joyce8/EMBER2024-capa huggingface dataset:
Function at 0x418110
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov ecx, 0x20
mov eax, dword [edi + 4]
cmp eax, ecx
mov dword [edi + 0x78], 0
cmova eax, ecx
mov dword [edi + 0x7c], 0
mov dword [edi + 0x54], eax
xor ecx, ecx
mov eax, dword [edi]
mov dword [edi + 0x30], 1
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
mov dword [edi + 0x40], 0
mov dword [edi + 0x44], 1
mov dword [edi + 0x70], 0
mov dword [edi + 0x88], 0
mov dword [edi + 0x90], 0xffffffff
mov dword [edi + 0x94], 0xffffffff
mov dword [edi + 0x68], 0
mov dword [edi + 0x6c], 0
mov dword [edi + 0x48], 0
mov dword [edi + 0x4c], 0
mov dword [edi + 0x50], 0
mov dword [edi + 0x60], 0
mov dword [edi + 0x64], 0
mov dword [edi + 0x80], 0
mov dword [edi + 0x84], 0
mov dword [edi + 0x58], 0
cmp eax, dword [edi + 0x20]
je 0x41822c
lea ebx, [edi + 0xd0]
lea ebp, [ecx + 0x20]
mov edx, dword [ebx]
test edx, edx
je 0x418205
mov dword [ebx], 0
nop
mov eax, dword [ebx - 8]
mov esi, dword [edx]
mov eax, dword [eax + 0x14]
mov ecx, eax
mov eax, dword [eax + 4]
call eax
mov edx, esi
test esi, esi
jne 0x4181f0
add ebx, 0x28
sub ebp, 1
jne 0x4181e2
mov edx, dword [edi + 0x5c]
mov ecx, dword [edi + 0x58]
test edx, edx
je 0x418227
mov eax, dword [edi + 0x14]
mov ecx, eax
mov eax, dword [eax + 4]
call eax
mov ecx, dword [edi + 0x58]
mov dword [edi + 0x5c], ebp
mov eax, dword [edi]
mov dword [edi + 0x20], eax
mov eax, dword [edi + 0x10]
mov dword [edi + 0x98], eax
lea eax, [ecx + 5]
lea eax, [eax + eax*4]
mov dword [edi + 0x9c], 0
lea ebx, [edi + eax*8]
mov dword [edi + 0xa0], 0
lea eax, [ecx + 1]
mov dword [edi + 0xa4], 0
lea ecx, [ebx + 0x20]
mov dword [edi + 0xa8], 0
mov dword [edi + 0xac], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x58], eax
call fcn.004199b0
mov ebp, eax
test ebp, ebp
jne 0x418319
lea ecx, [ebx + 0x1c]
call fcn.004199b0
mov ebp, eax
test ebp, ebp
jne 0x418319
lea ecx, [ebx + 0x20]
call fcn.00419ab0
mov ebp, eax
test ebp, ebp
jne 0x418319
lea ecx, [ebx + 0x1c]
call fcn.00419ab0
mov ebp, eax
test ebp, ebp
jne 0x418319
push ebx
call fcn.004198e0
mov ebp, eax
test ebp, ebp
je 0x41832b
mov dword [edi + 0x44], 0
lea esi, [edi + 0xe4]
mov dword [esp + 0x10], 0x20
cmp dword [esi - 4], 0
je 0x4182fe
lea ecx, [esi + 4]
call fcn.00419ab0
mov ecx, esi
call fcn.00419ab0
lea ecx, [esi - 4]
call fcn.00419c90
mov ecx, esi
call fcn.00419ae0
lea ecx, [esi + 4]
call fcn.00419ae0
add esi, 0x28
sub dword [esp + 0x10], 1
jne 0x4182e1
test ebp, ebp
jle 0x418324
movzx ebp, bp
or ebp, 0x80070000
test ebp, ebp
je 0x41832b
mov dword [edi + 0x40], ebp
cmp dword [edi + 0x38], 0
jne 0x418344
cmp dword [edi + 0x40], 0
jne 0x418344
cmp dword [edi + 0x3c], 0
jne 0x418344
mov dword [edi + 0x44], 0
xor eax, eax
cmp dword [edi + 0x44], eax
pop edi
cmovne ebp, eax
pop esi
mov eax, ebp
pop ebp
pop ebx
pop ecx
ret
Function at 0x419c50
Capabilities:
Create thread

Disassembly:
push ecx
push esi
lea eax, [esp + 4]
mov esi, ecx
push eax
push 0
push dword [esp + 0x14]
push edx
push 0
push 0
call sub.msvcrt.dll__beginthreadex
add esp, 0x18
mov dword [esi], eax
pop esi
test eax, eax
je 0x419c79
xor eax, eax
pop ecx
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov ecx, 1
cmovne ecx, eax
mov eax, ecx
pop ecx
ret 4

Function at 0x41aab1
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x41aaf0
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41aaf0
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41aaf0
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x41aaf0
cmp dword [ecx + 0x74], 0xe
jbe 0x41aaf0
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x41b1d0
Capabilities:
Get process heap force flags

Disassembly:
call fcn.0041b100
mov ecx, dword fs:[0x18]
mov ecx, dword [ecx + 0x30]
mov edx, dword [ecx + 0xa4]
shl edx, 0x10
or edx, dword [ecx + 0xa8]
cmp edx, 0x50001
jae 0x41b1fa
add eax, 0x74
ret
cmp edx, 0x60000
jae 0x41b206
add eax, 0x78
ret
add eax, 0x88
ret

Function at 0x41b210
Capabilities:
Get process heap force flags

Disassembly:
call fcn.0041b100
mov ecx, dword fs:[0x18]
mov ecx, dword [ecx + 0x30]
mov edx, dword [ecx + 0xa4]
shl edx, 0x10
or edx, dword [ecx + 0xa8]
cmp edx, 0x60000
jae 0x41b23a
add eax, 0x7c
ret
add eax, 0x8c
ret

Function at 0x41b820
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
call fcn.00402be0
mov esi, dword [ebp + 8]
test al, al
je 0x41b83e
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call fcn.0041b850
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x41b980
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 2
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x41b9dc
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41b9dc
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41b9dc
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x41b9dc
cmp dword [ecx + 0x74], 0xe
jbe 0x41b9dc
cmp dword [ecx + 0xe8], 0
je 0x41b9dc
push dword [ebp + 8]
call fcn.0041b850
add esp, 4
lea eax, [ebp - 0xc]
mov byte [ebp - 1], 0
mov dword [ebp - 0x18], eax
lea eax, [ebp - 8]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 1]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x18]
push eax
push 0x426814
call fcn.0041b630
add esp, 8
cmp dword [ebp - 8], 0
jne 0x41ba11
push dword [ebp + 8]
call fcn.0041b820
mov esp, ebp
pop ebp
ret
Function at 0x41ba50
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x41baac
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41baac
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41baac
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x41baac
cmp dword [ecx + 0x74], 0xe
jbe 0x41baac
cmp dword [ecx + 0xe8], 0
je 0x41baac
push dword [ebp + 8]
call fcn.0041b850
add esp, 4
lea eax, [ebp - 0xc]
mov byte [ebp - 1], 0
mov dword [ebp - 0x18], eax
lea eax, [ebp - 8]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 1]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x18]
push eax
push 0x426814
call fcn.0041b630
add esp, 8
cmp dword [ebp - 8], 0
jne 0x41bae1
push dword [ebp + 8]
call fcn.0041b820
mov esp, ebp
pop ebp
ret

Function at 0x41bb30
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ecx, dword [eax + 0xa4]
shl ecx, 0x10
or ecx, dword [eax + 0xa8]
cmp ecx, 0x60000
jae 0x41bb5a
mov eax, 2
pop ebp
ret
push esi
call fcn.0041b100
mov esi, eax
mov eax, dword [ebp + 8]
mov edx, dword [esi + 0x70]
mov ecx, edx
and cl, 2
movzx ecx, cl
neg ecx
sbb ecx, ecx
inc eax
cmp eax, 3
ja case.default.0x41bb7a
jmp dword [eax*4 + 0x41bbb0]
or edx, 2
lea eax, [ecx + 2]
mov dword [esi + 0x70], edx
pop esi
pop ebp
ret
and edx, 0xfffffffd
mov dword [esi + 0x70], edx
lea eax, [ecx + 2]
pop esi
pop ebp
ret
call sub.msvcrt.dll__errno
mov dword [eax], 0x16
call fcn.0041c250
or eax, 0xffffffff
pop esi
pop ebp
ret
Function at 0x41c280
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x328
mov eax, dword [0x423040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x17
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x41c2a7
mov ecx, 5
int 0x29
push 2
call fcn.0041ab55
push 0x50
lea eax, [ebp - 0x320]
push 0
push eax
call sub.msvcrt.dll_memset
push 0x2cc
lea eax, [ebp - 0x2d0]
push 0
push eax
call sub.msvcrt.dll_memset
lea eax, [ebp - 0x320]
add esp, 0x1c
mov dword [ebp - 0x328], eax
lea eax, [ebp - 0x2d0]
mov dword [ebp - 0x324], eax
mov dword [ebp - 0x220], eax
mov dword [ebp - 0x224], ecx
mov dword [ebp - 0x228], edx
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x230], esi
mov dword [ebp - 0x234], edi
mov word [ebp - 0x208], ss
mov word [ebp - 0x214], cs
mov word [ebp - 0x238], ds
mov word [ebp - 0x23c], es
mov word [ebp - 0x240], fs
mov word [ebp - 0x244], gs
pushfd
pop dword [ebp - 0x210]
mov eax, dword [ebp + 4]
mov dword [ebp - 0x218], eax
lea eax, [ebp + 4]
mov dword [ebp - 0x20c], eax
mov dword [ebp - 0x2d0], 0x10001
mov eax, dword [eax - 4]
mov dword [ebp - 0x21c], eax
mov eax, dword [ebp + 4]
mov dword [ebp - 0x320], 0xc0000417
mov dword [ebp - 0x31c], 1
mov dword [ebp - 0x314], eax
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
push 0
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea eax, [ebp - 0x328]
push eax
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
test eax, eax
jne 0x41c3b2
test esi, esi
jne 0x41c3b2
push 2
call fcn.0041ab55
add esp, 4
push 0xc0000417
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0041abb5
mov esp, ebp
pop ebp
ret

Function at 0x41c760
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41c78d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41c78d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x41c850
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
push edi
mov eax, ecx
mov edi, dword [esp + 0x14]
mov ebp, dword [esp + 0x18]
cmp edi, 0x1f
jb 0x41c9f0
test edx, 3
je 0x41c882
movzx esi, byte [edx]
movzx ebx, al
inc edx
shr eax, 8
xor esi, ebx
xor eax, dword [ebp + esi*4]
dec edi
jmp 0x41c867
xor eax, dword [edx]
lea edi, [edx + edi - 0x1b]
sub edx, edi
lea ebx, [ebx]
mov ecx, dword [edi + edx + 0xc]
mov ebx, dword [edi + edx + 8]
movzx esi, bl
xor ecx, dword [ebp + esi*4 + 0xc00]
movzx esi, bh
shr ebx, 0x10
xor ecx, dword [ebp + esi*4 + 0x800]
movzx esi, bl
shr ebx, 8
xor ecx, dword [ebp + esi*4 + 0x400]
xor ecx, dword [ebp + ebx*4]
mov ebx, dword [edi + edx + 4]
movzx esi, bl
xor ecx, dword [ebp + esi*4 + 0x1c00]
movzx esi, bh
shr ebx, 0x10
xor ecx, dword [ebp + esi*4 + 0x1800]
movzx esi, bl
shr ebx, 8
xor ecx, dword [ebp + esi*4 + 0x1400]
xor ecx, dword [ebp + ebx*4 + 0x1000]
movzx esi, al
mov ebx, eax
shr ebx, 0x18
xor ecx, dword [ebp + esi*4 + 0x2c00]
xor ecx, dword [ebp + ebx*4 + 0x2000]
ror eax, 0x10
movzx esi, al
shr eax, 0x18
xor ecx, dword [ebp + esi*4 + 0x2400]
xor ecx, dword [ebp + eax*4 + 0x2800]
mov eax, dword [edi + edx + 0x18]
mov ebx, dword [edi + edx + 0x14]
movzx esi, bl
xor eax, dword [ebp + esi*4 + 0xc00]
movzx esi, bh
shr ebx, 0x10
xor eax, dword [ebp + esi*4 + 0x800]
movzx esi, bl
shr ebx, 8
xor eax, dword [ebp + esi*4 + 0x400]
xor eax, dword [ebp + ebx*4]
mov ebx, dword [edi + edx + 0x10]
movzx esi, bl
xor eax, dword [ebp + esi*4 + 0x1c00]
movzx esi, bh
shr ebx, 0x10
xor eax, dword [ebp + esi*4 + 0x1800]
movzx esi, bl
shr ebx, 8
xor eax, dword [ebp + esi*4 + 0x1400]
xor eax, dword [ebp + ebx*4 + 0x1000]
movzx esi, cl
mov ebx, ecx
shr ebx, 0x18
xor eax, dword [ebp + esi*4 + 0x2c00]
xor eax, dword [ebp + ebx*4 + 0x2000]
ror ecx, 0x10
movzx esi, cl
shr ecx, 0x18
xor eax, dword [ebp + esi*4 + 0x2400]
xor eax, dword [ebp + ecx*4 + 0x2800]
add edx, 0x18
jae 0x41c890
add edi, 0x18
sub edx, 0x18
movzx ebx, al
movzx ecx, ah
shr eax, 0x10
movzx esi, al
shr eax, 8
mov eax, dword [ebp + eax*4]
xor eax, dword [ebp + ebx*4 + 0xc00]
xor eax, dword [ebp + ecx*4 + 0x800]
xor eax, dword [ebp + esi*4 + 0x400]
add edx, 4
jb 0x41c9e9
xor eax, dword [edi + edx]
jmp 0x41c9b7
add edx, edi
add edi, 3
sub edi, edx
test edi, edi
je 0x41ca07
movzx esi, byte [edx]
movzx ebx, al
inc edx
shr eax, 8
xor esi, ebx
xor eax, dword [ebp + esi*4]
dec edi
jne 0x41c9f4
pop edi
pop esi
pop ebp
pop ebx
ret 8
Function at 0x408ab3
Capabilities:
Check mutex on windows

Disassembly:
sub esp, 0x1c
mov dword [esp + 8], str.qFlJFfII
mov dword [esp + 4], 1
mov dword [esp], 0
call sub.KERNEL32.dll_CreateMutexA
sub esp, 0xc
test eax, eax
mov dword [0x4223d4], eax
mov dl, 1
je 0x408aed
call sub.KERNEL32.dll_GetLastError
cmp eax, 0xb7
setne dl
mov al, dl
add esp, 0x1c
ret
Function at 0x40970c
Capabilities:
Write file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x86c
mov esi, dword [0x422830]
test esi, esi
jne 0x409942
mov edi, eax
lea eax, [esp + 0x48]
mov dword [esp + 0x3c], ecx
mov ebx, edx
mov dword [esp], eax
call sub.KERNEL32.dll_GetLocalTime
push ecx
movzx eax, word [esp + 0x4e]
cmp eax, dword [0x42b480]
mov ecx, dword [esp + 0x3c]
je 0x4097a2
test cl, cl
jne 0x4097a6
movzx edx, word [esp + 0x48]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.C:UsersAdministratorAppDataRoamingLogs_
mov dword [esp + 8], str._s_.2d__.2d__.4d
mov dword [esp + 4], 0x104
mov dword [esp], 0x42b4a0
mov dword [0x42b480], eax
mov dword [esp + 0x18], edx
movzx edx, word [esp + 0x4a]
mov dword [esp + 0x14], edx
call fcn.004127a8
mov eax, dword [0x42282c]
cmp eax, 0xffffffff
je 0x4097c5
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
push edx
jmp 0x4097c5
test cl, cl
je 0x4097cf
mov eax, dword [0x42282c]
cmp eax, 0xffffffff
je 0x4097b9
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
push eax
mov dword [esp], 0x42b4a0
call fcn.00406e04
mov dword [0x42282c], 0xffffffff
cmp dword [0x42282c], 0xffffffff
jne 0x409906
mov dword [esp], str.C:UsersAdministratorAppDataRoamingLogs_
call fcn.0040729c
test al, al
jne 0x4097f8
mov dword [esp], str.C:UsersAdministratorAppDataRoamingLogs_
call fcn.00407b16
lea ebp, [esp + 0x458]
mov dword [esp + 0x14], 0x204
mov dword [esp + 0xc], 0x104
mov dword [esp + 8], 0x42b4a0
mov dword [esp + 4], 0
mov dword [esp + 0x10], ebp
mov dword [esp], 0xfde9
call sub.KERNEL32.dll_MultiByteToWideChar
sub esp, 0x18
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 4
mov dword [esp + 0xc], 0
mov dword [esp + 8], 1
mov dword [esp + 4], 0x40000000
mov dword [esp], ebp
call sub.KERNEL32.dll_CreateFileW
sub esp, 0x1c
cmp eax, 0xffffffff
mov dword [0x42282c], eax
jne 0x409886
mov dword [0x422830], 1
jmp 0x409945
mov dword [esp + 0xc], 2
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], eax
call sub.KERNEL32.dll_SetFilePointer
sub esp, 0x10
movzx eax, word [esp + 0x54]
lea ebp, [esp + 0x58]
mov dword [esp + 8], str.__.2d__.2d__d__.2d:_.2d:_.2d__r_n
mov dword [esp + 4], 0x400
mov dword [esp], ebp
mov dword [esp + 0x20], eax
movzx eax, word [esp + 0x52]
mov dword [esp + 0x1c], eax
movzx eax, word [esp + 0x50]
mov dword [esp + 0x18], eax
movzx eax, word [esp + 0x48]
mov dword [esp + 0x14], eax
movzx eax, word [esp + 0x4a]
mov dword [esp + 0x10], eax
movzx eax, word [esp + 0x4e]
mov dword [esp + 0xc], eax
call fcn.004127a8
xor ecx, ecx
mov edx, eax
mov eax, ebp
call fcn.0040970c
test ebx, ebx
jle 0x409945
mov dword [esp + 4], ebx
mov dword [esp], edi
call fcn.004096f0
lea eax, [esp + 0x44]
mov dword [esp + 0x10], 0
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp + 0xc], eax
mov eax, dword [0x42282c]
mov dword [esp], eax
call sub.KERNEL32.dll_WriteFile
sub esp, 0x14
mov esi, eax
jmp 0x409945
or esi, 0xffffffff
add esp, 0x86c
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x10019b28
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1003d3d4]
jne 0x10019b32
repz ret
jmp fcn.1001f83d

Function at 0x100260bc
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1003d3d4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.1001fa56
and dword [ebp - 0x14], 0
cmp dword [0x10040050], 0
mov dword [ebp - 0x18], eax
jne 0x1002616f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x10026217
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x10026217
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x10040050], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x10040054], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x10040058], eax
call edi
push eax
call esi
mov dword [0x10040060], eax
test eax, eax
je 0x1002616f
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x1004005c], eax
mov eax, dword [0x1004005c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x100261c8
cmp dword [0x10040060], ecx
je 0x100261c8
push eax
call esi
push dword [0x10040060]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x100261c8
test ebx, ebx
je 0x100261c8
call edi
test eax, eax
je 0x100261bf
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x100261bf
test byte [ebp - 8], 1
jne 0x100261c8
or dword [ebp + 0x10], 0x200000
jmp 0x100261fb
mov eax, dword [0x10040054]
cmp eax, dword [ebp - 0x18]
je 0x100261fb
push eax
call esi
test eax, eax
je 0x100261fb
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x100261fb
mov eax, dword [0x10040058]
cmp eax, dword [ebp - 0x18]
je 0x100261fb
push eax
call esi
test eax, eax
je 0x100261fb
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x10040050]
call esi
test eax, eax
je 0x10026217
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x10026219
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10019b28
leave
ret
Function at 0x10027c50
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push 0xffffffffffffffff
push 0x10030ac0
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov eax, dword [0x1003d3d4]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov eax, dword [0x100400b8]
test eax, eax
jne 0x10027c84
xor esi, esi
jmp 0x10027c8d
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
mov dword [esp + 0x14], esi
mov ebp, dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [esp + 0x30], 0
test esi, esi
je 0x10027cd7
cmp dword [esi + 0x14], 0
jne 0x10027d19
cmp dword [esi + 0x10], 0
jne 0x10027d20
push 0x100277e0
push 0x100400b0
call fcn.10027a20
mov eax, dword [0x100400b8]
add esp, 8
test eax, eax
je 0x10027dcd
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [esp + 0x30], 0xffffffff
test esi, esi
je 0x10027d05
lea ecx, [esi + 4]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x10027d05
mov eax, dword [esi]
mov edx, dword [eax]
push 0
mov ecx, esi
call edx
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebp
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
cmp dword [esi + 0x10], 0
je 0x10027d60
nop
mov ebx, dword [esi + 0x10]
mov eax, dword [ebx + 4]
mov dword [esi + 0x10], eax
mov ecx, dword [ebx]
test ecx, ecx
je 0x10027d4e
mov edx, dword [ecx]
mov eax, dword [edx + 4]
call eax
mov edi, dword [ebx]
mov edx, dword [edi]
mov eax, dword [edx]
push 0
mov ecx, edi
call eax
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebp
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebp
cmp dword [esi + 0x10], 0
jne 0x10027d20
cmp dword [esi + 0x14], 0
je 0x10027ca9
mov edi, dword [esi + 0x14]
mov ecx, dword [edi + 0x10]
mov dword [esi + 0x14], ecx
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x10027d85
mov edx, dword [ecx]
mov eax, dword [edi + 0xc]
mov edx, dword [edx + 4]
push eax
call edx
mov ebx, dword [edi + 8]
test ebx, ebx
je 0x10027db6
lea eax, [ebx + 4]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x10027db6
mov edx, dword [ebx]
mov eax, dword [edx + 4]
mov ecx, ebx
call eax
lea ecx, [ebx + 8]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x10027db6
mov eax, dword [ebx]
mov edx, dword [eax + 8]
mov ecx, ebx
call edx
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebp
cmp dword [esi + 0x14], 0
jne 0x10027d6a
jmp 0x10027ca3
lea ecx, [esp + 0x18]
call fcn.10019f3b
mov dword [esp + 0x24], 0
mov dword [esp + 0x18], vtable.boost::thread_resource_error.0
lea eax, [esp + 0x18]
push eax
mov byte [esp + 0x34], 1
call fcn.100049ba
int3
jmp 0x10027c50
Function at 0x10027e00
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push 0xffffffffffffffff
push 0x10030ac0
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov eax, dword [0x1003d3d4]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov eax, dword [0x100400b8]
test eax, eax
jne 0x10027c84
xor esi, esi
jmp 0x10027c8d
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
mov dword [esp + 0x14], esi
mov ebp, dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [esp + 0x30], 0
test esi, esi
je 0x10027cd7
cmp dword [esi + 0x14], 0
jne 0x10027d19
cmp dword [esi + 0x10], 0
jne 0x10027d20
push 0x100277e0
push 0x100400b0
call fcn.10027a20
mov eax, dword [0x100400b8]
add esp, 8
test eax, eax
je 0x10027dcd
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [esp + 0x30], 0xffffffff
test esi, esi
je 0x10027d05
lea ecx, [esi + 4]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x10027d05
mov eax, dword [esi]
mov edx, dword [eax]
push 0
mov ecx, esi
call edx
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebp
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
cmp dword [esi + 0x10], 0
je 0x10027d60
nop
mov ebx, dword [esi + 0x10]
mov eax, dword [ebx + 4]
mov dword [esi + 0x10], eax
mov ecx, dword [ebx]
test ecx, ecx
je 0x10027d4e
mov edx, dword [ecx]
mov eax, dword [edx + 4]
call eax
mov edi, dword [ebx]
mov edx, dword [edi]
mov eax, dword [edx]
push 0
mov ecx, edi
call eax
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebp
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebp
cmp dword [esi + 0x10], 0
jne 0x10027d20
cmp dword [esi + 0x14], 0
je 0x10027ca9
mov edi, dword [esi + 0x14]
mov ecx, dword [edi + 0x10]
mov dword [esi + 0x14], ecx
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x10027d85
mov edx, dword [ecx]
mov eax, dword [edi + 0xc]
mov edx, dword [edx + 4]
push eax
call edx
mov ebx, dword [edi + 8]
test ebx, ebx
je 0x10027db6
lea eax, [ebx + 4]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x10027db6
mov edx, dword [ebx]
mov eax, dword [edx + 4]
mov ecx, ebx
call eax
lea ecx, [ebx + 8]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x10027db6
mov eax, dword [ebx]
mov edx, dword [eax + 8]
mov ecx, ebx
call edx
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebp
cmp dword [esi + 0x14], 0
jne 0x10027d6a
jmp 0x10027ca3
lea ecx, [esp + 0x18]
call fcn.10019f3b
mov dword [esp + 0x24], 0
mov dword [esp + 0x18], vtable.boost::thread_resource_error.0
lea eax, [esp + 0x18]
push eax
mov byte [esp + 0x34], 1
call fcn.100049ba
int3
jmp 0x10027c50