x78ab27fa
call sym.MSVCR100.dll___doserrno
mov dword [eax], 5
call sym.MSVCR100.dll__errno
mov dword [eax], 0xd
jmp 0x78abfa15
Function at 0x78ac1201
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.kernel32.dll_GetEnvironmentStringsW]
mov esi, eax
xor ecx, ecx
cmp esi, ecx
je 0x78ae06ff
cmp word [esi], cx
je 0x78ac122b
add eax, 2
cmp word [eax], cx
jne 0x78ac121b
add eax, 2
cmp word [eax], cx
jne 0x78ac121b
push ebx
sub eax, esi
lea ebx, [eax + 2]
push edi
push ebx
call fcn.78b25c3e
mov edi, eax
pop ecx
test edi, edi
je 0x78ac124a
push ebx
push esi
push edi
call fcn.78b25c3e
add esp, 0xc
push esi
call dword [sym.imp.kernel32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret
xor eax, eax
pop esi
ret

Function at 0x78ac7e18
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x78ac7e54
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x78ac7e54
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x78ac7e54
xor eax, eax
cmp dword [ecx + 0x74], 0xe
jbe 0x78ac7e53
cmp dword [ecx + 0xe8], eax
setne al
ret
xor eax, eax
ret
Function at 0x78ae880c
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push 0x28
mov eax, 0x78b4ee00
call fcn.78b2499c
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0x30]
lea ecx, [eax + 1]
mov dword [ebx + 0x30], ecx
test eax, eax
jne 0x78ae8926
cmp dword [ebx + 0x1c], eax
setne byte [ebp - 0x29]
cmp dword [ebx + 0x18], eax
jne 0x78ae88fb
cmp byte [ebp - 0x29], al
mov edi, dword [ebx + 0x14]
sete al
movzx eax, al
push eax
push dword [ebx + 0x28]
mov eax, dword [ebx + 0x24]
call fcn.78b25c3e
cmp byte [ebp - 0x29], 0
jne 0x78ae890b
call dword [sym.imp.kernel32.dll_GetCurrentThread]
push eax
lea esi, [ebp - 0x28]
mov dword [ebp - 0x30], eax
call fcn.78b25c3e
mov cx, word [eax + 4]
mov word [ebx + 0xc], cx
mov eax, dword [eax]
mov dword [ebx + 8], eax
mov eax, dword [ebx + 0x24]
mov ecx, dword [ebx + 0x14]
imul eax, eax, 0x2c
mov ecx, dword [ecx + 0x10]
mov esi, dword [eax + ecx]
movzx edi, word [eax + ecx + 0x10]
push 0xc
lea eax, [ebp - 0x1c]
push 0
push eax
call sym.MSVCR100.dll_memset
add esp, 0xc
push dword [ebp - 0x30]
mov dword [ebp - 0x1c], esi
lea esi, [ebp - 0x1c]
mov word [ebp - 0x18], di
call fcn.78b25c3e
mov edi, dword [ebx + 0x14]
mov esi, ebx
call fcn.78af314f
mov esi, dword [ebx + 0x14]
lea edi, [esi + 0x20]
push edi
mov dword [ebp - 0x30], edi
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
and dword [ebp - 4], 0
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax]
imul eax, eax, 0x2c
mov ecx, dword [ebx + 0x28]
mov edx, dword [esi + 0x10]
imul ecx, ecx, 0x2c
mov eax, dword [eax + edx + 0x28]
lea ecx, [eax + ecx + 8]
mov eax, ebx
call fcn.78af3395
push edi
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
jmp 0x78ae890b
mov ecx, dword [ebx + 0x14]
lea ecx, [ecx + 0xc4]
mov eax, ebx
call fcn.78af3395
mov eax, dword [ebx + 0x14]
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0x70]
push esi
call dword [sym.imp.kernel32.dll_TlsGetValue]
push ebx
push esi
mov dword [ebx + 0x20], eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
call fcn.78b24a0b
ret 4
Function at 0x78aebae2
Capabilities:
Allocate thread local storage

Disassembly:
push 0x20
mov eax, 0x78b4ea57
call fcn.78abb046
mov edi, dword [ebp + 8]
push dword [0x78b5636c]
xor esi, esi
mov dword [edi], 0x78ae3cd8
lea eax, [edi + 0x24]
mov dword [edi + 4], esi
mov dword [edi + 8], esi
mov dword [edi + 0xc], 0x10
mov dword [edi + 0x10], esi
mov dword [edi + 0x1c], esi
push eax
mov dword [edi + 0x20], esi
call dword [sym.imp.kernel32.dll_InitializeCriticalSectionAndSpinCount]
mov dword [ebp - 4], esi
push dword [0x78b5636c]
lea ebx, [edi + 0x68]
mov dword [edi + 0x3c], esi
mov dword [edi + 0x40], esi
mov dword [edi + 0x44], esi
mov dword [edi + 0x48], esi
mov dword [edi + 0x4c], esi
mov dword [edi + 0x50], esi
mov dword [edi + 0x54], esi
mov dword [edi + 0x58], esi
mov dword [edi + 0x5c], esi
lea eax, [ebx + 0xc]
mov dword [edi + 0x60], esi
mov dword [edi + 0x64], esi
push eax
mov dword [ebp - 0x10], ebx
mov dword [ebx], esi
mov dword [ebx + 4], esi
call dword [sym.imp.kernel32.dll_InitializeCriticalSectionAndSpinCount]
mov byte [ebp - 4], 1
call dword [sym.imp.kernel32.dll_TlsAlloc]
mov dword [ebx + 8], eax
cmp eax, 0xffffffff
jne 0x78aebb9b
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, esi
jle 0x78aebb84
and eax, 0xffff
or eax, 0x80070000
push eax
lea ecx, [ebp - 0x2c]
call fcn.78b25c3e
push 0x78b4feb4
lea eax, [ebp - 0x2c]
push eax
call fcn.78b25c3e
push 0x78aebc60
push 0x78ae3cb8
mov byte [ebp - 4], 2
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
cmp eax, esi
je 0x78aebbd0
mov ecx, dword [0x78b54630]
xor ecx, eax
mov dword [edi + 0x8c], ecx
mov dword [edi + 0x90], esi
jmp 0x78aebc1f
push 4
push 0x3000
push 0x1000
push esi
mov dword [edi + 0x8c], esi
call dword [sym.imp.kernel32.dll_VirtualAlloc]
mov dword [edi + 0x90], eax
cmp eax, esi
jne 0x78aebc1c
push 1
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x10], 0x78abb0d8
call fcn.78b25c3e
mov dword [ebp - 0x1c], 0x78abbd3c
push 0x78abbdd8
lea eax, [ebp - 0x1c]
jmp 0x78aebb95
mov byte [eax], 1
push 1
call fcn.78b25c3e
pop ecx
call fcn.78b25c3e
push esi
push esi
push esi
push esi
call dword [sym.imp.kernel32.dll_CreateEventW]
mov dword [edi + 0x48], eax
mov eax, dword [edi + 0xc]
xor ecx, ecx
push 4
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.78b25c3e
mov dword [edi + 0x4c], eax
pop ecx
mov eax, edi
call fcn.78abb658
ret 4
Function at 0x78aef174
Capabilities:
Check for time delay via gettickcount

Disassembly:
push 0xc
mov eax, 0x78b4f1e0
call fcn.78abb046
mov edi, ecx
mov ebx, dword [sym.imp.kernel32.dll_GetTickCount]
push 0x64
pop esi
call ebx
sub eax, 0x1f4
mov dword [ebp - 0x10], eax
mov eax, dword [edi + 0x20]
cmp eax, 2
je 0x78aef263
lea eax, [edi + 0x24]
mov dword [ebp - 0x14], eax
push esi
push dword [edi + 0x48]
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
push dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
and dword [ebp - 4], 0
mov eax, dword [edi + 0x20]
sub eax, 0
je 0x78aef237
dec eax
jne 0x78aef24a
cmp dword [ebp - 0x18], 0x102
jne 0x78aef1f2
call fcn.78b25c3e
cmp dword [edi + 0x10], 0
jbe 0x78aef1e8
push 0
push edi
call fcn.78b25c3e
call ebx
push 0x64
mov dword [ebp - 0x10], eax
pop esi
jmp 0x78aef24a
call ebx
sub eax, dword [ebp - 0x10]
push 0x64
pop esi
mov dword [ebp - 0x18], eax
cmp eax, esi
jbe 0x78aef224
cmp eax, 0x82
jbe 0x78aef20f
call fcn.78b25c3e
jmp 0x78aef21d
cmp dword [edi + 0x10], 0
jbe 0x78aef21d
push 0
push edi
call fcn.78b25c3e
call ebx
mov dword [ebp - 0x10], eax
jmp 0x78aef24a
cmp dword [edi + 0x10], 0
jbe 0x78aef232
push 0
push edi
call fcn.78b25c3e
sub esi, dword [ebp - 0x18]
jmp 0x78aef24a
push edi
call fcn.78b25c3e
movzx esi, al
neg esi
sbb esi, esi
and esi, 0xffffff9b
add esi, 0x64
or dword [ebp - 4], 0xffffffff
push dword [ebp - 0x14]
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
mov eax, dword [edi + 0x20]
cmp eax, 2
jne 0x78aef1a7
call fcn.78abb658
ret