joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100aa460
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, ecx
push ebx
push esi
push edi
cmp dword [eax + 8], 0
mov dword [ebp - 4], eax
jne 0x100aa4a8
mov edx, str.ERROR:
mov ecx, 0x100ef488
call fcn.100146e0
mov edx, str.Internal_error:_VCDiffEngine::Encode___called_before_VCDiffEngine::Init__
mov ecx, eax
call fcn.100146e0
push eax
call fcn.100195d0
add esp, 4
cmp byte [0x100f05bc], 0
je 0x100aa541
jmp 0x100aa577
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x100aa541
cmp edi, 0x10
jae 0x100aa4dd
mov esi, dword [ebp + 0x14]
test edi, edi
je 0x100aa4ca
mov eax, dword [esi]
mov ecx, esi
push edi
push dword [ebp + 8]
call dword [eax + 0xc]
mov eax, dword [esi]
mov ecx, esi
push dword [ebp + 0x10]
call dword [eax + 0x1c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
lea ecx, [ebp + 0xf]
call fcn.100aa590
mov esi, dword [ebp + 8]
lea eax, [esi + edi]
mov edi, esi
mov dword [ebp + 8], eax
mov ecx, esi
call fcn.100aa5e0
mov ebx, eax
lea esp, [esp]
push dword [ebp + 0x14]
push ecx
mov ecx, dword [ebp + 8]
sub ecx, esi
push ecx
mov ecx, dword [ebp - 4]
push esi
push edi
push ebx
call fcn.100aa6c0
mov ecx, dword [ebp + 8]
test eax, eax
je 0x100aa54a
add esi, eax
lea eax, [ecx - 0x10]
mov edi, esi
cmp esi, eax
jbe 0x100aa4f0
mov ebx, dword [ebp + 0x14]
sub ecx, esi
je 0x100aa537
mov eax, dword [ebx]
push ecx
push esi
mov ecx, ebx
call dword [eax + 0xc]
mov eax, dword [ebx]
mov ecx, ebx
push dword [ebp + 0x10]
call dword [eax + 0x1c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
lea edx, [edi + 1]
lea eax, [ecx - 0x10]
cmp edx, eax
ja 0x100aa527
movzx ecx, byte [edi]
mov eax, dword [0x100f1a3c]
mov eax, dword [eax + ecx*4]
add eax, ebx
imul ebx, eax, 0x101
movzx eax, byte [edi + 0x10]
mov edi, edx
add ebx, eax
and ebx, 0x7fffff
jmp 0x100aa500
mov ecx, 0x100ef488
call fcn.1002bf20
push 1
call fcn.100b8942
int3

Function at 0x100aa590
Capabilities:
Terminate process

Disassembly:
cmp dword [0x100f1a3c], 0
push esi
mov esi, ecx
jne 0x100aa5c9
mov edx, str.ERROR:
mov ecx, 0x100ef488
call fcn.100146e0
mov edx, str.RollingHash_object_instantiated_before_calling_RollingHash::Init__
mov ecx, eax
call fcn.100146e0
push eax
call fcn.100195d0
add esp, 4
cmp byte [0x100f05bc], 0
jne 0x100aa5cd
mov eax, esi
pop esi
ret
mov ecx, 0x100ef488
call fcn.1002bf20
push 1
call fcn.100b8942
int3
Function at 0x100aaf20
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
mov eax, dword [0x10001850]
xor eax, esp
mov dword [esp + 0x10], eax
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x88], 0
jne 0x100aaf78
mov edx, str.ERROR:
mov ecx, 0x100ef488
call fcn.100146e0
mov edx, str.VCDiffCodeTableWriter::Copy___called_without_calling_Init__
mov ecx, eax
call fcn.100146e0
push eax
call fcn.100195d0
add esp, 4
cmp byte [0x100f05bc], 0
je 0x100aaffc
jmp 0x100ab010
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0
push eax
mov eax, dword [edi + 0x7c]
lea ecx, [edi + 0x58]
add eax, dword [edi + 0x80]
push eax
push dword [ebp + 8]
call fcn.100a8f20
mov bl, al
mov ecx, edi
mov byte [esp + 0x14], bl
push dword [esp + 0x14]
push dword [ebp + 0xc]
push 3
call fcn.100aac20
mov cl, byte [edi + 0x58]
mov al, cl
add al, 2
cmp bl, al
jb 0x100aafd4
mov al, byte [edi + 0x5c]
inc al
add al, cl
cmp bl, al
ja 0x100aafd4
push dword [esp + 0x10]
mov ecx, dword [edi + 0x3c]
call fcn.10090e70
jmp 0x100aaff3
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x14]
mov esi, dword [edi + 0x3c]
call fcn.100af0f0
lea edx, [esp + 0x19]
mov ecx, esi
push eax
sub edx, eax
push edx
call fcn.1002b320
mov eax, dword [ebp + 0xc]
add dword [edi + 0x80], eax
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.100b6427
mov esp, ebp
pop ebp
ret 8
mov ecx, 0x100ef488
call fcn.1002bf20
push 1
call fcn.100b8942
int3
Function at 0x100ab460
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x100ab46b
xor eax, eax
pop ebp
ret
pop ebp
jmp fcn.100ab480
Function at 0x100ae340
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Manually build aes constants

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, 0x100f1410
mov word [0x100f1910], 0
push esi
dec eax
mov word [0x100f1410], 0x301
push edi
mov edi, 0x100f1410
mov byte [0x100f1913], 1
mov ebx, 2
sub edi, eax
lea esi, [eax + 2]
mov cl, byte [esi]
lea esi, [esi + 1]
mov dl, cl
mov al, cl
and dl, 0x80
neg dl
sbb dl, dl
add al, al
xor al, cl
and dl, 0x1b
xor al, dl
mov byte [edi + esi - 1], al
movzx eax, al
mov byte [eax + 0x100f1910], bl
inc ebx
cmp ebx, 0x100
jl 0x100ae375
mov byte [0x100f1190], 0x63
mov ebx, 1
mov byte [0x100f12f3], 0
jmp 0x100ae3c0
movzx eax, bl
mov ecx, 0x100f150f
movzx eax, byte [eax + 0x100f1910]
sub ecx, eax
mov cl, byte [ecx]
mov dl, cl
rol dl, 1
xor cl, dl
rol dl, 1
xor cl, dl
rol dl, 1
mov al, dl
rol al, 1
xor al, cl
xor al, dl
xor al, 0x63
mov byte [ebx + 0x100f1190], al
movzx eax, al
mov byte [eax + 0x100f1290], bl
inc ebx
cmp ebx, 0x100
jl 0x100ae3c0
mov al, 1
mov edx, 0x100f1390
movzx ecx, al
mov dword [edx], ecx
mov cl, al
and cl, 0x80
neg cl
sbb cl, cl
add al, al
and cl, 0x1b
add edx, 4
xor al, cl
cmp edx, 0x100f1408
jl 0x100ae408
mov ecx, dword [0x100032d4]
xor esi, esi
mov edi, 0xff
mov ah, byte [esi + 0x100f1190]
mov bl, ah
mov bh, ah
and bl, 0x80
mov al, bl
neg al
sbb al, al
add bh, bh
and al, 0x1b
mov dl, bh
xor dl, al
xor dl, ah
neg bl
movzx edx, dl
sbb bl, bl
movzx eax, ah
shl edx, 8
and bl, 0x1b
or edx, eax
xor bh, bl
mov bl, byte [esi + 0x100f1290]
shl edx, 8
or edx, eax
movzx eax, bh
shl edx, 8
or edx, eax
mov dword [esi*4 + 0x100f1510], edx
test cl, cl
je 0x100ae4ac
test bl, bl
je 0x100ae4ac
movzx eax, cl
movzx edx, bl
movzx eax, byte [eax + 0x100f1910]
movzx edx, byte [edx + 0x100f1910]
add eax, edx
cdq
idiv edi
mov al, byte [edx + 0x100f1410]
mov byte [ebp - 1], al
jmp 0x100ae4b0
mov byte [ebp - 1], 0
test ch, ch
je 0x100ae4dc
test bl, bl
je 0x100ae4dc
movzx eax, ch
movzx edx, bl
movzx eax, byte [eax + 0x100f1910]
movzx edx, byte [edx + 0x100f1910]
add eax, edx
cdq
idiv edi
mov al, byte [edx + 0x100f1410]
mov byte [ebp - 2], al
jmp 0x100ae4e0
mov byte [ebp - 2], 0
mov al, byte [0x100032d6]
test al, al
je 0x100ae50e
test bl, bl
je 0x100ae50e
movzx eax, al
movzx edx, bl
movzx eax, byte [eax + 0x100f1910]
movzx edx, byte [edx + 0x100f1910]
add eax, edx
cdq
idiv edi
mov bh, byte [edx + 0x100f1410]
jmp 0x100ae510
xor bh, bh
mov al, byte [0x100032d7]
test al, al
je 0x100ae53e
test bl, bl
je 0x100ae53e
movzx eax, al
movzx edx, bl
movzx eax, byte [eax + 0x100f1910]
movzx edx, byte [edx + 0x100f1910]
add eax, edx
cdq
idiv edi
mov bl, byte [edx + 0x100f1410]
jmp 0x100ae540
xor bl, bl
movzx edx, byte [ebp - 1]
movzx eax, byte [ebp - 2]
shl edx, 8
or edx, eax
movzx eax, bh
shl edx, 8
or edx, eax
movzx eax, bl
shl edx, 8
or edx, eax
mov dword [esi*4 + 0x100f0d90], edx
inc esi
cmp esi, 0x100
jl 0x100ae435
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100af080
Capabilities:
Terminate process

Disassembly:
push ecx
test ecx, ecx
jns 0x100af0ce
push ecx
push ecx
mov edx, str.ERROR:
mov ecx, 0x100ef488
call fcn.100146e0
mov edx, str.Negative_value
mov ecx, eax
call fcn.100146e0
add esp, 4
mov ecx, eax
call fcn.1004fd10
mov edx, str._passed_to_VarintBE::Length__which_requires_non_negative_argument
mov ecx, eax
call fcn.100146e0
push eax
call fcn.100195d0
add esp, 4
cmp byte [0x100f05bc], 0
jne 0x100af0da
xor eax, eax
pop ecx
ret
xor eax, eax
sar ecx, 7
inc eax
test ecx, ecx
jne 0x100af0d0
pop ecx
ret
mov ecx, 0x100ef488
call fcn.1002bf20
push 1
call fcn.100b8942
int3

Function at 0x100af0f0
Capabilities:
Terminate process

Disassembly:
push ecx
push esi
push edi
test ecx, ecx
jns 0x100af142
push ecx
push ecx
mov edx, str.ERROR:
mov ecx, 0x100ef488
call fcn.100146e0
mov edx, str.Negative_value
mov ecx, eax
call fcn.100146e0
add esp, 4
mov ecx, eax
call fcn.1004fd10
mov edx, str._passed_to_VarintBE::EncodeInternal__which_requires_non_negative_argument
mov ecx, eax
call fcn.100146e0
push eax
call fcn.100195d0
add esp, 4
cmp byte [0x100f05bc], 0
jne 0x100af171
xor eax, eax
pop edi
pop esi
pop ecx
ret
mov al, cl
lea esi, [edx + 4]
and al, 0x7f
sar ecx, 7
mov byte [esi], al
mov edi, 1
dec esi
test ecx, ecx
je 0x100af16b
mov dl, cl
lea esi, [esi - 1]
or dl, 0x80
sar ecx, 7
inc edi
mov byte [esi + 1], dl
test ecx, ecx
jne 0x100af158
mov eax, edi
pop edi
pop esi
pop ecx
ret
mov ecx, 0x100ef488
call fcn.1002bf20
push 1
call fcn.100b8942
int3

Function at 0x100af220
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push esi
test eax, eax
jg 0x100af27d
jl 0x100af235
test edx, edx
jae 0x100af27d
push eax
push edx
mov edx, str.ERROR:
mov ecx, 0x100ef488
call fcn.100146e0
mov edx, str.Negative_value
mov ecx, eax
call fcn.100146e0
mov ecx, eax
call fcn.100a9fd0
mov edx, str._passed_to_VarintBE::Length__which_requires_non_negative_argument
mov ecx, eax
call fcn.100146e0
push eax
call fcn.100195d0
add esp, 4
cmp byte [0x100f05bc], 0
jne 0x100af294
xor eax, eax
pop esi
pop ecx
pop ebp
ret
xor esi, esi
nop
shrd edx, eax, 7
inc esi
sar eax, 7
mov ecx, edx
or ecx, eax
jne 0x100af280
mov eax, esi
pop esi
pop ecx
pop ebp
ret
mov ecx, 0x100ef488
call fcn.1002bf20
push 1
call fcn.100b8942
int3
Function at 0x100af2b0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push esi
push edi
test eax, eax
jg 0x100af30d
jl 0x100af2c5
test edx, edx
jae 0x100af30d
push eax
push edx
mov edx, str.ERROR:
mov ecx, 0x100ef488
call fcn.100146e0
mov edx, str.Negative_value
mov ecx, eax
call fcn.100146e0
mov ecx, eax
call fcn.100a9fd0
mov edx, str._passed_to_VarintBE::EncodeInternal__which_requires_non_negative_argument
mov ecx, eax
call fcn.100146e0
push eax
call fcn.100195d0
add esp, 4
cmp byte [0x100f05bc], 0
jne 0x100af34f
xor eax, eax
pop edi
pop esi
pop ebp
ret
lea esi, [ecx + 8]
mov edi, 1
mov cl, dl
and cl, 0x7f
shrd edx, eax, 7
mov byte [esi], cl
dec esi
sar eax, 7
mov ecx, edx
or ecx, eax
je 0x100af349
lea ebx, [ebx]
mov cl, dl
lea esi, [esi - 1]
or cl, 0x80
inc edi
shrd edx, eax, 7
mov byte [esi + 1], cl
sar eax, 7
mov ecx, edx
or ecx, eax
jne 0x100af330
mov eax, edi
pop edi
pop esi
pop ebp
ret
mov ecx, 0x100ef488
call fcn.1002bf20
push 1
call fcn.100b8942
int3

Function at 0x100af370
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ed7e1
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x10001850]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp + 8]
mov dword [ecx], eax
mov eax, dword [ebp + 0xc]
mov dword [ecx + 4], eax
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x10], 0
mov dword [ebp - 4], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x18], 0
mov dword [ecx + 0x1c], 0
mov byte [ebp - 4], 1
mov dword [ecx + 0x20], 0
mov dword [ecx + 0x24], 0
mov dword [ecx + 0x28], 0
mov byte [ebp - 4], 2
mov eax, dword [ebp + 0x10]
mov dword [ecx + 0x2c], 0
mov dword [ecx + 0x30], eax
mov dword [ecx + 0x34], 0xffffffff
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100af4e0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 8]
cmp eax, dword [esi + 0xc]
jne 0x100af5c8
mov eax, dword [esi + 0x14]
cmp eax, dword [esi + 0x18]
jne 0x100af5c8
mov eax, dword [esi + 0x20]
cmp eax, dword [esi + 0x24]
jne 0x100af5c8
mov ecx, dword [esi + 4]
call fcn.100af790
mov ecx, eax
test ecx, ecx
jne 0x100af55f
push dword [esi + 4]
mov edx, str.ERROR:
push ecx
mov ecx, 0x100ef488
call fcn.100146e0
mov edx, str.Error_finding_table_size_for_source_size
mov ecx, eax
call fcn.100146e0
add esp, 4
mov ecx, eax
call fcn.10011a30
push eax
call fcn.100195d0
add esp, 4
call fcn.1009dcb0
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
lea eax, [ecx - 1]
mov dword [ebp - 4], 0xffffffff
mov dword [esi + 0x2c], eax
lea eax, [ebp - 4]
push eax
push ecx
lea ecx, [esi + 8]
call fcn.100afdf0
lea eax, [ebp - 4]
mov dword [ebp - 4], 0xffffffff
push eax
mov eax, dword [esi + 4]
lea ecx, [esi + 0x14]
shr eax, 4
push eax
call fcn.100afdf0
lea eax, [ebp - 4]
mov dword [ebp - 4], 0xffffffff
push eax
mov eax, dword [esi + 4]
lea ecx, [esi + 0x20]
shr eax, 4
push eax
call fcn.100afdf0
cmp byte [ebp + 8], 0
je 0x100af5bd
push dword [esi + 4]
mov ecx, esi
call fcn.100afa90
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edx, str.ERROR:
mov ecx, 0x100ef488
call fcn.100146e0
mov edx, str.Init___called_twice_for_same_BlockHash_object
mov ecx, eax
call fcn.100146e0
push eax
call fcn.100195d0
add esp, 4
cmp byte [0x100f05bc], 0
je 0x100af554
mov ecx, 0x100ef488
call fcn.1002bf20
push 1
call fcn.100b8942
int3
Function at 0x100af790
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, ecx
mov eax, 1
mov edx, esi
shr edx, 2
inc edx
cmp edx, eax
jbe 0x100af7aa
add eax, eax
je 0x100af7fb
cmp eax, edx
jb 0x100af7a2
lea ecx, [eax - 1]
test eax, ecx
je 0x100af85a
push eax
push ecx
push esi
push ecx
mov edx, str.ERROR:
mov ecx, 0x100ef488
call fcn.100146e0
mov edx, str.Internal_error:_CalcTableSize_dictionary_size_
mov ecx, eax
call fcn.100146e0
add esp, 4
mov ecx, eax
call fcn.10011a30
mov edx, str._:_resulting_table_size
mov ecx, eax
call fcn.100146e0
add esp, 4
mov ecx, eax
call fcn.10011a30
mov edx, str._is_not_a_power_of_2
jmp 0x100af83f
push eax
push ecx
push esi
push ecx
mov edx, str.ERROR:
mov ecx, 0x100ef488
call fcn.100146e0
mov edx, str.Internal_error:_CalcTableSize_dictionary_size_
mov ecx, eax
call fcn.100146e0
add esp, 4
mov ecx, eax
call fcn.10011a30
mov edx, str._:_resulting_table_size
mov ecx, eax
call fcn.100146e0
add esp, 4
mov ecx, eax
call fcn.10011a30
mov edx, str._is_zero_or_negative
mov ecx, eax
call fcn.100146e0
push eax
call fcn.100195d0
add esp, 4
cmp byte [0x100f05bc], 0
je 0x100af8be
jmp 0x100af8c2
test esi, esi
je 0x100af8c0
lea ecx, [edx + edx]
cmp eax, ecx
jbe 0x100af8c0
push eax
push ecx
push esi
push ecx
mov edx, str.ERROR:
mov ecx, 0x100ef488
call fcn.100146e0
mov edx, str.Internal_error:_CalcTableSize_dictionary_size_
mov ecx, eax
call fcn.100146e0
add esp, 4
mov ecx, eax
call fcn.10011a30
mov edx, str._:_resulting_table_size
mov ecx, eax
call fcn.100146e0
add esp, 4
mov ecx, eax
call fcn.10011a30
mov edx, str._is_too_large
mov ecx, eax
call fcn.100146e0
push eax
call fcn.100195d0
add esp, 4
call fcn.1009dcb0
xor eax, eax
pop esi
ret
mov ecx, 0x100ef488
call fcn.1002bf20
push 1
call fcn.100b8942
int3
Function at 0x100af8e0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov edx, ecx
push ebx
push esi
push edi
mov eax, dword [edx + 8]
cmp eax, dword [edx + 0xc]
jne 0x100af926
mov edx, str.ERROR:
mov ecx, 0x100ef488
call fcn.100146e0
mov edx, str.BlockHash::AddBlock___called_before_BlockHash::Init__
mov ecx, eax
call fcn.100146e0
push eax
call fcn.100195d0
add esp, 4
cmp byte [0x100f05bc], 0
je 0x100afa70
jmp 0x100afa77
mov esi, dword [edx + 0x34]
mov eax, dword [edx + 4]
inc esi
shr eax, 4
cmp esi, eax
jl 0x100af976
dec eax
mov edx, str.ERROR:
push eax
push ecx
push esi
push ecx
mov ecx, 0x100ef488
call fcn.100146e0
mov edx, str.BlockHash::AddBlock___called_with_block_number
mov ecx, eax
call fcn.100146e0
add esp, 4
mov ecx, eax
call fcn.1004fd10
mov edx, str._that_is_past_last_block
mov ecx, eax
call fcn.100146e0
add esp, 4
mov ecx, eax
call fcn.1004fd10
jmp 0x100af90b
mov edi, dword [edx + 0x14]
cmp dword [edi + esi*4], 0xffffffff
lea eax, [edi + esi*4]
je 0x100af9c7
push dword [eax]
mov edx, str.ERROR:
push ecx
push esi
push ecx
mov ecx, 0x100ef488
call fcn.100146e0
mov edx, str.Internal_error_in_BlockHash::AddBlock__:_block_number_
mov ecx, eax
call fcn.100146e0
add esp, 4
mov ecx, eax
call fcn.1004fd10
mov edx, str.__next_block_should_be__1_but_is
mov ecx, eax
call fcn.100146e0
add esp, 4
mov ecx, eax
call fcn.1004fd10
jmp 0x100af90b
mov ecx, dword [edx + 0x2c]
and ecx, dword [ebp + 8]
mov eax, dword [edx + 8]
mov ebx, dword [eax + ecx*4]
test ebx, ebx
jns 0x100af9ea
mov dword [eax + ecx*4], esi
mov eax, dword [edx + 0x20]
mov dword [eax + esi*4], esi
mov dword [edx + 0x34], esi
pop edi
pop esi
pop ebx
pop ebp
ret 4
mov eax, dword [edx + 0x20]
mov eax, dword [eax + ebx*4]
cmp dword [edi + eax*4], 0xffffffff
je 0x100afa64
push dword [edi + eax*4]
mov edx, str.ERROR:
push ecx
push eax
push ecx
push ebx
push ecx
mov ecx, 0x100ef488
call fcn.100146e0
mov edx, str.Internal_error_in_BlockHash::AddBlock__:_first_matching_block_
mov ecx, eax
call fcn.100146e0
add esp, 4
mov ecx, eax
call fcn.1004fd10
mov edx, str.__last_matching_block_
mov ecx, eax
call fcn.100146e0
add esp, 4
mov ecx, eax
call fcn.1004fd10
mov edx, str.__next_block_should_be__1_but_is
mov ecx, eax
call fcn.100146e0
add esp, 4
mov ecx, eax
call fcn.1004fd10
push eax
call fcn.100195d0
add esp, 4
call fcn.1009dcb0
pop edi
pop esi
pop ebx
pop ebp
ret 4
mov dword [edi + eax*4], esi
mov eax, dword [edx + 0x20]
mov dword [eax + ebx*4], esi
mov dword [edx + 0x34], esi
pop edi
pop esi
pop ebx
pop ebp
ret 4
mov ecx, 0x100ef488
call fcn.1002bf20
push 1
call fcn.100b8942
int3
Function at 0x100afa90
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [ebp + 8]
mov eax, dword [edi + 4]
cmp ecx, eax
jle 0x100afafc
push eax
push ecx
push ecx
push ecx
mov edx, str.ERROR:
mov ecx, 0x100ef488
call fcn.100146e0
mov edx, str.BlockHash::AddAllBlocksThroughIndex___called_with_index
mov ecx, eax
call fcn.100146e0
add esp, 4
mov ecx, eax
call fcn.1004fd10
mov edx, str._higher_than_end_index
mov ecx, eax
call fcn.100146e0
add esp, 4
mov ecx, eax
call fcn.10011a30
push eax
call fcn.100195d0
add esp, 4
cmp byte [0x100f05bc], 0
je 0x100afb86
jmp 0x100afb8d
mov edx, dword [edi + 0x34]
shl edx, 4
cmp ecx, edx
jg 0x100afb53
push edx
push ecx
push ecx
push ecx
mov edx, str.ERROR:
mov ecx, 0x100ef488
call fcn.100146e0
mov edx, str.BlockHash::AddAllBlocksThroughIndex___called_with_index
mov ecx, eax
call fcn.100146e0
add esp, 4
mov ecx, eax
call fcn.1004fd10
mov edx, str.___last_index_added__
mov ecx, eax
call fcn.100146e0
add esp, 4
mov ecx, eax
call fcn.1004fd10
mov edx, 0x100fdbfc
mov ecx, eax
call fcn.100146e0
jmp 0x100afae1
cmp eax, 0x10
jb 0x100afb86
add eax, 0xfffffff0
cmp ecx, eax
jle 0x100afb62
lea ecx, [eax + 1]
mov eax, dword [edi]
lea esi, [eax + 0x10]
lea ebx, [eax + ecx]
add esi, edx
cmp esi, ebx
jae 0x100afb86
mov ecx, esi
call fcn.100aa5e0
push eax
mov ecx, edi
call fcn.100af8e0
add esi, 0x10
cmp esi, ebx
jb 0x100afb70
pop edi
pop esi
pop ebx
pop ebp
ret 4
mov ecx, 0x100ef488
call fcn.1002bf20
push 1
call fcn.100b8942
int3

Function at 0x100afc20
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ecx + 4]
mov edx, dword [ebp + 8]
shr eax, 4
cmp edx, eax
jb 0x100afc70
push edx
push ecx
mov edx, str.ERROR:
mov ecx, 0x100ef488
call fcn.100146e0
mov edx, str.NextMatchingBlock_called_for_invalid_block_number
mov ecx, eax
call fcn.100146e0
add esp, 4
mov ecx, eax
call fcn.1004fd10
push eax
call fcn.100195d0
add esp, 4
cmp byte [0x100f05bc], 0
jne 0x100afc82
or eax, 0xffffffff
pop ebp
ret 8
mov eax, dword [ecx + 0x14]
push dword [ebp + 0xc]
push dword [eax + edx*4]
call fcn.100afba0
pop ebp
ret 8
mov ecx, 0x100ef488
call fcn.1002bf20
push 1
call fcn.100b8942
int3
Function at 0x100d73d0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
jmp 0x100d74a0
push 0xffffffffffffffff
push 0x100edc98
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov eax, dword [0x10001850]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov eax, dword [0x100025d0]
cmp eax, 0xffffffff
jne 0x100d74d9
xor ebp, ebp
mov dword [esp + 0x14], ebp
jmp 0x100d74e6
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebp, eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], ebp
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov dword [esp + 0x2c], 0
test ebp, ebp
je 0x100d754d
jmp 0x100d751c
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [ebp + 0x14], 0
mov edi, dword [ebp + 0xc]
jne 0x100d758a
test edi, edi
jne 0x100d7590
push 0x100d70a0
push 0x100f04dc
call fcn.100d6d40
mov eax, dword [0x100025d0]
add esp, 8
cmp eax, 0xffffffff
je 0x100d754d
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [esp + 0x2c], 0xffffffff
test ebp, ebp
je 0x100d7576
lea eax, [ebp + 4]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x100d7576
mov eax, dword [ebp]
mov ecx, ebp
push 0
call dword [eax]
push ebp
push 0
call esi
push eax
call ebx
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
test edi, edi
je 0x100d75c8
mov edi, edi
mov eax, dword [edi + 4]
mov dword [ebp + 0xc], eax
mov ecx, dword [edi]
test ecx, ecx
je 0x100d75b9
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [edi]
mov ecx, esi
push 0
mov eax, dword [esi]
call dword [eax]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0
call esi
push eax
call ebx
push edi
push 0
call esi
push eax
call ebx
mov edi, dword [ebp + 0xc]
test edi, edi
jne 0x100d7590
mov ebx, dword [ebp + 0x10]
lea eax, [ebp + 0x10]
mov dword [esp + 0x18], eax
mov esi, dword [ebx]
cmp esi, ebx
je 0x100d7510
mov ebp, eax
mov edi, edi
cmp byte [esi + 0xd], 0
mov edi, esi
jne 0x100d7627
mov eax, dword [esi + 8]
cmp byte [eax + 0xd], 0
jne 0x100d760c
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0xd], 0
jne 0x100d7627
jmp 0x100d7600
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0xd], 0
je 0x100d7600
jmp 0x100d7627
mov eax, dword [esi + 4]
cmp byte [eax + 0xd], 0
jne 0x100d7625
cmp esi, dword [eax + 8]
jne 0x100d7625
mov esi, eax
mov eax, dword [eax + 4]
cmp byte [eax + 0xd], 0
je 0x100d7615
mov esi, eax
mov ecx, dword [edi + 0x14]
test ecx, ecx
je 0x100d763b
mov edx, dword [edi + 0x1c]
test edx, edx
je 0x100d763b
mov eax, dword [ecx]
push edx
call dword [eax + 4]
push edi
lea eax, [esp + 0x24]
mov ecx, ebp
push eax
call fcn.100d70d0
cmp esi, ebx
jne 0x100d75e0
mov ebp, dword [esp + 0x14]
jmp 0x100d7510