joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100cea20
Capabilities:
Decrypt data via sspi

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x3c
mov esi, ecx
mov edi, edx
mov ecx, dword [edx + 0xf8]
mov edx, dword [edx + 0x108]
cmp edx, ecx
jb 0x100ceca1
mov eax, dword [edi + 0x100]
mov dword [esp], ecx
mov dword [esp + 4], 1
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 4
lea ecx, [esp + 0x30]
mov dword [esp + 8], eax
mov eax, esp
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x38], eax
lea eax, [edi + 0x12c]
push 0
push 0
push ecx
push eax
call sub.Secur32.dll_DecryptMessage
cmp eax, 0x90316
jg 0x100cebcd
cmp eax, 0x80090318
je 0x100cec77
test eax, eax
jne 0x100cec68
mov ecx, dword [esp + 0x14]
mov ebp, dword [edi + 0x100]
mov ebx, dword [esp + 0xc]
mov edx, dword [edi + 0x108]
mov dword [edi + 0xf0], 0
sub ecx, ebp
mov eax, ecx
add eax, ebx
jb 0x100cecd0
cmp edx, eax
jb 0x100cece1
lea eax, [edi + 0xe8]
add ebp, ecx
mov edx, ebx
mov ecx, eax
call fcn.10116c80
mov eax, dword [edi + 0xe8]
add eax, dword [edi + 0xf0]
push ebx
push ebp
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
add dword [edi + 0xf0], ebx
mov dword [edi + 0xe4], 0
mov dword [edi + 0xe0], 0
xor ebx, ebx
cmp dword [esp + 0x28], 5
mov ecx, dword [edi + 0xf8]
jne 0x100ceb6c
mov ebx, dword [esp + 0x24]
sub ecx, ebx
jb 0x100cecb0
test ebx, ebx
je 0x100cebb1
mov edx, dword [edi + 0x108]
mov ebp, edx
sub ebp, ecx
jb 0x100cecc9
mov dword [edi + 0x108], 0
je 0x100cebb1
test ecx, ecx
je 0x100cebab
mov eax, dword [edi + 0x100]
add ecx, eax
push ebp
push ecx
push eax
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
mov dword [edi + 0x108], ebp
xor eax, eax
test ebx, ebx
mov dword [edi + 0xf8], ebx
mov dword [edi + 0xfc], 0
sete al
jmp 0x100cec87
cmp eax, 0x90317
je 0x100cec94
cmp eax, 0x90321
jne 0x100cec68
mov dword [edi + 0x150], 0x10000
mov byte [edi + 0x154], 0
xor ebx, ebx
cmp dword [esp + 0x28], 5
mov ecx, dword [edi + 0xf8]
jne 0x100cec07
mov ebx, dword [esp + 0x24]
sub ecx, ebx
jb 0x100cecb0
test ebx, ebx
je 0x100cec4c
mov edx, dword [edi + 0x108]
mov ebp, edx
sub ebp, ecx
jb 0x100cecc9
mov dword [edi + 0x108], 0
je 0x100cec4c
test ecx, ecx
je 0x100cec46
mov eax, dword [edi + 0x100]
add ecx, eax
push ebp
push ecx
push eax
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
mov dword [edi + 0x108], ebp
mov dword [edi + 0xf8], ebx
mov dword [edi + 0xfc], 0
mov dword [edi + 0x168], 0
jmp 0x100cec8d
mov dword [esi + 8], eax
mov dword [esi + 4], 0
mov byte [esi], 1
jmp 0x100cec99
cmp dword [esp + 0x10], 4
mov eax, 1
jne 0x100cec87
mov eax, dword [esp + 0xc]
mov dword [edi + 0x168], eax
mov word [esi], 0
jmp 0x100cec99
mov word [esi], 0x100
add esp, 0x3c
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x1044ae54
call fcn.100088f0
add esp, 4
ud2
mov ecx, str.assertion_failed:_size___nread
mov edx, 0x1f
push 0x1044ae94
call fcn.1004d560
add esp, 4
ud2
push 0x1044aea4
jmp 0x100ceca6
mov edx, eax
push 0x1044ae64
call fcn.10009cc0
add esp, 4
ud2
mov ecx, eax
push 0x1044ae64
jmp 0x100ceca6
Function at 0x100d4db0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edi
push esi
movzx eax, byte [ecx + 0x3c]
mov esi, ecx
cmp eax, 4
je 0x100d4dcb
cmp eax, 3
je 0x100d4de2
test eax, eax
jne 0x100d4e28
push dword [esi + 0x18]
jmp 0x100d4ddb
movzx eax, byte [esi + 0x74]
cmp eax, 3
je 0x100d4df9
test eax, eax
jne 0x100d4e28
push dword [esi + 0x40]
call sub.WS2_32.dll_closesocket
jmp 0x100d4e28
movzx eax, byte [esi + 0x74]
cmp eax, 3
je 0x100d4e05
test eax, eax
jne 0x100d4e0d
push dword [esi + 0x40]
call sub.WS2_32.dll_closesocket
jmp 0x100d4e0d
add esi, 0x48
mov ecx, esi
pop esi
pop edi
jmp fcn.100c8bb0
lea ecx, [esi + 0x48]
call fcn.100c8bb0
lea edi, [esi + 0x78]
mov ecx, edi
call fcn.10109090
mov eax, dword [esi + 0x78]
lock dec dword [eax]
jne 0x100d4e28
mov ecx, edi
pop esi
pop edi
jmp fcn.1006dd70
pop esi
pop edi
ret
Function at 0x100f24c0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebx
push edi
push esi
mov eax, dword [esp + 0x14]
cmp eax, 3
je 0x100f24d4
test eax, eax
jne 0x100f25ee
mov edi, dword [0x104dec5c]
test edi, edi
je 0x100f25ee
xor ebx, ebx
jmp 0x100f24f7
mov edi, dword [edi + 8]
test edi, edi
je 0x100f2519
push dword [edi + 4]
call sub.KERNEL32.dll_TlsGetValue
test eax, eax
je 0x100f24f0
mov esi, eax
push 0
push dword [edi + 4]
call sub.KERNEL32.dll_TlsSetValue
push esi
call dword [edi]
add esp, 4
mov bl, 1
jmp 0x100f24f0
test bl, 1
je 0x100f25ee
mov edi, dword [0x104dec5c]
test edi, edi
je 0x100f25ee
xor ebx, ebx
jmp 0x100f2547
mov edi, dword [edi + 8]
test edi, edi
je 0x100f2569
push dword [edi + 4]
call sub.KERNEL32.dll_TlsGetValue
test eax, eax
je 0x100f2540
mov esi, eax
push 0
push dword [edi + 4]
call sub.KERNEL32.dll_TlsSetValue
push esi
call dword [edi]
add esp, 4
mov bl, 1
jmp 0x100f2540
test bl, 1
je 0x100f25ee
mov edi, dword [0x104dec5c]
test edi, edi
je 0x100f25ee
xor ebx, ebx
jmp 0x100f2587
mov edi, dword [edi + 8]
test edi, edi
je 0x100f25a9
push dword [edi + 4]
call sub.KERNEL32.dll_TlsGetValue
test eax, eax
je 0x100f2580
mov esi, eax
push 0
push dword [edi + 4]
call sub.KERNEL32.dll_TlsSetValue
push esi
call dword [edi]
add esp, 4
mov bl, 1
jmp 0x100f2580
test bl, 1
je 0x100f25ee
mov edi, dword [0x104dec5c]
test edi, edi
je 0x100f25ee
xor ebx, ebx
jmp 0x100f25c7
mov edi, dword [edi + 8]
test edi, edi
je 0x100f25e9
push dword [edi + 4]
call sub.KERNEL32.dll_TlsGetValue
test eax, eax
je 0x100f25c0
mov esi, eax
push 0
push dword [edi + 4]
call sub.KERNEL32.dll_TlsSetValue
push esi
call dword [edi]
add esp, 4
mov bl, 1
jmp 0x100f25c0
test bl, 1
jne 0x100f25f9
mov al, byte [0x10464d40]
pop esi
pop edi
pop ebx
ret 0xc
mov edi, dword [0x104dec5c]
jmp 0x100f2604
mov edi, dword [edi + 8]
test edi, edi
je 0x100f25ee
push dword [edi + 4]
call sub.KERNEL32.dll_TlsGetValue
test eax, eax
je 0x100f2601
mov esi, eax
push 0
push dword [edi + 4]
call sub.KERNEL32.dll_TlsSetValue
push esi
call dword [edi]
add esp, 4
jmp 0x100f2601
Function at 0x100f2650
Capabilities:
Allocate thread local storage

Disassembly:
push ebx
push edi
push esi
sub esp, 0x18
mov edi, ecx
mov ecx, 0x104decbc
call fcn.100f4810
mov esi, dword [edi]
test esi, esi
jne 0x100f26c9
mov ebx, dword [edi + 4]
call sub.KERNEL32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x100f2746
mov esi, eax
test ebx, ebx
je 0x100f26bd
call sub.KERNEL32.dll_GetProcessHeap
push 0xc
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x100f278f
mov dword [eax], ebx
mov dword [eax + 4], esi
mov dword [eax + 8], 0
mov ecx, eax
mov eax, dword [0x104dec5c]
nop dword [eax]
mov dword [ecx + 8], eax
lock cmpxchg dword [0x104dec5c], ecx
jne 0x100f26b0
mov eax, esi
test esi, esi
xchg dword [edi], eax
je 0x100f275f
mov eax, dword [0x104dec60]
test eax, eax
je 0x100f26ea
cmp eax, 0x100f30b0
jne 0x100f270f
mov eax, dword [0x104decbc]
mov byte [eax + 0x18], 0
push eax
call sub.KERNEL32.dll_LeaveCriticalSection
jmp 0x100f273d
mov ecx, 0x10421629
mov edx, 0x17
call fcn.100f2ce0
test eax, eax
mov eax, 0x100f30b0
cmovne eax, edx
mov dword [0x104dec60], eax
cmp eax, 0x100f30b0
je 0x100f26d9
mov eax, dword [0x104dec78]
test eax, eax
jne 0x100f2736
mov ecx, 0x10421918
mov edx, 0x17
call fcn.100f2ce0
test eax, eax
mov eax, 0x100f4ef0
cmovne eax, edx
mov dword [0x104dec78], eax
push 0x104decbc
call eax
mov eax, esi
add esp, 0x18
pop esi
pop edi
pop ebx
ret
mov ecx, 0x104224e5
mov edx, 0x2e
push 0x10422514
call fcn.100f30d0
add esp, 4
ud2
mov ecx, esp
mov dword [esp], str.assertion_failed:_key___0library_std_src_syswindows_thread_local_key.rs
mov dword [esp + 4], 1
mov dword [esp + 8], 0
mov dword [esp + 0x10], str.formatter_errorfailed_to_write_whole_buffer
mov dword [esp + 0x14], 0
call fcn.100f3860
ud2
mov ecx, 0xc
mov edx, 4
call fcn.10006540
ud2

Function at 0x100f27a0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
sub esp, 0xc
mov eax, dword [0x104d5390]
test eax, eax
jne 0x100f27b8
mov ecx, 0x104d5390
call fcn.100f2650
push eax
call sub.KERNEL32.dll_TlsGetValue
test eax, eax
je 0x100f27cd
xor edi, edi
mov esi, eax
cmp eax, 1
je 0x100f2849
jmp 0x100f2809
call sub.KERNEL32.dll_GetProcessHeap
push 0x10
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x100f2851
mov dword [eax], 0
mov dword [eax + 0xc], 0x104d5390
mov esi, eax
mov eax, dword [0x104d5390]
test eax, eax
jne 0x100f2802
mov ecx, 0x104d5390
call fcn.100f2650
push esi
push eax
call sub.KERNEL32.dll_TlsSetValue
mov ecx, dword [esi]
mov edx, dword [esi + 4]
mov eax, dword [esi + 8]
lea edi, [esi + 4]
mov dword [esi], 1
mov dword [esi + 4], 0
mov dword [esi + 8], 0
test ecx, ecx
mov dword [esp], ecx
mov dword [esp + 4], edx
mov dword [esp + 8], eax
je 0x100f2849
test eax, eax
je 0x100f2849
lock dec dword [eax]
jne 0x100f2849
lea ecx, [esp + 8]
call fcn.100f2c20
mov eax, edi
add esp, 0xc
pop esi
pop edi
ret
mov ecx, 0x10
mov edx, 4
call fcn.10006540
ud2
Function at 0x100f36e0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
mov eax, dword [0x104d539c]
test eax, eax
jne 0x100f36f4
mov ecx, 0x104d539c
call fcn.100f2650
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 2
jb 0x100f3706
cmp dword [eax], 1
mov esi, eax
je 0x100f3773
mov eax, dword [0x104d539c]
test eax, eax
jne 0x100f3719
mov ecx, 0x104d539c
call fcn.100f2650
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
je 0x100f3778
mov esi, eax
test eax, eax
jne 0x100f3766
call sub.KERNEL32.dll_GetProcessHeap
push 0xc
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x100f377e
mov dword [eax], 0
mov dword [eax + 8], 0x104d539c
mov esi, eax
mov eax, dword [0x104d539c]
test eax, eax
jne 0x100f375f
mov ecx, 0x104d539c
call fcn.100f2650
push esi
push eax
call sub.KERNEL32.dll_TlsSetValue
mov dword [esi + 4], 0
mov dword [esi], 1
add esi, 4
jmp 0x100f377a
xor esi, esi
mov eax, esi
pop esi
ret
mov ecx, 0xc
mov edx, 4
call fcn.10006540
ud2
Function at 0x100fb490
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x38
mov dword [esp + 0x18], edx
mov esi, ecx
lea edi, [esp + 2]
mov ebx, esp
mov ebp, dword [ecx]
mov ecx, 2
test ebp, ebp
je 0x100fb5b0
cmp ebp, 3
je 0x100fb635
cmp ebp, 1
je 0x100fb656
mov eax, ebp
and eax, 3
cmp eax, 2
je 0x100fb4ee
jmp 0x100fb667
mov eax, ebp
and eax, 3
cmp eax, 2
jne 0x100fb5a0
mov eax, dword [0x104d5390]
test eax, eax
jne 0x100fb501
mov ecx, 0x104d5390
call fcn.100f2650
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 2
jb 0x100fb520
cmp dword [eax], 1
jne 0x100fb520
add eax, 4
jmp 0x100fb52d
call fcn.100f27a0
test eax, eax
je 0x100fb63d
mov ecx, eax
call fcn.100f2870
mov ecx, ebp
mov dword [esp], eax
mov byte [esp + 8], 0
mov eax, ebp
and ecx, 0xfffffffc
mov dword [esp + 4], ecx
lock cmpxchg dword [esi], edi
je 0x100fb575
mov ebp, eax
mov eax, dword [esp]
test eax, eax
je 0x100fb4e0
lock dec dword [eax]
jne 0x100fb4e0
mov ecx, ebx
call fcn.100f2c20
jmp 0x100fb4e0
call fcn.100fa490
movzx eax, byte [esp + 8]
test al, al
je 0x100fb570
mov eax, dword [esp]
test eax, eax
je 0x100fb5a0
lock dec dword [eax]
jne 0x100fb5a0
mov ecx, ebx
call fcn.100f2c20
nop word cs:[eax + eax]
nop dword [eax + eax]
mov ebp, dword [esi]
mov ecx, 2
jmp 0x100fb4aa
xor eax, eax
lock cmpxchg dword [esi], ecx
mov ebp, eax
jne 0x100fb4aa
mov byte [esp + 4], 0
mov dword [esp], 3
push ebx
push dword [esp + 0x1c]
mov eax, dword [esp + 0x54]
call dword [eax + 0xc]
add esp, 8
mov eax, dword [esp]
xchg dword [esi], eax
mov ecx, eax
and ecx, 3
cmp ecx, 2
mov dword [esp + 0x1c], ecx
jne 0x100fb699
and eax, 0xfffffffc
je 0x100fb635
mov esi, esp
jmp 0x100fb606
test edi, edi
mov eax, edi
je 0x100fb635
mov ecx, dword [eax]
mov edi, dword [eax + 4]
mov dword [eax], 0
test ecx, ecx
je 0x100fb680
mov dword [esp], ecx
mov byte [eax + 8], 1
mov ebx, dword [esp]
lea ecx, [ebx + 0x18]
call fcn.100fb700
lock dec dword [ebx]
jne 0x100fb600
mov ecx, esi
call fcn.100f2c20
jmp 0x100fb600
add esp, 0x38
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, 0x1042153f
mov edx, 0x5e
push 0x104215a0
call fcn.1000a730
add esp, 4
ud2
mov ecx, 0x1042290a
mov edx, 0x2a
push 0x10422934
jmp 0x100fb676
mov ecx, str.assertion_failed:_state_and_queue__STATE_MASK__RUNNING
mov edx, 0x39
push 0x10422980
call fcn.100f30d0
add esp, 4
ud2
mov ecx, str.called__Option::unwrap____on_a__None__valueC:UsersAdministrator.cargo_registry_srcgithub.com_1ecc6299db9ec823url_2.2.0_srclib.rs__filed
mov edx, 0x2b
push 0x104229bc
call fcn.100082b0
add esp, 4
ud2
lea ecx, [esp + 0x20]
lea edx, [esp + 0x24]
lea eax, [esp + 0x1c]
mov dword [esp], str.assertion_failed:___left__right___n__left:__queue_is_not_full__tail____head_
mov dword [esp + 4], 3
mov dword [esp + 8], 0
mov dword [esp + 0x24], 0x104225c0
mov dword [esp + 0x28], ecx
lea ecx, [esp + 0x28]
mov dword [esp + 0x2c], 0x100b98b0
mov dword [esp + 0x30], edx
mov edx, 0x104229ac
mov dword [esp + 0x20], eax
mov dword [esp + 0x34], 0x100b98b0
mov dword [esp + 0x10], ecx
mov ecx, esp
mov dword [esp + 0x14], 2
call fcn.100f9210
ud2
Function at 0x100fdfb0
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
push ebx
push edi
push esi
mov ebx, dword [esp + 0x14]
cmp edx, 1
mov eax, 0x17
mov ebp, 2
mov esi, ecx
cmove ebp, eax
push 0x81
push 0
push 0
push 0
push ebx
push ebp
call sub.WS2_32.dll_WSASocketW
mov edi, eax
cmp eax, 0xffffffff
je 0x100fdfee
mov dword [esi + 4], edi
mov dword [esi], 0
jmp 0x100fe057
call sub.WS2_32.dll_WSAGetLastError
cmp eax, 0x2739
je 0x100fe001
cmp eax, 0x2726
jne 0x100fe047
push 1
push 0
push 0
push 0
push ebx
push ebp
call sub.WS2_32.dll_WSASocketW
cmp eax, 0xffffffff
je 0x100fe042
mov edi, eax
push 0
push 1
push eax
call sub.KERNEL32.dll_SetHandleInformation
test eax, eax
jne 0x100fdfe3
call sub.KERNEL32.dll_GetLastError
mov dword [esi + 8], eax
mov dword [esi + 4], 0
mov dword [esi], 1
push edi
call sub.WS2_32.dll_closesocket
jmp 0x100fe057
call sub.WS2_32.dll_WSAGetLastError
mov dword [esi + 8], eax
mov dword [esi + 4], 0
mov dword [esi], 1
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x100fe740
Capabilities:
Get thread local storage value

Disassembly:
push edi
push esi
sub esp, 8
mov eax, dword [0x104d5390]
mov esi, ecx
test eax, eax
jne 0x100fe75a
mov ecx, 0x104d5390
call fcn.100f2650
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 2
jb 0x100fe76f
cmp dword [eax], 1
jne 0x100fe76f
add eax, 4
jmp 0x100fe77c
call fcn.100f27a0
test eax, eax
je 0x100fe843
mov ecx, dword [eax]
inc ecx
test ecx, ecx
jle 0x100fe7ec
cmp dword [eax + 4], 0
jne 0x100fe804
mov dword [esp + 4], esi
mov eax, dword [0x104d5390]
test eax, eax
jne 0x100fe7a0
mov ecx, 0x104d5390
call fcn.100f2650
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 2
jb 0x100fe7b7
cmp dword [eax], 1
mov edi, eax
jne 0x100fe7b7
add edi, 4
jmp 0x100fe7c2
call fcn.100f27a0
mov edi, eax
test eax, eax
je 0x100fe835
cmp dword [edi], 0
jne 0x100fe81d
mov dword [edi], 0xffffffff
mov eax, dword [edi + 4]
test eax, eax
je 0x100fe7e1
lock dec dword [eax]
jne 0x100fe7e1
lea ecx, [edi + 4]
call fcn.100f2c20
mov dword [edi + 4], esi
inc dword [edi]
add esp, 8
pop esi
pop edi
ret
mov eax, esp
mov ecx, 0x10424705
mov edx, 0x18
push 0x10422f4c
push 0x104215b0
jmp 0x100fe859
mov ecx, 0x10422f5c
mov edx, 0x26
push 0x10422f84
call fcn.100f30d0
add esp, 4
ud2
mov eax, esp
mov ecx, str.already_borrowed
mov edx, 0x10
push 0x10422f94
push 0x104215d0
jmp 0x100fe859
lock dec dword [esi]
jne 0x100fe843
lea ecx, [esp + 4]
call fcn.100f2c20
mov eax, esp
mov ecx, 0x1044ace7
mov edx, 0x46
push 0x1042168c
push 0x1042167c
push eax
call fcn.1000a790
add esp, 0xc
ud2
Function at 0x100fec40
Capabilities:
Generate random numbers via rtlgenrandom
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff0
sub esp, 0x50
mov eax, dword [0x104d53b0]
test eax, eax
jne 0x100fec5d
mov ecx, 0x104d53b0
call fcn.100f2650
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 2
jb 0x100fec7a
mov ecx, dword [eax]
xor ecx, 1
or ecx, dword [eax + 4]
jne 0x100fec7a
add eax, 8
jmp 0x100fed1e
mov eax, dword [0x104d53b0]
test eax, eax
jne 0x100fec8d
mov ecx, 0x104d53b0
call fcn.100f2650
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
je 0x100fed1c
mov esi, eax
test eax, eax
jne 0x100fece9
call sub.KERNEL32.dll_GetProcessHeap
push 0x20
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x100fed7a
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 0x18], 0x104d53b0
mov esi, eax
mov eax, dword [0x104d53b0]
test eax, eax
jne 0x100fece2
mov ecx, 0x104d53b0
call fcn.100f2650
push esi
push eax
call sub.KERNEL32.dll_TlsSetValue
xorps xmm0, xmm0
lea eax, [esp + 0x30]
movaps xmmword [esp + 0x30], xmm0
push 0x10
push eax
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x100fed24
movaps xmm0, xmmword [esp + 0x30]
lea eax, [esi + 8]
mov dword [esi + 4], 0
mov dword [esi], 1
movups xmmword [esi + 8], xmm0
jmp 0x100fed1e
xor eax, eax
lea esp, [ebp - 4]
pop esi
pop ebp
ret
call sub.KERNEL32.dll_GetLastError
lea edx, [esp + 0x10]
lea ecx, [esp + 8]
mov dword [esp + 0x18], 0x10422d74
mov dword [esp + 0x1c], 1
mov dword [esp + 0x20], 0
mov byte [esp + 0x10], 0
mov dword [esp + 0x14], eax
mov dword [esp + 8], edx
mov dword [esp + 0x28], ecx
lea ecx, [esp + 0x18]
mov edx, 0x10422d7c
mov dword [esp + 0xc], fcn.100f8fb0
mov dword [esp + 0x2c], 1
call fcn.100f9210
ud2
mov ecx, 0x20
mov edx, 8
call fcn.10006540
ud2

Function at 0x100feed0
Capabilities:
Create thread

Disassembly:
push ebx
push edi
push esi
mov ebx, edx
mov esi, ecx
call sub.KERNEL32.dll_GetProcessHeap
push 8
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x100fef84
mov edi, eax
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
add ebx, 0xfffe
and ebx, 0xffff0001
mov dword [edi], ecx
mov dword [edi + 4], eax
push 0
push 0x10000
push edi
push 0x100fefa0
push ebx
push 0
call sub.KERNEL32.dll_CreateThread
test eax, eax
je 0x100fef29
mov dword [esi + 4], eax
xor eax, eax
jmp 0x100fef7e
mov eax, dword [edi + 4]
push dword [edi]
call dword [eax]
add esp, 4
mov eax, dword [edi + 4]
cmp dword [eax + 4], 0
je 0x100fef5c
mov ebx, dword [edi]
cmp dword [eax + 8], 9
jae 0x100fef4c
call sub.KERNEL32.dll_GetProcessHeap
push ebx
jmp 0x100fef54
call sub.KERNEL32.dll_GetProcessHeap
push dword [ebx - 4]
push 0
push eax
call sub.KERNEL32.dll_HeapFree
call sub.KERNEL32.dll_GetProcessHeap
push edi
push 0
push eax
call sub.KERNEL32.dll_HeapFree
call sub.KERNEL32.dll_GetLastError
mov dword [esi + 8], eax
mov eax, 1
mov dword [esi + 4], 0
mov dword [esi], eax
pop esi
pop edi
pop ebx
ret
mov ecx, 8
mov edx, 4
call fcn.10006540
ud2
Function at 0x100ff160
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
mov eax, dword [0x104d53b8]
test eax, eax
jne 0x100ff174
mov ecx, 0x104d53b8
call fcn.100f2650
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 2
jb 0x100ff186
cmp dword [eax], 1
mov esi, eax
je 0x100ff1f7
mov eax, dword [0x104d53b8]
test eax, eax
jne 0x100ff199
mov ecx, 0x104d53b8
call fcn.100f2650
push eax
call sub.KERNEL32.dll_TlsGetValue
test eax, eax
je 0x100ff1ae
xor esi, esi
cmp eax, 1
je 0x100ff1fa
mov esi, eax
jmp 0x100ff1ea
call sub.KERNEL32.dll_GetProcessHeap
push 0xc
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x100ff1fe
mov dword [eax], 0
mov dword [eax + 8], 0x104d53b8
mov esi, eax
mov eax, dword [0x104d53b8]
test eax, eax
jne 0x100ff1e3
mov ecx, 0x104d53b8
call fcn.100f2650
push esi
push eax
call sub.KERNEL32.dll_TlsSetValue
mov dword [esi], 1
mov dword [esi + 4], 0
add esi, 4
mov eax, esi
pop esi
ret
mov ecx, 0xc
mov edx, 4
call fcn.10006540
ud2

Function at 0x100ff210
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
mov eax, dword [0x104d53c0]
test eax, eax
jne 0x100ff224
mov ecx, 0x104d53c0
call fcn.100f2650
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 2
jb 0x100ff236
cmp dword [eax], 1
mov esi, eax
je 0x100ff2a7
mov eax, dword [0x104d53c0]
test eax, eax
jne 0x100ff249
mov ecx, 0x104d53c0
call fcn.100f2650
push eax
call sub.KERNEL32.dll_TlsGetValue
test eax, eax
je 0x100ff25e
xor esi, esi
cmp eax, 1
je 0x100ff2aa
mov esi, eax
jmp 0x100ff29a
call sub.KERNEL32.dll_GetProcessHeap
push 0xc
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x100ff2ae
mov dword [eax], 0
mov dword [eax + 8], 0x104d53c0
mov esi, eax
mov eax, dword [0x104d53c0]
test eax, eax
jne 0x100ff293
mov ecx, 0x104d53c0
call fcn.100f2650
push esi
push eax
call sub.KERNEL32.dll_TlsSetValue
mov dword [esi], 1
mov dword [esi + 4], 0
add esi, 4
mov eax, esi
pop esi
ret
mov ecx, 0xc
mov edx, 4
call fcn.10006540
ud2
Function at 0x100ffb30
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
sub esp, 0x1c
mov eax, dword [0x104d53c8]
test eax, eax
jne 0x100ffb48
mov ecx, 0x104d53c8
call fcn.100f2650
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 2
jb 0x100ffb62
cmp dword [eax], 1
mov edi, eax
jne 0x100ffb62
add edi, 4
jmp 0x100ffc20
mov eax, dword [0x104d53c8]
test eax, eax
jne 0x100ffb75
mov ecx, 0x104d53c8
call fcn.100f2650
push eax
call sub.KERNEL32.dll_TlsGetValue
test eax, eax
je 0x100ffb8e
xor edi, edi
mov esi, eax
cmp eax, 1
je 0x100ffc20
jmp 0x100ffbce
call sub.KERNEL32.dll_GetProcessHeap
push 0x20
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x100ffc28
mov dword [eax], 0
mov dword [eax + 0x1c], 0x104d53c8
mov esi, eax
mov eax, dword [0x104d53c8]
test eax, eax
jne 0x100ffbc7
mov ecx, 0x104d53c8
call fcn.100f2650
push esi
push eax
call sub.KERNEL32.dll_TlsSetValue
mov ecx, dword [esi]
mov edx, dword [esi + 4]
mov eax, dword [esi + 8]
mov dword [esi], 1
mov dword [esi + 4], 0
mov dword [esi + 8], 3
lea edi, [esi + 4]
mov dword [esp], ecx
mov dword [esp + 4], edx
mov dword [esp + 8], eax
test ecx, ecx
movsd xmm0, qword [esi + 0xc]
movsd xmm1, qword [esi + 0x14]
movsd qword [esp + 0xc], xmm0
movsd qword [esp + 0x14], xmm1
je 0x100ffc20
cmp eax, 3
je 0x100ffc20
lea ecx, [esp + 8]
call fcn.100ffc40
mov eax, edi
add esp, 0x1c
pop esi
pop edi
ret
mov ecx, 0x20
mov edx, 4
call fcn.10006540
ud2
Function at 0x10103d00
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
mov eax, dword [0x104d53d8]
test eax, eax
jne 0x10103d14
mov ecx, 0x104d53d8
call fcn.100f2650
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 2
jb 0x10103d27
cmp byte [eax + 4], 2
mov esi, eax
jne 0x10103d8a
mov eax, dword [0x104d53d8]
test eax, eax
jne 0x10103d3a
mov ecx, 0x104d53d8
call fcn.100f2650
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
je 0x10103d8f
mov esi, eax
test eax, eax
jne 0x10103d84
call sub.KERNEL32.dll_GetProcessHeap
push 8
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x10103d95
mov byte [eax + 4], 2
mov dword [eax], 0x104d53d8
mov esi, eax
mov eax, dword [0x104d53d8]
test eax, eax
jne 0x10103d7d
mov ecx, 0x104d53d8
call fcn.100f2650
push esi
push eax
call sub.KERNEL32.dll_TlsSetValue
mov word [esi + 4], 0
add esi, 4
jmp 0x10103d91
xor esi, esi
mov eax, esi
pop esi
ret
mov ecx, 8
mov edx, 4
call fcn.10006540
ud2

Function at 0x10103db0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
mov eax, dword [0x104d53d0]
test eax, eax
jne 0x10103dc4
mov ecx, 0x104d53d0
call fcn.100f2650
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 2
jb 0x10103dd7
cmp byte [eax + 4], 3
mov esi, eax
jne 0x10103e38
mov eax, dword [0x104d53d0]
test eax, eax
jne 0x10103dea
mov ecx, 0x104d53d0
call fcn.100f2650
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
je 0x10103e3d
mov esi, eax
test eax, eax
jne 0x10103e34
call sub.KERNEL32.dll_GetProcessHeap
push 8
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x10103e43
mov byte [eax + 4], 3
mov dword [eax], 0x104d53d0
mov esi, eax
mov eax, dword [0x104d53d0]
test eax, eax
jne 0x10103e2d
mov ecx, 0x104d53d0
call fcn.100f2650
push esi
push eax
call sub.KERNEL32.dll_TlsSetValue
mov byte [esi + 4], 2
add esi, 4
jmp 0x10103e3f
xor esi, esi
mov eax, esi
pop esi
ret
mov ecx, 8
mov edx, 4
call fcn.10006540
ud2