joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42e950
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x818
mov eax, dword [0x442f98]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
lea ecx, [ebp - 0x810]
push ecx
push 0x20019
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x42eb1f
lea eax, [ebp - 0x814]
mov dword [ebp - 0x808], 0x400
push eax
push 0x20019
push 0
push str.cAllowedRegistryPaths
push dword [ebp - 0x810]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x42ea51
lea eax, [ebp - 0x808]
push eax
lea eax, [ebp - 0x804]
push eax
push 0
push 0
push str.tWhiteList
push dword [ebp - 0x814]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x42ea45
mov eax, dword [ebp - 0x808]
add eax, eax
cmp eax, 0x800
jae 0x42eb30
xor ecx, ecx
mov word [ebp + eax - 0x804], cx
lea eax, [ebp - 0x80c]
push eax
lea eax, [ebp - 0x804]
mov dword [ebp - 0x80c], ecx
push 0x439e90
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcstok_s]
add esp, 0xc
push eax
mov ecx, esi
call fcn.0042eb40
lea eax, [ebp - 0x80c]
push eax
push 0x439e90
push 0
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcstok_s]
add esp, 0xc
test eax, eax
jne 0x42ea22
push dword [ebp - 0x814]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x818]
push eax
push 0x20019
push 0
push 0x439e94
push dword [ebp - 0x810]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x42eb13
lea eax, [ebp - 0x808]
mov dword [ebp - 0x808], 0x400
push eax
lea eax, [ebp - 0x804]
push eax
push 0
push 0
push str.tWhiteList
push dword [ebp - 0x818]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x42eb07
mov eax, dword [ebp - 0x808]
add eax, eax
cmp eax, 0x800
jae 0x42eb30
xor ecx, ecx
mov word [ebp + eax - 0x804], cx
lea eax, [ebp - 0x80c]
push eax
lea eax, [ebp - 0x804]
mov dword [ebp - 0x80c], ecx
push 0x439e90
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcstok_s]
add esp, 0xc
push eax
mov ecx, esi
call fcn.0042e870
lea eax, [ebp - 0x80c]
push eax
push 0x439e90
push 0
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcstok_s]
add esp, 0xc
test eax, eax
jne 0x42eae4
push dword [ebp - 0x818]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x810]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00434ca0
mov esp, ebp
pop ebp
ret 4
call fcn.0043508e
int3

Function at 0x43212e
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
xor eax, eax
push esi
push eax
push 1
push eax
push eax
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [esi + 4], eax
cmp eax, 0xffffffff
je 0x432163
lea eax, [esi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov eax, esi
pop esi
leave
ret
push str.unable_to_create_tls_index
lea ecx, [ebp - 0x1c]
call fcn.0042f636
push 0x43c89c
lea eax, [ebp - 0x1c]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x4342c2
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
mov ecx, esi
call fcn.004302cd
cmp dword [esi + 4], ebx
je 0x4344bc
mov ecx, esi
call fcn.004302cd
xor eax, eax
inc eax
push 0x5c
pop edi
cmp dword [esi + 4], eax
jne 0x434311
push ebx
mov ecx, esi
call fcn.0042f82a
movzx ecx, ax
push 0x2f
pop eax
cmp cx, ax
je 0x434307
cmp cx, di
jne 0x434311
xor ecx, ecx
lea eax, [ecx + 1]
jmp 0x4344be
mov ecx, esi
call fcn.004302cd
cmp dword [esi + 4], 3
push 2
pop edi
jne 0x434380
push ebx
mov ecx, esi
call fcn.0042f82a
movzx eax, ax
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_iswalpha]
pop ecx
test eax, eax
je 0x434380
xor eax, eax
mov ecx, esi
inc eax
push eax
call fcn.0042f82a
cmp ax, 0x3a
jne 0x434380
push edi
mov ecx, esi
call fcn.0042f82a
push 0x2f
movzx eax, ax
pop ecx
cmp ax, cx
je 0x434364
push 0x5c
pop ecx
cmp ax, cx
jne 0x434380
mov ecx, esi
call fcn.004302cd
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
xor ecx, ecx
inc ecx
cmp ecx, eax
sbb eax, eax
neg eax
jmp 0x4344be
mov ecx, esi
call fcn.004302cd
cmp dword [esi + 4], edi
jbe 0x4344b8
push ebx
mov ecx, esi
call fcn.0042f82a
push 0x2f
movzx eax, ax
pop ecx
cmp ax, cx
je 0x4343af
push 0x5c
pop ecx
cmp ax, cx
jne 0x4344b8
xor eax, eax
mov ecx, esi
inc eax
push eax
call fcn.0042f82a
push 0x2f
movzx eax, ax
pop ecx
cmp ax, cx
je 0x4343d1
push 0x5c
pop ecx
cmp ax, cx
jne 0x4344b8
push edi
mov ecx, esi
call fcn.0042f82a
push 0x2f
movzx eax, ax
pop ecx
cmp ax, cx
je 0x4344bc
push 0x5c
pop ebx
cmp ax, bx
je 0x4344bc
mov ecx, esi
inc edi
call fcn.004302cd
cmp edi, dword [esi + 4]
jae 0x434419
push edi
mov ecx, esi
call fcn.0042f82a
push 0x2f
movzx eax, ax
pop ecx
cmp ax, cx
je 0x434419
cmp ax, bx
jne 0x4343f4
mov ecx, esi
call fcn.004302cd
cmp dword [esi + 4], edi
je 0x4344bc
mov ecx, esi
inc edi
call fcn.004302cd
cmp dword [esi + 4], edi
je 0x4344bc
push edi
mov ecx, esi
call fcn.0042f82a
push 0x2f
movzx eax, ax
pop ecx
cmp ax, cx
je 0x4344bc
cmp ax, bx
je 0x4344bc
mov ecx, esi
inc edi
call fcn.004302cd
cmp edi, dword [esi + 4]
jae 0x434477
push edi
mov ecx, esi
call fcn.0042f82a
push 0x2f
movzx eax, ax
pop ecx
cmp ax, cx
je 0x434477
cmp ax, bx
jne 0x434452
mov ecx, esi
call fcn.004302cd
lea eax, [edi + 1]
cmp dword [esi + 4], eax
ja 0x4344bc
mov ecx, esi
call fcn.004302cd
cmp dword [esi + 4], edi
jne 0x4344a1
movzx eax, word [0x442f94]
mov ecx, esi
push eax
call fcn.0042fbf4
mov ecx, esi
call fcn.004302cd
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
xor ecx, ecx
inc ecx
cmp ecx, eax
sbb ebx, ebx
neg ebx
mov eax, ebx
jmp 0x4344be
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4344fc
Capabilities:
Check if file exists

Disassembly:
push 0x49c
mov eax, 0x437533
call fcn.004355e9
mov esi, dword [ebp + 8]
mov ecx, esi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x470], esi
call fcn.004302cd
cmp dword [esi + 4], 0
jne 0x43452e
mov eax, 0xffffe89d
jmp 0x43472d
xor ebx, ebx
lea ecx, [ebp - 0x488]
push ebx
push 0xffffffffffffffff
push 0x43a730
call fcn.0042f69b
push ebx
lea eax, [ebp - 0x488]
mov dword [ebp - 4], ebx
push eax
mov ecx, esi
call fcn.00430129
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x478]
mov esi, eax
call fcn.0042f7cc
lea ecx, [ebp - 0x480]
call fcn.0042f7aa
cmp esi, 0xffffffff
je 0x434580
mov eax, 0xffffe8c2
jmp 0x43472d
mov esi, dword [ebp - 0x470]
mov ecx, esi
call fcn.004302cd
lea ecx, [ebp - 0x46c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
jne 0x4346ca
mov ecx, esi
call fcn.004302cd
lea ecx, [ebp - 0x48c]
push ecx
lea ecx, [ebp - 0x21c]
push ecx
push 0x105
push eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
mov esi, eax
test esi, esi
jne 0x4345d1
inc eax
jmp 0x43472d
cmp esi, 0x105
jbe 0x4345e3
mov eax, 0xffffe8c1
jmp 0x43472d
push esi
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x488]
call fcn.0042f6ed
lea eax, [ebp - 0x488]
mov dword [ebp - 4], 1
push eax
call fcn.004342c2
pop ecx
test eax, eax
je 0x434625
mov dword [edi], 2
mov dword [edi + 4], ebx
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], ebx
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
jmp 0x43468d
movzx eax, word [ebp + esi*2 - 0x21e]
cmp eax, 0x2f
je 0x434637
cmp eax, 0x5c
jne 0x434673
lea esi, [esi*2 - 2]
cmp esi, 0x20a
jae 0x434754
xor eax, eax
mov word [ebp + esi - 0x21c], ax
lea eax, [ebp - 0x46c]
push eax
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x470], eax
cmp eax, 0xffffffff
jne 0x4346aa
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x434688
cmp eax, 3
je 0x434688
xor ebx, ebx
inc ebx
jmp 0x43468d
mov ebx, 0xffffe8c2
lea ecx, [ebp - 0x478]
call fcn.0042f7cc
lea ecx, [ebp - 0x480]
call fcn.0042f7aa
mov eax, ebx
jmp 0x43472d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x478]
call fcn.0042f7cc
lea ecx, [ebp - 0x480]
call fcn.0042f7aa
mov eax, dword [ebp - 0x470]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
test byte [ebp - 0x46c], 0x10
push 0
pop eax
setne al
inc eax
mov dword [edi], eax
cmp dword [ebp - 0x450], 0
jne 0x434733
mov eax, dword [ebp - 0x44c]
mov dword [edi + 4], eax
lea eax, [ebp - 0x458]
push eax
call fcn.00434b2e
cmp dword [ebp - 0x468], 0
pop ecx
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], edx
jne 0x434718
cmp dword [ebp - 0x464], 0
je 0x434725
lea eax, [ebp - 0x468]
push eax
call fcn.00434b2e
pop ecx
mov dword [edi + 8], eax
xor eax, eax
mov dword [edi + 0xc], edx
call fcn.004355a4
ret
push str.file_size_larger_than_4GB_encountered
lea ecx, [ebp - 0x4a8]
call fcn.0042f636
push 0x43c89c
lea eax, [ebp - 0x4a8]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
call fcn.0043508e
int3
Function at 0x100879b
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
xor esi, esi
push edi
mov dword [ebp - 4], esi
cmp dword [ebp + 0xc], esi
je 0x1008844
cmp dword [ebp + 8], esi
je 0x1008844
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
push esi
lea eax, [ebp - 4]
push eax
push esi
push 0x20006
push esi
push esi
push esi
push 0x10016c0
mov ebx, 0x80000001
push ebx
call edi
mov dword [ebp + 8], eax
cmp eax, esi
jne 0x100884b
cmp dword [ebp - 4], esi
je 0x10087f4
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], esi
push esi
lea eax, [ebp - 4]
push eax
push esi
push 0x20006
push 1
push esi
push esi
push 0x1001648
push ebx
call edi
mov dword [ebp + 8], eax
cmp eax, esi
jne 0x100884b
mov eax, dword [ebp + 0xc]
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
cmp dx, si
jne 0x1008818
sub eax, ecx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push dword [ebp + 0xc]
push 1
push esi
push 0x100161c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp + 8], eax
jmp 0x100884b
mov dword [ebp + 8], 0x57
cmp dword [ebp - 4], esi
pop edi
pop esi
pop ebx
je 0x100885c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp + 8]
leave
ret 8

Function at 0x1008a96
Capabilities:
Listen for remote procedure calls

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x1029004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
or dword [ebp - 0x21c], 0xffffffff
xor ebx, ebx
mov esi, ecx
lea eax, [esi + 4]
push eax
push ebx
push ebx
push 0x932f1d58
push 0x36c5ce3f
push 0xe553e9d8
push 0x62bffacd
push 0x7814c1fa
push 0x50
push 6
lea eax, [ebp - 0x214]
push eax
mov dword [ebp - 0x218], ebx
mov byte [ebp - 0x214], bl
mov byte [ebp - 0x213], bl
mov byte [ebp - 0x212], bl
mov byte [ebp - 0x211], bl
mov byte [ebp - 0x210], bl
mov byte [ebp - 0x20f], 5
mov dword [0x1029144], esi
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x1008bb9
push edi
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
push dword [ebp - 0x21c]
lea eax, [ebp - 0x20c]
push 0x1001778
push 0x104
push eax
call fcn.0100898d
add esp, 0x10
push ebx
lea eax, [ebp - 0x20c]
push eax
xor edi, edi
inc edi
push edi
push 0x1001768
call dword [sym.imp.RPCRT4.dll_RpcServerUseProtseqEpW]
test eax, eax
jne 0x1008bb8
push 0x1008a37
push 0x4d2
push ebx
push ebx
push ebx
push dword [section..data]
call dword [sym.imp.RPCRT4.dll_RpcServerRegisterIfEx]
test eax, eax
jne 0x1008bb8
push edi
push edi
push edi
call dword [sym.imp.RPCRT4.dll_RpcServerListen]
cmp eax, ebx
je 0x1008ba1
cmp eax, 0x6b1
jne 0x1008bb8
push 0x100172c
push ebx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 8], eax
mov dword [ebp - 0x218], edi
pop edi
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x218]
pop esi
xor ecx, ebp
pop ebx
call fcn.0100a217
leave
ret
Function at 0x1008bd2
Capabilities:
Connect network resource

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
push esi
mov esi, ecx
xor ecx, ecx
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ecx
jne 0x1008bf3
mov dword [ebp - 4], 0x57
jmp 0x1008ccb
mov eax, dword [esi + 8]
cmp eax, ecx
je 0x1008c19
cmp dword [esi + 0xc], ecx
jne 0x1008c19
push 0x7530
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x1008c19
mov dword [esi + 0xc], 1
push ebx
lea eax, [esi + 0x14]
push edi
push eax
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea edi, [esi + 0x2c]
mov ebx, dword [edi]
jmp 0x1008c44
push dword [ebp + 8]
lea eax, [ebx + 8]
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x1008c94
mov ebx, dword [ebx]
cmp ebx, dword [esi + 0x30]
jne 0x1008c2f
mov eax, dword [ebp + 8]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x1008c4f
sub eax, edx
sar eax, 1
lea ebx, [eax + 1]
lea eax, [ebx + ebx + 0xc]
push eax
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
mov esi, eax
pop ecx
test esi, esi
jne 0x1008c7a
mov dword [ebp - 4], 8
jmp 0x1008c94
push dword [ebp + 8]
lea eax, [esi + 8]
push ebx
push eax
call fcn.0100891e
mov eax, dword [edi + 4]
mov dword [esi], edi
mov dword [esi + 4], eax
mov dword [eax], esi
mov dword [edi + 4], esi
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor edx, edx
cmp dword [ebp - 4], edx
jne 0x1008cc9
push 8
pop ecx
xor eax, eax
lea edi, [ebp - 0x28]
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
push edx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
push edx
mov dword [ebp - 0xc], eax
push edx
lea eax, [ebp - 0x28]
push eax
call sub.MPR.dll_WNetAddConnection2W
mov dword [ebp - 4], eax
pop edi
pop ebx
mov eax, dword [ebp - 4]
pop esi
leave
ret 8
Function at 0x1008df9
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x1029004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
xor edi, edi
mov dword [ebp - 0x210], edi
mov dword [ebp - 0x214], edi
mov dword [ebp - 0x224], edi
mov dword [ebp - 0x220], edi
mov dword [ebp - 0x21c], 8
cmp dword [ebp + 8], edi
jne 0x1008e49
call fcn.010088cb
test eax, eax
je 0x1008e49
xor ebx, ebx
jmp 0x1008efb
push esi
lea eax, [ebp - 0x210]
push eax
push 0x2001f
push edi
mov esi, 0x1001648
push esi
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
cmp ebx, edi
jne 0x1008efa
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x20c]
push eax
push edi
push 2
push 0x100161c
push edi
push dword [ebp - 0x210]
mov dword [ebp - 0x218], 0x208
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
mov ebx, eax
cmp ebx, edi
jne 0x1008efa
cmp word [ebp - 0x20c], di
je 0x1008eed
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x20c]
push eax
call sub.WINSPOOL.DRV_OpenPrinterW
test eax, eax
jne 0x1008ed6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x1008efa
push dword [ebp - 0x214]
call sub.WINSPOOL.DRV_ClosePrinter
lea eax, [ebp - 0x20c]
push eax
call sub.WINSPOOL.DRV_Ordinal_204
push esi
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
pop esi
cmp dword [ebp - 0x210], edi
je 0x1008f0f
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.0100a217
leave
ret 4
Function at 0x100aa20
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebp - 0xc], eax
xor eax, eax
cmp dword [ebp + 8], eax
je 0x100abfc
mov edi, dword [ebp + 0x1c]
cmp edi, eax
je 0x100abfc
cmp dword [ebp + 0xc], eax
je 0x100abfc
cmp dword [ebp + 0x14], eax
je 0x100aa69
mov dword [edi], eax
cmp dword [ebp + 0x18], eax
je 0x100aa83
push esi
push dword [ebp + 0x14]
push dword [ebp + 8]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
jmp 0x100ab82
mov esi, dword [sym.imp.USER32.dll_MsgWaitForMultipleObjectsEx]
mov edi, 0xc0
xor ebx, ebx
push 1
xor eax, eax
push eax
push eax
push eax
lea eax, [ebp - 0x28]
push eax
inc ebx
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x100aabb
cmp dword [ebp - 0x24], 0x12
je 0x100ab18
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
cmp ebx, 0x64
jb 0x100aa90
mov ebx, dword [ebp + 0xc]
push 6
push 0
push 0
push dword [ebp + 8]
push ebx
call esi
test eax, eax
je 0x100aad0
jbe 0x100aad9
dec ebx
cmp eax, ebx
jbe 0x100ab7f
cmp eax, edi
je 0x100aa8e
push 6
push 0x4ff
push dword [ebp + 0x10]
push dword [ebp + 8]
push dword [ebp + 0xc]
call esi
cmp eax, edi
je 0x100aa8e
cmp eax, dword [ebp + 0xc]
jne 0x100ab7f
cmp dword [ebp - 4], 0xffffffff
je 0x100aa8e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 8]
cmp eax, dword [ebp - 4]
jae 0x100ab49
sub dword [ebp - 4], eax
jmp 0x100aa8e
mov eax, dword [0x1029018]
cmp eax, 0x1029018
je 0x100ab3f
test byte [eax + 0x1c], 2
je 0x100ab3f
push dword [ebp - 0xc]
push 0x10019d0
push 0x13
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0100a6f5
mov eax, 0x83450068
jmp 0x100ac01
mov ecx, dword [0x1029018]
cmp ecx, 0x1029018
je 0x100ab75
test byte [ecx + 0x1c], 4
je 0x100ab75
push 0x10019d0
push 0x14
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.0100a6cf
mov ecx, dword [0x1029018]
mov edi, dword [ebp + 0x1c]
mov eax, 0x102
jmp 0x100ab88
mov edi, dword [ebp + 0x1c]
mov ecx, dword [0x1029018]
xor edx, edx
cmp eax, edx
je 0x100ab90
jbe 0x100aba3
mov esi, dword [ebp + 0xc]
dec esi
cmp eax, esi
ja 0x100aba3
cmp dword [ebp + 0x14], edx
jne 0x100ab9f
mov dword [edi], eax
xor eax, eax
jmp 0x100ac01
cmp eax, 0x80
jb 0x100abc5
mov esi, dword [ebp + 0xc]
add esi, 0x7f
cmp eax, esi
ja 0x100abc5
cmp dword [ebp + 0x14], edx
jne 0x100abbe
add eax, 0xffffff80
mov dword [edi], eax
mov eax, 0x83450066
jmp 0x100ac01
cmp eax, 0x102
jne 0x100abd5
mov dword [edi], edx
mov eax, 0x83450067
jmp 0x100ac01
cmp ecx, 0x1029018
je 0x100abf5
test byte [ecx + 0x1c], 4
je 0x100abf5
push 0x10019d0
push 0x15
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.0100a6cf
mov eax, 0x80004005
jmp 0x100ac01
mov eax, 0x80070057
pop edi
pop esi
pop ebx
leave
ret 0x18
Function at 0x100aced
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
xor esi, esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
cmp edi, esi
je 0x100adc1
mov ebx, dword [ebp + 0x10]
cmp ebx, esi
je 0x100adc1
push 0xc
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
jne 0x100ad2f
mov edi, 0x8007000e
jmp 0x100adea
mov eax, dword [ebp + 0xc]
mov dword [esi + 4], eax
lea eax, [ebp - 4]
push eax
push 0x10297fc
push 4
mov dword [esi], edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
test eax, eax
jne 0x100ad83
mov eax, dword [0x1029018]
cmp eax, 0x1029018
je 0x100ad7c
test byte [eax + 0x1c], 4
je 0x100ad7c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x1029018]
push 0x10019d0
push 0x27
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0100a6f5
mov edi, 0x80004005
jmp 0x100adea
mov eax, dword [ebp - 4]
mov dword [esi + 8], eax
lea eax, [ebp - 8]
push eax
xor edi, edi
push edi
push esi
push 0x100b650
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, edi
jne 0x100adb5
cmp dword [ebp - 4], edi
je 0x100ad7c
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [ebp - 4], edi
jmp 0x100ad7c
mov ecx, dword [ebp - 8]
mov dword [ebx], ecx
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
jmp 0x100adf4
mov eax, dword [0x1029018]
cmp eax, 0x1029018
je 0x100ade5
test byte [eax + 0x1c], 4
je 0x100ade5
push 0x10019d0
push 0x26
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0100a6cf
mov edi, 0x80070057
test esi, esi
je 0x100adf4
push esi
call fcn.0100a7dc
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 0x10

Function at 0x100ae87
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp dword [0x102901c], 2
push esi
mov esi, 0x80004005
je 0x100aea2
mov esi, 0x83450065
jmp 0x100aeb7
push dword [ebp + 8]
push dword [0x10297cc]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x100aeb7
xor esi, esi
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x100aec3
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
jne 0x100aefb
mov esi, 0x80070057
mov eax, dword [0x1029018]
cmp eax, 0x1029018
je 0x100af34
test byte [eax + 0x1c], 4
je 0x100af34
push 0x10019d0
push 0x2e
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0100a6cf
jmp 0x100af34
cmp dword [0x102901c], 2
je 0x100af24
mov esi, 0x83450065
mov eax, dword [0x1029018]
cmp eax, 0x1029018
je 0x100af34
test byte [eax + 0x1c], 4
je 0x100af34
push 0x10019d0
push 0x2f
jmp 0x100aeee
push dword [0x10297cc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [esi], eax
xor esi, esi
mov eax, esi
pop esi
pop ebp
ret 4
Function at 0x100b560
Capabilities:
Allocate thread local storage

Disassembly:
mov eax, dword [0x102901c]
push ebx
push esi
mov esi, 0x80004005
mov ebx, 0x10019d0
cmp eax, 1
je 0x100b57f
cmp eax, 3
jne 0x100b621
mov esi, dword [sym.imp.KERNEL32.dll_TlsAlloc]
call esi
mov dword [0x10297cc], eax
call esi
push 0x10297f8
mov dword [0x10297d0], eax
call fcn.0100a7ed
mov esi, eax
test esi, esi
jge 0x100b5cb
mov eax, dword [0x1029018]
cmp eax, 0x1029018
je 0x100b61b
test byte [eax + 0x1c], 4
je 0x100b61b
push esi
push 0x1001ba0
push ebx
push 0xa
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0100a721
jmp 0x100b616
push 0x10297ec
call fcn.0100b6af
mov esi, eax
test esi, esi
jge 0x100b5f8
mov eax, dword [0x1029018]
cmp eax, 0x1029018
je 0x100b61b
test byte [eax + 0x1c], 4
je 0x100b61b
push esi
push 0x1001b58
push ebx
push 0xb
jmp 0x100b5be
push edi
xor eax, eax
mov edi, 0x10297d4
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor esi, esi
stosd dword es:[edi], eax
mov dword [0x10297e0], esi
mov dword [0x102901c], 2
pop edi
mov eax, dword [0x1029018]
test esi, esi
jge 0x100b646
jmp 0x100b626
mov eax, dword [0x1029018]
cmp eax, 0x1029018
je 0x100b641
test byte [eax + 0x1c], 4
je 0x100b641
push ebx
push 0xc
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0100a6cf
call fcn.0100b28a
mov eax, esi
pop esi
pop ebx
ret