joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5138c2
Capabilities:
Contain obfuscated stackstrings

Disassembly:
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x5137a1
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.005134b3
push edi
xchg esp, eax
mov bl, 0xc7
lea eax, [ebp - 0x40]
push eax
call fcn.005134c3
push eax
push esi
push dword [ebp + 8]
call fcn.00513478
add esp, 0x10
mov dword [ebp - 0x88], eax
call fcn.005134b3
and al, byte [ecx + 0x7e]
lea eax, [ebp - 0x18]
mov byte [ebp - 0x18], bl
push eax
mov byte [ebp - 0x17], bl
mov byte [ebp - 0x16], 0x40
mov byte [ebp - 0x15], bl
mov byte [ebp - 0x14], 0xe9
mov byte [ebp - 0x13], 0xd6
mov byte [ebp - 0x12], 0xcd
mov byte [ebp - 0x11], 0xcb
mov byte [ebp - 0x10], 0xca
mov byte [ebp - 0xf], 0xde
mov byte [ebp - 0xe], 0xd3
mov byte [ebp - 0xd], 0xf9
mov byte [ebp - 0xc], 0xcd
mov byte [ebp - 0xb], 0xda
mov byte [ebp - 0xa], 0xda
mov byte [ebp - 9], 0xbf
call fcn.005134c3
push eax
push esi
push dword [ebp + 8]
call fcn.00513478
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.005134c3
push eax
push esi
push dword [ebp + 8]
jne 0x5138cc
call fcn.00513478
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.005134c3
push eax
push esi
push dword [ebp + 8]
call fcn.00513478
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.005134b3
adc ebp, edi
jnp 0x51399d
mov byte [ebp - 0x84], bl
mov byte [ebp - 0x83], bl
mov byte [ebp - 0x82], 0xe9
mov byte [ebp - 0x81], bl
mov byte [ebp - 0x80], 0x51
invalid
inc ebp
invalid
Function at 0x407fb0
Capabilities:
Delete directory

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
jne 0x407fbd
xor eax, eax
pop esi
ret
push edi
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
pop edi
jne 0x407fcf
pop esi
ret
cmp ecx, 1
jne 0x407fdd
cmp byte [esi], 0x5c
jne 0x407fdd
xor eax, eax
pop esi
ret
push esi
call fcn.00407d60
add esp, 4
test eax, eax
je 0x407ff1
push esi
call dword [sym.imp.KERNEL32.DLL_RemoveDirectoryA]
pop esi
ret

Function at 0x401000
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ebp, esp
add esp, 0xfffffffc
push esi
call dword [sym.imp.KERNEL32.DLL_GetCommandLineA]
mov dword [0x4033fc], eax
mov eax, dword [ebp + 4]
mov dword [0x40323a], eax
xor eax, eax
mov ecx, 0x16
push eax
dec ecx
jne 0x401020
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
push 0x7f00
push esi
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [ebp - 0x5c]
push ecx
mov eax, 0x30
mov dword [ecx], eax
mov eax, dword [0x40323a]
mov dword [ebp - 0x48], eax
mov eax, 0x4016df
mov dword [ebp - 0x54], eax
mov ecx, str.Hello
mov dword [ebp - 0x34], ecx
call dword [sym.imp.USER32.dll_RegisterClassExA]
xor ecx, ecx
push ecx
push dword [0x40323a]
push ecx
push ecx
push 0x12e
push 0x7a
push 0x34c
push 0x2aa
push 0x40000
lea eax, str.lukifas
push eax
mov eax, str.Hello
push eax
push ecx
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x403448], eax
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x403448]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
xor ebx, ebx
lea edi, [ebp - 0x50]
jmp 0x4010bc
push edi
call dword [sym.imp.USER32.dll_DispatchMessageA]
push ebx
push ebx
push ebx
push edi
call dword [sym.imp.USER32.dll_GetMessageA]
test al, al
jne 0x4010b5
mov esp, ebp
ret
Function at 0x403a74
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x390
mov eax, dword [0x44608c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
mov eax, 0x101
push 0
push eax
mov ecx, esi
mov dword [ebp - 0x390], eax
call fcn.004046c1
cmp dword [esi + 0x14], 8
jb 0x403aaa
mov eax, dword [esi]
jmp 0x403aac
mov eax, esi
lea ecx, [ebp - 0x390]
push ecx
push eax
push 2
call sub.Secur32.dll_GetUserNameExW
test al, al
je 0x403adf
push 0
push dword [ebp - 0x390]
mov ecx, esi
call fcn.004046c1
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004065bb
mov esp, ebp
pop ebp
ret 4
push 0x4243c0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xf
lea ecx, [ebp - 0x38c]
call fcn.004018f5
push 0x442bc0
lea eax, [ebp - 0x38c]
push eax
call fcn.004073d4
int3

Function at 0x41cee0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x1a000]
push edi
or ebp, 0xffffffff
jmp 0x41cf02
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x41cf09
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x41cef8
mov eax, 1
add ebx, ebx
jne 0x41cf1b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x41cf10
jne 0x41cf2c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41cf10
xor ecx, ecx
sub eax, 3
jb 0x41cf40
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x41cfb2
mov ebp, eax
add ebx, ebx
jne 0x41cf4b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x41cf58
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x41cf7c
inc ecx
add ebx, ebx
jne 0x41cf68
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x41cf5d
jne 0x41cf79
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41cf5d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x41cf9c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x41cf8d
jmp 0x41cefe
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x41cf9c
add edi, ecx
jmp 0x41cefe
pop esi
mov edi, esi
mov ecx, 0x157
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x41cfba
cmp byte [edi], 0
jne 0x41cfba
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x41cfbf
lea edi, [esi + 0x1a000]
mov eax, dword [edi]
or eax, eax
je 0x41d02e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1d0b0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1d100]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41cfec
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1d104]
or eax, eax
je 0x41d028
mov dword [ebx], eax
add ebx, 4
jmp 0x41d009
call dword [esi + 0x1d108]
popal
jmp 0x403ab4
Function at 0x10002f40
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x10064870]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push dword [0x10064010]
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
jne 0x10002f89
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_PeekMessageW]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10002e40
mov esp, ebp
pop ebp
ret 0x14
mov esi, dword [eax + 0x1078]
test esi, esi
je 0x10002f63
mov esi, dword [esi + 0x3c]
test esi, esi
je 0x1002a1b5
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
jne 0x10002fc3
test edx, edx
jne 0x10002fc3
test ecx, ecx
jne 0x10002fc3
lea ebx, [ecx + 2]
test al, 1
je 0x10002fc3
mov ebx, 3
push edi
mov edi, ebx
mov dword [ebp - 8], 1
and edi, 1
test edi, edi
je 0x10002fe9
xor ecx, ecx
lea eax, [esi + 0x64]
xchg dword [eax], ecx
test ecx, ecx
jne 0x100030f7
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x14]
cmp dword [ebp - 8], 0
je 0x1000310c
inc dword [esi + 0x8c]
push eax
push ecx
push edx
push dword [ebp + 0xc]
push dword [ebp + 8]
mov dword [ebp - 8], 0
call dword [sym.imp.USER32.dll_PeekMessageW]
push dword [0x10064010]
mov dword [ebp - 0xc], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
mov eax, dword [ebp - 0xc]
je 0x10003033
dec dword [esi + 0x8c]
test eax, eax
je 0x100030d0
pop edi
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10002e40
mov esp, ebp
pop ebp
ret 0x14
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
test bl, 2
je 0x10002fd0
xor ecx, ecx
lea eax, [esi + 0x64]
xchg dword [eax], ecx
mov eax, dword [ebp + 0x18]
test ecx, ecx
mov ecx, dword [ebp + 0x14]
je 0x10002fd0
mov ecx, esi
call fcn.100199d1
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
jmp 0x10002fd0
test bl, 2
je 0x10003155
mov edi, dword [esi + 4]
mov ebx, 3
mov dword [ebp - 0xc], 0xffffffff
add edi, 0x3c
lea ecx, [ecx]
jmp 0x1000312c
mov dword [ebp - 0xc], eax
jmp 0x1000314f
mov esi, dword [edi]
test esi, esi
je 0x1000314f
mov eax, dword [esi]
mov eax, dword [eax + 0xc]
mov dword [ebp - 8], eax
cmp eax, fcn.10002e90
jne 0x1001e53a
jmp 0x1001e532
cmp eax, dword [ebp - 0xc]
jb 0x10003127
add edi, 4
dec ebx
jne 0x1000312c
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop ebx
xor ecx, ebp
pop esi
call fcn.10002e40
mov esp, ebp
pop ebp
ret 0x14
or eax, 0xffffffff
jmp 0x1000314a
cmp eax, fcn.10002ea0
jne 0x1001e572
call dword [sym.imp.kernel32.dll_GetTickCount]
mov dword [ebp - 8], eax
sub eax, dword [esi + 0x34]
sub eax, dword [esi + 0x30]
js 0x1001e584
lea ecx, [esi + 8]
call fcn.10016da7
mov ecx, dword [ebp - 8]
mov dword [esi + 0x30], ecx
test eax, eax
jne 0x1000314a
mov eax, 5
jmp 0x1000314a
mov ecx, eax
call dword [0x10067390]
mov ecx, esi
call dword [ebp - 8]
jmp 0x1000314a
neg eax
jmp 0x1001e560
xor eax, eax
jmp 0x10003035
Function at 0x10003170
Capabilities:
Get thread local storage value

Disassembly:
mov esi, dword [ebp - 0x18]
cmp eax, esi
jb 0x1001e5fa
add edi, 4
dec ebx
jne 0x100031ca
mov cl, byte [ebp - 5]
test cl, cl
je 0x1002a1bc
mov edx, dword [ebp - 0xc]
cmp esi, edx
ja 0x100031f4
mov edi, dword [ebp - 0x14]
mov eax, dword [edi + 0x6c]
mov dword [ebp - 0x10], eax
cmp esi, 1
jbe 0x100031fb
lea ebx, [ebx]
push 2
push 0x1cff
push esi
lea eax, [ebp - 0x10]
push eax
push 1
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjectsEx]
mov ecx, eax
cmp ecx, 1
je 0x100030ba
cmp ecx, 0xc0
je 0x10003085
test ecx, ecx
jne 0x1002a1d3
mov dword [edi + 0x90], 1
pop edi
pop esi
pop ebx
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10002e40
mov esp, ebp
pop ebp
ret
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x10064870]
xor eax, ebp
mov dword [ebp - 4], eax
push dword [0x10064010]
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x1002a221
mov eax, dword [eax + 0x1078]
test eax, eax
je 0x1002a221
mov ecx, dword [eax + 0x3c]
mov dword [ebp - 0x14], ecx
test ecx, ecx
je 0x100030bd
push ebx
push esi
or edx, 0xffffffff
push edi
mov dword [ebp - 0xc], edx
cmp dword [ecx + 0x64], 0
jne 0x1002a212
jmp 0x1001e588
mov esi, dword [edi]
test esi, esi
je 0x100031ec
mov eax, dword [esi]
mov byte [ebp - 5], 1
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x10], eax
cmp eax, fcn.10002e90
je 0x1001e5a4
jmp 0x1001e5ac
mov esi, dword [ebp - 0x18]
jmp 0x10003051
mov esi, edx
jmp 0x10003071
xor esi, esi
jmp 0x10003085
mov edi, dword [ecx + 4]
mov ebx, 3
xor cl, cl
mov dword [ebp - 0x18], 0xffffffff
mov byte [ebp - 5], cl
add edi, 0x3c
jmp 0x100031ca
or eax, 0xffffffff
jmp 0x10003046
cmp eax, fcn.10002ea0
jne 0x1001e5e4
call dword [sym.imp.kernel32.dll_GetTickCount]
mov dword [ebp - 0x10], eax
sub eax, dword [esi + 0x34]
sub eax, dword [esi + 0x30]
js 0x1001e5f6
lea ecx, [esi + 8]
call fcn.10016da7
mov ecx, dword [ebp - 0x10]
mov dword [esi + 0x30], ecx
test eax, eax
jne 0x10003046
mov eax, 5
jmp 0x10003046
mov ecx, eax
call dword [0x10067390]
mov ecx, esi
call dword [ebp - 0x10]
jmp 0x10003046
neg eax
jmp 0x1001e5d2
mov esi, eax
mov dword [ebp - 0x18], esi
jmp 0x10003051
cmp esi, 0xffffffff
je 0x1002a1c9
test esi, esi
jne 0x10003066
mov esi, 5
jmp 0x10003066
lea eax, [ecx - 0x80]
test eax, eax
je 0x1002a1e6
cmp ecx, 0x102
jne 0x100030ba
cmp dword [ebp - 0xc], 0xffffffff
mov ecx, edi
je 0x100031bb
call dword [sym.imp.kernel32.dll_GetTickCount]
mov edx, dword [ebp - 0xc]
mov ecx, edi
cmp eax, edx
jae 0x1002a208
sub edx, eax
jmp 0x100031b8
xor eax, eax
mov dword [ebp - 0xc], eax
jmp 0x100031bb
mov dword [ecx + 0x90], 1
jmp 0x100030ba
call dword [sym.imp.USER32.dll_WaitMessage]
jmp 0x100030c2
Function at 0x10003210
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push dword [0x10064010]
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
jne 0x1002ce00
pop ebp
jmp dword [sym.imp.USER32.dll_GetMessageW]
mov ecx, dword [eax + 0x1078]
test ecx, ecx
je 0x10003229
mov ecx, dword [ecx + 0x3c]
push 2
push 1
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.10016da7
pop ebp
ret 0x10
Function at 0x10005370
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x10064870]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
push dword [0x10064010]
xor edi, edi
mov dword [ebp - 8], edi
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x1002bdd9
cmp dword [eax + 0x1078], edi
je 0x1002bdd9
push esi
push dword [0x10064010]
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x1002bd78
mov esi, dword [eax + 0x1078]
test esi, esi
je 0x1002bd72
test byte [esi + 0x2c], 2
jne 0x1002bd78
jmp 0x1001ea6f
lea ecx, [esi + 4]
cmp dword [0x10066330], edi
je 0x1001eaa3
mov eax, 1
lock xadd dword [ecx], eax
jmp 0x1001ea80
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x1001eac3
mov eax, dword [ebx]
mov edi, dword [eax + 0x14]
mov ecx, edi
call dword [0x10067390]
mov ecx, ebx
call edi
test al, 4
je 0x1001eac3
cmp esi, dword [ebx + 0x10]
jne 0x1001eaa9
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x10019e2e
mov eax, dword [ebx]
mov edi, dword [eax + 0x14]
mov ecx, edi
call dword [0x10067390]
mov ecx, ebx
call edi
test al, 4
je 0x10019e35
test ebx, ebx
je 0x1001eac3
cmp esi, dword [ebx + 0x10]
jne 0x1001eaa9
mov ecx, dword [ebp + 0x10]
test ecx, ecx
jne 0x1002bda2
xor edx, edx
cmp dword [esi + 0x28], 0
jne 0x1001eab3
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0x3c]
test eax, 0x400000
jne 0x1001eac3
test ebx, ebx
je 0x1000548d
test al, 1
je 0x1002bdbf
push dword [ebp + 0x14]
push edx
push ebx
call fcn.10016da7
test eax, eax
jns 0x1001ea90
jmp 0x1001eabd
mov eax, dword [ebp - 8]
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.10002e40
mov esp, ebp
pop ebp
ret 0x10
xor ebx, ebx
jmp 0x10005459
xor ebx, ebx
jmp 0x10005448
cmp dword [esi + 0x24], edi
lea eax, [esi + 0xc]
je 0x100053da
jmp 0x1002bd8a
inc dword [esi + 8]
cmp dword [ebp + 0x14], 6
push ebx
jbe 0x100053f7
jmp 0x1001eac3
mov dword [ebp - 8], 1
mov ecx, esi
call fcn.1001f0a0
jmp 0x100054a4
inc dword [ecx]
mov eax, dword [ecx]
jmp 0x1001ea80
push 0x8004001e
jmp 0x1002bdce
push 0x8004001f
jmp 0x1002bdce
push eax
jmp 0x1002bdce
push 0x80070057
jmp 0x1002bdce
mov dword [0], edi
push 0x80070057
call dword [sym.imp.kernel32.dll_SetLastError]
mov eax, edi
jmp 0x100054a8
cmp dword [0x10066330], edi
je 0x100053da
push eax
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
jmp 0x100053da
call fcn.10016da7
mov edx, eax
test edx, edx
je 0x1001eac3
cmp esi, dword [edx + 0x10]
je 0x10005466
jmp 0x1001eaa9
test byte [ebx + 0x3c], 1
je 0x1000548d
push 0x80040028
call dword [sym.imp.kernel32.dll_SetLastError]
jmp 0x1001ea97
push 0x80040014
call dword [sym.imp.kernel32.dll_SetLastError]
mov eax, edi
jmp 0x100054a9
Function at 0x100054c0
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x10064870]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
push dword [0x10064010]
xor edi, edi
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x10020d57
cmp dword [eax + 0x1078], edi
je 0x10020d57
push ebx
push dword [0x10064010]
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x1000552a
mov ebx, dword [eax + 0x1078]
test ebx, ebx
je 0x10020cbf
mov dword [ebp - 0x10], edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], edi
test ebx, ebx
jne 0x1001ed7b
jmp 0x10020d47
xor ebx, ebx
jmp 0x10005514
test byte [ebx + 0x2c], 2
jne 0x10020d47
cmp dword [ebx + 0x24], edi
lea eax, [ebx + 0xc]
jne 0x10020cca
lea ecx, [ebx + 4]
cmp dword [0x10066330], edi
je 0x1001ee97
mov eax, 1
lock xadd dword [ecx], eax
inc dword [ebx + 8]
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x10020d37
mov eax, dword [esi]
mov edi, dword [eax + 0x14]
mov ecx, edi
call dword [0x10067390]
mov ecx, esi
call edi
test al, 4
je 0x1001ef25
cmp ebx, dword [esi + 0x10]
jne 0x10020ce2
xor edi, edi
cmp dword [esi + 0x48], edi
jne 0x1001eea0
test dword [esi + 0x3c], 0x80000
jne 0x10020cf4
cmp dword [esi + 0x5c], 0
jne 0x1001eeaa
cmp dword [esi + 0x60], 0
jne 0x1001eeb2
cmp dword [esi + 0x64], 0
jne 0x1001eeba
cmp dword [esi + 0x68], 0
jne 0x1001eec2
cmp dword [esi + 0x6c], 0
jne 0x1001eecd
cmp dword [esi + 0x70], 0
jne 0x1001eed8
cmp dword [esi + 0x78], 0
jne 0x1001eee3
cmp dword [esi + 0x74], 0
jne 0x1001eeee
cmp dword [esi + 0x7c], 0
jne 0x1001eef9
cmp dword [esi + 0x88], 0
jne 0x1001ef04
cmp dword [esi + 0x80], 0
jne 0x1001ef0f
cmp dword [esi + 0x8c], 0
jne 0x1001ef1a
mov ecx, ebx
call fcn.1001f0a0
pop esi
lea ecx, [ebp - 0x10]
call fcn.10004795
pop ebx
mov ecx, dword [ebp - 4]
mov eax, edi
xor ecx, ebp
pop edi
call fcn.10002e40
mov esp, ebp
pop ebp
ret 4
inc dword [ecx]
mov eax, dword [ecx]
jmp 0x1001eda9
mov edi, 1
jmp 0x1001ede5
or edi, 8
jmp 0x1001edfc
or edi, 0x10
jmp 0x1001ee06
or edi, 0x40
jmp 0x1001ee10
or edi, 0x80
jmp 0x1001ee1a
or edi, 0x100
jmp 0x1001ee24
or edi, 0x200
jmp 0x1001ee2e
or edi, 0x800
jmp 0x1001ee38
or edi, 0x400
jmp 0x1001ee42
or edi, 0x1000
jmp 0x1001ee4c
or edi, 0x2000
jmp 0x1001ee59
or edi, 0x4000
jmp 0x1001ee66
or edi, 0x8000
jmp 0x1001ee73
xor edi, edi
jmp 0x10020d37
mov dword [0], edi
jmp 0x10005514
cmp dword [0x10066330], edi
je 0x1001ed91
push eax
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
jmp 0x1001ed91
push 0x8004001e
call dword [sym.imp.kernel32.dll_SetLastError]
xor edi, edi
jmp 0x1001ee73
cmp dword [esi + 0x44], 0
jne 0x1001edf2
mov ecx, esi
call fcn.10016da7
test eax, eax
je 0x1001edf2
cmp dword [eax + 0x5c0], 0
jle 0x10020d19
or edi, 2
cmp dword [eax + 0x668], 0
je 0x10020d25
or edi, 4
cmp byte [eax + 0xd], 0
je 0x1001edf2
or edi, 0x20
jmp 0x1001edf2
push 0x80070057
call dword [sym.imp.kernel32.dll_SetLastError]
jmp 0x1001ee73
push 0x80070057
call dword [sym.imp.kernel32.dll_SetLastError]
jmp 0x1001ee7b
push 0x80040014
call dword [sym.imp.kernel32.dll_SetLastError]
jmp 0x1001ee84
Function at 0x100055e0
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push esi
mov esi, ecx
cmp dword [esi + 4], 0
je 0x100055ff
test byte [esi + 0x60], 1
jne 0x10022353
test byte [esi + 0x60], 2
jne 0x10022367
push esi
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapFree]
pop esi
ret
push dword [0x10064010]
call dword [sym.imp.kernel32.dll_TlsGetValue]
lea ecx, [eax + 0x1030]
jmp 0x10022379
push dword [0x10064010]
call dword [sym.imp.kernel32.dll_TlsGetValue]
lea ecx, [eax + 0x1050]
push dword [esi + 4]
call fcn.10016da7
jmp 0x100055ff
Function at 0x10008dd3
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push esi
mov esi, ecx
push edi
push dword [0x10064010]
xor edi, edi
mov dword [esi + 4], 1
mov dword [esi + 0xc], edi
mov dword [esi], 0x10003864
mov dword [esi + 0x14], 0x10019320
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x10008e28
mov eax, dword [eax + 0x1078]
test eax, eax
je 0x10008e20
mov dword [esi + 0x10], eax
mov eax, esi
pop edi
pop esi
ret
mov dword [0], edi
jmp 0x10008e18
mov eax, edi
jmp 0x10008e18

Function at 0x1000dd65
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x10066330]
push esi
mov esi, ecx
push 0x1f4
lea edx, [esi + 0xc]
mov dword [esi + 4], 1
mov dword [esi], 0x100038f4
push edx
mov dword [edx + 0x18], eax
call dword [sym.imp.kernel32.dll_InitializeCriticalSectionAndSpinCount]
push dword [0x10064010]
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov dword [eax + 0x1078], esi
mov eax, esi
pop esi
ret

Function at 0x1000dd6a
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x10066330]
push esi
mov esi, ecx
push 0x1f4
lea edx, [esi + 0xc]
mov dword [esi + 4], 1
mov dword [esi], 0x100038f4
push edx
mov dword [edx + 0x18], eax
call dword [sym.imp.kernel32.dll_InitializeCriticalSectionAndSpinCount]
push dword [0x10064010]
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov dword [eax + 0x1078], esi
mov eax, esi
pop esi
ret

Function at 0x100128ce
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebx
push edi
mov edi, ecx
mov ebx, 0x80004005
cmp dword [edi + 0xc], 0
je 0x100171b4
mov eax, dword [edi + 0xc]
dec eax
neg eax
pop edi
sbb eax, eax
and eax, ebx
pop ebx
ret
push esi
push dword [0x10064010]
call dword [sym.imp.kernel32.dll_TlsGetValue]
push 1
lea ecx, [eax + 0x1074]
call fcn.10016da7
mov esi, eax
neg esi
sbb esi, esi
and esi, 0x7fffbffb
add esi, ebx
mov ecx, esi
call fcn.1000ec37
xor ecx, ecx
test esi, esi
pop esi
sets cl
inc ecx
mov dword [edi + 0xc], ecx
jmp 0x100128e3

Function at 0x10016da7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x10016db6
pop dword [ebp - 0x38]
mov eax, 0x7fc2e2a3
add eax, 0x903e8b13
sub dword [ebp - 0x38], eax
push 0x40
push 0x1000
push 0x4b22b
push 0
mov eax, 0x712b4dd1
sub eax, 0x6124dd25
add eax, dword [ebp - 0x38]
call dword [eax]
mov ecx, 0xd51f0fa4
sub ecx, 0xd51ec104
xor edx, edx
add edx, eax
mov edi, 0xa4a6da30
sub edi, 0x949f6630
add edi, dword [ebp - 0x38]
mov esi, 0x408f9e68
xor dword [ebp - 4], eax
mov ebx, dword [edi]
add dword [ebp - 0x24], eax
xor ebx, esi
sub dword [ebp - 0x10], edx
mov dword [edx], ebx
add dword [ebp - 0x34], eax
add edx, 0x197b3db6
add edx, 0xe684c24e
add edi, 0xa6036578
sub edi, 0xa6036574
loop 0x10016e11
add eax, 0x55387e2c
add eax, 0xaac8af27
xor ebx, ebx
add ebx, eax
add eax, 0xa3b5cc8c
sub eax, 0xa3b5cc87
mov ecx, 0xbd29fc53
sub ecx, 0xad29fc53
add ecx, dword [ebp - 0x38]
call ebx
leave
ret