joyce8/EMBER2024-capa huggingface dataset:
Function at 0x34845881
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x3485177e
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x3485dd14]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
xor esi, esi
push esi
push esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], esi
call dword [sym.imp.OLEAUT32.dll_CreateErrorInfo]
mov edi, dword [esp + 0x2c]
mov eax, dword [edi + 8]
add eax, 0x64
push eax
mov dword [esp + 0x30], eax
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
mov ebx, dword [esp + 0x30]
cmp ebx, esi
mov dword [esp + 0x24], esi
je 0x3484598e
mov ebp, dword [esp + 0x34]
cmp ebp, esi
je 0x3484598e
mov ecx, dword [edi + 8]
push ebx
add ecx, 0x40
call fcn.34848c6e
test eax, eax
je 0x34845987
mov ecx, dword [edi + 8]
push ebp
add ecx, 0x40
call fcn.34848c6e
test eax, eax
je 0x34845987
mov ecx, dword [edi + 8]
lea eax, [esp + 0x14]
push eax
add ecx, 0x40
call fcn.34848544
mov esi, eax
test esi, esi
jl 0x34845993
lea ecx, [esp + 0x18]
push ecx
mov ecx, dword [edi + 8]
lea edx, [esp + 0x18]
push edx
add ecx, 0x40
call fcn.348485bb
mov esi, eax
test esi, esi
jl 0x34845993
mov ecx, dword [edi + 8]
lea eax, [esp + 0x14]
push eax
push ebx
add ecx, 0x40
call fcn.34848ab7
mov esi, eax
test esi, esi
jl 0x34845993
mov ecx, dword [edi + 8]
push ebp
push ebx
add ecx, 0x40
call fcn.34848c1d
cmp eax, 1
je 0x34845993
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [edi + 8]
push ebp
add ecx, 0x40
call fcn.34848ab7
mov esi, eax
test esi, esi
jl 0x34845993
mov esi, 1
jmp 0x34845993
mov esi, 0x80040e6a
jmp 0x34845993
mov esi, 0x80070057
mov eax, dword [esp + 0x14]
test eax, eax
je 0x348459b0
mov edx, dword [edi + 8]
push 0x34860d08
push eax
mov eax, dword [edx + 0x44]
push esi
push eax
call fcn.34812a85
jmp 0x348459c3
test esi, esi
jge 0x348459c3
push 0
push 0x34860d08
push esi
push 0
call fcn.3481d00b
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x348459d2
push eax
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 0xc
Function at 0x34847f7f
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x348519eb
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x3485dd14]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x3485dd14]
xor eax, esp
push eax
lea eax, [esp + 0x34]
mov dword fs:[0], eax
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x4c]
mov edx, dword [esp + 0x50]
mov edi, dword [esp + 0x58]
mov esi, dword [esp + 0x44]
xor ebp, ebp
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x54]
push ebp
push ebp
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], edx
mov dword [esp + 0x34], eax
mov dword [esp + 0x20], edi
mov dword [esp + 0x1c], ebp
call dword [sym.imp.OLEAUT32.dll_CreateErrorInfo]
mov ebx, dword [esi + 8]
add ebx, 0x64
push ebx
mov dword [esp + 0x20], ebx
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
cmp edi, ebp
mov dword [esp + 0x3c], ebp
jne 0x3484800b
mov esi, 0x80070057
jmp 0x34848045
mov ebp, dword [0x34860644]
xor esi, esi
test ebp, ebp
jbe 0x34848039
mov edi, 0x34860648
lea ecx, [ecx]
mov edx, dword [edi]
lea ecx, [esp + 0x20]
push ecx
push edx
call fcn.3481f5f0
test eax, eax
jne 0x34848082
add esi, 1
add edi, 0xc
cmp esi, ebp
jb 0x3484801e
mov dword [esp + 0x14], 0x80040e6d
mov esi, dword [esp + 0x14]
push 0
push 0x34860d38
push esi
push 0
call fcn.3481d00b
test ebx, ebx
je 0x3484805f
push ebx
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
mov eax, esi
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.3481f5cd
add esp, 0x2c
ret 0x18
mov edx, dword [esp + 0x18]
lea eax, [esi + esi*2]
mov ecx, dword [eax*4 + 0x34860650]
mov esi, dword [esp + 0x14]
mov dword [edx], ecx
jmp 0x34848054
Function at 0x3484eeb1
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftPCHealthErrorReportingDWInstalled
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x3484ef09
mov eax, dword [ebp + 0xc]
push edi
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
push 0
push 0
push str.DW0200
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
pop edi
jne 0x3484ef09
mov al, 1
jmp 0x3484ef0b
xor al, al
leave
ret 8

Function at 0x3484ef60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x3484ef6f
pop dword [ebp - 0x20]
mov eax, 0x3484ef6f
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0x6e32b2a2
sub dword [ebp - 0x30], 0x1fe06d57
mov dword [ebp - 0x2c], 0xaada9b4
sub dword [ebp - 0x2c], 0xd87a5d6f
mov dword [ebp - 0x28], 0xe421c2da
sub dword [ebp - 0x28], 0x97d57eac
mov dword [ebp - 0x24], 0x89bc537c
add dword [ebp - 0x24], 0x7643ac84
lea eax, [ebp - 0x30]
push eax
mov eax, 0x3088d812
add eax, 0x3fc48f6
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0xd9ec0c5e
add dword [ebp - 0x30], 0x9a865cf8
mov dword [ebp - 0x2c], 0xc2e40b17
add dword [ebp - 0x2c], 0x7e88565e
mov dword [ebp - 0x28], 0x8e6df2ad
add dword [ebp - 0x28], 0xd50179bf
mov dword [ebp - 0x24], 0x8e757dc6
sub dword [ebp - 0x24], 0x8e757dc6
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, 0x9249aada
sub eax, 0x5dc489b2
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x39936
push 0
call eax
mov ecx, 0x5351
mov edx, eax
mov ebx, 0xeb8008e5
sub ebx, 0xb6f938e5
add ebx, dword [ebp - 0x20]
mov esi, 0x2195c46f
sub esi, 0x3c223a0b
add dword [ebp - 0xc], 0x8c40b9c4
mov edi, dword [ebx]
add dword [ebp - 0x10], 0x8141699
add edi, esi
xor dword [ebp - 0x10], 0xe46dbe05
mov dword [edx], edi
add dword [ebp - 0x14], ecx
add edx, 4
add ebx, 4
loop 0x3484f086
add eax, 0x500411fc
sub eax, 0x5002d1e5
mov ebx, eax
add eax, 0x67dcd53e
sub eax, 0x67dcd539
mov ecx, 0x475bdad9
sub ecx, 0x12dadad9
add ecx, dword [ebp - 0x20]
call ebx
leave
ret
Function at 0x10003e4b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x10003e5a
pop dword [ebp - 0x10]
mov eax, 0x7d7c3e5e
add eax, 0x9283fffc
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0xc1710529
sub dword [ebp - 0x20], 0x731ebfde
mov dword [ebp - 0x1c], 0x64c24f64
add dword [ebp - 0x1c], 0xcd70fce1
mov dword [ebp - 0x18], 0x2ea0fc95
add dword [ebp - 0x18], 0x1dab4799
mov dword [ebp - 0x14], 0x4b478132
add dword [ebp - 0x14], 0xb4b87ece
lea eax, [ebp - 0x20]
push eax
mov eax, 0xcc92d572
sub eax, 0xbc91046a
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0x9e969189
add dword [ebp - 0x20], 0xd5dbd7cd
mov dword [ebp - 0x1c], 0xff37373f
sub dword [ebp - 0x1c], 0xbdcad5ca
mov dword [ebp - 0x18], 0x177fca8e
add dword [ebp - 0x18], 0x4befa1de
mov dword [ebp - 0x14], 0xec20e3a
sub dword [ebp - 0x14], 0xec20e3a
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, 0x8f17351
add eax, 0x7105cf3
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x3a4fa
push 0
call eax
mov ecx, 0xea6d44e0
sub ecx, 0xea6cfd51
mov esi, eax
mov edx, 0x10035000
add edx, dword [ebp - 0x10]
mov edi, 0x3fdd1190
sub edi, 0x693c1f23
mov dword [ebp - 8], 0xaa5a1396
mov ebx, dword [edx]
add dword [ebp - 4], ecx
xor ebx, edi
sub dword [ebp - 0xc], ecx
mov dword [esi], ebx
add dword [ebp - 8], 0xec749a6
add esi, 0x71362422
sub esi, 0x7136241e
add edx, 0x9b663afd
sub edx, 0x9b663af9
loop 0x10003f76
add eax, 0x199c9b26
sub eax, 0x199b8a17
xor ebx, ebx
add ebx, eax
add eax, 0x4cf406fa
add eax, 0xb30bf90b
mov ecx, 0xe092b6b1
sub ecx, 0xd092b6b1
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x5a79b0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 6], edx
mov word [ebp - 2], ax
xor eax, eax
push ebp
push 0x5a7a2a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
mov edx, 0x104
call fcn.0040707c
push 0xffffffffffffffff
movzx eax, word [ebp - 2]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00406d7c
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathW
test eax, eax
jne 0x5a7a02
lea eax, [ebp - 0xc]
xor edx, edx
call fcn.00406d44
mov eax, dword [ebp - 0xc]
call fcn.00406d7c
mov edx, eax
mov eax, dword [ebp - 6]
call fcn.00406eac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5a7a31
lea eax, [ebp - 0xc]
call fcn.00406ce0
ret

Function at 0x5a83f4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
xor eax, eax
push ebp
push 0x5a8569
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [0x5d6c70], 0
je 0x5a854e
lea eax, [ebp - 8]
mov ecx, 0x5a8584
mov edx, dword [0x5d6c60]
call fcn.004071d4
mov eax, dword [ebp - 8]
call fcn.0041447c
test al, al
jne 0x5a8493
mov byte [0x5d6c70], 0
jmp 0x5a854e
cmp byte [0x5d6c5d], 0
je 0x5a8471
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
mov cx, word [0x5a8598]
mov dl, 3
mov eax, 0x5a85a8
call fcn.0047e154
dec eax
jne 0x5a854e
jmp 0x5a8493
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
mov cx, word [0x5a8598]
mov dl, 3
mov eax, 0x5a8630
call fcn.0047e154
dec eax
jne 0x5a854e
mov eax, 0x5a8750
call fcn.005a7fb4
test al, al
jne 0x5a8444
xor eax, eax
push ebp
push 0x5a8547
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x5a8750
call fcn.005a7fb4
test al, al
je 0x5a84c9
push 0
push 0x5a8760
call sub.kernel32.dll_WinExec
mov dl, 1
mov eax, dword [0x42d820]
call fcn.00439c3c
mov dword [ebp - 4], eax
lea eax, [ebp - 0xc]
mov ecx, 0x5a8584
mov edx, dword [0x5d6c60]
call fcn.004071d4
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x68]
mov ecx, dword [0x5d6c24]
mov edx, 0x5a8788
mov eax, dword [ebp - 4]
call fcn.005a80f0
call fcn.0041f128
push eax
lea eax, [ebp - 0x10]
mov ecx, 0x5a8584
mov edx, dword [0x5d6c60]
call fcn.004071d4
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
pop ecx
mov ebx, dword [eax]
call dword [ebx + 0x80]
mov eax, dword [ebp - 4]
call fcn.00404ef4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5a854e
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5a8570
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00406ce8
ret
Function at 0x5aa2f4
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
xor eax, eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], eax
xor eax, eax
push ebp
push 0x5aa56e
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [0x5d6c72], 0
je 0x5aa539
lea eax, [ebp - 0x2c]
mov ecx, 0x5aa588
mov edx, dword [0x5d6c68]
call fcn.004071d4
mov eax, dword [ebp - 0x2c]
call fcn.0041447c
test al, al
jne 0x5aa3a3
mov byte [0x5d6c72], 0
jmp 0x5aa539
cmp byte [0x5d6c5d], 0
je 0x5aa381
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
mov cx, word [0x5aa59c]
mov dl, 3
mov eax, 0x5aa5ac
call fcn.0047e154
dec eax
jne 0x5aa539
jmp 0x5aa3a3
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
mov cx, word [0x5aa59c]
mov dl, 3
mov eax, 0x5aa630
call fcn.0047e154
dec eax
jne 0x5aa539
mov eax, 0x5aa750
call fcn.005a7fb4
test al, al
jne 0x5aa354
xor eax, eax
push ebp
push 0x5aa532
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x30]
mov ecx, 0x5aa588
mov edx, dword [0x5d6c68]
call fcn.004071d4
mov eax, dword [ebp - 0x30]
mov dword [ebp - 4], eax
call fcn.00563cfc
xor eax, eax
push ebp
push 0x5aa51d
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00565b4c
push 0x5aa76c
push dword [0x5d6c34]
push 0x5aa7c0
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.004072b8
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x10]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 8]
call fcn.0054d200
test eax, eax
jne 0x5aa4f2
cmp dword [ebp - 0x18], 0
jle 0x5aa44a
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 0x10]
mov edx, dword [edx]
call fcn.00406e7c
jmp 0x5aa4b5
push 0x5aa7fc
push dword [0x5d6c28]
push 0x5aa8c4
push dword [0x5d6c40]
push 0x5aa8c4
push dword [0x5d6c30]
push 0x5aa8c4
push dword [0x5d6c34]
push 0x5aa8d8
lea eax, [ebp - 0x20]
mov edx, 9
call fcn.004072b8
lea eax, [ebp - 0x34]
mov edx, dword [ebp - 0x20]
mov ecx, 0xfde9
call fcn.00406f44
mov edx, dword [ebp - 0x34]
mov eax, dword [ebp - 8]
call fcn.0054a96c
mov eax, dword [ebp - 8]
call fcn.00564464
push edx
push eax
lea eax, [ebp - 0x1c]
call fcn.00413ea8
mov eax, dword [ebp - 0x10]
call fcn.0054d37c
push 0x5aa90c
push dword [ebp - 0x1c]
push 0x5aa94c
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.004072b8
lea eax, [ebp - 0x38]
mov edx, dword [ebp - 0x20]
mov ecx, 0xfde9
call fcn.00406f44
mov edx, dword [ebp - 0x38]
mov eax, dword [ebp - 8]
call fcn.0054a96c
mov eax, dword [ebp - 0xc]
call fcn.00596bc0
mov eax, dword [ebp - 8]
call fcn.005645f0
mov edx, dword [ebp - 8]
call fcn.0054aa94
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5aa524
call fcn.00563e6c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5aa575
lea eax, [ebp - 0x38]
mov edx, 2
call fcn.00406200
lea eax, [ebp - 0x30]
mov edx, 2
call fcn.00406ce8
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.00406ce8
ret
Function at 0x43159d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
push 0
mov ecx, dword [ebp - 8]
call fcn.0040181b
mov dword [eax], 3
jmp 0x4315d3
push 0
mov ecx, dword [ebp - 8]
call fcn.0040181b
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0xc]
mov dword [ecx], eax
push 0
mov ecx, dword [ebp - 8]
call fcn.0040181b
cmp dword [eax], 0
jl 0x43166d
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x18], 0xfffffff9
mov dword [ebp - 0x1c], 0x1c3a23fe
mov dword [ebp - 0x20], 0xecc2443a
mov dword [ebp - 0x48], 0x282d564c
mov dword [ebp - 0x44], 0x282d564c
mov dword [ebp - 0x40], 0x282d564c
mov dword [ebp - 0x3c], 0x282d564c
lea ecx, [ebp - 1]
call fcn.00417ea9
push eax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x28]
call fcn.00417eac
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x34]
call fcn.00417e7e
mov dword [ebp - 0x10], 0xff79
lea eax, [ebp - 0x10]
push eax
push 1
push 1
push 0x758a
call fcn.00428cbb
add esp, 0x10
lea ecx, [ebp - 0x34]
call fcn.00417ea4
jmp 0x4315bb
mov esp, ebp
pop ebp
ret
Function at 0x47048a
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x49c473
call fcn.0049b920
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov eax, ecx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x18], 0x319b
cmp dword [ebp - 0x18], 0x3292
jle 0x4704f9
xor esi, esi
mov dword [ebp - 0x14], esi
xor edi, edi
and dword [ebp - 0x1c], 0
mov ebx, edi
and ebx, esi
mov esi, dword [ebp - 0x1c]
mov eax, ebx
xor eax, esi
cdq
push edx
push eax
mov ecx, 0xaa71a0
call fcn.00417cc4
inc esi
cmp esi, 0x7b6a
jl 0x4704c4
inc edi
cmp edi, 0x2cb7
mov esi, dword [ebp - 0x14]
jl 0x4704b9
inc esi
mov dword [ebp - 0x14], esi
cmp esi, 0x4d0b
jl 0x4704b7
mov eax, dword [ebp - 0x20]
push dword [eax + 4]
call fcn.004849e6
pop ecx
and dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0x2f21
jge 0x470520
push 0xa9b200
push 0xaa71a0
call fcn.00419747
pop ecx
pop ecx
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10001000
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x34
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x10001cd0
lea eax, [ebp - 0x18]
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
lea eax, [ebp - 0x28]
push 8
push str.data.binsrclib.rs
push eax
call fcn.100102b0
add esp, 0xc
mov eax, dword [ebp - 0x28]
cmp eax, 0x80000000
jne 0x1000107d
movsd xmm0, qword [ebp - 0x24]
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x38]
movsd qword [ebp - 0x38], xmm0
push 0x1003634c
push 0x10036318
push eax
push 0x2b
push 0x100362ec
call fcn.10034fc0
add esp, 0x14
jmp 0x10001127
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x10], 1
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x20]
push 0x40
push 0x1000
mov dword [ebp - 0x3c], eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push dword [ebp - 0x3c]
push dword [ebp - 0x2c]
push eax
mov esi, eax
call fcn.10026f30
add esp, 0xc
lea eax, [ebp - 0x38]
push esi
push eax
call fcn.10001ec0
add esp, 8
mov eax, dword [ebp - 0x30]
movsd xmm0, qword [ebp - 0x38]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x28]
movsd qword [ebp - 0x28], xmm0
push eax
call fcn.10001d60
add esp, 4
test eax, eax
lea ecx, [ebp - 0x28]
jne 0x10001100
nop word cs:[eax + eax]
nop
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
call fcn.10011780
add esp, 0xc
jmp 0x100010f0
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x10], 2
push 0x1003635c
push 0x10036328
push ecx
push 0x2b
push 0x100362ec
call fcn.10034fc0
add esp, 0x14
ud2
Function at 0x1000a560
Capabilities:
Get system information on windows

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x3c
xorps xmm0, xmm0
call 0x1000a56f
pop edi
lea eax, [esp + 0x18]
mov dword [esp + 0x38], 0
movups xmmword [esp + 0x28], xmm0
movups xmmword [esp + 0x18], xmm0
push eax
call sub.KERNEL32.dll_GetSystemInfo
mov esi, dword [esp + 0x1c]
test esi, esi
je 0x1000a60f
mov ecx, dword [esp + 0x54]
xor edx, edx
mov ebx, dword [esp + 0x5c]
mov ebp, dword [esp + 0x50]
mov eax, ecx
div esi
lea eax, [esi + ecx]
sub eax, edx
test edx, edx
cmove eax, ecx
test eax, eax
cmove eax, esi
test ebx, ebx
mov dword [esp + 4], eax
je 0x1000a5f7
mov ecx, dword [esp + 0x58]
mov dword [esp + 0x10], 0
mov dword [esp], 0
mov dword [esp + 8], 0
xor edx, edx
mov dword [esp + 0xc], 0
mov eax, dword [ecx]
lea ebp, [ecx + ebx*8]
mov ebx, dword [ecx + 4]
mov esi, dword [eax*4 + 0x1000a7c0]
xor eax, eax
add esi, edi
jmp esi
mov ebx, dword [esp + 4]
xor ecx, ecx
xor edx, edx
xor esi, esi
mov dword [esp + 8], 0
test dl, dl
je 0x1000a620
jmp 0x1000a62d
push 0x1003ba24
push 0x39
push str.attempt_to_calculate_the_remainder_with_a_divisor_of_zeroUnmapViewOfFile_failed:__n
call fcn.10035230
mov eax, 1
test cl, cl
je 0x1000a73a
mov dword [ebp + 4], 7
jmp 0x1000a7af
test esi, esi
je 0x1000a747
mov dword [ebp + 4], 8
jmp 0x1000a7af
push eax
push 0x3000
push ebx
push dword [esp + 0x14]
call sub.KERNEL32.dll_VirtualAlloc
test eax, eax
je 0x1000a764
mov dword [ebp], 1
jmp 0x1000a798
call fcn.100155d0
mov dword [ebp + 4], 0xa
jmp 0x1000a7ac
mov dword [ebp + 8], eax
mov dword [ebp + 0xc], ebx
jmp 0x1000a7b6
mov dword [ebp + 8], eax
mov dword [ebp], 2
mov eax, ebp
add esp, 0x3c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1000b9f0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x1000c310
lea eax, [ebp - 0x18]
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
movzx eax, byte [0x1005e0bc]
test al, al
je 0x1000bbc1
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x1000ba3c
cmp eax, 3
jne 0x1000bbba
mov ebx, dword [0x1005e0c0]
test ebx, ebx
je 0x1000bbba
mov dword [ebp - 0x20], 0
jmp 0x1000ba67
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x1000ba98
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x1000bc0b
dec esi
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x1000ba60
push 0
push esi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x1000ba60
test byte [ebp - 0x20], 1
je 0x1000bbba
mov ebx, dword [0x1005e0c0]
test ebx, ebx
je 0x1000bbba
mov dword [ebp - 0x20], 0
jmp 0x1000bac7
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x1000baf8
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x1000bc0b
dec esi
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x1000bac0
push 0
push esi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x1000bac0
test byte [ebp - 0x20], 1
je 0x1000bbba
mov ebx, dword [0x1005e0c0]
test ebx, ebx
je 0x1000bbba
mov dword [ebp - 0x20], 0
jmp 0x1000bb27
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x1000bb58
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x1000bc0b
dec esi
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x1000bb20
push 0
push esi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x1000bb20
test byte [ebp - 0x20], 1
je 0x1000bbba
mov ebx, dword [0x1005e0c0]
test ebx, ebx
je 0x1000bbba
mov dword [ebp - 0x20], 0
jmp 0x1000bb87
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x1000bbb4
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x1000bc0b
dec esi
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x1000bb80
push 0
push esi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x1000bb80
test byte [ebp - 0x20], 1
jne 0x1000bbd4
movzx eax, byte [0x10046100]
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
mov ebx, dword [0x1005e0c0]
jmp 0x1000bbdf
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x1000bbba
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x1000bc0b
dec esi
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x1000bbdc
push 0
push esi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
call edi
add esp, 4
jmp 0x1000bbdc
mov dword [ebp - 0x10], 0
push 0x1003c194
call fcn.100354c0
add esp, 4
ud2
Function at 0x1000ee20
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, dword [esi]
test eax, eax
je 0x1000ee43
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 2
jb 0x1000ee58
cmp dword [eax + 4], 0
je 0x1000ee58
add eax, 8
pop esi
ret
push esi
call fcn.10034670
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 2
jae 0x1000ee38
mov eax, dword [esi]
test eax, eax
je 0x1000eeea
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
je 0x1000ef03
test eax, eax
jne 0x1000eeae
movzx eax, byte [0x1005e089]
push 4
push 0x10
call fcn.10004c40
add esp, 8
test eax, eax
je 0x1000ef18
mov dword [eax], esi
mov dword [eax + 4], 0
mov ecx, dword [esi]
test ecx, ecx
je 0x1000ef07
dec ecx
push eax
push ecx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x1000eed2
mov edx, dword [esi]
xor ecx, ecx
mov dword [esi], 0
cmp edx, 1
mov edx, 0
jne 0x1000eed6
mov ecx, dword [esi + 4]
mov edx, dword [esi + 8]
jmp 0x1000eed6
xor ecx, ecx
xor edx, edx
lea esi, [eax + 8]
mov dword [eax + 4], 1
mov dword [eax + 8], ecx
mov byte [eax + 0xc], dl
mov eax, esi
pop esi
ret
push esi
call fcn.10034670
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jne 0x1000ee73
xor eax, eax
pop esi
ret
push esi
mov esi, eax
call fcn.10034670
add esp, 4
mov ecx, eax
mov eax, esi
jmp 0x1000eea2
push 0x10
push 4
call fcn.10034ec0
int3