joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10097c20
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push esi
push edi
test eax, eax
jg 0x10097c7d
jl 0x10097c35
test edx, edx
jae 0x10097c7d
push eax
push edx
mov edx, str.ERROR:
mov ecx, 0x1011f818
call fcn.10015f70
mov edx, str.Negative_value
mov ecx, eax
call fcn.10015f70
mov ecx, eax
call fcn.10093950
mov edx, str._passed_to_VarintBE::EncodeInternal__which_requires_non_negative_argument
mov ecx, eax
call fcn.10015f70
push eax
call fcn.100881f0
add esp, 4
cmp byte [0x10120b44], 0
jne 0x10097cbf
xor eax, eax
pop edi
pop esi
pop ebp
ret
lea esi, [ecx + 8]
mov edi, 1
mov cl, dl
and cl, 0x7f
shrd edx, eax, 7
mov byte [esi], cl
dec esi
sar eax, 7
mov ecx, edx
or ecx, eax
je 0x10097cb9
lea ebx, [ebx]
mov cl, dl
lea esi, [esi - 1]
or cl, 0x80
inc edi
shrd edx, eax, 7
mov byte [esi + 1], cl
sar eax, 7
mov ecx, edx
or ecx, eax
jne 0x10097ca0
mov eax, edi
pop edi
pop esi
pop ebp
ret
mov ecx, 0x1011f818
call fcn.1001a0c0
push 1
call fcn.100a1f52
int3

Function at 0x10097ce0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d7851
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x10113840]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp + 8]
mov dword [ecx], eax
mov eax, dword [ebp + 0xc]
mov dword [ecx + 4], eax
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x10], 0
mov dword [ebp - 4], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x18], 0
mov dword [ecx + 0x1c], 0
mov byte [ebp - 4], 1
mov dword [ecx + 0x20], 0
mov dword [ecx + 0x24], 0
mov dword [ecx + 0x28], 0
mov byte [ebp - 4], 2
mov eax, dword [ebp + 0x10]
mov dword [ecx + 0x2c], 0
mov dword [ecx + 0x30], eax
mov dword [ecx + 0x34], 0xffffffff
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10097e50
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 8]
cmp eax, dword [esi + 0xc]
jne 0x10097f38
mov eax, dword [esi + 0x14]
cmp eax, dword [esi + 0x18]
jne 0x10097f38
mov eax, dword [esi + 0x20]
cmp eax, dword [esi + 0x24]
jne 0x10097f38
mov ecx, dword [esi + 4]
call fcn.10098100
mov ecx, eax
test ecx, ecx
jne 0x10097ecf
push dword [esi + 4]
mov edx, str.ERROR:
push ecx
mov ecx, 0x1011f818
call fcn.10015f70
mov edx, str.Error_finding_table_size_for_source_size
mov ecx, eax
call fcn.10015f70
add esp, 4
mov ecx, eax
call fcn.1003be00
push eax
call fcn.100881f0
add esp, 4
call fcn.10086370
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
lea eax, [ecx - 1]
mov dword [ebp - 4], 0xffffffff
mov dword [esi + 0x2c], eax
lea eax, [ebp - 4]
push eax
push ecx
lea ecx, [esi + 8]
call fcn.100987a0
lea eax, [ebp - 4]
mov dword [ebp - 4], 0xffffffff
push eax
mov eax, dword [esi + 4]
lea ecx, [esi + 0x14]
shr eax, 4
push eax
call fcn.100987a0
lea eax, [ebp - 4]
mov dword [ebp - 4], 0xffffffff
push eax
mov eax, dword [esi + 4]
lea ecx, [esi + 0x20]
shr eax, 4
push eax
call fcn.100987a0
cmp byte [ebp + 8], 0
je 0x10097f2d
push dword [esi + 4]
mov ecx, esi
call fcn.10098400
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edx, str.ERROR:
mov ecx, 0x1011f818
call fcn.10015f70
mov edx, str.Init___called_twice_for_same_BlockHash_object
mov ecx, eax
call fcn.10015f70
push eax
call fcn.100881f0
add esp, 4
cmp byte [0x10120b44], 0
je 0x10097ec4
mov ecx, 0x1011f818
call fcn.1001a0c0
push 1
call fcn.100a1f52
int3
Function at 0x10098100
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, ecx
mov eax, 1
mov edx, esi
shr edx, 2
inc edx
cmp edx, eax
jbe 0x1009811a
add eax, eax
je 0x1009816b
cmp eax, edx
jb 0x10098112
lea ecx, [eax - 1]
test eax, ecx
je 0x100981ca
push eax
push ecx
push esi
push ecx
mov edx, str.ERROR:
mov ecx, 0x1011f818
call fcn.10015f70
mov edx, str.Internal_error:_CalcTableSize_dictionary_size_
mov ecx, eax
call fcn.10015f70
add esp, 4
mov ecx, eax
call fcn.1003be00
mov edx, str._:_resulting_table_size
mov ecx, eax
call fcn.10015f70
add esp, 4
mov ecx, eax
call fcn.1003be00
mov edx, str._is_not_a_power_of_2
jmp 0x100981af
push eax
push ecx
push esi
push ecx
mov edx, str.ERROR:
mov ecx, 0x1011f818
call fcn.10015f70
mov edx, str.Internal_error:_CalcTableSize_dictionary_size_
mov ecx, eax
call fcn.10015f70
add esp, 4
mov ecx, eax
call fcn.1003be00
mov edx, str._:_resulting_table_size
mov ecx, eax
call fcn.10015f70
add esp, 4
mov ecx, eax
call fcn.1003be00
mov edx, str._is_zero_or_negative
mov ecx, eax
call fcn.10015f70
push eax
call fcn.100881f0
add esp, 4
cmp byte [0x10120b44], 0
je 0x1009822e
jmp 0x10098232
test esi, esi
je 0x10098230
lea ecx, [edx + edx]
cmp eax, ecx
jbe 0x10098230
push eax
push ecx
push esi
push ecx
mov edx, str.ERROR:
mov ecx, 0x1011f818
call fcn.10015f70
mov edx, str.Internal_error:_CalcTableSize_dictionary_size_
mov ecx, eax
call fcn.10015f70
add esp, 4
mov ecx, eax
call fcn.1003be00
mov edx, str._:_resulting_table_size
mov ecx, eax
call fcn.10015f70
add esp, 4
mov ecx, eax
call fcn.1003be00
mov edx, str._is_too_large
mov ecx, eax
call fcn.10015f70
push eax
call fcn.100881f0
add esp, 4
call fcn.10086370
xor eax, eax
pop esi
ret
mov ecx, 0x1011f818
call fcn.1001a0c0
push 1
call fcn.100a1f52
int3
Function at 0x10098250
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov edx, ecx
push ebx
push esi
push edi
mov eax, dword [edx + 8]
cmp eax, dword [edx + 0xc]
jne 0x10098296
mov edx, str.ERROR:
mov ecx, 0x1011f818
call fcn.10015f70
mov edx, str.BlockHash::AddBlock___called_before_BlockHash::Init__
mov ecx, eax
call fcn.10015f70
push eax
call fcn.100881f0
add esp, 4
cmp byte [0x10120b44], 0
je 0x100983e0
jmp 0x100983e7
mov esi, dword [edx + 0x34]
mov eax, dword [edx + 4]
inc esi
shr eax, 4
cmp esi, eax
jl 0x100982e6
dec eax
mov edx, str.ERROR:
push eax
push ecx
push esi
push ecx
mov ecx, 0x1011f818
call fcn.10015f70
mov edx, str.BlockHash::AddBlock___called_with_block_number
mov ecx, eax
call fcn.10015f70
add esp, 4
mov ecx, eax
call fcn.10042ce0
mov edx, str._that_is_past_last_block
mov ecx, eax
call fcn.10015f70
add esp, 4
mov ecx, eax
call fcn.10042ce0
jmp 0x1009827b
mov edi, dword [edx + 0x14]
cmp dword [edi + esi*4], 0xffffffff
lea eax, [edi + esi*4]
je 0x10098337
push dword [eax]
mov edx, str.ERROR:
push ecx
push esi
push ecx
mov ecx, 0x1011f818
call fcn.10015f70
mov edx, str.Internal_error_in_BlockHash::AddBlock__:_block_number_
mov ecx, eax
call fcn.10015f70
add esp, 4
mov ecx, eax
call fcn.10042ce0
mov edx, str.__next_block_should_be__1_but_is
mov ecx, eax
call fcn.10015f70
add esp, 4
mov ecx, eax
call fcn.10042ce0
jmp 0x1009827b
mov ecx, dword [edx + 0x2c]
and ecx, dword [ebp + 8]
mov eax, dword [edx + 8]
mov ebx, dword [eax + ecx*4]
test ebx, ebx
jns 0x1009835a
mov dword [eax + ecx*4], esi
mov eax, dword [edx + 0x20]
mov dword [eax + esi*4], esi
mov dword [edx + 0x34], esi
pop edi
pop esi
pop ebx
pop ebp
ret 4
mov eax, dword [edx + 0x20]
mov eax, dword [eax + ebx*4]
cmp dword [edi + eax*4], 0xffffffff
je 0x100983d4
push dword [edi + eax*4]
mov edx, str.ERROR:
push ecx
push eax
push ecx
push ebx
push ecx
mov ecx, 0x1011f818
call fcn.10015f70
mov edx, str.Internal_error_in_BlockHash::AddBlock__:_first_matching_block_
mov ecx, eax
call fcn.10015f70
add esp, 4
mov ecx, eax
call fcn.10042ce0
mov edx, str.__last_matching_block_
mov ecx, eax
call fcn.10015f70
add esp, 4
mov ecx, eax
call fcn.10042ce0
mov edx, str.__next_block_should_be__1_but_is
mov ecx, eax
call fcn.10015f70
add esp, 4
mov ecx, eax
call fcn.10042ce0
push eax
call fcn.100881f0
add esp, 4
call fcn.10086370
pop edi
pop esi
pop ebx
pop ebp
ret 4
mov dword [edi + eax*4], esi
mov eax, dword [edx + 0x20]
mov dword [eax + ebx*4], esi
mov dword [edx + 0x34], esi
pop edi
pop esi
pop ebx
pop ebp
ret 4
mov ecx, 0x1011f818
call fcn.1001a0c0
push 1
call fcn.100a1f52
int3
Function at 0x10098400
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push ebx
mov ebx, ecx
push esi
push edi
mov eax, dword [ebx + 4]
cmp edx, eax
jle 0x1009846c
push eax
push ecx
push edx
push ecx
mov edx, str.ERROR:
mov ecx, 0x1011f818
call fcn.10015f70
mov edx, str.BlockHash::AddAllBlocksThroughIndex___called_with_index
mov ecx, eax
call fcn.10015f70
add esp, 4
mov ecx, eax
call fcn.10042ce0
mov edx, str._higher_than_end_index
mov ecx, eax
call fcn.10015f70
add esp, 4
mov ecx, eax
call fcn.1003be00
push eax
call fcn.100881f0
add esp, 4
cmp byte [0x10120b44], 0
je 0x10098533
jmp 0x1009853a
mov ecx, dword [ebx + 0x34]
shl ecx, 4
cmp edx, ecx
jg 0x100984c3
push ecx
push ecx
push edx
push ecx
mov edx, str.ERROR:
mov ecx, 0x1011f818
call fcn.10015f70
mov edx, str.BlockHash::AddAllBlocksThroughIndex___called_with_index
mov ecx, eax
call fcn.10015f70
add esp, 4
mov ecx, eax
call fcn.10042ce0
mov edx, str.___last_index_added__
mov ecx, eax
call fcn.10015f70
add esp, 4
mov ecx, eax
call fcn.10042ce0
mov edx, 0x100ebd78
mov ecx, eax
call fcn.10015f70
jmp 0x10098451
cmp eax, 0x10
jb 0x10098533
add eax, 0xfffffff0
cmp edx, eax
jle 0x100984d2
lea edx, [eax + 1]
mov eax, dword [ebx]
add edx, eax
mov dword [ebp + 8], edx
lea edi, [eax + 0x10]
add edi, ecx
cmp edi, edx
jae 0x10098533
movzx eax, byte [edi]
lea edx, [edi + 3]
movzx ecx, byte [edi + 1]
mov esi, 7
imul eax, eax, 0x101
add eax, ecx
lea esp, [esp]
movzx ecx, byte [edx - 1]
lea edx, [edx + 2]
imul eax, eax, 0x101
add ecx, eax
imul eax, ecx, 0x101
movzx ecx, byte [edx - 2]
add eax, ecx
and eax, 0x7fffff
dec esi
jne 0x10098500
push eax
mov ecx, ebx
call fcn.10098250
add edi, 0x10
cmp edi, dword [ebp + 8]
jb 0x100984e2
pop edi
pop esi
pop ebx
pop ebp
ret 4
mov ecx, 0x1011f818
call fcn.1001a0c0
push 1
call fcn.100a1f52
int3

Function at 0x100985d0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ecx + 4]
mov edx, dword [ebp + 8]
shr eax, 4
cmp edx, eax
jb 0x10098620
push edx
push ecx
mov edx, str.ERROR:
mov ecx, 0x1011f818
call fcn.10015f70
mov edx, str.NextMatchingBlock_called_for_invalid_block_number
mov ecx, eax
call fcn.10015f70
add esp, 4
mov ecx, eax
call fcn.10042ce0
push eax
call fcn.100881f0
add esp, 4
cmp byte [0x10120b44], 0
jne 0x10098632
or eax, 0xffffffff
pop ebp
ret 8
mov eax, dword [ecx + 0x14]
push dword [ebp + 0xc]
push dword [eax + edx*4]
call fcn.10098550
pop ebp
ret 8
mov ecx, 0x1011f818
call fcn.1001a0c0
push 1
call fcn.100a1f52
int3
Function at 0x10099080
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Manually build aes constants

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, 0x10121620
mov word [0x10121b20], 0
push esi
dec eax
mov word [0x10121620], 0x301
push edi
mov edi, 0x10121620
mov byte [0x10121b23], 1
mov ebx, 2
sub edi, eax
lea esi, [eax + 2]
mov cl, byte [esi]
lea esi, [esi + 1]
mov dl, cl
mov al, cl
and dl, 0x80
neg dl
sbb dl, dl
add al, al
xor al, cl
and dl, 0x1b
xor al, dl
mov byte [edi + esi - 1], al
movzx eax, al
mov byte [eax + 0x10121b20], bl
inc ebx
cmp ebx, 0x100
jl 0x100990b5
mov byte [0x101213a0], 0x63
mov ebx, 1
mov byte [0x10121503], 0
jmp 0x10099100
movzx eax, bl
mov ecx, 0x1012171f
movzx eax, byte [eax + 0x10121b20]
sub ecx, eax
mov cl, byte [ecx]
mov dl, cl
rol dl, 1
xor cl, dl
rol dl, 1
xor cl, dl
rol dl, 1
mov al, dl
rol al, 1
xor al, cl
xor al, dl
xor al, 0x63
mov byte [ebx + 0x101213a0], al
movzx eax, al
mov byte [eax + 0x101214a0], bl
inc ebx
cmp ebx, 0x100
jl 0x10099100
mov al, 1
mov edx, 0x101215a0
movzx ecx, al
mov dword [edx], ecx
mov cl, al
and cl, 0x80
neg cl
sbb cl, cl
add al, al
and cl, 0x1b
add edx, 4
xor al, cl
cmp edx, 0x10121618
jl 0x10099148
mov ecx, dword [0x101151bc]
xor esi, esi
mov edi, 0xff
mov ah, byte [esi + 0x101213a0]
mov bl, ah
mov bh, ah
and bl, 0x80
mov al, bl
neg al
sbb al, al
add bh, bh
and al, 0x1b
mov dl, bh
xor dl, al
xor dl, ah
neg bl
movzx edx, dl
sbb bl, bl
movzx eax, ah
shl edx, 8
and bl, 0x1b
or edx, eax
xor bh, bl
mov bl, byte [esi + 0x101214a0]
shl edx, 8
or edx, eax
movzx eax, bh
shl edx, 8
or edx, eax
mov dword [esi*4 + 0x10121720], edx
test cl, cl
je 0x100991ec
test bl, bl
je 0x100991ec
movzx eax, cl
movzx edx, bl
movzx eax, byte [eax + 0x10121b20]
movzx edx, byte [edx + 0x10121b20]
add eax, edx
cdq
idiv edi
mov al, byte [edx + 0x10121620]
mov byte [ebp - 1], al
jmp 0x100991f0
mov byte [ebp - 1], 0
test ch, ch
je 0x1009921c
test bl, bl
je 0x1009921c
movzx eax, ch
movzx edx, bl
movzx eax, byte [eax + 0x10121b20]
movzx edx, byte [edx + 0x10121b20]
add eax, edx
cdq
idiv edi
mov al, byte [edx + 0x10121620]
mov byte [ebp - 2], al
jmp 0x10099220
mov byte [ebp - 2], 0
mov al, byte [0x101151be]
test al, al
je 0x1009924e
test bl, bl
je 0x1009924e
movzx eax, al
movzx edx, bl
movzx eax, byte [eax + 0x10121b20]
movzx edx, byte [edx + 0x10121b20]
add eax, edx
cdq
idiv edi
mov bh, byte [edx + 0x10121620]
jmp 0x10099250
xor bh, bh
mov al, byte [0x101151bf]
test al, al
je 0x1009927e
test bl, bl
je 0x1009927e
movzx eax, al
movzx edx, bl
movzx eax, byte [eax + 0x10121b20]
movzx edx, byte [edx + 0x10121b20]
add eax, edx
cdq
idiv edi
mov bl, byte [edx + 0x10121620]
jmp 0x10099280
xor bl, bl
movzx edx, byte [ebp - 1]
movzx eax, byte [ebp - 2]
shl edx, 8
or edx, eax
movzx eax, bh
shl edx, 8
or edx, eax
movzx eax, bl
shl edx, 8
or edx, eax
mov dword [esi*4 + 0x10120fa0], edx
inc esi
cmp esi, 0x100
jl 0x10099175
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100c2200
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
jmp 0x100c22d0
push 0xffffffffffffffff
push 0x100d7dd8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov eax, dword [0x10113840]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov eax, dword [0x101146c8]
cmp eax, 0xffffffff
jne 0x100c2309
xor ebp, ebp
mov dword [esp + 0x14], ebp
jmp 0x100c2316
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebp, eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], ebp
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov dword [esp + 0x2c], 0
test ebp, ebp
je 0x100c237d
jmp 0x100c234c
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [ebp + 0x14], 0
mov edi, dword [ebp + 0xc]
jne 0x100c23ba
test edi, edi
jne 0x100c23c0
push 0x100c1ed0
push 0x10120a58
call fcn.100c1b70
mov eax, dword [0x101146c8]
add esp, 8
cmp eax, 0xffffffff
je 0x100c237d
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [esp + 0x2c], 0xffffffff
test ebp, ebp
je 0x100c23a6
lea eax, [ebp + 4]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x100c23a6
mov eax, dword [ebp]
mov ecx, ebp
push 0
call dword [eax]
push ebp
push 0
call esi
push eax
call ebx
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
test edi, edi
je 0x100c23f8
mov edi, edi
mov eax, dword [edi + 4]
mov dword [ebp + 0xc], eax
mov ecx, dword [edi]
test ecx, ecx
je 0x100c23e9
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [edi]
mov ecx, esi
push 0
mov eax, dword [esi]
call dword [eax]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0
call esi
push eax
call ebx
push edi
push 0
call esi
push eax
call ebx
mov edi, dword [ebp + 0xc]
test edi, edi
jne 0x100c23c0
mov ebx, dword [ebp + 0x10]
lea eax, [ebp + 0x10]
mov dword [esp + 0x18], eax
mov esi, dword [ebx]
cmp esi, ebx
je 0x100c2340
mov ebp, eax
mov edi, edi
cmp byte [esi + 0xd], 0
mov edi, esi
jne 0x100c2457
mov eax, dword [esi + 8]
cmp byte [eax + 0xd], 0
jne 0x100c243c
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0xd], 0
jne 0x100c2457
jmp 0x100c2430
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0xd], 0
je 0x100c2430
jmp 0x100c2457
mov eax, dword [esi + 4]
cmp byte [eax + 0xd], 0
jne 0x100c2455
cmp esi, dword [eax + 8]
jne 0x100c2455
mov esi, eax
mov eax, dword [eax + 4]
cmp byte [eax + 0xd], 0
je 0x100c2445
mov esi, eax
mov ecx, dword [edi + 0x14]
test ecx, ecx
je 0x100c246b
mov edx, dword [edi + 0x1c]
test edx, edx
je 0x100c246b
mov eax, dword [ecx]
push edx
call dword [eax + 4]
push edi
lea eax, [esp + 0x24]
mov ecx, ebp
push eax
call fcn.100c1f00
cmp esi, ebx
jne 0x100c2410
mov ebp, dword [esp + 0x14]
jmp 0x100c2340
Function at 0x100c22d0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
jmp 0x100c22d0
push 0xffffffffffffffff
push 0x100d7dd8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov eax, dword [0x10113840]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov eax, dword [0x101146c8]
cmp eax, 0xffffffff
jne 0x100c2309
xor ebp, ebp
mov dword [esp + 0x14], ebp
jmp 0x100c2316
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebp, eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], ebp
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov dword [esp + 0x2c], 0
test ebp, ebp
je 0x100c237d
jmp 0x100c234c
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [ebp + 0x14], 0
mov edi, dword [ebp + 0xc]
jne 0x100c23ba
test edi, edi
jne 0x100c23c0
push 0x100c1ed0
push 0x10120a58
call fcn.100c1b70
mov eax, dword [0x101146c8]
add esp, 8
cmp eax, 0xffffffff
je 0x100c237d
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [esp + 0x2c], 0xffffffff
test ebp, ebp
je 0x100c23a6
lea eax, [ebp + 4]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x100c23a6
mov eax, dword [ebp]
mov ecx, ebp
push 0
call dword [eax]
push ebp
push 0
call esi
push eax
call ebx
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
test edi, edi
je 0x100c23f8
mov edi, edi
mov eax, dword [edi + 4]
mov dword [ebp + 0xc], eax
mov ecx, dword [edi]
test ecx, ecx
je 0x100c23e9
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [edi]
mov ecx, esi
push 0
mov eax, dword [esi]
call dword [eax]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0
call esi
push eax
call ebx
push edi
push 0
call esi
push eax
call ebx
mov edi, dword [ebp + 0xc]
test edi, edi
jne 0x100c23c0
mov ebx, dword [ebp + 0x10]
lea eax, [ebp + 0x10]
mov dword [esp + 0x18], eax
mov esi, dword [ebx]
cmp esi, ebx
je 0x100c2340
mov ebp, eax
mov edi, edi
cmp byte [esi + 0xd], 0
mov edi, esi
jne 0x100c2457
mov eax, dword [esi + 8]
cmp byte [eax + 0xd], 0
jne 0x100c243c
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0xd], 0
jne 0x100c2457
jmp 0x100c2430
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0xd], 0
je 0x100c2430
jmp 0x100c2457
mov eax, dword [esi + 4]
cmp byte [eax + 0xd], 0
jne 0x100c2455
cmp esi, dword [eax + 8]
jne 0x100c2455
mov esi, eax
mov eax, dword [eax + 4]
cmp byte [eax + 0xd], 0
je 0x100c2445
mov esi, eax
mov ecx, dword [edi + 0x14]
test ecx, ecx
je 0x100c246b
mov edx, dword [edi + 0x1c]
test edx, edx
je 0x100c246b
mov eax, dword [ecx]
push edx
call dword [eax + 4]
push edi
lea eax, [esp + 0x24]
mov ecx, ebp
push eax
call fcn.100c1f00
cmp esi, ebx
jne 0x100c2410
mov ebp, dword [esp + 0x14]
jmp 0x100c2340
Function at 0x40d7e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
mov eax, dword [0x43d080]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x1c], 0x88903eac
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
sub eax, 0x88903eac
je 0x40d86d
jmp 0x40d81c
mov eax, dword [ebp - 0x28]
sub eax, 0xbeb398d
je 0x40d87f
jmp 0x40d82f
mov eax, dword [ebp - 0x28]
sub eax, 0x1c93095e
je 0x40d984
jmp 0x40d842
mov eax, dword [ebp - 0x28]
sub eax, 0x59668892
je 0x40d8cd
jmp 0x40d855
mov eax, dword [ebp - 0x28]
sub eax, 0x6c2675ff
je 0x40d972
jmp 0x40d868
jmp 0x40d9c5
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x1c], 0xbeb398d
jmp 0x40d9c5
mov eax, dword [0x43e54c]
mov ecx, dword [0x43e548]
mov edx, eax
add edx, 0x9ee80cbf
sub edx, 1
sub edx, 0x9ee80cbf
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x1c93095e
mov ecx, 0x59668892
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1c], eax
jmp 0x40d9c5
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
nop
mov eax, ebx
mov ebx, 0x99
nop
xor ebx, eax
mov ecx, dword [ebp - 0x14]
mov edi, dword [ebp - 0x18]
not byte [edi]
nop
mov eax, ebx
mov ebx, 0x99
nop
xor ebx, eax
add byte [edi], 0x79
sub byte [edi], 0x35
nop
mov eax, ebx
mov ebx, 0x99
nop
xor ebx, eax
imul byte [edi]
inc edi
loop 0x40d8e4
mov ecx, dword [0x43e54c]
mov eax, dword [0x43e548]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x1c93095e
mov ecx, 0x6c2675ff
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1c], eax
jmp 0x40d9c5
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00426b40
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
nop
mov eax, ebx
mov ebx, 0x99
nop
xor ebx, eax
mov ecx, dword [ebp - 0x14]
mov edi, dword [ebp - 0x18]
not byte [edi]
nop
mov eax, ebx
mov ebx, 0x99
nop
xor ebx, eax
add byte [edi], 0x79
sub byte [edi], 0x35
nop
mov eax, ebx
mov ebx, 0x99
nop
xor ebx, eax
imul byte [edi]
inc edi
loop 0x40d99b
mov dword [ebp - 0x1c], 0x59668892
jmp 0x40d806
Function at 0x42ebab
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x42ec48
push ebx
push esi
call fcn.0042eb74
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0042eb08
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x42ebf5
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x42ec47
push edi
push eax
call fcn.0042d640
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x42ec15
call fcn.0042d68e
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x42ec46
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0042eb08
add esp, 0x20
test eax, eax
jne 0x42ec34
push edi
call fcn.0042d68e
jmp 0x42ec3c
push ebx
call fcn.0042d68e
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x42fe57
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x438c30
push 0x438c28
push str.FlsAlloc
push 0x1f
call fcn.0042fd16
mov esi, eax
add esp, 0x10
test esi, esi
je 0x42fe8b
push dword [ebp + 8]
mov ecx, esi
call dword [0x436144]
call esi
jmp 0x42fe91
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x42fed5
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x438c40
push 0x438c38
push str.FlsGetValue
push 0x21
call fcn.0042fd16
mov esi, eax
add esp, 0x10
test esi, esi
je 0x42ff0c
push dword [ebp + 8]
mov ecx, esi
call dword [0x436144]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x42ff14
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x438c48
push 0x438c40
push str.FlsSetValue
push 0x22
call fcn.0042fd16
mov esi, eax
add esp, 0x10
test esi, esi
je 0x42ff4e
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x436144]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]