joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001cd60
Capabilities:
Create thread

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x48
mov eax, dword [ecx + 4]
mov esi, dword [ecx + 0xc]
mov ebx, dword [ecx]
mov edi, dword [ecx + 8]
mov edx, dword [ecx + 0x10]
xor ecx, ecx
mov dword [0x101860cc], eax
mov word [0x10186ac0], cx
test eax, eax
je 0x1001cdb8
mov dword [ebp - 0x2c], edx
mov dword [esp + 4], eax
mov dword [esp], 0x10186ac0
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov edx, dword [ebp - 0x2c]
mov dword [0x101860cc], 0x10186ac0
sub esp, 8
mov eax, esi
pxor xmm0, xmm0
mov dword [0x101860c8], edi
mov byte [0x101860c0], al
lea eax, [ebp - 0x1c]
movups xmmword [0x10186dd8], xmm0
mov dword [0x10186dd4], ebx
mov dword [0x10186ddc], edx
mov dword [ebp - 0x1c], 0
movups xmmword [0x10186de0], xmm0
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x10014940
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
xor edx, edx
sub esp, 0x18
test eax, eax
je 0x1001ce38
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 1
sub esp, 4
lea esp, [ebp - 0x10]
mov eax, edx
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret

Function at 0x1001ce80
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 4
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x14]
mov dword [esp], eax
mov edi, eax
lea esi, [esi]
nop
mov ecx, dword [edi + 0x28]
movzx esi, word [edi + 0x24]
movzx edx, byte [ecx]
test esi, esi
je 0x1001cef0
mov ebx, ecx
mov eax, 0x1504
jmp 0x1001cedd
lea ebp, [ebx + 1]
xor edx, edx
mov ebx, eax
shl ebx, 5
add eax, ebx
lea ebx, [ebp + 1]
add eax, edx
movzx edx, byte [ebp + 1]
mov ebp, ebx
sub ebp, ecx
cmp ebp, esi
jae 0x1001cf1e
test dl, dl
je 0x1001cec0
mov ebp, ebx
cmp dl, 0x60
jbe 0x1001cec5
sub edx, 0x20
movzx edx, dl
jmp 0x1001cec5
mov eax, 0x1504
test dl, dl
je 0x1001cf1e
lea esi, [esi]
mov ebx, eax
shl ebx, 5
add eax, ebx
cmp dl, 0x60
jbe 0x1001cf12
sub edx, 0x20
movzx edx, dl
add ecx, 1
add eax, edx
movzx edx, byte [ecx]
test dl, dl
jne 0x1001cf00
cmp dword [esp + 0x18], eax
je 0x1001cf40
mov edi, dword [edi]
test edi, edi
je 0x1001cf33
cmp dword [esp], edi
jne 0x1001cea0
add esp, 4
mov eax, 0xffffffff
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [edi + 0x10]
add esp, 4
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x1001f030
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, ecx
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x3c
movzx edi, word [ebp + 0x10]
mov dword [esp + 0x20], eax
movzx eax, word [ecx]
mov esi, dword [esp + 0x50]
mov dword [esp + 0x1c], edx
shr di, 4
shr eax, 4
mov dword [esp + 0x24], ecx
mov edx, eax
mov eax, dword [esi + eax*4]
mov word [esp + 0x2e], di
xor edx, 0x7f
mov ecx, dword [esi + edx*4]
mov dword [esp + 0x14], eax
movzx eax, di
mov edi, dword [esi + eax*4]
mov dword [esp + 0x28], ecx
add edi, ecx
mov dword [esp + 0x18], edi
lea edi, [ebx + 4]
xor ebx, ebx
lea esi, [esi]
mov dword [esp], esi
mov edx, dword [esp + 0x14]
mov ecx, edi
mov eax, ebp
add ebx, 1
call fcn.1000ea70
mov dword [esp], esi
mov edx, dword [esp + 0x18]
lea ecx, [edi + 0x20]
lea eax, [ebp + 0x10]
add edi, 0x440
add ebp, 0x20
call fcn.1000ea70
cmp dword [esp + 0x1c], ebx
jne 0x1001f088
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov ebp, dword [eax]
cmp ebp, 0x10
jbe 0x1001f1aa
lea edx, [eax + 0x44]
movzx eax, word [esp + 0x2e]
mov edi, dword [esp + 0x24]
sub ebp, 0xf
mov dword [esp + 0x18], ebx
shr ebp, 1
xor eax, 0x7f
mov dword [esp + 0x1c], edx
add edi, 0x200
add ebp, 0x7f
movzx eax, ax
add ecx, dword [esi + eax*4]
mov dword [esp + 0x14], ecx
nop
mov ebx, dword [esp + 0x14]
mov ecx, ebp
lea esi, [esi]
lea esi, [esi]
mov edx, ecx
shr ecx, 1
and edx, 1
movzx eax, word [edi + ecx*2]
neg edx
and edx, 0x7ff
xor eax, edx
shr eax, 4
add ebx, dword [esi + eax*4]
cmp ecx, 1
jne 0x1001f110
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
movzx eax, word [eax + ebp*2 + 0x200]
shr eax, 4
mov edx, dword [esi + eax*4]
xor eax, 0x7f
add edx, ebx
mov dword [ecx + ebp*8 - 0x3bc], edx
add ebx, dword [esi + eax*4]
mov dword [ecx + ebp*8 - 0x3b8], ebx
sub ebp, 1
cmp ebp, 0x7f
jne 0x1001f100
mov eax, dword [ecx]
mov ebx, dword [esp + 0x18]
mov esi, ecx
mov edx, dword [esp + 0x1c]
lea edi, [eax*4 - 0x40]
cmp ebx, 1
je 0x1001f1aa
imul ebx, ebx, 0x440
add esi, 0x484
mov ebp, edx
add ebx, edx
lea esi, [esi]
mov dword [esp], esi
add esi, 0x440
mov dword [esp + 8], edi
mov dword [esp + 4], ebp
call sub.msvcrt.dll_memcpy
cmp esi, ebx
jne 0x1001f190
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x1001f570
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x2c
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
test eax, eax
je 0x1001f591
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.USER32.dll_ShowWindow]
sub esp, 8
mov dword [esp + 0xc], 2
mov dword [esp + 8], 1
mov dword [esp + 4], 0x1e
mov dword [esp], 1
call fcn.1001c510
call fcn.1002aa70
call fcn.10014260
mov dword [esp + 0x10], 0x11f
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0x7d0
mov dword [esp + 4], 0x10038620
mov dword [esp], 0x10
call fcn.1001cd60
call fcn.10027f20
mov dword [esp], 0xffffffff
call dword [sym.imp.KERNEL32.dll_Sleep]
sub esp, 4
add esp, 0x2c
ret
Function at 0x100216f0
Capabilities:
Print debug messages

Disassembly:
push edi
pxor xmm0, xmm0
lea edi, [esp + 8]
and esp, 0xfffffff0
push dword [edi - 4]
push ebp
mov ebp, esp
push edi
sub esp, 0x84
movups xmmword [ebp - 0x27], xmm0
movdqu xmm1, xmmword [str.Error_cleaning_up_spin_keys_for_thread]
movdqu xmm2, xmmword [0x101854c0]
movdqu xmm3, xmmword [0x101854d0]
movups xmmword [ebp - 0x47], xmm0
mov eax, dword [0x101860d0]
mov dword [ebp - 0xc], eax
xor eax, eax
movups xmmword [ebp - 0x77], xmm1
movups xmmword [ebp - 0x67], xmm2
movups xmmword [ebp - 0x57], xmm3
movups xmmword [ebp - 0x37], xmm0
movups xmmword [ebp - 0x1c], xmm0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea edx, [ebp - 0x50]
mov dword [esp + 8], 0xa
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll__ultoa]
cmp byte [ebp - 0x50], 0
je 0x100217ab
mov eax, 0x27
lea edx, [ebp - 0x77]
jmp 0x1002177d
cmp eax, 0x6a
je 0x1002179a
mov ecx, eax
add eax, 1
cmp byte [edx + eax], 0
jne 0x10021778
cmp eax, 0x6a
je 0x1002179a
add ecx, 2
mov byte [ebp + eax - 0x77], 0xa
mov byte [ebp + ecx - 0x77], 0
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
sub esp, 4
call sub.msvcrt.dll_abort
mov ecx, 0x28
mov eax, 0x27
lea edx, [ebp - 0x77]
jmp 0x10021790

Function at 0x10021b30
Capabilities:
Allocate thread local storage

Disassembly:
call sub.msvcrt.dll_abort
cmp dword [0x10186d90], 1
je 0x10021be8
push edi
mov eax, 0x10186d90
push esi
push ebx
sub esp, 0x10
call fcn.100214d0
lea esi, [eax + 4]
mov ebx, eax
mov dword [esp], esi
call fcn.10018790
mov edi, dword [0x10186d90]
test edi, edi
jne 0x10021ba0
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x10186044], eax
cmp eax, 0xffffffff
je 0x1001f705
mov dword [0x10186d90], 1
mov dword [esp], esi
call fcn.10018ad0
test ebx, ebx
je 0x10021bda
add esp, 0x10
mov eax, ebx
pop ebx
pop esi
pop edi
jmp fcn.100217c0
cmp edi, 1
je 0x10021b82
mov dword [esp], 2
call dword [0x10186088]
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0x10186d90
mov dword [esp + 4], str._once__p_is__d_n
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
mov dword [esp], esi
call fcn.10018ad0
test ebx, ebx
jne 0x10021b8e
add esp, 0x10
pop ebx
pop esi
pop edi
ret
ret
Function at 0x10021bf0
Capabilities:
Set thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
call fcn.100218b0
mov edx, dword [entry3]
test edx, edx
je 0x10021d20
mov ebx, eax
test eax, eax
je 0x10021d20
mov dword [eax + 0x24], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebx + 0x3c], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [ebx + 0x1c], 0xffffffff
mov dword [ebx + 0x18], eax
sub esp, 0x10
lea eax, [ebx + 0x38]
mov dword [esp], eax
call fcn.10035f40
cmp eax, 1
je 0x10021d2c
mov ebp, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebx + 0x38], 0xffffffff
mov dword [ebx + 0x64], 0
mov dword [ebx + 0x14], 0
call ebp
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov esi, eax
call ebp
lea edx, [ebx + 0x14]
mov dword [esp + 8], edi
mov dword [esp + 0x18], 2
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edx
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
sub esp, 0x1c
test eax, eax
je fcn.1001f70a
mov eax, dword [ebx + 0x14]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [ebx + 0x68], 0
mov dword [ebx + 0x6c], eax
movzx eax, byte [ebx + 0x20]
sub esp, 4
and eax, 0xffffffcf
or eax, 0x10
mov byte [ebx + 0x20], al
mov eax, dword [0x10186044]
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
je 0x10021d31
add esp, 0x2c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
add esp, 0x2c
xor ebx, ebx
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
call fcn.100216f0
jmp fcn.1001f70a

Function at 0x10021d40
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
sub esp, 0x1c
call fcn.10021b30
mov eax, dword [0x10186044]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x10021d68
add esp, 0x1c
ret
add esp, 0x1c
jmp fcn.10021bf0
Function at 0x10022030
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov eax, dword [esp + 0x34]
test eax, eax
jne 0x10022060
mov ecx, dword [esp + 0x38]
test ecx, ecx
je 0x10022130
add esp, 0x1c
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret 0xc
cmp eax, 1
je 0x10022160
cmp eax, 3
jne 0x1002204b
mov eax, dword [0x10186044]
cmp eax, 0xffffffff
je 0x1002204b
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x1002204b
lea esi, [eax + 0x1c]
lea edi, [eax + 0x38]
test byte [eax + 0x20], 0x30
je 0x10022190
mov eax, dword [eax + 0xb4]
test eax, eax
je 0x100220a9
call fcn.10021d70
mov eax, dword [ebx + 0x14]
test eax, eax
je 0x100220db
mov dword [esp], eax
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
call ebp
mov eax, dword [ebx + 0x18]
sub esp, 4
test eax, eax
je 0x100220cd
mov dword [esp], eax
call ebp
sub esp, 4
mov dword [ebx + 0x14], 0
mov dword [ebx + 0x18], 0
mov dword [esp], esi
call fcn.10018c50
mov dword [esp], edi
call fcn.10035f40
cmp eax, 1
je 0x10022256
mov eax, dword [ebx + 0xb0]
mov dword [ebx + 0x38], 0xffffffff
test eax, eax
je 0x1002224a
mov eax, dword [0x10186044]
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
jmp 0x1002204b
mov eax, dword [0x10186d6c]
test eax, eax
je 0x1002204b
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_RemoveVectoredExceptionHandler]
mov dword [0x10186d6c], 0
sub esp, 4
jmp 0x1002204b
mov dword [esp + 4], 0x10021440
mov dword [esp], 1
call dword [sym.imp.KERNEL32.dll_AddVectoredExceptionHandler]
sub esp, 8
mov dword [0x10186d6c], eax
mov eax, 1
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret 0xc
mov edx, dword [ebx + 0x68]
mov eax, dword [eax + 0x18]
test edx, edx
jne 0x10022200
test eax, eax
je 0x100221aa
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov eax, dword [ebx + 0xb4]
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x68], 1
test eax, eax
je 0x100221c7
call fcn.10021d70
test byte [ebx + 0x24], 4
je 0x10022240
mov eax, dword [ebx + 0x14]
mov dword [ebx], 0xdeadbeef
test eax, eax
je 0x100220db
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebx + 0x14], 0
sub esp, 4
mov dword [esp], esi
call fcn.10018c50
jmp 0x100220e3
test eax, eax
je 0x10022240
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebx + 0x18], 0
sub esp, 4
mov dword [esp], esi
call fcn.10018c50
mov dword [esp], edi
call fcn.10035f40
cmp eax, 1
je 0x10022256
mov dword [ebx + 0x38], 0xffffffff
jmp 0x1002204b
mov dword [esp], esi
call fcn.10018c50
jmp 0x1002221f
mov eax, ebx
call fcn.10021970
jmp 0x10022109
call fcn.100216f0
lea esi, [esi]
nop
Function at 0x10022530
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [pe_dos_header]
ud2
lea eax, [esp + 0x20]
mov dword [0], eax
ud2
mov eax, dword [esp + 0x28]
mov dword [0], eax
ud2
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
mov ebx, dword [esp + 0x50]
mov edi, dword [esp + 0x54]
mov eax, dword [0x101860d0]
mov dword [esp + 0x2c], eax
mov eax, dword [ebx]
test edi, edi
je 0x10022670
cmp eax, 1
je 0x10022595
mov eax, ebx
call fcn.100214d0
mov esi, eax
lea eax, [eax + 4]
mov dword [esp], eax
mov dword [esp + 0x1c], eax
call fcn.10018790
mov ebp, dword [ebx]
test ebp, ebp
je 0x100225b0
cmp ebp, 1
jne 0x10022640
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
call fcn.10018ad0
test esi, esi
je 0x10022595
mov eax, esi
call fcn.100217c0
xor eax, eax
mov edx, dword [esp + 0x2c]
sub edx, dword [0x101860d0]
jne 0x100226ba
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0x20], 0x10021880
mov dword [esp + 0x24], esi
call fcn.10021b30
mov eax, dword [0x10186044]
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [esp], eax
call ebp
sub esp, 4
test eax, eax
je 0x100226a8
mov eax, dword [eax + 0xc]
mov dword [esp + 0x28], eax
lock or dword [esp], 0
call fcn.10021b30
mov eax, dword [0x10186044]
mov dword [esp], eax
call ebp
sub esp, 4
test eax, eax
je 0x10022690
lea ecx, [esp + 0x20]
mov dword [eax + 0xc], ecx
lock or dword [esp], 0
call edi
call fcn.10021b30
mov eax, dword [0x10186044]
mov dword [esp], eax
call ebp
sub esp, 4
test eax, eax
je 0x10022680
mov edx, dword [esp + 0x28]
mov dword [eax + 0xc], edx
mov dword [ebx], 1
jmp 0x1002257e
mov dword [esp], 2
call dword [0x10186088]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], ebx
mov dword [esp + 4], str._once__p_is__d_n
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
jmp 0x1002257e
mov eax, 0x16
jmp 0x10022597
call fcn.10021bf0
test eax, eax
jne 0x10022626
jmp 0x1001f72f
call fcn.10021bf0
test eax, eax
jne 0x10022602
jmp 0x1001f724
call fcn.10021bf0
test eax, eax
jne 0x100225dc
jmp 0x1001f71d
call fcn.10013840
nop

Function at 0x10022900
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call fcn.10021b30
mov eax, dword [0x10186044]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x10022978
lea ebp, [ebx + 0x38]
xor edi, edi
mov dword [esp], ebp
call fcn.10035f50
mov eax, dword [ebx + 0x28]
cmp dword [esp + 0x30], eax
jae 0x10022954
mov eax, dword [ebx + 0x30]
mov edx, dword [esp + 0x30]
cmp byte [eax + edx], 0
je 0x10022954
mov eax, dword [ebx + 0x2c]
mov edi, dword [eax + edx*4]
mov dword [esp], ebp
call fcn.10035fa0
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
call fcn.10021bf0
mov ebx, eax
jmp 0x1002292b
Function at 0x10022990
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov esi, dword [esp + 0x40]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x14], eax
call fcn.10021b30
mov eax, dword [0x10186044]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x10022ab0
lea edi, [ebx + 0x38]
mov dword [esp], edi
call fcn.10035f50
cmp esi, dword [ebx + 0x28]
jae 0x10022a10
mov edx, dword [ebx + 0x2c]
mov eax, dword [esp + 0x44]
mov dword [edx + esi*4], eax
mov eax, dword [ebx + 0x30]
mov byte [eax + esi], 1
mov dword [esp], edi
call fcn.10035fa0
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
sub esp, 4
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
lea ebp, [esi + 1]
lea eax, [ebp*4]
mov dword [esp + 4], eax
mov eax, dword [ebx + 0x2c]
mov dword [esp], eax
call sub.msvcrt.dll_realloc
test eax, eax
je 0x10022abc
mov dword [esp + 0x1c], eax
mov dword [esp + 4], ebp
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
call sub.msvcrt.dll_realloc
mov edx, dword [esp + 0x1c]
test eax, eax
mov dword [esp + 0x18], eax
je 0x10022abc
mov ecx, dword [ebx + 0x28]
mov eax, ebp
mov dword [esp + 4], 0
mov dword [esp + 0x1c], edx
sub eax, ecx
lea ecx, [edx + ecx*4]
shl eax, 2
mov dword [esp], ecx
mov dword [esp + 8], eax
call sub.msvcrt.dll_memset
mov eax, dword [ebx + 0x28]
mov edx, dword [esp + 0x18]
mov ecx, ebp
mov dword [esp + 4], 0
sub ecx, eax
add eax, edx
mov dword [esp + 8], ecx
mov dword [esp], eax
call sub.msvcrt.dll_memset
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
mov dword [ebx + 0x28], ebp
mov dword [ebx + 0x2c], edx
mov dword [ebx + 0x30], eax
jmp 0x100229d8
call fcn.10021bf0
mov ebx, eax
jmp 0x100229c5
mov dword [esp], edi
call fcn.10035fa0
mov eax, 0xc
jmp 0x10022a00

Function at 0x10022b40
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 0x1c
call fcn.10021b30
mov eax, dword [0x10186044]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x10022b68
mov eax, dword [eax + 0x18]
add esp, 0x1c
ret
call fcn.10021bf0
test eax, eax
jne 0x10022b5d
add esp, 0x1c
ret

Function at 0x10022bd0
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 0x1c
call fcn.10021b30
mov eax, dword [0x10186044]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x10022bf8
add eax, 0xc
add esp, 0x1c
ret
call fcn.10021bf0
test eax, eax
jne 0x10022bed
jmp 0x10022bf0
Function at 0x10022c30
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov esi, dword [esp + 0x20]
call fcn.10021d40
mov dword [eax + 4], esi
mov ebx, eax
mov eax, dword [eax + 0xb4]
test eax, eax
je 0x10022c52
call fcn.10021d70
test byte [ebx + 0x20], 0x30
jne 0x10022c6c
add ebx, 0x70
mov dword [esp + 4], 1
mov dword [esp], ebx
call dword [sym.imp.msvcrt.dll_longjmp]
mov eax, dword [0x10186044]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
push edx
test eax, eax
je 0x10022cad
cmp dword [ebx + 0x14], 0
mov eax, dword [eax + 0x18]
je 0x10022ced
mov dword [ebx + 0x68], 1
mov esi, dword [ebx + 4]
test eax, eax
je 0x10022ca2
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
xor eax, eax
mov dword [ebx + 0x18], eax
test byte [ebx + 0x24], 4
jne 0x10022cb6
mov dword [esp], esi
call dword [sym.imp.msvcrt.dll__endthreadex]
mov eax, dword [ebx + 0x14]
mov dword [ebx], 0xdeadbeef
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
push ecx
mov dword [ebx + 0x14], eax
mov eax, ebx
call fcn.10021b10
xor eax, eax
mov dword [esp + 4], eax
mov eax, dword [0x10186044]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push edx
push edx
jmp 0x10022cad
mov dword [ebx], 0xdeadbeef
test eax, eax
je 0x10022d01
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
xor eax, eax
mov esi, dword [ebx + 4]
mov dword [ebx + 0x18], eax
jmp 0x10022cce

Function at 0x10022d10
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x10186d98]
test eax, eax
jne 0x10022d20
xor eax, eax
ret
sub esp, 0x1c
call fcn.10021b30
mov eax, dword [0x10186044]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x10022d60
mov edx, dword [eax + 0x10]
test edx, edx
jle 0x10022d50
xor eax, eax
add esp, 0x1c
ret
test byte [eax + 0x20], 3
je 0x10022d44
mov eax, dword [eax + 0x24]
and eax, 1
jmp 0x10022d46
call fcn.10021bf0
test eax, eax
jne 0x10022d3d
jmp 0x10022d44

Function at 0x10022d70
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 0x1c
call fcn.10021b30
mov eax, dword [0x10186044]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x10022db0
mov edx, dword [esp + 0x20]
test edx, edx
jle 0x10022da0
lock add dword [eax + 0x10], 1
add esp, 0x1c
ret
lock sub dword [eax + 0x10], 1
add esp, 0x1c
ret
call fcn.10021bf0
test eax, eax
jne 0x10022d8d
add esp, 0x1c
ret
Function at 0x10022eb0
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
call fcn.10021b30
mov eax, dword [0x10186044]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x10022f20
test byte [ebx + 0x20], 0xc
jne 0x10022ee0
mov eax, dword [0x10186d98]
test eax, eax
jne 0x10022ef0
add esp, 0x14
pop ebx
pop esi
ret
lea esi, [ebx + 0x1c]
mov dword [esp], esi
call fcn.10018790
movzx eax, byte [ebx + 0x20]
test al, 3
je 0x10022f12
mov edx, dword [ebx + 0x24]
test dl, 1
je 0x10022f12
mov ecx, dword [ebx + 0x10]
test ecx, ecx
jle 0x10022f31
mov dword [esp], esi
call fcn.10018ad0
add esp, 0x14
pop ebx
pop esi
ret
call fcn.10021bf0
mov ebx, eax
test eax, eax
jne 0x10022ed1
add esp, 0x14
pop ebx
pop esi
ret
and eax, 0xfffffff3
and edx, 0xfffffffe
or eax, 4
mov dword [ebx + 0x24], edx
mov byte [ebx + 0x20], al
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x10022f51
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push eax
mov dword [esp], esi
call fcn.10018ad0
call fcn.10022dc0
nop
push edi
push esi
push ebx
sub esp, 0x10
mov eax, dword [esp + 0x20]
test eax, eax
je 0x10022fe0
mov dword [esp], eax
call fcn.100120c0
mov edi, eax
mov eax, 0xfffffffe
cmp eax, edi
mov eax, 0
sbb eax, edx
jb 0x10023020
call fcn.10021b30
mov eax, dword [0x10186044]
mov esi, edi
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x10023080
test edi, edi
je 0x10022ffa
call fcn.10022eb0
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x10023058
mov dword [esp + 4], esi
mov dword [esp], eax
call fcn.100121e0
call fcn.10022eb0
add esp, 0x10
xor eax, eax
pop ebx
pop esi
pop edi
ret
call fcn.10021b30
mov eax, dword [0x10186044]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x10023070
call fcn.10022eb0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_Sleep]
sub esp, 4
call fcn.10022eb0
add esp, 0x10
xor eax, eax
pop ebx
pop esi
pop edi
ret
call fcn.10021b30
mov eax, dword [0x10186044]
mov esi, 0xffffffff
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
jne 0x10022fb2
call fcn.10021bf0
mov ebx, eax
jmp 0x10022fb2
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_Sleep]
sub esp, 4
jmp 0x10022fce
call fcn.10021bf0
jmp 0x10022ffa
call fcn.10021bf0
mov ebx, eax
jmp 0x10022fae
Function at 0x10023090
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov esi, dword [esp + 0x20]
call fcn.10021b30
mov eax, dword [0x10186044]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x10023108
test esi, esi
je 0x100230e0
call fcn.10022eb0
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x10023118
mov dword [esp + 4], esi
mov dword [esp], eax
call fcn.100121e0
call fcn.10022eb0
add esp, 0x14
xor eax, eax
pop ebx
pop esi
ret
call fcn.10022eb0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_Sleep]
sub esp, 4
call fcn.10022eb0
add esp, 0x14
xor eax, eax
pop ebx
pop esi
ret
call fcn.10021bf0
mov ebx, eax
jmp 0x100230b5
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_Sleep]
sub esp, 4
jmp 0x100230d1

Function at 0x100252a0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.10018e60
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.10018e60
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]