joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100246e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov dword [ebp - 0x20], ecx
mov eax, dword [0x100db010]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov edi, dword [ebp - 0x20]
mov ecx, dword [edi + 0x24]
mov eax, dword [ecx]
lea edx, [ebp - 0x1c]
push edx
lea edx, [ebp - 0x10]
push edx
lea edx, [ebp - 0x18]
push edx
push dword [edi + 0x28]
call dword [eax + 0x10]
mov ebx, eax
mov esi, dword [ebp - 0x1c]
lea eax, [ebp - 0x18]
sub esi, eax
push dword [edi + 0x20]
push esi
push 1
push eax
call fcn.100abcdd
add esp, 0x10
cmp eax, esi
jne 0x10024750
cmp ebx, 1
je 0x100246f9
cmp ebx, 2
mov esi, 0xffffffff
je 0x10024753
mov eax, dword [ebp - 0x20]
push dword [eax + 0x20]
call fcn.100ab88b
add esp, 4
neg eax
sbb esi, esi
jmp 0x10024753
xor esi, esi
dec esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10099c81
mov eax, esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x10024770
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
cmp byte [ecx + 0x2c], 0
je 0x10024794
push dword [ecx + 0x20]
push esi
push 1
push eax
call fcn.100abcdd
add esp, 0x14
jmp 0x100247c3
test esi, esi
jle 0x100247bc
mov dword [ebp - 0x10], ecx
xor edi, edi
mov ebx, eax
movzx eax, byte [eax + edi]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx]
push eax
call dword [edx + 0x30]
cmp eax, 0xffffffff
je 0x100247be
inc edi
cmp esi, edi
mov eax, ebx
jne 0x1002479d
mov edi, esi
jmp 0x100247be
xor edi, edi
mov eax, edi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 8

Function at 0x100247d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov ebx, dword [ebp + 8]
mov eax, dword [0x100db010]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp ebx, 0xffffffff
je 0x10024813
mov esi, ecx
mov byte [ebp - 0x19], bl
cmp byte [ecx + 0x2c], 0
je 0x1002482b
xor edi, edi
inc edi
lea eax, [ebp - 0x19]
push dword [esi + 0x20]
push edi
push edi
push eax
call fcn.100abcdd
add esp, 0x10
cmp eax, edi
je 0x10024815
xor ebx, ebx
dec ebx
jmp 0x10024815
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10099c81
mov eax, ebx
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 4
lea eax, [ebp - 0x18]
lea ecx, [ebp - 0x20]
mov dword [ecx], eax
lea ebx, [ebp - 0x19]
mov ecx, dword [esi + 0x24]
mov eax, dword [ecx]
lea edx, [ebp - 0x20]
push edx
lea edx, [ebp - 0x10]
push edx
lea edx, [ebp - 0x18]
push edx
lea edx, [ebp - 0x24]
push edx
lea edx, [ebp - 0x18]
push edx
push ebx
push dword [esi + 0x28]
call dword [eax + 8]
cmp dword [ebp - 0x24], ebx
je 0x1002480e
mov edi, eax
cmp eax, 3
je 0x1002488c
cmp edi, 1
ja 0x1002480e
mov ebx, dword [ebp - 0x20]
lea eax, [ebp - 0x18]
sub ebx, eax
push dword [esi + 0x20]
push ebx
push 1
push eax
call fcn.100abcdd
add esp, 0x10
cmp eax, ebx
jne 0x1002480e
mov ebx, dword [ebp - 0x24]
cmp edi, 1
je 0x10024836
jmp 0x100248a5
xor edi, edi
inc edi
push dword [esi + 0x20]
push edi
push edi
push ebx
call fcn.100abcdd
add esp, 0x10
cmp eax, edi
jne 0x1002480e
mov ebx, dword [ebp + 8]
jmp 0x10024815
Function at 0x100248e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
cmp byte [ecx + 0x2c], 0
je 0x10024904
push dword [ecx + 0x20]
push esi
push 2
push eax
call fcn.100abcdd
add esp, 0x14
jmp 0x10024934
test esi, esi
jle 0x1002492d
mov dword [ebp - 0x10], ecx
xor edi, edi
mov ebx, eax
movzx eax, word [eax + edi*2]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx]
push eax
call dword [edx + 0x30]
cmp ax, 0xffff
je 0x1002492f
inc edi
cmp esi, edi
mov eax, ebx
jne 0x1002490d
mov edi, esi
jmp 0x1002492f
xor edi, edi
mov eax, edi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 8

Function at 0x10024940
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
movzx esi, word [ebp + 8]
mov eax, dword [0x100db010]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp si, 0xffff
je 0x10024986
mov edi, ecx
mov word [ebp - 0x1a], si
cmp byte [ecx + 0x2c], 0
je 0x1002499e
lea eax, [ebp - 0x1a]
push dword [edi + 0x20]
push 1
push 2
push eax
call fcn.100abcdd
add esp, 0x10
cmp eax, 1
je 0x10024988
xor esi, esi
dec esi
jmp 0x10024988
xor esi, esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10099c81
mov eax, esi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 4
lea eax, [ebp - 0x18]
lea ecx, [ebp - 0x20]
mov dword [ecx], eax
lea esi, [ebp - 0x1a]
mov ecx, dword [edi + 0x24]
mov eax, dword [ecx]
lea edx, [ebp - 0x20]
push edx
lea edx, [ebp - 0x10]
push edx
lea edx, [ebp - 0x18]
push edx
lea edx, [ebp - 0x24]
push edx
lea edx, [ebp - 0x18]
push edx
push esi
push dword [edi + 0x28]
call dword [eax + 8]
cmp dword [ebp - 0x24], esi
je 0x10024981
mov ebx, eax
cmp eax, 3
je 0x100249ff
cmp ebx, 1
ja 0x10024981
mov esi, dword [ebp - 0x20]
lea eax, [ebp - 0x18]
sub esi, eax
push dword [edi + 0x20]
push esi
push 1
push eax
call fcn.100abcdd
add esp, 0x10
cmp eax, esi
jne 0x10024981
mov esi, dword [ebp - 0x24]
cmp ebx, 1
je 0x100249a9
jmp 0x10024a18
xor ebx, ebx
inc ebx
push dword [edi + 0x20]
push ebx
push ebx
push esi
call fcn.100abcdd
add esp, 0x10
cmp eax, ebx
jne 0x10024981
movzx esi, word [ebp + 8]
jmp 0x10024988

Function at 0x10024bb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor eax, eax
cmp edx, ecx
je 0x10024bdf
shl eax, 4
movsx esi, byte [edx]
add esi, eax
mov edi, esi
and edi, 0xf0000000
mov eax, edi
shr eax, 0x18
or eax, edi
xor eax, esi
inc edx
cmp ecx, edx
jne 0x10024bc1
pop esi
pop edi
pop ebp
ret 8

Function at 0x10024cf0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor eax, eax
cmp edx, ecx
je 0x10024d21
shl eax, 4
movzx esi, word [edx]
add esi, eax
mov edi, esi
and edi, 0xf0000000
mov eax, edi
shr eax, 0x18
or eax, edi
xor eax, esi
add edx, 2
cmp ecx, edx
jne 0x10024d01
pop esi
pop edi
pop ebp
ret 8
Function at 0x1002e274
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov ecx, edi
call fcn.10036f14
mov ebx, eax
test esi, esi
je 0x1002e2ad
mov eax, dword [esi + 0xc]
cmp eax, dword [esi + 0x10]
je 0x1002e29a
movzx eax, word [eax]
jmp 0x1002e2a1
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x20]
cmp ax, 0xffff
je 0x1002e2ad
test bl, bl
jne 0x1002e2b3
jmp 0x1002e310
xor esi, esi
test bl, bl
jne 0x1002e301
mov ecx, dword [edi]
mov eax, dword [ecx + 0xc]
cmp eax, dword [ecx + 0x10]
je 0x1002e2c2
movzx eax, word [eax]
jmp 0x1002e2c7
mov eax, dword [ecx]
call dword [eax + 0x20]
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx]
movzx eax, ax
push eax
push 8
call dword [edx + 0xc]
test al, al
je 0x1002e2f2
mov ecx, dword [edi]
mov eax, dword [ecx + 0xc]
cmp eax, dword [ecx + 0x10]
je 0x1002e2eb
add eax, 2
mov dword [ecx + 0xc], eax
jmp 0x1002e280
mov eax, dword [ecx]
call dword [eax + 0x24]
jmp 0x1002e280
mov ecx, edi
call fcn.10036f14
mov ebx, eax
test esi, esi
jne 0x1002e319
jmp 0x1002e30a
mov ecx, edi
call fcn.10036f14
mov ebx, eax
test bl, bl
jne 0x1002e338
jmp 0x1002e33e
mov ecx, edi
call fcn.10036f14
mov ebx, eax
mov eax, dword [esi + 0xc]
cmp eax, dword [esi + 0x10]
je 0x1002e326
movzx eax, word [eax]
jmp 0x1002e32d
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x20]
cmp ax, 0xffff
sete al
xor bl, al
jne 0x1002e33e
mov eax, dword [ebp + 0x10]
or byte [eax], 2
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x1003a680
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov edi, dword [0x100dc7a0]
test edi, edi
jne 0x1003a726
push 0x24
call fcn.10099c14
add esp, 4
mov esi, eax
mov dword [eax + 4], 0
mov dword [eax], 0
push 0xc
call fcn.10099c14
add esp, 4
mov dword [esi + 8], eax
lea ecx, [eax + 0xc]
mov dword [esi + 0x10], ecx
mov dword [eax + 8], 0
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [esi + 0xc], ecx
lea eax, [esi + 0x18]
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x14], eax
mov dword [esi + 0x20], 1
mov dword [0x100dc7a0], esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
xor edx, edx
test eax, eax
je 0x1003a71d
cmp word [eax], 0
je 0x1003a71d
xor ecx, ecx
nop dword [eax + eax]
lea edx, [ecx + 1]
cmp word [eax + ecx*2 + 2], 0
mov ecx, edx
jne 0x1003a710
mov ecx, esi
push edx
push eax
call fcn.1003a730
test edi, edi
sete al
pop esi
pop edi
pop ebp
ret
Function at 0x1003b860
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x38
mov edi, ecx
mov eax, dword [0x100db010]
xor eax, ebp
mov dword [esp + 0x30], eax
mov dword [esp + 0x18], ecx
mov dword [esp + 8], edx
mov dword [esp + 0x1c], edx
movzx ecx, byte [0x100dc7a4]
xor ecx, 3
xor eax, eax
mov dword [esp + 0x10], ecx
mov ebx, dword [eax*8 + 0x100c2af4]
mov dword [esp + 0x14], eax
mov eax, dword [eax*8 + 0x100c2af0]
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov byte [esp + 0x2b], bl
lea ecx, [ebx + ebx]
push ecx
push eax
lea eax, [esp + 0x28]
push eax
call fcn.1009d0a0
add esp, 0xc
mov word [esp + ebx*2 + 0x20], 0
movzx eax, byte [esp + 0x2b]
test al, al
mov ecx, dword [esp + 0x24]
mov edx, eax
mov dword [esp + 0xc], ecx
cmovs edx, ecx
cmp edx, dword [esp + 8]
jbe 0x1003b900
test al, al
js 0x1003b940
mov ecx, dword [esp + 0x10]
jmp 0x1003b956
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], ecx
test edx, edx
je 0x1003b96a
test al, al
lea esi, [esp + 0x20]
cmovs esi, dword [esp + 4]
xor ebx, ebx
nop dword [eax]
movzx ecx, word [edi + ebx*2]
cmp cx, word [esi + ebx*2]
jne 0x1003b8f6
add ebx, 1
cmp edx, ebx
jne 0x1003b920
jmp 0x1003b96a
push dword [esp + 0x20]
call fcn.10099c44
add esp, 4
movzx ecx, byte [0x100dc7a4]
xor ecx, 3
mov eax, dword [esp + 0x14]
add eax, 1
cmp eax, ecx
jb 0x1003b891
jmp 0x1003b9f6
test al, al
js 0x1003b978
mov ecx, eax
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
jmp 0x1003b98e
push dword [esp + 4]
call fcn.10099c44
add esp, 4
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov ecx, dword [esp + 0xc]
xor ebx, ebx
test ecx, ecx
je 0x1003b9fc
cmp ecx, dword [esp + 8]
je 0x1003b9fc
lea eax, [esp + 0x18]
push 0
push 0x100c2ba4
push eax
mov ebx, ecx
call fcn.10056250
mov edx, ebx
add esp, 0xc
sub eax, ebx
mov ecx, dword [esp + 0x1c]
cmp ecx, ebx
cmovb edx, ecx
sub ecx, edx
cmp ecx, eax
cmovae ecx, eax
cmp ecx, esi
jne 0x1003b9f6
test esi, esi
je 0x1003b9fa
add edx, edx
add edx, dword [esp + 0x18]
xor eax, eax
nop word cs:[eax + eax]
nop
movzx ecx, word [edx + eax*2]
cmp cx, word [edi + eax*2]
sete bl
jne 0x1003b9fc
add eax, 1
cmp esi, eax
jne 0x1003b9e0
jmp 0x1003b9fc
xor ebx, ebx
jmp 0x1003b9fc
mov bl, 1
mov ecx, dword [esp + 0x30]
xor ecx, ebp
call fcn.10099c81
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1003f7c0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov eax, dword [0x100db010]
xor eax, ebp
mov dword [ebp - 0x10], eax
call fcn.1003a960
mov esi, eax
mov ecx, eax
push 0x100c2ae5
call fcn.1003ad80
test al, al
jne 0x1003f7fe
mov ecx, esi
push str.vmodule
call fcn.1003ad80
test al, al
je 0x1003f890
cmp dword [0x100dc7bc], 0
jne 0x1003f95b
mov eax, dword [0x100dc7c0]
mov dword [0x100dc7bc], eax
push 0x10
call fcn.10099c14
add esp, 4
mov edi, eax
mov dword [ebp - 0x24], str.vmodule
push str.vmodule
call fcn.100ad280
add esp, 4
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x24]
lea edx, [ebp - 0x1c]
mov ecx, esi
push eax
push edx
call fcn.1003adf0
mov dword [ebp - 0x38], 0x100c2ae5
push 0x100c2ae5
call fcn.100ad280
add esp, 4
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x38]
lea ebx, [ebp - 0x30]
mov ecx, esi
push eax
push ebx
call fcn.1003adf0
mov ecx, edi
push 0x100dc7c4
lea eax, [ebp - 0x1c]
push eax
push ebx
call fcn.1005b400
mov dword [0x100dc7c0], edi
cmp byte [ebp - 0x25], 0
js 0x1003f8d1
cmp byte [ebp - 0x11], 0
js 0x1003f8e2
mov esi, dword [ebp + 8]
mov eax, dword [esi]
mov dword [0x100da1d0], eax
mov bl, 1
test al, 1
je 0x1003f947
mov eax, dword [0x100dc7d8]
test eax, eax
je 0x1003f8ef
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x100dc7d8], 0
mov ecx, dword [0x100dc7c8]
test ecx, ecx
jne 0x1003f91e
and byte [0x100da1d0], 0xfe
jmp 0x1003f8f9
push dword [ebp - 0x30]
call fcn.10099c44
add esp, 4
cmp byte [ebp - 0x11], 0
jns 0x1003f890
push dword [ebp - 0x1c]
call fcn.10099c44
add esp, 4
jmp 0x1003f890
mov ecx, dword [0x100dc7c8]
test ecx, ecx
jne 0x1003f91e
push 0xc
call fcn.10099c14
add esp, 4
mov ecx, eax
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 8], 0
mov dword [0x100dc7c8], eax
push dword [esi + 4]
call fcn.10038d36
cmp dword [esi + 0xc], 0
jne 0x1003f940
mov eax, dword [0x100dc7c8]
cmp byte [eax + 0xb], 0
jns 0x1003f939
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
call fcn.1003f960
mov ebx, eax
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10099c81
mov eax, ebx
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
int3
Function at 0x1003f960
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20c
mov eax, dword [0x100db010]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov bl, 1
cmp dword [0x100dc7d8], 0
jne 0x1003fb8a
mov esi, dword [0x100dc7c8]
test esi, esi
je 0x1003f9a1
test byte [0x100da1d0], 1
jne 0x1003fa88
jmp 0x1003fb8a
push 0xc
call fcn.10099c14
add esp, 4
mov esi, eax
lea edi, [ebp - 0x218]
push 0x104
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov dword [esi + 4], 0
mov dword [esi], 0
mov dword [esi + 8], 0
push edi
call fcn.100ad8fd
add esp, 4
cmp eax, 0x7ffffff0
jae 0x1003fba1
mov ebx, eax
cmp eax, 5
jae 0x1003f9fb
mov byte [esi + 0xb], bl
mov eax, esi
test ebx, ebx
jne 0x1003fa27
jmp 0x1003fa3a
lea edi, [ebx + 8]
and edi, 0xfffffff8
js 0x1003fba8
lea eax, [edi + edi]
push eax
call fcn.10099c14
add esp, 4
mov dword [esi], eax
or edi, 0x80000000
mov dword [esi + 8], edi
mov dword [esi + 4], ebx
lea edi, [ebp - 0x218]
mov ecx, ebx
add ecx, ebx
push ecx
push edi
push eax
mov edi, eax
call fcn.1009d0a0
mov eax, edi
add esp, 0xc
mov word [eax + ebx*2], 0
movzx eax, byte [esi + 0xb]
test al, al
jns 0x1003fa4b
mov eax, dword [esi + 4]
mov ecx, esi
push eax
push 0x5c
call fcn.10038f2a
cmp eax, 0xffffffff
mov bl, 1
je 0x1003fa69
add eax, 1
mov ecx, esi
push 0xffffffffffffffff
push eax
call fcn.10038e4c
mov ecx, esi
push 0x100c2c84
call fcn.10038bb2
mov dword [0x100dc7c8], esi
test byte [0x100da1d0], 1
je 0x1003fb8a
cmp byte [esi + 0xb], 0
jns 0x1003fa90
mov esi, dword [esi]
sub esp, 0x1c
movaps xmm0, xmmword [0x100c2bf0]
movups xmmword [esp + 4], xmm0
mov dword [esp], esi
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x80
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x100dc7d8], eax
add eax, 1
cmp eax, 1
ja 0x1003fb8a
mov word [ebp - 0x218], 0
lea esi, [ebp - 0x218]
push esi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x1003fb88
cmp eax, 0x104
ja 0x1003fb88
mov ecx, dword [0x100dc7c8]
push esi
call fcn.10038d36
mov ecx, dword [0x100dc7c8]
movzx eax, byte [ecx + 0xb]
test al, al
js 0x1003fb15
mov edx, ecx
jmp 0x1003fb1a
mov edx, dword [ecx]
mov eax, dword [ecx + 4]
cmp word [edx + eax*2 - 2], 0x5c
je 0x1003fb32
push 0x100c2c80
call fcn.10038bb2
mov ecx, dword [0x100dc7c8]
push 0x100c2c84
call fcn.10038bb2
mov eax, dword [0x100dc7c8]
cmp byte [eax + 0xb], 0
jns 0x1003fb49
mov eax, dword [eax]
movaps xmm0, xmmword [0x100c2bf0]
sub esp, 0x1c
movups xmmword [esp + 4], xmm0
mov dword [esp], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x80
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x100dc7d8], eax
add eax, 1
cmp eax, 1
ja 0x1003fb8a
mov dword [0x100dc7d8], 0
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10099c81
mov eax, ebx
add esp, 0x20c
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, esi
call fcn.10037b74
call fcn.100a8d87
int3
Function at 0x100408d0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, ecx
mov eax, dword [ebp + 8]
mov edi, dword [eax]
mov dword [eax], 0
lea ebx, [edi + 1]
cmp ebx, 2
jae 0x100408f2
cmp dword [esi], edi
jne 0x100408fe
jmp 0x1004091d
call fcn.1003f7b0
mov eax, dword [ebp + 8]
cmp dword [esi], edi
je 0x1004091d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esi]
add ecx, 1
cmp ecx, 2
jae 0x10040939
cmp ebx, 2
jae 0x10040959
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp + 8]
movups xmm0, xmmword [eax + 4]
movups xmm1, xmmword [eax + 0x10]
movups xmmword [esi + 0x10], xmm1
movups xmmword [esi + 4], xmm0
mov eax, esi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov dword [ebp - 0x10], eax
call fcn.1003f7b0
push dword [esi]
call fcn.10045060
mov eax, dword [ebp - 0x10]
add esp, 4
mov dword [esi], 0
cmp ebx, 2
jb 0x10040913
mov dword [esi], edi
mov edi, eax
call fcn.1003f7b0
mov eax, edi
jmp 0x10040913

Function at 0x10041d40
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x1408
call fcn.1009a0d0
mov eax, dword [0x100db010]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x100da1d8]
cmp eax, 0xffffffff
je 0x10041e96
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test bl, 3
je 0x10041e96
and ebx, 0xfffffffc
lea eax, [ebp - 0x810]
push 0x800
push ebx
push eax
call fcn.1009d0a0
add esp, 0xc
mov ecx, dword [0x100da1d8]
lea eax, [ebp - 0x80f]
push eax
mov dword [ebp - 0x1414], ecx
push ecx
call fcn.100644c0
add esp, 8
test ebx, ebx
je 0x10041dbb
push ebx
call fcn.10099c7c
add esp, 4
mov eax, dword [0x100dd408]
mov ecx, dword [0x100de718]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x10041eab
mov esi, dword [0x100dd404]
mov ecx, esi
call fcn.100444a0
lea eax, [ebp - 0x1410]
push 0xc00
push 0x100dc804
push eax
call fcn.1009d0a0
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov edi, 0x100
mov al, 1
jmp 0x10041e2a
lea ecx, [edi - 1]
cmp edi, 2
mov edi, ecx
jb 0x10041e86
test al, 1
je 0x10041e86
xor eax, eax
lea esi, [ebp - 0x1408]
xor ebx, ebx
jmp 0x10041e4e
add ebx, 1
add esi, 0xc
cmp ebx, 0x100
je 0x10041e20
mov ecx, dword [ebp + ebx*8 - 0x810]
test ecx, ecx
je 0x10041e40
cmp dword [esi - 8], 0
je 0x10041e40
mov edx, dword [ebp + ebx*8 - 0x80c]
cmp edx, dword [esi]
jne 0x10041e40
mov edx, dword [esi - 4]
test edx, edx
je 0x10041e40
mov dword [ebp + ebx*8 - 0x810], 0
push ecx
call edx
add esp, 4
mov al, 1
jmp 0x10041e40
push 2
push dword [ebp - 0x1414]
call fcn.100644c0
add esp, 8
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10099c81
add esp, 0x1408
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x100dd408
call fcn.10099cc7
add esp, 4
cmp dword [0x100dd408], 0xffffffff
jne 0x10041ddc
push 4
call fcn.10099c14
add esp, 4
mov esi, eax
mov ecx, eax
call fcn.1000ba50
mov dword [0x100dd404], esi
push 0x100dd408
call fcn.10099d3d
add esp, 4
jmp 0x10041ddc
Function at 0x10041ef0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x100da1d8]
cmp eax, 0xffffffff
je 0x10041f12
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
and eax, 3
add eax, 0xffffffff
cmp eax, 2
setb al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x10041f20
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
mov eax, dword [0x100da1d8]
cmp eax, 0xffffffff
je 0x10041f3d
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
jne 0x10041f42
call fcn.10042050
mov eax, dword [0x100dd408]
mov ecx, dword [0x100de718]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x10041ff9
mov edi, dword [0x100dd404]
mov ecx, edi
call fcn.100444a0
mov eax, dword [0x100dc800]
add eax, 1
mov ecx, 0x100
nop dword [eax]
movzx edx, al
lea ebx, [edx + edx*2]
cmp dword [ebx*4 + 0x100dc804], 0
je 0x10041fad
lea edx, [eax + 1]
movzx edx, dl
lea ebx, [edx + edx*2]
cmp dword [ebx*4 + 0x100dc804], 0
je 0x10041fad
add eax, 2
add ecx, 0xfffffffe
jne 0x10041f80
jmp 0x10041fdd
lea eax, [ebx*4 + 0x100dc804]
mov dword [eax], 1
lea eax, [edx*4]
mov ecx, dword [ebp + 8]
mov dword [eax + eax*2 + 0x100dc808], ecx
mov dword [0x100dc800], edx
mov dword [esi], edx
mov eax, dword [eax + eax*2 + 0x100dc80c]
mov dword [esi + 4], eax
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x1004203e
cmp eax, 0x100
jge 0x10042041
pop esi
pop edi
pop ebx
pop ebp
ret 4
push 0x100dd408
call fcn.10099cc7
add esp, 4
cmp dword [0x100dd408], 0xffffffff
jne 0x10041f63
push 4
call fcn.10099c14
add esp, 4
mov edi, eax
mov ecx, eax
call fcn.1000ba50
mov dword [0x100dd404], edi
push 0x100dd408
call fcn.10099d3d
add esp, 4
jmp 0x10041f63
int3
int3
Function at 0x10042050
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x808
mov eax, dword [0x100db010]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov eax, dword [0x100da1d8]
mov dword [ebp - 0x810], eax
cmp eax, 0xffffffff
jne 0x100420ee
lea esi, [ebp - 0x810]
push esi
call fcn.10064490
add esp, 4
test al, al
je 0x1004216f
mov ecx, dword [ebp - 0x810]
cmp ecx, 0xffffffff
jne 0x100420c5
push esi
call fcn.10064490
add esp, 4
test al, al
je 0x10042172
cmp dword [ebp - 0x810], 0xffffffff
je 0x10042172
push 0xffffffffffffffff
call fcn.100644b0
add esp, 4
mov ecx, dword [ebp - 0x810]
mov eax, 0xffffffff
lock cmpxchg dword [0x100da1d8], ecx
mov eax, dword [ebp - 0x810]
je 0x100420ee
push eax
call fcn.100644b0
add esp, 4
mov eax, dword [0x100da1d8]
mov dword [ebp - 0x810], eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
jne 0x1004216c
lea edi, [ebp - 0x80c]
push 0x800
push 0
push edi
call fcn.1009d620
add esp, 0xc
lea eax, [ebp - 0x809]
push eax
push dword [ebp - 0x810]
call fcn.100644c0
add esp, 8
push 0x800
call fcn.10099c73
add esp, 4
mov esi, eax
push 0x800
push edi
push eax
call fcn.1009d0a0
add esp, 0xc
mov eax, esi
or eax, 3
push eax
push dword [ebp - 0x810]
call fcn.100644c0
add esp, 8
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.10099c81
mov eax, esi
add esp, 0x808
pop esi
pop edi
pop ebp
ret
int3
int3
int3