joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003eb50
Capabilities:
Get number of processors

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x102dcb1e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ebx
sub esp, 0x18
push esi
mov esi, ecx
xorps xmm0, xmm0
mov dword [ebp - 0x14], esi
push edi
movups xmmword [esi + 4], xmm0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0xf
mov byte [esi + 4], 0
mov dword [ebp - 4], 0
mov dword [esi], vtable.Blizzard::Streaming::Manifests::ServerItem.0
movups xmmword [esi + 0x1c], xmm0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0xf
mov byte [esi + 0x1c], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x48], 0
mov byte [ebp - 4], 3
call fcn.10042420
mov dword [ebp - 0x28], eax
mov eax, dword [esi + 0x44]
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x20], 0x64
cmp eax, dword [esi + 0x48]
je 0x1003ec17
movups xmm0, xmmword [ebp - 0x28]
movups xmmword [eax], xmm0
add dword [esi + 0x44], 0x10
jmp 0x1003ec24
lea ecx, [ebp - 0x28]
push ecx
push eax
lea ecx, [esi + 0x40]
call fcn.1005ef20
mov ecx, dword [ebp - 0xc]
mov eax, esi
mov dword [esi + 0x54], 0xa
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [esi + 0x58], 1
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x100489f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x102dd3ed
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xac
push ebx
push esi
push edi
mov edi, ecx
push dword [edi + 0xc]
mov eax, dword [edi]
push dword [edi + 8]
push 0
mov eax, dword [eax + 0x30]
push 0
call eax
mov esi, dword [edi + 0x40]
lea ecx, [ebp - 0x10]
mov byte [edi + 0x1c], al
call fcn.1005c420
mov dword [ebp - 4], 0
lea edx, [ebp - 0xb8]
lea ecx, [ebp - 0x10]
mov dword [ebp - 0xb8], 0x1c
mov dword [ebp - 0xac], esi
call fcn.1004fdc0
mov bl, al
mov dword [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x10048a6c
call fcn.1002b970
mov dword [ebp - 4], 0xffffffff
test bl, bl
je 0x10048aab
push dword [edi + 0x18]
mov ecx, dword [edi + 0x44]
lea edx, [edi + 0x20]
push dword [edi + 0x14]
push dword [edi + 0x10]
push dword [edi + 0xc]
push dword [edi + 8]
call fcn.10048bc0
add esp, 0x14
test al, al
je 0x10048aab
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0xc]
xor al, al
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1004d560
Capabilities:
Access peb ldr_data

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x102dd9de
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ebx
sub esp, 8
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x14], edi
mov dword [edi], 0
mov dword [ebp - 4], 0
lea esi, [edi + 0x28]
mov dword [edi], vtable.Blizzard::URL::HttpCallback.0
mov dword [edi + 4], 1
mov byte [edi + 8], 1
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x18], 0xffffffff
mov dword [edi + 0x1c], 0xffffffff
mov dword [edi + 0x20], 0xffffffff
mov dword [edi + 0x24], 0xffffffff
push 0x40
mov dword [ebp - 0x18], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.102d8574
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
mov eax, dword [ebx + 8]
lea esi, [edi + 0x3c]
mov dword [edi + 0x30], 0
xorps xmm0, xmm0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], eax
push 3
movups xmmword [esi], xmm0
push 0x103040c0
mov dword [esi + 0x10], 3
push esi
mov dword [esi + 0x14], 0xf
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
mov byte [esi + 3], 0
mov dword [edi + 0x54], 0
mov dword [edi + 0x58], 0
lea ecx, [edi + 0x5c]
mov byte [ebp - 4], 3
call fcn.100536c0
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4

Function at 0x1004daf0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x264
push esi
mov esi, ecx
test esi, esi
je 0x1004db8e
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
push eax
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputs]
mov ecx, esi
add esp, 0xc
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1004db20
sub ecx, edx
lea edx, [ecx + 1]
mov dword [esp + 8], edx
cmp edx, 0x12c
ja 0x1004db3e
lea eax, [esp + 0x10]
jmp 0x1004db5d
xor ecx, ecx
mov eax, edx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.102d8db3
mov edx, dword [esp + 0xc]
add esp, 4
sub esp, 0xc
mov dword [esp + 0x18], eax
mov ecx, eax
push esi
call fcn.100567f0
add esp, 0x10
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x10]
cmp eax, ecx
je 0x1004db8e
push eax
call fcn.102d8dbc
add esp, 4
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10050280
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x102db8d5
push eax
mov dword fs:[0], esp
sub esp, 0x808
push esi
mov esi, dword [ebp + 8]
push edi
test esi, esi
jne 0x100502ec
mov ecx, 0x103c1be8
mov dword [ebp - 0x14], 0x103c1be8
call fcn.100536a0
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], esi
cmp eax, 1
jne 0x100502db
push esi
push 0x102fe041
push 0x102fe041
push str.file___NULL
call fcn.1004d850
add esp, 0x10
mov ecx, 0x103c1be8
mov dword [ebp - 4], 0xffffffff
call fcn.100536b0
cmp dword [esi], 0xffffffff
jne 0x10050321
push 0x1005b0e0
push ecx
mov edx, 0x1005b140
mov ecx, 0x103be954
call fcn.10056e50
add esp, 8
mov dword [eax], 8
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov edi, dword [ebp + 0x14]
test edi, edi
jne 0x10050371
mov ecx, 0x103c1be8
mov dword [ebp - 0x14], 0x103c1be8
call fcn.100536a0
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 1
cmp eax, 1
jne 0x10050360
push edi
push 0x102fe041
push 0x102fe041
push str.amount___NULL
call fcn.1004d850
add esp, 0x10
mov ecx, 0x103c1be8
mov dword [ebp - 4], 0xffffffff
call fcn.100536b0
cmp dword [edi], 0
je 0x100504aa
push dword [ebp + 0x10]
lea eax, [ebp + 8]
mov byte [esi + 8], 0
push eax
push dword [edi]
push dword [ebp + 0xc]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp + 8]
mov dword [edi], ecx
test eax, eax
jne 0x100504aa
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp edi, 0x27
je 0x10050402
cmp edi, 0x70
je 0x10050402
push 0x1005b0e0
push ecx
mov edx, 0x1005b140
mov ecx, 0x103be954
call fcn.10056e50
mov dword [eax], 6
lea eax, [ebp - 0x414]
push dword [esi + 0x54]
push edi
push str.Win32_Write___d_____s
push eax
call fcn.1005aa70
add esp, 0x18
mov edx, 0x1005b140
mov esi, eax
push 0x1005b0e0
push ecx
mov ecx, 0x103be954
call fcn.10056e50
mov edx, 6
jmp 0x10050451
push 0x1005b0e0
push ecx
mov edx, 0x1005b140
mov ecx, 0x103be954
call fcn.10056e50
mov dword [eax], 0xb
lea eax, [ebp - 0x814]
push dword [esi + 0x54]
push edi
push str.Win32_Write___d_____s
push eax
call fcn.1005aa70
add esp, 0x18
mov edx, 0x1005b140
mov esi, eax
push 0x1005b0e0
push ecx
mov ecx, 0x103be954
call fcn.10056e50
mov edx, 0xb
mov ecx, dword [eax + 8]
test esi, esi
mov eax, 0x102fe041
cmovne eax, esi
push 1
push eax
call fcn.1004dc60
mov edi, eax
add esp, 0x10
test edi, edi
je 0x10050498
push 0x1005b0e0
push ecx
mov edx, 0x1005b140
mov ecx, 0x103be954
call fcn.10056e50
mov esi, eax
add esp, 8
mov ecx, dword [esi + 8]
cmp ecx, edi
je 0x10050495
call fcn.1004dfa0
mov dword [esi + 8], edi
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0xc]
mov al, 1
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10050a90
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x260
push ebx
push esi
mov esi, ecx
test esi, esi
jne 0x10050ab3
mov edx, 1
lea eax, [esp + 0x10]
mov dword [esp + 8], edx
jmp 0x10050af3
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10050ab6
sub ecx, edx
lea edx, [ecx + 1]
mov dword [esp + 8], edx
cmp edx, 0x12c
ja 0x10050ad4
lea eax, [esp + 0x10]
jmp 0x10050af3
xor ecx, ecx
mov eax, edx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.102d8db3
mov edx, dword [esp + 0xc]
add esp, 4
sub esp, 0xc
mov dword [esp + 0x18], eax
mov ecx, eax
push esi
call fcn.100567f0
add esp, 0x10
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
lea ecx, [esp + 0x10]
mov eax, dword [esp + 0xc]
cmp eax, ecx
je 0x10050b26
push eax
call fcn.102d8dbc
add esp, 4
cmp ebx, 0xffffffff
jne 0x10050b33
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test bl, 0x10
mov eax, 0
pop esi
setne al
inc eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10051300
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x264
push ebx
push esi
mov esi, ecx
push edi
mov edi, edx
test esi, esi
jne 0x10051326
mov edx, 1
lea eax, [esp + 0x18]
mov dword [esp + 0x10], edx
jmp 0x1005136d
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10051330
sub ecx, edx
lea edx, [ecx + 1]
mov dword [esp + 0x10], edx
cmp edx, 0x12c
ja 0x1005134e
lea eax, [esp + 0x18]
jmp 0x1005136d
xor ecx, ecx
mov eax, edx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.102d8db3
mov edx, dword [esp + 0x14]
add esp, 4
sub esp, 0xc
mov dword [esp + 0x20], eax
mov ecx, eax
push esi
call fcn.100567f0
add esp, 0x10
push edi
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
lea ecx, [esp + 0x18]
mov eax, dword [esp + 0x14]
sete bl
cmp eax, ecx
je 0x100513a4
push eax
call fcn.102d8dbc
add esp, 4
test bl, bl
je 0x100513bd
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
sete al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10052b30
Capabilities:
Get token privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, ecx
push esi
push edi
lea eax, [ebx + 4]
mov byte [ebx + 0xc], 0
push eax
push str.SeManageVolumePrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
push ebx
push 0x28
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea eax, [ebp - 4]
push eax
push 0
push 0
push 3
push dword [ebx]
call edi
mov esi, dword [ebp - 4]
mov eax, esi
call fcn.102d97c0
mov dword [ebp - 8], esp
lea eax, [ebp - 4]
push eax
push esi
mov esi, dword [ebp - 8]
push esi
push 3
push dword [ebx]
call edi
test eax, eax
je 0x10052bd4
xor edx, edx
cmp dword [esi], edx
jbe 0x10052bd4
mov ecx, dword [ebx + 8]
lea eax, [esi + 4]
cmp dword [eax + 4], ecx
jne 0x10052bcc
mov ecx, dword [eax]
cmp ecx, dword [ebx + 4]
jne 0x10052bc9
mov ecx, dword [eax + 8]
cmp ecx, 2
je 0x10052bc4
cmp ecx, 1
je 0x10052bc4
xor cl, cl
jmp 0x10052bc6
mov cl, 1
mov byte [ebx + 0xc], cl
mov ecx, dword [ebx + 8]
inc edx
add eax, 0xc
cmp edx, dword [esi]
jb 0x10052ba7
mov eax, ebx
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10052bf0
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x408
lea eax, [esp]
push esi
mov esi, dword [ebp + 0xc]
push edi
push 0
push eax
push esi
push dword [ebp + 8]
mov edi, ecx
push dword [edi]
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x10052c47
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x1005b0e0
push ecx
mov edx, 0x1005b140
mov ecx, 0x103be954
mov esi, eax
call fcn.10056e50
mov dword [eax], 7
push dword [edi + 0x54]
push esi
push str.PreallocateFast_Win___SetFilePointerEx___err__d____s
jmp 0x10052cc1
push dword [edi]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x10052c81
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x1005b0e0
push ecx
mov edx, 0x1005b140
mov ecx, 0x103be954
mov esi, eax
call fcn.10056e50
mov dword [eax], 7
push dword [edi + 0x54]
push esi
push str.PreallocateFast_Win___SetEndOfFile___err__d____s
jmp 0x10052cc1
push esi
push dword [ebp + 8]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_SetFileValidData]
test eax, eax
jne 0x10052d39
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x1005b0e0
push ecx
mov edx, 0x1005b140
mov ecx, 0x103be954
mov esi, eax
call fcn.10056e50
mov dword [eax], 7
push dword [edi + 0x54]
push esi
push str.PreallocateFast_Win___SetFileValidData___err__d____s
lea eax, [esp + 0x24]
push eax
call fcn.1005aa70
add esp, 0x18
mov edx, 0x1005b140
mov esi, eax
push 0x1005b0e0
push ecx
mov ecx, 0x103be954
call fcn.10056e50
test esi, esi
mov edx, 7
push 1
mov ecx, dword [eax + 8]
mov eax, 0x102fe041
cmovne eax, esi
push eax
call fcn.1004dc60
mov edi, eax
add esp, 0x10
test edi, edi
je 0x10052d31
push 0x1005b0e0
push ecx
mov edx, 0x1005b140
mov ecx, 0x103be954
call fcn.10056e50
mov esi, eax
add esp, 8
mov ecx, dword [esi + 8]
cmp ecx, edi
je 0x10052d2e
call fcn.1004dfa0
mov dword [esi + 8], edi
xor al, al
pop edi
pop esi
mov esp, ebp
pop ebp
ret
pop edi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10055eb0
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
push esi
mov esi, ecx
test esi, esi
je 0x10055f24
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x400
push eax
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
je 0x10055efc
sub esp, 0xc
lea eax, [ebp - 0x804]
mov edx, 0x100
mov ecx, esi
push eax
call fcn.10056680
add esp, 0x10
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
push edi
lea edi, [esi + 0xff]
mov ecx, str._unknown_
mov eax, esi
cmp esi, edi
jae 0x10055f20
nop
mov dl, byte [ecx]
lea ecx, [ecx + 1]
test dl, dl
je 0x10055f20
mov byte [eax], dl
inc eax
cmp eax, edi
jb 0x10055f10
mov byte [eax], 0
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10056c70
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x102db76d
push eax
mov dword fs:[0], esp
sub esp, 0xc
push esi
push edi
mov esi, edx
mov edi, ecx
call fcn.10056910
push dword [ebp + 0xc]
mov edx, esi
mov ecx, edi
call fcn.10056a30
mov edi, dword [ebp + 8]
add esp, 4
mov ecx, dword [ebp + 0x14]
mov dword [edi], eax
mov dword [eax + 0x18], 1
mov esi, dword [edi]
test ecx, ecx
jne 0x10056cc4
mov eax, dword [0x103bcfa4]
test eax, eax
cmovne ecx, eax
xor edx, edx
lea eax, [esi + 4]
push eax
test ecx, ecx
mov eax, 0x10000
cmovle eax, edx
push eax
push esi
push 0x100573a0
push ecx
push edx
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x18
mov dword [esi], eax
test eax, eax
jne 0x10056d36
mov ecx, 0x103c1be8
mov dword [ebp - 0x14], 0x103c1be8
call fcn.100536a0
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 0
cmp eax, 1
jne 0x10056d25
push 0
push 0x102fe041
push 0x102fe041
push str.thread__threadHandle___NULL
call fcn.1004d850
add esp, 0x10
mov ecx, 0x103c1be8
mov dword [ebp - 4], 0xffffffff
call fcn.100536b0
cmp dword [esi], 0
jne 0x10056d5a
mov ecx, dword [edi]
call fcn.10056bc0
mov dword [edi], 0
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0xc]
mov al, 1
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10056fc0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x102db76d
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
mov eax, dword [esi]
not eax
cmp eax, 0xffffffff
jne 0x1005702a
mov ecx, 0x103c1be8
mov dword [ebp - 0x14], 0x103c1be8
call fcn.100536a0
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 0
cmp eax, 1
jne 0x10057020
push 0
push 0x102fe041
push 0x102fe041
push str.Blizzard::Thread::TLSSlotIsAllocated_slot_
call fcn.1004d850
add esp, 0x10
mov ecx, 0x103c1be8
call fcn.100536b0
mov eax, dword [esi]
not eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10057050
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
mov eax, dword fs:[0]
push 0x102ddf9d
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
mov edi, edx
mov eax, dword [esi]
not eax
cmp eax, 0xffffffff
jne 0x100570c5
mov ecx, 0x103c1be8
mov dword [ebp - 0x14], 0x103c1be8
call fcn.100536a0
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 0
cmp eax, 1
jne 0x100570b4
push 0
push 0x102fe041
push 0x102fe041
push str.Blizzard::Thread::TLSSlotIsAllocated_slot_
call fcn.1004d850
add esp, 0x10
mov ecx, 0x103c1be8
mov dword [ebp - 4], 0xffffffff
call fcn.100536b0
mov eax, dword [esi]
push edi
not eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
cmp dword [esi + 4], 0
je 0x100571b2
test edi, edi
je 0x100571b2
call fcn.10056910
mov ecx, 0x103be974
call fcn.10056fc0
test eax, eax
je 0x1005710b
mov eax, dword [eax + 0x24]
test eax, eax
je 0x100571b2
cmp dword [eax + 0x10], 0
jne 0x100571b2
mov esi, dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, 0x103bd088
mov dword [ebp - 0x10], 0x103bd088
mov ebx, eax
call fcn.10053850
mov dword [ebp - 4], 1
mov ecx, dword [0x103bcfa0]
cmp ecx, 0x10
jl 0x10057182
mov ecx, 0x103c1be8
mov dword [ebp - 0x1c], 0x103c1be8
call fcn.100536a0
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 2
cmp eax, 1
jne 0x1005716f
push 0
push 0x102fe041
push 0x102fe041
push str.__ran_out_of_non_Core_TLS_entries_
call fcn.1004d850
add esp, 0x10
mov ecx, 0x103c1be8
call fcn.100536b0
mov dword [ebp - 4], 3
jmp 0x100571a8
lea eax, [ecx + ecx*2]
inc ecx
mov dword [0x103bcfa0], ecx
mov dword [eax*4 + 0x103bcfa8], ebx
mov dword [eax*4 + 0x103bcfac], edi
mov dword [eax*4 + 0x103bcfb0], esi
mov dword [ebp - 4], 4
mov ecx, 0x103bd088
call fcn.10053a00
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100571d0
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x102ddfc5
push eax
mov dword fs:[0], esp
sub esp, 0xc
push esi
push edi
mov edi, edx
mov esi, ecx
call fcn.10056910
mov eax, dword [esi]
not eax
cmp eax, 0xffffffff
je 0x10057249
mov ecx, 0x103c1be8
mov dword [ebp - 0x14], 0x103c1be8
call fcn.100536a0
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 0
cmp eax, 1
jne 0x10057238
push 0
push 0x102fe041
push 0x102fe041
push str._System_Thread::TLSSlotIsAllocated_slot_
call fcn.1004d850
add esp, 0x10
mov ecx, 0x103c1be8
mov dword [ebp - 4], 0xffffffff
call fcn.100536b0
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov edx, eax
not edx
mov dword [esi], edx
cmp eax, 0xffffffff
jne 0x100572af
mov ecx, 0x103c1be8
mov dword [ebp - 0x14], 0x103c1be8
call fcn.100536a0
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 1
cmp eax, 1
jne 0x10057293
push 0
push 0x102fe041
push 0x102fe041
push str.__failed_to_allocate_TLS_
call fcn.1004d850
add esp, 0x10
mov ecx, 0x103c1be8
call fcn.100536b0
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, 0x103bd088
mov dword [esi + 4], edi
call fcn.10053850
mov eax, dword [0x103c07f8]
mov dword [eax*4 + 0x103c05f8], esi
inc eax
mov dword [0x103c07f8], eax
mov ecx, 0x103bd088
mov dword [ebp - 4], 2
call fcn.10053a00
mov ecx, dword [ebp - 0xc]
mov al, 1
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10057540
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
mov ebx, edx
mov esi, ecx
mov ecx, ebx
mov dword [ebp - 4], esi
call fcn.100574c0
test al, al
je 0x10057620
mov eax, dword [ebx]
push edi
mov edi, 1
sub eax, 0
je 0x100575fa
sub eax, edi
jne 0x100575ff
mov dword [ebp - 8], eax
xorps xmm0, xmm0
lea eax, [ebp - 0x28]
push eax
movups xmmword [ebp - 0x28], xmm0
movups xmmword [ebp - 0x18], xmm0
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x14]
mov esi, edi
test eax, eax
cmovne esi, eax
call fcn.10053590
cmp esi, dword [0x103bd4dc]
cmovl esi, dword [0x103bd4dc]
cmp esi, 0x20
jb 0x100575b8
mov esi, dword [ebp - 4]
or edi, 0xffffffff
jmp 0x100575ff
xorps xmm0, xmm0
mov dword [ebp - 0x2c], 0
lea eax, [ebp - 0x4c]
push eax
movups xmmword [ebp - 0x4c], xmm0
movups xmmword [ebp - 0x3c], xmm0
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x38]
mov esi, edi
test eax, eax
cmovne esi, eax
call fcn.10053590
cmp esi, dword [0x103bd4dc]
cmovl esi, dword [0x103bd4dc]
mov ecx, esi
mov esi, dword [ebp - 4]
shl edi, cl
dec edi
jmp 0x100575ff
mov ecx, dword [ebx + 4]
shl edi, cl
push edi
push dword [esi]
call dword [sym.imp.KERNEL32.dll_SetThreadAffinityMask]
pop edi
test eax, eax
je 0x10057620
mov eax, dword [ebx]
mov ecx, dword [ebx + 4]
mov dword [esi + 8], eax
mov al, 1
mov dword [esi + 0xc], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10058730
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov edx, 0x1000193
mov al, byte [ecx]
test al, al
je 0x10058755
movzx eax, al
lea ecx, [ecx + 1]
xor eax, edx
imul edx, eax, 0x1000193
mov al, byte [ecx]
test al, al
jne 0x10058741
test edx, edx
mov ecx, 1
cmovne ecx, edx
mov edx, dword [ebp + 0xc]
mov eax, ecx
and eax, 0x3f
mov dword [edx], eax
cmp dword [eax*8 + 0x103bcd98], 0
je 0x1005878c
cmp dword [eax*8 + 0x103bcd98], ecx
je 0x10058792
inc eax
and eax, 0x3f
mov dword [edx], eax
cmp dword [eax*8 + 0x103bcd98], 0
jne 0x10058773
xor al, al
pop ebp
ret 8
mov al, 1
pop ebp
ret 8