joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43fb10
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44b8a0
mov eax, dword fs:[0]
push eax
sub esp, 0x104
mov eax, dword [0x462304]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2c], ecx
mov ecx, dword [ebp - 0x2c]
add ecx, 0x98
call fcn.0043a380
test eax, eax
jne 0x43fb57
xor eax, eax
jmp 0x43fc9c
lea ecx, [ebp - 0x30]
call fcn.00408ca0
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x2c]
add ecx, 0x94
call fcn.0040bad0
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x40]
call fcn.00441a20
mov ecx, dword [ebp - 0x2c]
add ecx, 0x98
call fcn.0040bad0
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x34]
mov edx, dword [ecx]
mov eax, dword [edx]
mov dword [ebp - 0x48], eax
lea ecx, [ebp - 0x30]
call fcn.004317c0
mov dword [ebp - 0x44], eax
mov ecx, dword [ebp - 0x44]
push ecx
push 0x458ad8
mov edx, dword [ebp - 0x34]
push edx
call dword [ebp - 0x48]
mov dword [ebp - 0x60], eax
push 0x455770
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [ebp - 0x3c], eax
lea ecx, [ebp - 0x30]
call fcn.0040bad0
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x2c]
mov dword [ebp - 0x4c], edx
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0x3c]
push eax
mov ecx, dword [ebp - 0x38]
push ecx
call dword [ebp - 0x4c]
mov edx, dword [ebp - 0x3c]
push edx
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
push 1
lea ecx, [ebp - 0x110]
call fcn.0040a000
mov byte [ebp - 4], 1
lea eax, [ebp - 0x100]
mov dword [ebp - 0x50], eax
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ecx + 0x90]
cdq
push edx
push eax
mov ecx, dword [ebp - 0x50]
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_long_unsigned___int64__]
lea edx, [ebp - 0x28]
push edx
lea ecx, [ebp - 0x110]
call fcn.0041bb90
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x58], eax
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x58]
push ecx
push 0xb
mov ecx, dword [ebp - 0x2c]
call fcn.00440e50
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x28]
call fcn.0040ae50
push 5
mov edx, dword [ebp - 0x2c]
mov eax, dword [edx + 0x90]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov dword [ebp - 0x5c], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x110]
call fcn.0040e550
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.0040af90
mov eax, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00446150
mov esp, ebp
pop ebp
ret 4
Function at 0x4424d0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44bdb5
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x462304]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2c], ecx
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x8000
je 0x442514
mov ecx, dword [ebp + 8]
cmp dword [ecx + 8], 0x4f
je 0x442530
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
movsx edx, ax
and edx, 0x8000
je 0x442537
mov eax, dword [ebp + 8]
cmp dword [eax + 8], 0x4e
jne 0x442537
xor eax, eax
jmp 0x4426c4
mov ecx, dword [ebp + 8]
cmp dword [ecx + 4], 0x100
jne case.0x442562.1
mov edx, dword [ebp + 8]
mov eax, dword [edx + 8]
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x34]
sub ecx, 0x70
mov dword [ebp - 0x34], ecx
cmp dword [ebp - 0x34], 0xb
ja case.0x442562.1
mov edx, dword [ebp - 0x34]
jmp dword [edx*4 + 0x4426e0]
mov ecx, dword [ebp - 0x2c]
add ecx, 0x94
call fcn.0040bad0
mov ecx, eax
call fcn.0043fad0
movzx eax, al
test eax, eax
jne case.0x442562.0
mov ecx, dword [ebp - 0x2c]
call fcn.004416d0
mov eax, 1
jmp 0x4426c4
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x28]
push edx
call fcn.00436160
add esp, 8
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x48]
push ecx
push 0xc
mov ecx, dword [ebp - 0x2c]
call fcn.00440d80
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.0040ae30
mov eax, 1
jmp 0x4426c4
mov ecx, dword [ebp - 0x2c]
add ecx, 0x98
call fcn.0043a380
test eax, eax
jne 0x4425f7
xor eax, eax
jmp 0x4426c4
lea ecx, [ebp - 0x30]
call fcn.00408ca0
mov dword [ebp - 4], 1
mov ecx, dword [ebp - 0x2c]
add ecx, 0x98
call fcn.0040bad0
mov dword [ebp - 0x3c], eax
mov edx, dword [ebp - 0x3c]
mov eax, dword [edx]
mov ecx, dword [eax]
mov dword [ebp - 0x50], ecx
lea ecx, [ebp - 0x30]
call fcn.004317c0
mov dword [ebp - 0x4c], eax
mov edx, dword [ebp - 0x4c]
push edx
push 0x4589f8
mov eax, dword [ebp - 0x3c]
push eax
call dword [ebp - 0x50]
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
jge 0x442660
mov dword [ebp - 0x54], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.0040af90
mov eax, dword [ebp - 0x54]
jmp 0x4426c4
lea ecx, [ebp - 0x30]
call fcn.0040bad0
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x40]
mov edx, dword [ecx]
mov eax, dword [edx + 0x14]
mov dword [ebp - 0x58], eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x40]
push edx
call dword [ebp - 0x58]
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
jl 0x442690
cmp dword [ebp - 0x38], 1
jne 0x4426ab
mov dword [ebp - 0x5c], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.0040af90
mov eax, dword [ebp - 0x5c]
jmp 0x4426c4
mov dword [ebp - 0x60], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.0040af90
mov eax, dword [ebp - 0x60]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00446150
mov esp, ebp
pop ebp
ret 4
Function at 0x442970
Capabilities:
Create thread
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44bdfd
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
mov eax, dword [0x462304]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
call dword [sym.imp.ole32.dll_OleInitialize]
push 0
push 0
mov eax, dword [ebp + 0xc]
push eax
push 0x432610
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x64], eax
push 0x4558b0
lea ecx, [ebp - 0x28]
call fcn.00409b90
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
push ecx
mov edx, dword [ebp + 8]
push edx
push 0x43d8f0
call fcn.00435c60
add esp, 0xc
mov word [ebp - 0x68], ax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.0040ae50
push str.Creating_root_window
lea ecx, [ebp - 0x40]
call fcn.004098b0
mov dword [ebp - 4], 1
lea eax, [ebp - 0x40]
push eax
call fcn.004343f0
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.0040ae30
lea ecx, [ebp - 0x60]
push ecx
call fcn.00432cf0
add esp, 4
mov byte [ebp - 0x59], al
movzx edx, byte [ebp - 0x59]
test edx, edx
jne 0x442a3e
jmp 0x442aa3
push str.Running_IE
lea ecx, [ebp - 0x58]
call fcn.004098b0
mov dword [ebp - 4], 2
lea eax, [ebp - 0x58]
push eax
call fcn.004343f0
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x58]
call fcn.0040ae30
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x60]
push edx
call fcn.0043d990
add esp, 8
mov eax, dword [ebp - 0x60]
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
mov ecx, dword [ebp - 0x64]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov edx, dword [ebp - 0x64]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.ole32.dll_OleUninitialize]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00446150
mov esp, ebp
pop ebp
ret

Function at 0x442ed0
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
mov eax, 4
imul ecx, eax, 0
mov edx, dword [ebp + 8]
mov dword [edx + ecx + 8], 0x67452301
mov eax, 4
shl eax, 0
mov ecx, dword [ebp + 8]
mov dword [ecx + eax + 8], 0xefcdab89
mov edx, 4
shl edx, 1
mov eax, dword [ebp + 8]
mov dword [eax + edx + 8], 0x98badcfe
mov ecx, 4
imul edx, ecx, 3
mov eax, dword [ebp + 8]
mov dword [eax + edx + 8], 0x10325476
mov ecx, 4
shl ecx, 2
mov edx, dword [ebp + 8]
mov dword [edx + ecx + 8], 0xc3d2e1f0
mov eax, dword [ebp + 8]
mov dword [eax + 0x1c], 0
mov ecx, dword [ebp + 8]
xor edx, edx
xor eax, eax
mov dword [ecx], edx
mov dword [ecx + 4], eax
xor eax, eax
pop ebp
ret
Function at 0xeee744
Capabilities:
Encode data using xor

Disassembly:
jmp 0xeee74e
pushal
call 0xeee754
pop ebp
sub ebp, 0x10
sub ebp, 0xaee744
jmp 0xeee76a
mov eax, 0xaee744
add eax, ebp
add eax, 0x4c
mov ecx, 0x5e1
mov edx, 0x194e56
xor byte [eax], dl
inc eax
dec ecx
jne 0xeee781
jmp 0xeee794
fstp qword [ebx + 0x566adfdd]
push esi
push esi
xlatb
xchg edi, eax
scasb al, byte es:[edi]
push esi
push esi
push esi
push ebp
wait
out dx, al
push eax
push esi
push esi
push esi
in al, dx
jle 0xeee802
push esi
push esi
mov eax, dword [0xdd9e55b4]
xlatb
pop edx
push esi
push esi
push esi
push ebp
xchg ebx, eax
invalid
push edx
pop ds
pop ecx
shl dword [edx + 0xba9a9a9], cl
xchg esp, eax
pop edx
push esi
fstp st(2)
jb 0xeee864
push esi
push esi
push esi
mov byte ds:[edi], 0x77
push esi
in eax, 0xc3
fist dword [esi + 0x57]
jp 0xeee894
invalid
push cs
adc eax, 0xd584658a
mov esi, 0xd2591e53
sbb byte [esi + 0x56], dl
push esi
pop ecx
ficomp word [esi]
push esi
push esi
push esi
xor ch, bl
dec edx
outsd dx, dword [esi]
salc
lodsd eax, dword [esi]
mov esi, 0x564cd259
push esi
push esi
salc
lodsd eax, dword [esi]
mov edi, 0x5647d259
push esi
push esi
xor bh, dl
lodsd eax, dword [esi]
test eax, 0x43d25973
push esi
pop ecx
rol byte [ebx + 0x56], cl
push esi
push esi
pop ss
mov edi, 0xa9a9a99a
jg 0xeee8bc
outsd dx, dword [esi]
push edi
aad 0x97
push ebx
aad 0xbe
push edx
mov edi, 0xa9a9a9eb
jg 0xeee8b3
outsd dx, dword [esi]
push esp
aad 0x97
push eax
aad 0xbc
push edx
aad 0xbe
push ebx
mov edi, 0xa9a9a9fd
fnstsw word [edx + 0x72]
invalid
Function at 0x100062d0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
mov eax, dword [0x100701f0]
xor eax, esp
mov dword [esp + 0x18], eax
cmp dword [0x10072d54], 0
push esi
je 0x10006300
xor al, al
pop esi
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.10042bf9
mov esp, ebp
pop ebp
ret
push 0x18
call fcn.1004240d
add esp, 4
test eax, eax
je 0x1000631e
push 0
mov ecx, eax
call fcn.10006230
mov dword [0x10072d54], eax
jmp 0x10006328
mov dword [0x10072d54], 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edx, eax
mov dword [esp + 0x18], 7
xor eax, eax
mov dword [esp + 0x14], 0
mov word [esp + 4], ax
cmp word [edx], ax
jne 0x10006350
xor ecx, ecx
jmp 0x10006364
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10006355
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [esp + 0xc]
call fcn.10007bc0
mov ecx, dword [0x10072d54]
lea eax, [esp + 4]
push eax
call fcn.10006cf0
cmp dword [esp + 0x18], 8
jb 0x10006392
push dword [esp + 4]
call fcn.1004245e
add esp, 4
mov ecx, dword [esp + 0x1c]
mov al, 1
pop esi
xor ecx, esp
call fcn.10042bf9
mov esp, ebp
pop ebp
ret

Function at 0x10006cf0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x100701f0]
xor eax, esp
mov dword [esp + 0x34], eax
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push edi
mov edi, ecx
mov dword [esp + 8], 0
mov ecx, str._t_n_v_f_r
mov dword [esp + 0x20], 7
mov dword [esp + 0x1c], 0
mov word [esp + 0xc], ax
mov dword [esp + 0x38], 7
mov dword [esp + 0x34], eax
lea edx, [ecx + 2]
mov word [esp + 0x24], ax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10006d43
sub ecx, edx
sar ecx, 1
push ecx
push str._t_n_v_f_r
lea ecx, [esp + 0x2c]
call fcn.10007bc0
lea eax, [esp + 0xc]
mov ecx, esi
push eax
push 3
lea edx, [esp + 0x2c]
call fcn.10010d30
add esp, 8
cmp dword [esp + 0x38], 8
jb 0x10006d89
push dword [esp + 0x24]
call fcn.1004245e
add esp, 4
cmp dword [esp + 0x1c], 0
je 0x10006dc7
cmp dword [esp + 0x20], 8
lea ecx, [esp + 8]
lea eax, [esp + 0xc]
mov dword [esp + 8], 0
cmovae eax, dword [esp + 0xc]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov esi, eax
mov ecx, edi
push esi
push dword [esp + 0xc]
call fcn.100063d0
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [esp + 0x20], 8
jb 0x10006dda
push dword [esp + 0xc]
call fcn.1004245e
add esp, 4
mov ecx, dword [esp + 0x3c]
pop edi
pop esi
xor ecx, esp
call fcn.10042bf9
mov esp, ebp
pop ebp
ret 4
Function at 0x1000e6b0
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
mov eax, dword [0x10072d9c]
mov dword [esp], 0
push esi
test eax, 0xfffffffe
jne 0x1000e72c
mov ecx, 1
mov edx, 0x10072d9c
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
je 0x1000e708
mov eax, dword [0x10072d9c]
cmp eax, 1
jne 0x1000e72c
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
nop
push 0
call esi
mov eax, dword [0x10072d9c]
cmp eax, 1
je 0x1000e6f0
mov eax, dword [0x10072d9c]
pop esi
mov esp, ebp
pop ebp
ret
mov dword [0x10072da0], 0
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x10072da0], eax
cmp eax, 0xffffffff
je 0x1000e736
mov dword [0x10072d9c], 0x10072da0
mov eax, dword [0x10072d9c]
pop esi
mov esp, ebp
pop ebp
ret
call fcn.10008f00
int3

Function at 0x10010750
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
mov eax, dword [0x10072e08]
mov dword [esp], 0
push esi
test eax, 0xfffffffe
jne 0x100107dc
mov ecx, 1
mov esi, 0x10072e08
xor eax, eax
lock cmpxchg dword [esi], ecx
test eax, eax
je 0x100107a8
mov eax, dword [0x10072e08]
cmp eax, 1
jne 0x100107dc
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
nop
push 0
call esi
mov eax, dword [0x10072e08]
cmp eax, 1
je 0x10010790
mov eax, dword [0x10072e08]
pop esi
mov esp, ebp
pop ebp
ret
mov dword [0x10072e0c], 0
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x10072e0c], eax
cmp eax, 0xffffffff
je 0x100107e6
mov ecx, 0x100107f0
mov dword [0x10072e08], 0x10072e0c
test ecx, ecx
je 0x100107dc
mov edx, esi
call fcn.100056d0
mov eax, dword [0x10072e08]
pop esi
mov esp, ebp
pop ebp
ret
call fcn.10008f00
int3

Function at 0x10012900
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10
lea eax, [esp + 8]
mov dword [esp + 0xc], 0
push eax
lea eax, [esp + 0x10]
mov dword [esp + 8], 4
push eax
lea eax, [esp + 0xc]
mov dword [esp + 0x10], 4
push eax
push 0
push dword [ebp + 8]
mov dword [esp + 0x20], 0
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, eax
test edx, edx
jne 0x10012976
mov ecx, dword [esp + 4]
cmp ecx, 4
je 0x10012959
cmp ecx, 3
jne 0x10012971
cmp dword [esp + 8], 4
jne 0x10012971
mov ecx, dword [ebp + 0xc]
mov eax, dword [esp + 0xc]
mov dword [ecx], eax
mov eax, edx
mov esp, ebp
pop ebp
ret 8
mov eax, 0x3f4
mov esp, ebp
pop ebp
ret 8
Function at 0x10013310
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov ebx, ecx
mov dword [ebp - 8], 0
mov esi, edx
mov dword [ebp - 4], esi
push edi
test ebx, ebx
je 0x10013383
cmp dword [0x10073f30], 0
jne 0x10013370
push 0x44
call fcn.1004240d
add esp, 4
test eax, eax
je 0x1001334d
mov ecx, eax
call fcn.10001b70
mov esi, eax
jmp 0x1001334f
xor esi, esi
push 0
push esi
push 0x10073f30
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
je 0x1001336d
test esi, esi
je 0x1001336d
push ecx
mov ecx, esi
call fcn.10001b30
mov esi, dword [ebp - 4]
mov eax, dword [0x10073f30]
cmp dword [eax], 1
jl 0x10013383
mov dword [ebp - 8], 0x10000
jmp 0x10013385
xor ebx, ebx
push 8
call fcn.1004240d
add esp, 4
mov edi, eax
push 0
push dword [ebp - 8]
mov dword [edi], esi
mov esi, dword [ebp + 8]
test esi, esi
push edi
push 0x10013230
push ebx
setne cl
push 0
mov byte [edi + 4], cl
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x100133c8
push edi
call fcn.1004245e
add esp, 4
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x100133de
mov dword [esi], eax
mov al, 1
mov dword [esi + 4], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100154a0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 8
mov dword [esp + 4], 0
call fcn.100154e0
push dword [eax]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [eax]
mov eax, dword [ebp + 8]
mov dword [eax], ecx
test ecx, ecx
je 0x100154d5
mov edx, 1
add ecx, 4
lock xadd dword [ecx], edx
mov esp, ebp
pop ebp
ret

Function at 0x100154e0
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
mov eax, dword [0x10072e40]
mov dword [esp], 0
push esi
test eax, 0xfffffffe
jne 0x1001556c
mov ecx, 1
mov esi, 0x10072e40
xor eax, eax
lock cmpxchg dword [esi], ecx
test eax, eax
je 0x10015538
mov eax, dword [0x10072e40]
cmp eax, 1
jne 0x1001556c
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
nop
push 0
call esi
mov eax, dword [0x10072e40]
cmp eax, 1
je 0x10015520
mov eax, dword [0x10072e40]
pop esi
mov esp, ebp
pop ebp
ret
mov dword [0x10072e44], 0
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x10072e44], eax
cmp eax, 0xffffffff
je 0x10015576
mov ecx, 0x100107f0
mov dword [0x10072e40], 0x10072e44
test ecx, ecx
je 0x1001556c
mov edx, esi
call fcn.100056d0
mov eax, dword [0x10072e40]
pop esi
mov esp, ebp
pop ebp
ret
call fcn.10008f00
int3
Function at 0x10015b50
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xb4
push ebx
push edx
xor ebx, ebx
push ecx
mov dword [esp + 0xc], ebx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x10015be2
cmp dword [0x10072d60], 3
jg 0x10015bd4
lea ebx, [eax + 1]
mov dword [esp + 8], 3
push ebx
push 2
lea ecx, [esp + 0x18]
call fcn.10003df0
mov dword [esp + 0xac], str.b:core_src_base_threading_thread_local_win.cc
mov dword [esp + 0xb0], 0x23
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x23
push str.b:core_src_base_threading_thread_local_win.cc
lea ecx, [esp + 0x10]
mov dword [esp + 0xbc], eax
call fcn.10009a80
lea eax, [esp + 0x10]
push str.Failed_to_TlsSetValue__.
push eax
call fcn.100038f0
add esp, 8
test bl, 1
je 0x10015be2
lea ecx, [esp + 8]
call fcn.10009810
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10017570
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x20
push ebx
push edi
mov edi, ecx
mov dword [esp + 8], 0
call fcn.1000e6b0
push dword [eax]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push 1
cmp byte [eax + 0x65], 0
lea eax, [esp + 0x10]
je 0x100175d3
push 0xf
push 0xf
push 0
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
jne 0x100175cf
push 1
push 0x113
push 0x113
push eax
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
jne 0x100175cf
xor bl, bl
jmp 0x100175e5
mov bl, 1
jmp 0x100175e5
push 0
push 0
push 0
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
setne bl
push 0
lea eax, [edi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
test bl, bl
jne 0x100175fd
xor al, al
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0xc]
lea eax, [esp + 0xc]
mov ecx, edi
push eax
call fcn.10017430
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1001afe0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 8
jb 0x1001afee
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne al
pop ebp
ret
Function at 0x1001b000
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x100701f0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x218]
mov esi, ecx
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
dec eax
cmp eax, 0x102
ja 0x1001b15d
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x260]
call fcn.10006e50
xor eax, eax
mov dword [ebp - 0x21c], 7
push 0xffffffffffffffff
push eax
mov word [ebp - 0x230], ax
lea ecx, [ebp - 0x230]
lea eax, [ebp - 0x260]
mov dword [ebp - 0x220], 0
push eax
call fcn.100073e0
push 1
push 0
lea eax, [ebp - 0x264]
mov dword [ebp - 0x264], 0
push eax
lea ecx, [ebp - 0x230]
call fcn.10007500
cmp eax, 0xffffffff
je 0x1001b0ab
push 0xffffffffffffffff
push eax
lea ecx, [ebp - 0x230]
call fcn.10007d90
lea eax, [ebp - 0x248]
push eax
lea ecx, [ebp - 0x230]
call fcn.1000c0c0
cmp esi, eax
je 0x1001b0cd
push 0xffffffffffffffff
push 0
push eax
mov ecx, esi
call fcn.100073e0
cmp dword [ebp - 0x234], 8
jb 0x1001b0e4
push dword [ebp - 0x248]
call fcn.1004245e
add esp, 4
xor eax, eax
mov dword [ebp - 0x234], 7
cmp dword [ebp - 0x21c], 8
mov dword [ebp - 0x238], 0
mov word [ebp - 0x248], ax
jb 0x1001b118
push dword [ebp - 0x230]
call fcn.1004245e
add esp, 4
xor eax, eax
mov dword [ebp - 0x21c], 7
cmp dword [ebp - 0x24c], 8
mov dword [ebp - 0x220], 0
mov word [ebp - 0x230], ax
jb 0x1001b14c
push dword [ebp - 0x260]
call fcn.1004245e
add esp, 4
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10042bf9
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
xor ecx, ebp
pop esi
call fcn.10042bf9
mov esp, ebp
pop ebp
ret