joyce8/EMBER2024-capa huggingface dataset:
Function at 0x101fc54f
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x1039fb98]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x103a5ab3], 0
jne 0x101fc5a9
lea eax, [ebp - 0x120]
push eax
mov dword [ebp - 0x120], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x101fc5a2
cmp dword [ebp - 0x110], 2
jne 0x101fc5a2
cmp dword [ebp - 0x11c], 6
jb 0x101fc5a2
call fcn.101fc405
mov byte [0x103a5ab2], al
mov byte [0x103a5ab3], 1
mov ecx, dword [ebp - 4]
mov al, byte [0x103a5ab2]
xor ecx, ebp
call fcn.102f77a6
leave
ret

Function at 0x101fc5ce
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x164
mov eax, dword [0x1039fb98]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x160], 0
push ebx
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x164], ebx
call fcn.101fc54f
test al, al
je 0x101fc615
push dword [ebp + 0x10]
push ebx
push 0x5c
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov dword [ebp - 0x160], eax
jmp 0x101fc6b1
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
push edi
push 0x56
lea eax, [ebp - 0xb0]
push eax
push 0x59
push dword [ebp + 8]
call esi
push 0x56
mov edi, eax
lea eax, [ebp - 0x15c]
push eax
push 0x5a
push dword [ebp + 8]
call esi
cmp edi, 1
jle 0x101fc6af
cmp eax, 1
jle 0x101fc691
mov esi, dword [ebp + 0x10]
lea ebx, [eax + edi]
cmp ebx, esi
jg 0x101fc6af
lea eax, [ebp - 0xb0]
push eax
push esi
push dword [ebp - 0x164]
call fcn.102f9289
mov eax, dword [ebp - 0x164]
push 0x2d
pop ecx
lea eax, [eax + edi*2]
mov word [eax - 2], cx
lea ecx, [ebp - 0x15c]
push ecx
sub esi, edi
push esi
push eax
call fcn.102f9289
add esp, 0x18
mov dword [ebp - 0x160], ebx
jmp 0x101fc6af
cmp edi, dword [ebp + 0x10]
jg 0x101fc6af
lea eax, [ebp - 0xb0]
push eax
push dword [ebp + 0x10]
push ebx
call fcn.102f9289
add esp, 0xc
mov dword [ebp - 0x160], edi
pop edi
pop esi
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x160]
xor ecx, ebp
pop ebx
call fcn.102f77a6
leave
ret 0xc
Function at 0x101fd12e
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x1039fb98]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov dword [ebp - 0x110], eax
lea eax, [ebp - 0x10c]
push eax
push 0x20019
xor esi, esi
push esi
push 0x1003ff1c
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x101fd203
push edi
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x114]
push eax
push esi
push esi
push dword [ebp - 0x10c]
mov edi, 0x104
mov dword [ebp - 0x118], edi
mov dword [ebp - 0x114], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x101fd1f2
cmp dword [ebp - 0x114], 2
mov byte [ebp - 5], al
lea eax, [ebp - 0x108]
jne 0x101fd1dc
push edi
push dword [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
dec eax
lea ecx, [edi - 1]
cmp ecx, eax
sbb esi, esi
inc esi
jmp 0x101fd1f2
push eax
push edi
push dword [ebp - 0x110]
call fcn.101fd0cb
xor ecx, ecx
test eax, eax
setge cl
mov esi, ecx
push dword [ebp - 0x10c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
jmp 0x101fd205
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.102f77a6
leave
ret 4
Function at 0x101fe3da
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
and dword [ebp - 4], 0
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpW]
lea ebx, [esi + 4]
push ebx
push 0x10014a10
call edi
test eax, eax
jne 0x101fe4f0
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ebx, [esi + 0x20c]
push ebx
call edi
mov esi, eax
add esi, 3
cmp dword [ebp + 0xc], 0
je 0x101fe426
push dword [ebp + 0xc]
call edi
lea esi, [esi + eax + 1]
push esi
lea eax, [ebp - 4]
push eax
call fcn.101fe710
mov edi, eax
test edi, edi
jl 0x101fe514
push ebx
push 0x100400cc
push 0xffffffffffffffff
push esi
push dword [ebp - 4]
call fcn.102f86da
add esp, 0x14
test eax, eax
jge 0x101fe45c
mov edi, 0x8007007a
jmp 0x101fe514
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
je 0x101fe491
push 0xffffffffffffffff
push 0x10004560
push esi
push dword [ebp - 4]
call fcn.102fa4c9
add esp, 0x10
cmp eax, 0x50
je 0x101fe452
push 0xffffffffffffffff
push dword [ebp + 0xc]
push esi
push dword [ebp - 4]
call fcn.102fa4c9
add esp, 0x10
cmp eax, 0x50
je 0x101fe452
push 0x44
pop esi
push esi
lea eax, [ebp - 0x58]
push ebx
push eax
call fcn.102f835e
add esp, 0xc
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x58]
push eax
push ebx
push ebx
push 0x20
push ebx
push ebx
push ebx
push dword [ebp - 4]
mov dword [ebp - 0x58], esi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x101fe4d6
push dword [ebp - 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x14]
call esi
xor edi, edi
jmp 0x101fe514
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp edi, ebx
jle 0x101fe514
and edi, 0xffff
or edi, 0x80070000
jmp 0x101fe514
push ebx
push 0x100400c4
call edi
test eax, eax
jne 0x101fe50f
push dword [ebp + 0xc]
add esi, 0x20c
push esi
call fcn.101fe9d7
mov edi, eax
jmp 0x101fe514
mov edi, 0x81000004
cmp dword [ebp - 4], 0
je 0x101fe522
push dword [ebp - 4]
call fcn.10332b38
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x101fe85e
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
xor esi, esi
lea eax, [ebp - 0x1c]
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x101fe8aa
mov eax, dword [ebp - 0x18]
cmp eax, 1
je 0x101fe8a3
jbe 0x101fe8c0
cmp eax, 3
jbe 0x101fe893
cmp eax, 4
je 0x101fe8a3
jbe 0x101fe8c0
cmp eax, 6
ja 0x101fe89e
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x101fe867
cmp eax, 7
jne 0x101fe8c0
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
jmp 0x101fe8c0
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x101fe8be
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
mov eax, esi
pop esi
leave
ret 8
Function at 0x101fed76
Capabilities:
Parse pe header

Disassembly:
push 0xc
push 0x1035a440
call fcn.102f919a
and dword [ebp - 4], 0
mov eax, dword [ebp + 8]
movzx edx, word [eax]
mov ecx, 0x5a4d
cmp dx, cx
jne 0x101fedb4
mov ecx, dword [eax + 0x3c]
add ecx, eax
mov esi, 0xe0
cmp word [ecx + 0x14], si
jne 0x101fedb4
add esi, 0x2b
cmp word [ecx + 0x18], si
jne 0x101fedb4
mov eax, dword [ecx + 0x50]
jmp 0x101fedd5
mov ecx, 0x4550
cmp dx, cx
jne 0x101fede1
mov ecx, 0xe0
cmp word [eax + 0x14], cx
jne 0x101fede1
add ecx, 0x2b
cmp word [eax + 0x18], cx
jne 0x101fede1
mov eax, dword [eax + 0x50]
mov dword [ebp - 0x1c], eax
jmp 0x101fede5
and dword [ebp - 0x1c], 0
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x1c]
call fcn.102f91df
ret 4
Function at 0x101ff210
Capabilities:
Link many functions at runtime
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x1039fb98]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
xor eax, eax
push 0x206
mov word [ebp - 0x20c], ax
xor esi, esi
lea eax, [ebp - 0x20a]
push esi
push eax
mov dword [ebp - 0x214], 1
call fcn.102f835e
mov eax, 0x103a5ac8
add esp, 0xc
mov dword [ebp - 0x210], 0x208
mov ecx, eax
cmp dword [ecx], 0
je 0x101ff27d
add ecx, 0x14
inc esi
cmp ecx, 0x103a5af0
jl 0x101ff267
jmp 0x101ff3d0
imul esi, esi, 0x14
add esi, eax
je 0x101ff3d0
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x101ff3b2
cmp dword [ebp - 0x214], 1
jne 0x101ff3b2
xor ebx, ebx
cmp word [ebp - 0x20c], bx
je 0x101ff3b4
cmp dword [ebp - 0x210], ebx
je 0x101ff3b4
shr dword [ebp - 0x210], 1
cmp dword [ebp - 0x210], 0x104
jae 0x101ff2f9
mov ecx, dword [ebp - 0x210]
mov word [ebp + ecx*2 - 0x20c], ax
jmp 0x101ff2fd
mov word [ebp - 6], ax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [esi], eax
cmp eax, ebx
je 0x101ff3b4
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x100401a8
push eax
call edi
cmp eax, ebx
jne 0x101ff32b
mov eax, dword [ebp + 0x10]
jmp 0x101ff32d
call eax
mov dword [esi + 4], eax
cmp eax, 1
jne 0x101ff351
push 0x1004019c
push dword [esi]
call edi
push 0x10040188
push dword [esi]
mov dword [esi + 8], eax
call edi
push 0x10040178
jmp 0x101ff385
cmp eax, 2
jne 0x101ff366
push 0x1004019c
push dword [esi]
call edi
push 0x10040164
jmp 0x101ff343
cmp eax, 3
jne 0x101ff38f
push 0x10040154
push dword [esi]
call edi
push 0x1004013c
push dword [esi]
mov dword [esi + 8], eax
call edi
push 0x10040128
push dword [esi]
mov dword [esi + 0x10], eax
call edi
mov dword [esi + 0xc], eax
cmp dword [esi + 8], ebx
je 0x101ff3b4
cmp dword [esi + 0x10], ebx
je 0x101ff3b4
cmp dword [esi + 0xc], ebx
je 0x101ff3b4
push dword [0x103a5af0]
push esi
call fcn.101fefed
test eax, eax
jl 0x101ff3b4
xor esi, esi
jmp 0x101ff3b4
xor ebx, ebx
cmp esi, ebx
je 0x101ff3d0
mov eax, dword [esi]
cmp eax, ebx
je 0x101ff3c5
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [esi], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.102f77a6
leave
ret 0xc
Function at 0x101ff647
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x1039fb98]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor eax, eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x214]
push eax
push 1
xor ebx, ebx
push ebx
push 0x10040228
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x214], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x101ff691
xor eax, eax
jmp 0x101ff71a
cmp byte [ebp + 8], bl
je 0x101ff6a7
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
jmp 0x101ff71a
push esi
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x218]
push eax
push ebx
push 0x100401f4
push dword [ebp - 0x214]
mov dword [ebp - 0x21c], 0x208
mov dword [ebp - 0x218], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x214]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
pop esi
jne 0x101ff68a
cmp dword [ebp - 0x218], 1
je 0x101ff708
push ebx
push 0x37733964
call fcn.102d8670
jmp 0x101ff68a
xor eax, eax
mov word [ebp - 8], ax
lea eax, [ebp - 0x210]
push eax
call fcn.102d7bbc
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.102f77a6
leave
ret 4
Function at 0x1020898b
Capabilities:
Get thread local storage value

Disassembly:
push dword [0x1039a750]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0x1020899c
ret
mov eax, dword [eax + 0xc]
ret

Function at 0x10208a3c
Capabilities:
Allocate thread local storage

Disassembly:
cmp dword [0x103a5bb4], 0
jbe 0x10208a4e
inc dword [0x103a5bb4]
xor eax, eax
ret
call fcn.10260b35
test eax, eax
jne 0x10208a5d
mov eax, 0x80004005
ret
push esi
mov dword [0x1039a790], 2
mov dword [0x1039a794], 0x98
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x1039a750], eax
cmp eax, 0xffffffff
jne 0x10208a89
mov esi, 0x80040001
jmp 0x10208ad9
call fcn.1025fa87
call fcn.1025966c
mov esi, eax
test esi, esi
jl 0x10208ad9
call fcn.102193e2
mov esi, eax
test esi, esi
jl 0x10208ad9
call fcn.10259930
mov esi, eax
test esi, esi
jl 0x10208ad9
call fcn.10203926
mov esi, eax
test esi, esi
jl 0x10208ad9
call fcn.10258a78
mov esi, eax
test esi, esi
jl 0x10208ad9
push 0x103a5bb8
push 0x40
push 0x18
call fcn.102597ad
mov esi, eax
test esi, esi
jge 0x10208b0d
call fcn.102595fc
call fcn.10219a13
mov eax, dword [0x1039a750]
cmp eax, 0xffffffff
je 0x10208afb
push eax
call dword [sym.imp.KERNEL32.dll_TlsFree]
or dword [0x1039a750], 0xffffffff
cmp byte [0x103a5db0], 0
je 0x10208b09
call fcn.10258a91
mov eax, esi
pop esi
ret
mov dword [0x103a5bb4], 1
xor eax, eax
pop esi
ret
Function at 0x1020904a
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
xor ebx, ebx
push esi
push edi
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
cmp dword [0x103a5bc4], ebx
jne 0x10209077
mov ebx, 0x80004005
lea ecx, [ebp - 8]
call fcn.10208b1b
mov eax, ebx
jmp 0x102091ec
lea ecx, [ebp - 8]
call fcn.10208c39
mov eax, dword [0x1039a750]
mov esi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 0xffffffff
je 0x10209096
push eax
call esi
cmp eax, ebx
jne 0x102090ad
call fcn.10208a3c
cmp eax, ebx
mov dword [ebp - 4], eax
jl 0x102091c0
mov dword [ebp - 0xc], 1
push dword [0x1039a750]
call esi
cmp eax, ebx
je 0x102090be
inc dword [eax + 4]
jmp 0x10209068
push 0x40
call fcn.10206d55
mov esi, eax
cmp esi, ebx
jne 0x102090d7
mov dword [ebp - 4], 0x8007000e
jmp 0x1020916e
push esi
push dword [0x1039a750]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
lea eax, [esi + 8]
push eax
call fcn.1021500b
cmp eax, ebx
mov dword [ebp - 4], eax
jl 0x1020916e
lea edi, [esi + 0x10]
push edi
call fcn.10258afa
cmp eax, ebx
mov dword [ebp - 4], eax
jl 0x1020916e
lea eax, [esi + 0xc]
push eax
push dword [edi]
push 8
call fcn.1026556c
cmp eax, ebx
mov dword [ebp - 4], eax
jl 0x1020916e
mov byte [esi + 0x14], bl
mov byte [esi + 0x15], bl
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
xor eax, eax
xor ecx, ecx
inc ecx
mov dword [esi + 4], ecx
mov word [esi + 0x38], ax
mov byte [esi + 0x3b], 4
mov byte [esi + 0x3a], bl
mov dword [esi + 0x3c], ebx
lea edi, [ebp - 0x20]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x14
mov dword [ebp - 0x1c], 2
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], ebx
call fcn.102636cd
mov dword [esi], eax
cmp eax, ebx
jne 0x102091cd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
cmp esi, ebx
je 0x102091b6
mov ecx, dword [esi + 0xc]
cmp ecx, ebx
je 0x1020917e
call fcn.10265565
mov ecx, dword [esi + 0x10]
cmp ecx, ebx
je 0x1020918a
call fcn.10258aaf
mov eax, dword [esi + 8]
cmp eax, ebx
je 0x10209197
push eax
call fcn.10208d0f
mov eax, dword [esi]
cmp eax, ebx
je 0x102091a3
push eax
call fcn.10262590
push esi
call sym.osetup.dll_void___stdcall_NetUI::HFree_void__
push ebx
push dword [0x1039a750]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
cmp dword [ebp - 0xc], ebx
je 0x102091c0
call fcn.10208d95
lea ecx, [ebp - 8]
call fcn.10208b1b
mov eax, dword [ebp - 4]
jmp 0x102091ec
cmp dword [0x103a5bb4], 1
jne 0x102091e2
mov eax, dword [0x103a5bc8]
cmp eax, ebx
je 0x102091e2
push ebx
call eax
lea ecx, [ebp - 8]
call fcn.10208b1b
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x102091f1
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
mov dword [ebp - 4], ebx
lea ecx, [ebp - 4]
cmp dword [0x103a5bc4], ebx
jne 0x10209213
call fcn.10208b1b
mov eax, 0x80004005
pop ebx
leave
ret
push esi
call fcn.10208c39
mov eax, dword [0x1039a750]
cmp eax, 0xffffffff
jne 0x10209235
mov ebx, 0x80004005
lea ecx, [ebp - 4]
call fcn.10208b1b
mov eax, ebx
pop esi
jmp 0x10209210
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
cmp esi, ebx
jne 0x10209249
mov ebx, 0x8004000a
jmp 0x10209228
dec dword [esi + 4]
cmp dword [esi + 4], ebx
jg 0x10209228
push ebx
lea ecx, [esi + 0x24]
call fcn.10208ce0
push ebx
lea ecx, [esi + 0x28]
call fcn.10208ce0
push ebx
lea ecx, [esi + 0x2c]
call fcn.10208ce0
push ebx
lea ecx, [esi + 0x30]
call fcn.10208ce0
push ebx
lea ecx, [esi + 0x34]
call fcn.10259db7
lea ecx, [esi + 0x38]
call fcn.10208c89
cmp dword [0x103a5bb4], 1
jne 0x1020929c
mov eax, dword [0x103a5bc8]
cmp eax, ebx
je 0x1020929c
push 1
call eax
push dword [esi]
call fcn.10262590
cmp byte [esi + 0x14], bl
je 0x102092ae
call dword [sym.imp.ole32.dll_CoUninitialize]
cmp byte [esi + 0x15], bl
je 0x102092b9
call dword [sym.imp.ole32.dll_OleUninitialize]
mov ecx, dword [esi + 0xc]
call fcn.10265565
mov ecx, dword [esi + 0x10]
call fcn.10258aaf
push dword [esi + 8]
call fcn.10208d0f
mov eax, dword [esi + 0x1c]
cmp eax, ebx
je 0x102092de
push eax
call sym.osetup.dll_void___stdcall_NetUI::HFree_void__
push esi
call sym.osetup.dll_void___stdcall_NetUI::HFree_void__
push ebx
push dword [0x1039a750]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
call fcn.10208d95
jmp 0x10209228
Function at 0x1021101f
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0x1c]
push esi
push edi
xor edi, edi
cmp ebx, edi
jne 0x102110ee
movzx eax, word [ebp + 0x18]
push 0x2010
push eax
movzx eax, word [ebp + 0x14]
push eax
push edi
push dword [ebp + 8]
push edi
call dword [sym.imp.USER32.dll_LoadImageW]
cmp eax, edi
jne 0x10211057
xor eax, eax
jmp 0x102110e7
push edi
push 1
push dword [ebp + 0x28]
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
call fcn.10210ddb
cmp eax, edi
je 0x10211050
mov cl, byte [ebp + 0x2c]
cmp cl, 1
jbe 0x10211082
or byte [eax + 0x13], 0x80
mov byte [eax + 0x14], cl
mov esi, dword [ebp + 0x30]
cmp esi, edi
je 0x102110e7
mov cl, byte [eax + 0x12]
shr cl, 3
and cl, 7
cmp cl, 5
je 0x1021109c
cmp cl, 6
jne 0x102110e7
mov ecx, dword [esi]
shl ecx, 8
xor ecx, dword [eax + 0x14]
and ecx, 0x3f00
xor dword [eax + 0x14], ecx
mov ecx, dword [eax + 0x14]
mov edx, dword [esi + 4]
shl edx, 0xe
xor edx, ecx
and edx, 0xfc000
xor edx, ecx
mov dword [eax + 0x14], edx
mov ecx, dword [esi + 8]
shl ecx, 0x14
xor ecx, edx
and ecx, 0x3f00000
xor ecx, edx
mov dword [eax + 0x14], ecx
mov edx, dword [esi + 0xc]
shl edx, 0x1a
and ecx, 0x3ffffff
or edx, ecx
mov dword [eax + 0x14], edx
pop edi
pop esi
pop ebx
pop ebp
ret 0x30
push 2
push dword [ebp + 8]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
cmp eax, edi
je 0x10211050
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
je 0x10211050
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
cmp word [esi + 0xe], 0x18
jb 0x10211197
cmp dword [esi + 0x10], edi
jne 0x10211197
call fcn.102089be
cmp eax, edi
je 0x10211050
mov dl, byte [ebp + 0x28]
push 0xb
pop ecx
mov word [eax + 4], cx
mov cx, word [ebp + 0x14]
mov word [eax + 6], cx
mov cx, word [ebp + 0x18]
mov word [eax + 0x10], cx
mov cl, byte [ebp + 0xc]
and cl, 7
or cl, 8
shl cl, 3
mov byte [eax + 0x12], cl
mov ecx, dword [ebp + 0x10]
mov dword [eax + 0x14], ecx
mov cl, byte [ebp + 0x34]
and cl, 1
shl cl, 2
and dl, 1
or cl, dl
mov dl, byte [ebp + 0x24]
shl cl, 3
and dl, 1
or cl, dl
mov dl, byte [ebp + 0x20]
or cl, 4
add cl, cl
and dl, 1
or cl, dl
mov byte [eax + 0x13], cl
mov dword [eax + 8], esi
mov dword [eax + 0xc], edi
jmp 0x10211073
movzx eax, word [ebp + 0x18]
push 0x2000
push eax
movzx eax, word [ebp + 0x14]
push eax
push edi
push dword [ebp + 8]
push ebx
jmp 0x10211046
Function at 0x10215efa
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0xc]
push ebx
xor ebx, ebx
push esi
xor esi, esi
cmp dword [ebp + 8], eax
push edi
setne byte [ebp - 1]
mov edi, ecx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0x10], 3
mov byte [ebp - 2], bl
cmp byte [ebp - 1], bl
je 0x10215f55
cmp eax, ebx
je 0x10215f55
test byte [eax + 0x7e], 2
jne 0x10215f3b
xor eax, eax
jmp 0x10215f42
mov eax, ecx
mov ecx, dword [eax + 4]
cmp ecx, ebx
jne 0x10215f39
mov dword [ebp - 0x14], eax
call fcn.10226831
push eax
mov ecx, edi
call fcn.10217bec
mov byte [ebp - 2], al
cmp dword [ebp + 8], ebx
je 0x1021600a
cmp byte [ebp - 1], bl
je 0x10215fa3
push dword [0x1039a750]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, dword [eax + 8]
push 1
push ebx
push edi
lea ecx, [esi + 0x64]
call fcn.10283904
push 1
push ebx
push edi
lea ecx, [esi + 0x58]
call fcn.10283904
mov eax, dword [ebp + 8]
test byte [eax + 0x7e], 2
jne 0x10215f99
xor eax, eax
jmp 0x10215fa0
mov eax, ecx
mov ecx, dword [eax + 4]
cmp ecx, ebx
jne 0x10215f97
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov esi, dword [eax + 0x3c]
cmp esi, ebx
je 0x1021600a
cmp dword [edi + 0xc], ebx
je 0x1021600a
mov eax, dword [edi + 0x10]
cmp eax, ebx
je 0x10215fbe
cmp dword [eax + 0xc], ebx
jne 0x10215fc0
xor eax, eax
cmp eax, ebx
je 0x10216003
test byte [eax + 0x32], 2
jne 0x10215fdc
mov eax, dword [eax + 0x10]
cmp eax, ebx
je 0x10215fd6
cmp dword [eax + 0xc], ebx
jne 0x10215fd8
xor eax, eax
cmp eax, ebx
jne 0x10215fc4
cmp eax, ebx
je 0x10216003
mov eax, dword [eax + 0x3c]
mov dword [ebp - 8], eax
cmp eax, ebx
je 0x1021600a
push ebx
push eax
call fcn.1026492b
cmp eax, esi
je 0x10215ffa
mov dword [ebp - 8], ebx
jmp 0x1021600a
mov dword [ebp - 0x10], 1
jmp 0x1021600a
mov dword [ebp - 0x10], 4
push dword [ebp - 0x10]
push dword [ebp - 8]
push esi
push dword [edi + 0x3c]
call fcn.102647be
cmp byte [ebp - 2], bl
je 0x1021602f
mov ecx, dword [ebp + 0xc]
cmp ecx, ebx
je 0x1021602f
push 1
push 0xb
push ebx
call fcn.1021ffde
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0xc]
je 0x1021605b
cmp eax, ebx
je 0x10216047
mov edx, dword [edi]
push ebx
push eax
mov ecx, edi
call dword [edx + 0xc4]
cmp dword [ebp - 0xc], ebx
je 0x1021605b
mov eax, dword [edi]
push 1
push dword [ebp - 0xc]
mov ecx, edi
call dword [eax + 0xc4]
mov edi, dword [ebp + 8]
mov esi, 0x1000
cmp edi, ebx
je 0x1021608e
test byte [edi + 0x7e], 2
je 0x1021608e
mov ecx, edi
call fcn.10204632
test al, al
je 0x1021607c
mov eax, edi
jmp 0x10216082
push edi
call fcn.102762d3
cmp eax, ebx
je 0x1021608e
push esi
mov ecx, eax
call fcn.10217c9b
mov edi, dword [ebp + 0xc]
cmp edi, ebx
je 0x102160c1
cmp byte [ebp - 1], bl
je 0x102160c1
test byte [edi + 0x7e], 2
je 0x102160c1
mov ecx, edi
call fcn.10204632
test al, al
je 0x102160af
mov eax, edi
jmp 0x102160b5
push edi
call fcn.102762d3
cmp eax, ebx
je 0x102160c1
push esi
mov ecx, eax
call fcn.10217c9b
pop edi
pop esi
pop ebx
leave
ret 8