joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10079610
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1008e179
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x3c
push esi
mov eax, dword [0x100a4040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x100bf3a4]
mov ecx, dword [0x100be8d8]
mov dword [ebp - 0x18], eax
mov eax, dword fs:[0x2c]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x100c0994]
cmp eax, dword [ecx + 4]
jle 0x100797cb
push 0x100c0994
call fcn.1008a0fd
add esp, 4
cmp dword [0x100c0994], 0xffffffff
jne 0x100797cb
mov dword [ebp - 4], 0
xor eax, eax
movaps xmm0, xmmword [0x1009ad00]
movups xmmword [ebp - 0x4c], xmm0
mov dword [ebp - 0x3c], 0x46594659
mov dword [ebp - 0x38], 0x593b4159
mov dword [ebp - 0x34], 0x4b593c4d
mov word [ebp - 0x30], 0x41
nop dword [eax + eax]
mov cl, byte [ebp - 0x4c]
xor byte [ebp + eax - 0x4b], cl
inc eax
cmp eax, 0x1c
jb 0x100796c0
sub esp, 0x18
mov byte [ebp - 0x2f], 0
mov edx, esp
mov dword [ebp - 0x1c], esp
xorps xmm0, xmm0
lea ecx, [ebp - 0x4b]
lea esi, [ecx + 1]
movups xmmword [edx], xmm0
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100796f3
sub ecx, esi
lea eax, [ebp - 0x4b]
push ecx
push eax
mov ecx, edx
call fcn.1000bcd0
mov byte [ebp - 4], 1
mov cl, 0xd
mov byte [ebp - 0x13], cl
mov al, 2
mov byte [ebp - 0x14], cl
mov dl, 8
mov byte [ebp - 0x2c], 0x61
mov ch, 0xf
xor al, byte [ebp - 0x2c]
mov dh, 0x15
xor cl, byte [ebp - 0x2c]
mov ah, 4
mov byte [ebp - 0x2b], al
xorps xmm0, xmm0
mov byte [ebp - 0x2a], cl
mov cl, byte [ebp - 0x2c]
mov byte [ebp - 0x11], 0x4f
xor dl, cl
mov al, byte [ebp - 0x11]
xor dh, cl
xor al, cl
mov byte [ebp - 0x12], 5
mov byte [ebp - 0x25], al
xor ah, cl
mov al, byte [ebp - 0x12]
xor ch, cl
xor al, cl
mov byte [ebp - 0x29], dl
mov byte [ebp - 0x24], al
mov al, byte [ebp - 0x13]
xor al, cl
mov byte [ebp - 0x26], dh
mov byte [ebp - 0x23], al
mov al, byte [ebp - 0x14]
xor al, cl
mov byte [ebp - 0x27], ch
sub esp, 0x18
mov byte [ebp - 0x21], 0
mov edx, esp
mov byte [ebp - 0x28], ah
lea ecx, [ebp - 0x2b]
mov byte [ebp - 0x22], al
mov byte [ebp - 0x21], 0
lea esi, [ecx + 1]
movups xmmword [edx], xmm0
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10079794
sub ecx, esi
lea eax, [ebp - 0x2b]
push ecx
push eax
mov ecx, edx
call fcn.1000bcd0
mov byte [ebp - 4], 0
call fcn.1007a170
push 0x100c0994
mov dword [0x100c098c], eax
mov dword [ebp - 4], 0xffffffff
call fcn.1008a0ac
add esp, 0x34
mov ecx, dword [ebp - 0x18]
push ecx
call dword [0x100c098c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x1007ae90
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1008e2bd
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x100a4040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
cmp esi, dword [ecx + 8]
jae 0x1007afc6
mov eax, dword [ecx]
mov ecx, dword [eax + 4]
mov edi, dword [eax]
sub ecx, edi
mov eax, 0x2aaaaaab
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, esi
jbe 0x1007afe1
lea eax, [esi + esi*2]
mov esi, dword [ebp + 0x10]
lea eax, [edi + eax*4]
lea ebx, [eax + 4]
test esi, esi
jne 0x1007af57
mov edi, dword [ebx]
cmp dword [eax], edi
jne 0x1007af57
cmp edi, dword [eax + 8]
je 0x1007af38
mov esi, dword [ebp + 0xc]
mov ecx, edi
push esi
mov dword [ebp + 8], edi
call fcn.1000b8c0
lea eax, [esi + 0x18]
mov dword [ebp - 4], 0
push eax
lea ecx, [edi + 0x18]
call fcn.1000b8c0
add dword [ebx], 0x30
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push dword [ebp + 0xc]
mov ecx, eax
push edi
call fcn.10082050
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edi, dword [eax]
mov eax, 0x2aaaaaab
mov ecx, dword [ebx]
sub ecx, edi
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp esi, eax
jae 0x1007afe6
lea esi, [esi + esi*2]
shl esi, 4
add esi, edi
mov edi, dword [ebp + 0xc]
cmp esi, edi
je 0x1007af96
cmp dword [edi + 0x14], 0xf
mov eax, edi
jbe 0x1007af8b
mov eax, dword [edi]
push dword [edi + 0x10]
mov ecx, esi
push eax
call fcn.10026180
lea eax, [edi + 0x18]
lea ecx, [esi + 0x18]
cmp ecx, eax
je 0x1007afb2
cmp dword [eax + 0x14], 0xf
mov edx, dword [eax + 0x10]
jbe 0x1007afab
mov eax, dword [eax]
push edx
push eax
call fcn.10026180
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push str.field_range_error
lea ecx, [ebp - 0x18]
call fcn.1007a440
push 0x100a11b8
lea eax, [ebp - 0x18]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
call fcn.10025ff0
push str.field_range_error
lea ecx, [ebp - 0x24]
call fcn.1007a440
push 0x100a11b8
lea eax, [ebp - 0x24]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x10083aa0
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100a4040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov eax, ecx
push esi
mov esi, eax
mov dword [ebp - 8], eax
push edi
lea ecx, [esi + 1]
nop dword [eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x10083ac0
sub esi, ecx
mov dword [ebp - 0xc], esi
lea eax, [esi + 0x10]
and eax, 0xfffffff0
call fcn.1008b360
mov ebx, esp
mov dword [ebp - 0x10], ebx
test esi, esi
jle 0x10083b0e
sub dword [ebp - 8], ebx
mov edi, ebx
mov ebx, esi
mov esi, dword [ebp - 8]
nop word [eax + eax]
movsx eax, byte [edi + esi]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
add esp, 4
mov byte [edi], al
lea edi, [edi + 1]
sub ebx, 1
jne 0x10083af0
mov esi, dword [ebp - 0xc]
mov ebx, dword [ebp - 0x10]
mov edx, esi
xor edx, 0x444f5441
cmp esi, 4
jl 0x10083b53
mov edi, esi
shr edi, 2
mov eax, edi
neg eax
lea esi, [esi + eax*4]
nop word [eax + eax]
imul ecx, dword [ebx], 0x5bd1e995
add ebx, 4
imul edx, edx, 0x5bd1e995
mov eax, ecx
shr eax, 0x18
xor eax, ecx
imul ecx, eax, 0x5bd1e995
xor edx, ecx
sub edi, 1
jne 0x10083b30
sub esi, 1
je 0x10083b74
sub esi, 1
je 0x10083b6b
sub esi, 1
jne 0x10083b7f
movzx eax, byte [ebx + 2]
shl eax, 0x10
xor edx, eax
movzx eax, byte [ebx + 1]
shl eax, 8
xor edx, eax
movzx eax, byte [ebx]
xor eax, edx
imul edx, eax, 0x5bd1e995
mov eax, edx
shr eax, 0xd
xor eax, edx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xf
xor eax, ecx
lea esp, [ebp - 0x1c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1008a073
mov esp, ebp
pop ebp
ret
Function at 0x10083bb0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1008f009
mov eax, dword fs:[0]
push eax
sub esp, 0x38
push esi
push edi
mov eax, dword [0x100a4040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword fs:[0x2c]
mov edx, dword [0x100be8d8]
mov esi, dword [eax + edx*4]
mov eax, dword [0x100c09ec]
cmp eax, dword [esi + 4]
jle 0x10083d5d
push 0x100c09ec
call fcn.1008a0fd
add esp, 4
cmp dword [0x100c09ec], 0xffffffff
jne 0x10083d5d
mov dword [ebp - 4], 0
xor eax, eax
movaps xmm0, xmmword [0x1009a820]
movups xmmword [ebp - 0x44], xmm0
mov dword [ebp - 0x34], 0x482e363e
mov dword [ebp - 0x30], 0x383b2e48
mov dword [ebp - 0x2c], 0x2e4c362e
mov word [ebp - 0x28], 0x3f48
mov byte [ebp - 0x26], 0
mov cl, byte [ebp - 0x44]
xor byte [ebp + eax - 0x43], cl
inc eax
cmp eax, 0x1d
jb 0x10083c46
sub esp, 0x18
mov byte [ebp - 0x26], 0
mov edx, esp
mov dword [ebp - 0x18], esp
lea ecx, [ebp - 0x43]
xorps xmm0, xmm0
lea eax, [ecx + 1]
mov dword [ebp - 0x14], eax
movups xmmword [edx], xmm0
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 0
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10083c80
sub ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x43]
push ecx
push eax
mov ecx, edx
call fcn.1000bcd0
mov byte [ebp - 4], 1
mov cl, 0x7f
mov byte [ebp - 0xf], cl
mov al, 0x70
mov byte [ebp - 0x10], cl
mov dl, 0x7a
mov byte [ebp - 0x24], 0x13
mov ah, 0x76
xor al, byte [ebp - 0x24]
mov ch, 0x7d
xor cl, byte [ebp - 0x24]
mov dh, 0x67
mov byte [ebp - 0x23], al
xorps xmm0, xmm0
mov byte [ebp - 0x22], cl
mov cl, byte [ebp - 0x24]
mov byte [ebp - 0xd], 0x3d
xor dl, cl
mov al, byte [ebp - 0xd]
xor ah, cl
xor al, cl
mov byte [ebp - 0xe], 0x77
mov byte [ebp - 0x1d], al
xor dh, cl
mov al, byte [ebp - 0xe]
xor ch, cl
xor al, cl
mov byte [ebp - 0x21], dl
mov byte [ebp - 0x1c], al
mov al, byte [ebp - 0xf]
xor al, cl
mov byte [ebp - 0x1e], dh
mov byte [ebp - 0x1b], al
mov al, byte [ebp - 0x10]
xor al, cl
mov byte [ebp - 0x1f], ch
sub esp, 0x18
mov byte [ebp - 0x20], ah
mov edx, esp
mov byte [ebp - 0x1a], al
lea ecx, [ebp - 0x23]
mov byte [ebp - 0x19], 0
lea eax, [ecx + 1]
mov byte [ebp - 0x19], 0
mov dword [ebp - 0x14], eax
movups xmmword [edx], xmm0
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10083d25
sub ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x23]
push ecx
push eax
mov ecx, edx
call fcn.1000bcd0
mov byte [ebp - 4], 0
call fcn.1007a170
push 0x100c09ec
mov dword [0x100c0a0c], eax
mov dword [ebp - 4], 0xffffffff
call fcn.1008a0ac
add esp, 0x34
mov eax, dword [0x100c0a04]
cmp eax, dword [esi + 4]
jle 0x10083d97
push 0x100c0a04
call fcn.1008a0fd
add esp, 4
cmp dword [0x100c0a04], 0xffffffff
jne 0x10083d97
mov eax, dword [0x100c0a0c]
push 0x100c0a04
mov dword [0x100c09d0], eax
call fcn.1008a0ac
add esp, 4
push dword [ebp + 8]
mov eax, dword [0x100c09d0]
xor edx, edx
mov ecx, edi
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x10088920
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
mov ebx, ecx
mov eax, 0x1fffffff
bsr ecx, eax
push esi
mov esi, 1
mov dword [ebp - 0x14], ebx
mov eax, esi
shl eax, cl
mov ecx, dword [ebp + 8]
push edi
cmp ecx, eax
jbe 0x10088951
push str.invalid_hash_bucket_count
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
lea eax, [ecx - 1]
or eax, 1
bsr ecx, eax
mov eax, dword [ebx + 4]
push eax
mov dword [ebp - 8], eax
lea ecx, [ecx + 1]
shl esi, cl
lea ecx, [ebx + 0xc]
lea eax, [esi + esi]
push eax
call fcn.10088500
lea eax, [esi - 1]
mov dword [ebx + 0x1c], esi
mov dword [ebx + 0x18], eax
mov esi, dword [ebx + 4]
mov eax, dword [ebp - 8]
mov esi, dword [esi]
mov edi, esi
cmp esi, eax
je 0x10088a75
nop dword [eax]
cmp dword [esi + 0x1c], 0xf
lea ecx, [esi + 8]
mov edi, dword [edi]
mov edx, dword [ecx + 0x10]
mov dword [ebp - 0x10], edi
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], ecx
jbe 0x100889ac
mov edx, dword [ecx]
mov dword [ebp - 4], edx
xor edx, edx
mov ebx, 0x811c9dc5
cmp dword [ecx + 0x10], edx
jbe 0x100889d7
mov eax, dword [ebp - 4]
mov edi, dword [ebp - 0xc]
nop
movzx ecx, byte [eax + edx]
inc edx
xor ecx, ebx
imul ebx, ecx, 0x1000193
cmp edx, edi
jb 0x100889c0
mov edi, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0x18]
mov ecx, dword [ecx + 0xc]
and edx, ebx
lea ecx, [ecx + edx*8]
mov dword [ebp - 4], ecx
cmp dword [ecx], eax
jne 0x100889f3
mov dword [ecx], esi
mov dword [ecx + 4], esi
jmp 0x10088a6b
mov ebx, dword [ecx + 4]
lea ecx, [esi + 8]
lea edx, [ebx + 8]
call fcn.100267b0
test al, al
je 0x10088a2b
mov ebx, dword [ebx]
cmp ebx, esi
je 0x10088a23
mov edx, dword [esi + 4]
mov dword [edx], edi
mov ecx, dword [edi + 4]
mov dword [ecx], ebx
mov eax, dword [ebx + 4]
mov dword [eax], esi
mov dword [ebx + 4], ecx
mov dword [edi + 4], edx
mov dword [esi + 4], eax
mov eax, dword [ebp - 4]
mov dword [eax + 4], esi
jmp 0x10088a68
mov eax, dword [ebp - 4]
cmp dword [eax], ebx
je 0x10088a4b
mov ebx, dword [ebx + 4]
lea ecx, [esi + 8]
lea edx, [ebx + 8]
call fcn.100267b0
test al, al
jne 0x10088a7e
mov eax, dword [ebp - 4]
cmp dword [eax], ebx
jne 0x10088a32
mov edx, dword [esi + 4]
mov dword [edx], edi
mov ecx, dword [edi + 4]
mov dword [ecx], ebx
mov eax, dword [ebx + 4]
mov dword [eax], esi
mov dword [ebx + 4], ecx
mov dword [edi + 4], edx
mov dword [esi + 4], eax
mov eax, dword [ebp - 4]
mov dword [eax], esi
mov eax, dword [ebp - 8]
mov esi, edi
cmp edi, eax
jne 0x10088990
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edx, dword [esi + 4]
mov ebx, dword [ebx]
mov dword [edx], edi
mov ecx, dword [edi + 4]
mov dword [ecx], ebx
mov eax, dword [ebx + 4]
mov dword [eax], esi
mov dword [ebx + 4], ecx
mov dword [edi + 4], edx
mov dword [esi + 4], eax
jmp 0x10088a68
Function at 0x10089b85
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push 2
lea eax, [ebp - 4]
push eax
push 0x20000001
push str._x_sys_default_locale
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
xor ecx, ecx
test eax, eax
jne 0x10089bac
mov eax, ecx
mov dword [ebp - 4], eax
jmp 0x10089baf
mov eax, dword [ebp - 4]
push esi
mov esi, dword [ebp + 0xc]
push ecx
push ecx
push esi
push eax
push dword [ebp + 8]
push ecx
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push eax
push dword [esi]
call fcn.10089b61
pop esi
leave
ret 8
Function at 0x401996
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
test ebx, ebx
sete dl
cmp dword [ebp + 8], 0
sete al
mov ecx, 0
or dl, al
jne 0x401ada
lea ecx, [edi*4 + 0xb]
mov edx, 0x2aaaaaab
mov eax, ecx
imul edx
sar edx, 1
mov eax, ecx
sar eax, 0x1f
sub edx, eax
lea edx, [edx*4 + 1]
cmp edx, dword [ebp + 0x14]
jle 0x401a3d
mov dword [esp], 0x6f
call sub.KERNEL32.DLL_SetLastError
sub esp, 4
mov ecx, 0
jmp 0x401ada
movzx eax, byte [ecx]
and eax, 3
shl eax, 4
movzx eax, byte [eax + section.5819xrzi]
mov byte [ebx + 1], al
mov byte [ebx + 2], 0x3d
mov byte [ebx + 3], 0x3d
add ebx, 4
jmp 0x401ad2
movzx eax, byte [ecx + 1]
and eax, 0xf
movzx eax, byte [eax*4 + section.5819xrzi]
mov byte [ebx + 2], al
mov byte [ebx + 3], 0x3d
add ebx, 4
jmp 0x401ad2
mov esi, 0
mov ecx, dword [ebp + 8]
cmp esi, edi
jge 0x401ad2
movzx eax, byte [ecx]
shr al, 2
movzx eax, al
movzx eax, byte [eax + section.5819xrzi]
mov byte [ebx], al
mov eax, edi
sub eax, esi
cmp eax, 1
je 0x4019fc
movzx edx, byte [ecx]
and edx, 3
shl edx, 4
movzx eax, byte [ecx + 1]
shr al, 4
movzx eax, al
or edx, eax
movzx eax, byte [edx + section.5819xrzi]
mov byte [ebx + 1], al
mov eax, edi
sub eax, esi
cmp eax, 2
je 0x401a1f
movzx edx, byte [ecx + 1]
and edx, 0xf
shl edx, 2
movzx eax, byte [ecx + 2]
shr al, 6
movzx eax, al
or edx, eax
movzx eax, byte [edx + section.5819xrzi]
mov byte [ebx + 2], al
movzx eax, byte [ecx + 2]
and eax, 0x3f
movzx eax, byte [eax + section.5819xrzi]
mov byte [ebx + 3], al
add esi, 3
add ecx, 3
add ebx, 4
cmp esi, edi
jl 0x401a4d
mov byte [ebx], 0
mov ecx, 1
mov eax, ecx
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x401b7e
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov ebx, 0
mov dword [esp], 0
call sub.msvcrt.dll_malloc
mov esi, eax
mov dword [esp + 4], 0x40e000
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_fopen
mov edi, eax
mov eax, 0
test edi, edi
je 0x401c23
jmp 0x401bc1
mov eax, 0
jmp 0x401c23
test byte [edi + 0xc], 0x10
jne 0x401c00
inc ebx
mov dword [esp + 4], ebx
mov dword [esp], esi
call sub.msvcrt.dll_realloc
mov esi, eax
test eax, eax
je 0x401bba
mov dword [esp + 0xc], edi
mov dword [esp + 8], 1
mov dword [esp + 4], 1
lea eax, [eax + ebx - 1]
mov dword [esp], eax
call sub.msvcrt.dll_fread
test byte [edi + 0xc], 0x10
je 0x401bc7
lea eax, [ebx - 1]
mov dword [esp + 4], eax
mov dword [esp], esi
call fcn.00401b44
mov ebx, eax
mov dword [esp], esi
call sub.msvcrt.dll_free
mov dword [esp], edi
call sub.msvcrt.dll_fclose
mov eax, ebx
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x408886
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [esp + 0x10]
test edi, edi
jle 0x4088c3
cmp edi, dword [esi + 0xc]
jge 0x4088c3
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4088c3
cmp edi, dword [eax + 8]
jge 0x4088c3
mov eax, dword [eax + 0xc]
mov edi, dword [eax + edi*4]
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, edi
jmp 0x4088cc
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
pop edi
pop esi
pop ebx
ret 4

Function at 0x408b0a
Capabilities:
Allocate thread local storage

Disassembly:
xor eax, eax
push esi
mov esi, ecx
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], 4
mov dword [esi + 4], eax
mov dword [esi + 8], 1
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [esi], eax
jne 0x408b39
jmp fcn.004045c2
lea eax, [esi + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov eax, esi
pop esi
ret

Function at 0x408d8b
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x408db9
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x408dd7
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00408cf5
jmp 0x408dd7
mov eax, dword [esi + 0x14]
test eax, eax
je 0x408dd7
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
push eax
mov ecx, esi
call fcn.00408cf5
test edi, edi
mov eax, edi
jne 0x408dc1
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
mov ecx, dword [0x446aac]
test ecx, ecx
je 0x408e9a
jmp 0x408d8a
ret 8

Function at 0x41f76e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x445504]
jne 0x41f778
repz ret
jmp fcn.0042865c
Function at 0x1000f743
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x1000f782
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1000f782
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1000f782
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x1000f782
cmp dword [ecx + 0x74], 0xe
jbe 0x1000f782
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x100123ff
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1001249c
push ebx
push esi
call fcn.100123c8
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1001235c
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x10012449
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1001249b
push edi
push eax
call fcn.100133ba
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x10012469
call fcn.10010ea4
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1001249a
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1001235c
add esp, 0x20
test eax, eax
jne 0x10012488
push edi
call fcn.10010ea4
jmp 0x10012490
push ebx
call fcn.10010ea4
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x10012709
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1001a888
push 0x1001a880
push str.FlsAlloc
push 0x1f
call fcn.10012625
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1001273d
push dword [ebp + 8]
mov ecx, esi
call dword [0x10019150]
call esi
jmp 0x10012743
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x10012787
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1001a898
push 0x1001a890
push str.FlsGetValue
push 0x21
call fcn.10012625
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100127be
push dword [ebp + 8]
mov ecx, esi
call dword [0x10019150]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x100127c6
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1001a8a0
push 0x1001a898
push str.FlsSetValue
push 0x22
call fcn.10012625
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10012800
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x10019150]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x100136e5
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x10013724
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10013724
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10013724
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x10013724
cmp dword [ecx + 0x74], 0xe
jbe 0x10013724
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x1001643a
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x100164d7
push ebx
push esi
call fcn.10016403
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.10016397
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x10016484
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100164d6
push edi
push eax
call fcn.100173f6
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x100164a4
call fcn.10014f61
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100164d5
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.10016397
add esp, 0x20
test eax, eax
jne 0x100164c3
push edi
call fcn.10014f61
jmp 0x100164cb
push ebx
call fcn.10014f61
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x10016744
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1001f348
push 0x1001f340
push str.FlsAlloc
push 0x1f
call fcn.10016660
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10016778
push dword [ebp + 8]
mov ecx, esi
call dword [0x1001d150]
call esi
jmp 0x1001677e
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x100167c2
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1001f358
push 0x1001f350
push str.FlsGetValue
push 0x21
call fcn.10016660
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100167f9
push dword [ebp + 8]
mov ecx, esi
call dword [0x1001d150]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x10016801
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1001f360
push 0x1001f358
push str.FlsSetValue
push 0x22
call fcn.10016660
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1001683b
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x1001d150]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x1001bd60
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1001bd8d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1001bd8d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret