joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40e0d6
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x40e104
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x40e122
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0040e040
jmp 0x40e122
mov eax, dword [esi + 0x14]
test eax, eax
je 0x40e122
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
push eax
mov ecx, esi
call fcn.0040e040
test edi, edi
mov eax, edi
jne 0x40e10c
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
mov ecx, dword [0x4446b4]
test ecx, ecx
je 0x40e1e5
jmp 0x40e0d5
ret 8

Function at 0x41ce11
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x441708]
jne 0x41ce1b
repz ret
jmp fcn.00421f17
Function at 0x429202
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.004218fe
xor ebx, ebx
cmp dword [0x445508], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x4292d7
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x429242
xor eax, eax
jmp 0x42939b
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x42923b
push eax
call fcn.0042189b
mov dword [esp], 0x436f3c
push edi
mov dword [0x445508], eax
call esi
push eax
call fcn.0042189b
mov dword [esp], 0x436f28
push edi
mov dword [0x44550c], eax
call esi
push eax
call fcn.0042189b
mov dword [0x445510], eax
lea eax, [ebp - 8]
push eax
call fcn.0041da8b
test eax, eax
pop ecx
pop ecx
je 0x4292a5
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.004225af
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x4292d7
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.0042189b
cmp eax, ebx
pop ecx
mov dword [0x445518], eax
je 0x4292d7
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0042189b
pop ecx
mov dword [0x445514], eax
mov eax, dword [0x445514]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x429350
cmp dword [0x445518], esi
je 0x429350
push eax
call fcn.00421907
pop ecx
call eax
cmp eax, ebx
je 0x42931d
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x445518]
call fcn.00421907
pop ecx
call eax
test eax, eax
je 0x42931d
test byte [ebp - 0x18], 1
jne 0x429350
lea eax, [ebp - 0xc]
push eax
call fcn.0041dac2
test eax, eax
pop ecx
je 0x429338
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.004225af
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x429347
or dword [ebp + 0x10], 0x200000
jmp 0x429381
or dword [ebp + 0x10], 0x40000
jmp 0x429381
mov eax, dword [0x44550c]
cmp eax, esi
je 0x429381
push eax
call fcn.00421907
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x429381
mov eax, dword [0x445510]
cmp eax, esi
je 0x429381
push dword [ebp - 4]
push eax
call fcn.00421907
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x445508]
call fcn.00421907
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x430bd4
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x441708]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.00430b69
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.0041de30
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x430c23
cmp dword [ebp - 0x1c], 5
jb 0x430c3b
jmp 0x430c37
cmp dword [ebp - 0x10], 1
jne 0x430c3b
cmp dword [ebp - 0x1c], 4
ja 0x430c37
jne 0x430c3b
cmp dword [ebp - 0x18], 0
jbe 0x430c3b
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x438918
call fcn.00430a5a
test eax, eax
jge 0x430c5c
mov byte [0x4456ac], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0041ce11
add ebp, 0x78
leave
ret
Function at 0x401004
Capabilities:
Parse pe header

Disassembly:
push 0x28
push 0x402070
call fcn.00401284
xor edi, edi
push edi
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
cmp word [eax], 0x5a4d
jne 0x40103f
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40103f
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x401057
cmp eax, 0x20b
je 0x401044
mov dword [ebp - 0x1c], edi
jmp 0x40106b
cmp dword [ecx + 0x84], 0xe
jbe 0x40103f
xor eax, eax
cmp dword [ecx + 0xf8], edi
jmp 0x401065
cmp dword [ecx + 0x74], 0xe
jbe 0x40103f
xor eax, eax
cmp dword [ecx + 0xe8], edi
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], edi
push 1
call dword [0x402034]
pop ecx
or dword [0x402118], 0xffffffff
or dword [0x40211c], 0xffffffff
call dword [0x402030]
mov ecx, dword [0x402110]
mov dword [eax], ecx
call dword [0x40202c]
mov ecx, dword [0x40210c]
mov dword [eax], ecx
mov eax, dword [0x402048]
mov eax, dword [eax]
mov dword [0x402114], eax
call fcn.004011e0
call fcn.00401280
cmp dword [0x402064], edi
jne 0x4010cb
push fcn.00401280
call dword [0x402024]
pop ecx
call fcn.0040126e
push 0x402060
push 0x40205c
call fcn.00401268
push 0x401224
call fcn.004011ce
mov eax, dword [0x402108]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
push dword [0x402104]
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [0x40201c]
add esp, 0x20
mov dword [ebp - 0x34], eax
cmp eax, edi
jge 0x40111f
push 8
call fcn.004011a2
pop ecx
push 0x402058
push 0x402054
call fcn.00401268
call dword [0x402014]
mov ecx, dword [ebp - 0x20]
mov dword [eax], ecx
push dword [ebp - 0x20]
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
call fcn.00401000
add esp, 0x14
mov esi, eax
mov dword [ebp - 0x38], esi
cmp dword [ebp - 0x1c], edi
jne 0x40115b
push esi
call dword [0x402010]
call dword [0x40200c]
jmp 0x401190
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.004012bf
ret
Function at 0x10001e70
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push esi
push edi
push eax
push 0x40
mov edi, ecx
mov esi, edx
push 0x1e
push edi
call ebx
movups xmm0, xmmword [esi]
movups xmmword [edi], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [edi + 0x10], xmm0
mov eax, dword [esi + 0x18]
mov dword [edi + 0x18], eax
movzx eax, word [esi + 0x1c]
mov word [edi + 0x1c], ax
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
push 0x1e
push edi
call ebx
lea eax, [ebp - 4]
push eax
push 0x40
push 0x1e
lea esi, [edi + 0x190]
push esi
call ebx
mov ecx, dword [ebp + 8]
movups xmm0, xmmword [ecx]
movups xmmword [esi], xmm0
movq xmm0, qword [ecx + 0x10]
movq qword [esi + 0x10], xmm0
mov eax, dword [ecx + 0x18]
mov dword [esi + 0x18], eax
movzx eax, word [ecx + 0x1c]
mov word [esi + 0x1c], ax
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
push 0x1e
push esi
call ebx
lea eax, [ebp - 4]
push eax
push 0x40
push 4
lea esi, [edi + 0x7d8]
push esi
call ebx
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [esi], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
push 4
push esi
call ebx
lea eax, [ebp - 4]
push eax
push 0x40
push 1
lea esi, [edi + 0x7d0]
push esi
call ebx
mov eax, dword [ebp + 0x10]
movzx eax, byte [eax]
mov byte [esi], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
push 1
push esi
call ebx
lea esi, [edi + 0x7e4]
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push esi
call ebx
mov eax, dword [ebp + 0x14]
movzx eax, byte [eax]
mov byte [esi], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
push 1
push esi
call ebx
lea eax, [ebp - 4]
push eax
push 0x40
push 0x14
lea esi, [edi + 0x4b0]
push esi
call ebx
mov eax, dword [ebp + 0x18]
movups xmm0, xmmword [eax]
movups xmmword [esi], xmm0
mov eax, dword [eax + 0x10]
mov dword [esi + 0x10], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
push 0x14
push esi
call ebx
lea eax, [ebp - 4]
push eax
push 0x40
push 0x14
lea esi, [edi + 0x640]
push esi
call ebx
mov eax, dword [ebp + 0x1c]
movups xmm0, xmmword [eax]
movups xmmword [esi], xmm0
mov eax, dword [eax + 0x10]
mov dword [esi + 0x10], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
push 0x14
push esi
call ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10002220
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea eax, [ebp - 4]
push esi
push edi
push eax
push 0x40
push 2
push 0x99742d
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push eax
call edi
push 0
push 2
push 0x1004b0e0
push 0x99742d
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push eax
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x978c41
call ebx
push eax
call edi
push 0
push 1
push 0x1004b0e4
push 0x978c41
call ebx
push eax
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 2
push 0x974a4e
call ebx
push eax
call edi
push 0
push 2
push 0x1004b0e8
push 0x974a4e
call ebx
push eax
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 2
push 0x85699c
call ebx
push eax
call edi
push 0
push 2
push 0x1004b0ec
push 0x85699c
call ebx
push eax
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 2
push 0x84eb37
call ebx
push eax
call edi
push 0
push 2
push 0x1004b0e8
push 0x84eb37
call ebx
push eax
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 3
push 0x87e9c6
call ebx
push eax
call edi
push 0
push 3
push 0x1004b0f0
push 0x87e9c6
call ebx
push eax
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 3
push 0x87ea60
call ebx
push eax
call edi
push 0
push 3
push 0x1004b0f0
push 0x87ea60
call ebx
push eax
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 3
push 0x87e97c
call ebx
push eax
call edi
push 0
push 3
push 0x1004b0f0
push 0x87e97c
call ebx
push eax
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 3
push 0x87e9ec
call ebx
push eax
call edi
push 0
push 3
push 0x1004b0f4
push 0x87e9ec
call ebx
push eax
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 3
push 0x87ea55
call ebx
push eax
call edi
push 0
push 3
push 0x1004b0f8
push 0x87ea55
call ebx
push eax
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 3
push 0x87ea7d
call ebx
push eax
call edi
push 0
push 3
push 0x1004b0fc
push 0x87ea7d
call ebx
push eax
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 2
push 0x866ee9
call ebx
push eax
call edi
push 0
push 2
push 0x1004b0e8
push 0x866ee9
call ebx
push eax
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 2
push 0x87e707
call ebx
push eax
call edi
push 0
push 2
push 0x1004b100
push 0x87e707
call ebx
push eax
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10002430
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea eax, [ebp - 4]
push esi
push edi
push eax
push 0x40
push 2
push 0x99742d
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push eax
call edi
push 0
push 2
push 0x1004b0ec
push 0x99742d
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push eax
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x978c41
call ebx
push eax
call edi
push 0
push 1
push 0x1004b104
push 0x978c41
call ebx
push eax
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 2
push 0x974a4e
call ebx
push eax
call edi
push 0
push 2
push 0x1004b108
push 0x974a4e
call ebx
push eax
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 2
push 0x85699c
call ebx
push eax
call edi
push 0
push 2
push 0x1004b0e0
push 0x85699c
call ebx
push eax
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 2
push 0x84eb37
call ebx
push eax
call edi
push 0
push 2
push 0x1004b108
push 0x84eb37
call ebx
push eax
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 3
push 0x87e9c6
call ebx
push eax
call edi
push 0
push 3
push 0x1004b10c
push 0x87e9c6
call ebx
push eax
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 3
push 0x87ea60
call ebx
push eax
call edi
push 0
push 3
push 0x1004b10c
push 0x87ea60
call ebx
push eax
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 3
push 0x87e97c
call ebx
push eax
call edi
push 0
push 3
push 0x1004b10c
push 0x87e97c
call ebx
push eax
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 3
push 0x87e9ec
call ebx
push eax
call edi
push 0
push 3
push 0x1004b110
push 0x87e9ec
call ebx
push eax
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 3
push 0x87ea55
call ebx
push eax
call edi
push 0
push 3
push 0x1004b114
push 0x87ea55
call ebx
push eax
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 3
push 0x87ea7d
call ebx
push eax
call edi
push 0
push 3
push 0x1004b118
push 0x87ea7d
call ebx
push eax
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 2
push 0x866ee9
call ebx
push eax
call edi
push 0
push 2
push 0x1004b108
push 0x866ee9
call ebx
push eax
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 2
push 0x87e707
call ebx
push eax
call edi
push 0
push 2
push 0x1004b11c
push 0x87e707
call ebx
push eax
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10003140
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea eax, [ebp - 4]
push esi
push edi
push eax
push 0x40
push 1
push 0x8579ba
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push eax
call edi
push 0
push 1
push 0x1004b160
push 0x8579ba
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push eax
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 2
push 0x8579bc
call ebx
push eax
call edi
push 0
push 2
push 0x1004b1bc
push 0x8579bc
call ebx
push eax
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 2
push 0x8579d0
call ebx
push eax
call edi
push 0
push 2
push 0x1004b1c0
push 0x8579d0
call ebx
push eax
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x5c2413
call ebx
push eax
call edi
push 0
push 1
push 0x1004b160
push 0x5c2413
call ebx
push eax
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 3
push 0x5c242e
call ebx
push eax
call edi
push 0
push 3
push 0x1004b1c4
push 0x5c242e
call ebx
push eax
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 3
push 0x5c2433
call ebx
push eax
call edi
push 0
push 3
push 0x1004b1c8
push 0x5c2433
call ebx
push eax
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 2
push 0x5c244e
call ebx
push eax
call edi
push 0
push 2
push 0x1004b1cc
push 0x5c244e
call ebx
push eax
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10003270
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea eax, [ebp - 4]
push esi
push edi
push eax
push 0x40
push 2
push 0x5c03e8
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push eax
call edi
push 0
push 2
push 0x1004b0e8
push 0x5c03e8
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push eax
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 2
push 0x5c0354
call ebx
push eax
call edi
push 0
push 2
push 0x1004b0e8
push 0x5c0354
call ebx
push eax
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0x5c0463
call ebx
push eax
call edi
push 0
push 4
push 0x1004b1e4
push 0x5c0463
call ebx
push eax
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 3
push 0x5c046a
call ebx
push eax
call edi
push 0
push 3
push 0x1004b1c8
push 0x5c046a
call ebx
push eax
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 2
push 0x5c047c
call ebx
push eax
call edi
push 0
push 2
push 0x1004b1ec
push 0x5c047c
call ebx
push eax
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10003350
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea eax, [ebp - 4]
push esi
push edi
push eax
push 0x40
push 2
push 0x85588d
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push eax
call edi
push 0
push 2
push 0x1004b108
push 0x85588d
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push eax
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x85599d
call ebx
push eax
call edi
push 0
push 1
push 0x1004b160
push 0x85599d
call ebx
push eax
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 2
push 0x86b113
call ebx
push eax
call edi
push 0
push 2
push 0x1004b0e8
push 0x86b113
call ebx
push eax
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push 0x86b11d
call ebx
push eax
call edi
push 0
push 5
push 0x1004b208
push 0x86b11d
call ebx
push eax
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10009dd0
Capabilities:
Create thread
Read .ini file
Terminate process

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 1
jne 0x10009e9f
push str..TAC2_DATA_tac2config.ini
push 0x96
push 0x10051760
push 0x1004b0dc
push str.KeyLoad
push 0x1004cbb4
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push str..TAC2_DATA_tac2config.ini
push 0
push str.KeyLoad
push 0x1004cbb4
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov ecx, str.1235474521b4u1452141
mov eax, 0x10051760
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10009e42
test dl, dl
je 0x10009e3e
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10009e42
add eax, 2
add ecx, 2
test dl, dl
jne 0x10009e22
xor eax, eax
jmp 0x10009e47
sbb eax, eax
or eax, 1
test eax, eax
je 0x10009e6c
push 0x10
push str.Error
push str.Fuck_off.
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
push 0
push 0
push 0
push 0x10006fc0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x10009da0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push str..TAC2_DATAGAMEDATATaskKeyHookWDLA.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push fcn.10001e30
push 0x10001fe0
call fcn.100014e0
push 0x10009bd0
push 0x10002010
call fcn.100014e0
push 0x10009cc0
push 0x10002040
call fcn.100014e0
mov eax, 1
pop ebp
ret 0xc

Function at 0x1000d8d0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.1000d4f0
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1000d902
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 8]
call dword [0x1003c16c]
call dword [ebp - 8]
jmp 0x1000d90c
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esp, ebp
pop ebp
ret
Function at 0x10028880
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x38
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
push eax
lea ecx, [ebp - 4]
call fcn.100147a0
lea ecx, [ebp - 4]
call fcn.10028850
movzx eax, al
test eax, eax
jne 0x100288bd
mov dword [ebp - 0x18], 0
lea ecx, [ebp - 4]
call fcn.10028790
mov eax, dword [ebp - 0x18]
jmp 0x100289e5
lea ecx, [ebp - 4]
call fcn.10014b10
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.10028810
add esp, 4
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x10]
sar edx, 1
mov dword [ebp - 0x14], edx
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0x14]
push eax
lea ecx, [ebp - 4]
call fcn.10014b10
push eax
push 0
push 0
call fcn.100286d0
add esp, 0x20
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x10028923
mov dword [ebp - 0x20], 0
lea ecx, [ebp - 4]
call fcn.10028790
mov eax, dword [ebp - 0x20]
jmp 0x100289e5
push 0x66
push str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
push 2
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.1001ced0
add esp, 0x10
push eax
lea ecx, [ebp - 8]
call fcn.1000c090
lea ecx, [ebp - 8]
call fcn.1000c0d0
movzx edx, al
test edx, edx
jne 0x1002896c
mov dword [ebp - 0x24], 0
lea ecx, [ebp - 8]
call fcn.1000c0b0
lea ecx, [ebp - 4]
call fcn.10028790
mov eax, dword [ebp - 0x24]
jmp 0x100289e5
lea ecx, [ebp - 8]
call fcn.1000c110
mov dword [ebp - 0x28], eax
lea ecx, [ebp - 4]
call fcn.10014b10
mov dword [ebp - 0x2c], eax
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x28]
push ecx
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x2c]
push eax
push 0
push 0
call fcn.100286d0
add esp, 0x20
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jne 0x100289c7
mov dword [ebp - 0x34], 0
lea ecx, [ebp - 8]
call fcn.1000c0b0
lea ecx, [ebp - 4]
call fcn.10028790
mov eax, dword [ebp - 0x34]
jmp 0x100289e5
lea ecx, [ebp - 8]
call fcn.1001e490
mov dword [ebp - 0x38], eax
lea ecx, [ebp - 8]
call fcn.1000c0b0
lea ecx, [ebp - 4]
call fcn.10028790
mov eax, dword [ebp - 0x38]
mov esp, ebp
pop ebp
ret

Function at 0x100290b0
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.10028a70
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x100290e4
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 8]
call dword [0x1003c16c]
call dword [ebp - 8]
jmp 0x100290ea
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov esp, ebp
pop ebp
ret 4
Function at 0x10029140
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.10028ab0
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x10029174
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 8]
call dword [0x1003c16c]
call dword [ebp - 8]
jmp 0x1002917e
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esp, ebp
pop ebp
ret 4

Function at 0x10029190
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.10028ad0
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x100291c8
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
call dword [0x1003c16c]
call dword [ebp - 8]
jmp 0x100291d6
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov esp, ebp
pop ebp
ret 8