joyce8/EMBER2024-capa huggingface dataset:
Function at 0x19723c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x114
push ebx
push esi
push edi
xor eax, eax
mov ecx, 0x3f
lea edi, [esp + 0x20]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0xf
stosb byte es:[edi], al
call fcn.01971070
mov cl, byte [eax]
xor ebx, ebx
add esp, 4
xor edi, edi
cmp cl, bl
mov byte [esp + 0xc], cl
je 0x1972414
lea esi, [esp + 0xc]
sub esi, eax
lea ecx, [ecx]
mov cl, byte [eax + 1]
inc edi
inc eax
mov dl, cl
dec dl
xor dl, byte [esi + eax - 1]
cmp cl, bl
mov byte [esi + eax], dl
jne 0x1972400
lea eax, [esp + 0xc]
mov byte [esp + edi + 0xc], bl
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x1972420
sub eax, edx
mov byte [esp + eax + 0xb], bl
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [esp + 0x10]
push ecx
lea ebx, [esp + 0x28]
call fcn.01971390
mov eax, dword [ebp + 8]
mov edx, ebx
push edx
push eax
mov eax, dword [ebp + 0xc]
call fcn.01971e60
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1972460
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x114
push ebx
push esi
push edi
xor eax, eax
mov ecx, 0x3f
lea edi, [esp + 0x20]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x21
stosb byte es:[edi], al
call fcn.01971070
mov cl, byte [eax]
xor ebx, ebx
add esp, 4
xor edi, edi
cmp cl, bl
mov byte [esp + 0xc], cl
je 0x19724b4
lea esi, [esp + 0xc]
sub esi, eax
lea ecx, [ecx]
mov cl, byte [eax + 1]
inc edi
inc eax
mov dl, cl
dec dl
xor dl, byte [esi + eax - 1]
cmp cl, bl
mov byte [esi + eax], dl
jne 0x19724a0
lea eax, [esp + 0xc]
mov byte [esp + edi + 0xc], bl
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x19724c0
sub eax, edx
mov byte [esp + eax + 0xb], bl
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [esp + 0x10]
push ecx
lea ebx, [esp + 0x28]
call fcn.01971390
mov eax, dword [ebp + 8]
mov edx, ebx
push edx
push eax
mov eax, dword [ebp + 0xc]
call fcn.01971e60
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1972500
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x114
push ebx
push esi
push edi
xor eax, eax
mov ecx, 0x3f
lea edi, [esp + 0x20]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x29
stosb byte es:[edi], al
call fcn.01971070
mov cl, byte [eax]
add esp, 4
xor edi, edi
test cl, cl
mov byte [esp + 0xc], cl
je 0x1972555
lea esi, [esp + 0xc]
sub esi, eax
jmp 0x1972540
mov cl, byte [eax + 1]
mov bl, byte [esi + eax]
inc edi
inc eax
mov dl, cl
dec dl
xor dl, bl
test cl, cl
mov byte [esi + eax], dl
jne 0x1972540
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [esp + 0x10]
push ecx
lea ebx, [esp + 0x28]
mov byte [esp + edi + 0x14], 0
call fcn.01971390
mov eax, dword [ebp + 8]
mov edx, ebx
push edx
push eax
mov eax, dword [ebp + 0xc]
call fcn.01971e60
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1972590
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x114
push ebx
push esi
push edi
xor eax, eax
mov ecx, 0x3f
lea edi, [esp + 0x20]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x31
stosb byte es:[edi], al
call fcn.01971070
mov cl, byte [eax]
xor ebx, ebx
add esp, 4
xor edi, edi
cmp cl, bl
mov byte [esp + 0xc], cl
je 0x19725e4
lea esi, [esp + 0xc]
sub esi, eax
lea ecx, [ecx]
mov cl, byte [eax + 1]
inc edi
inc eax
mov dl, cl
dec dl
xor dl, byte [esi + eax - 1]
cmp cl, bl
mov byte [esi + eax], dl
jne 0x19725d0
lea eax, [esp + 0xc]
mov byte [esp + edi + 0xc], bl
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x19725f0
sub eax, edx
mov byte [esp + eax + 0xb], bl
push ebx
lea eax, [esp + 0x10]
push eax
lea ebx, [esp + 0x28]
call fcn.01971390
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov ecx, ebx
push ecx
push edx
call fcn.01971e60
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1972960
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x118
mov eax, dword [esp + 0x120]
push ebx
mov ebx, dword [eax]
push ebp
mov ebp, dword [esp + 0x12c]
push esi
push edi
push 0x16
call fcn.01971070
mov cl, byte [eax]
add esp, 4
xor edi, edi
test cl, cl
mov byte [esp + 0x10], cl
je 0x19729aa
lea esi, [esp + 0x10]
sub esi, eax
mov cl, byte [eax + 1]
inc edi
inc eax
mov dl, cl
dec dl
xor dl, byte [esi + eax - 1]
test cl, cl
mov byte [esi + eax], dl
jne 0x1972996
mov byte [esp + edi + 0x10], 0
xor eax, eax
mov ecx, 0x41
lea edi, [esp + 0x24]
lea edx, [esp + 0x24]
rep stosd dword es:[edi], eax
mov eax, ebp
sub edx, ebp
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x19729c4
mov al, byte [esp + 0x24]
mov ebp, dword [ebx + 0x8c]
xor edi, edi
test al, al
lea esi, [esp + 0x24]
je 0x19729ff
xor eax, eax
mov al, byte [esi]
push eax
call ebp
test eax, eax
je 0x19729f2
add esi, 2
jmp 0x19729fa
cmp byte [esi], 0x5c
jne 0x19729f9
mov edi, esi
inc esi
cmp byte [esi], 0
jne 0x19729e2
lea eax, [esp + 0x24]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1972a06
sub eax, edx
lea ecx, [esp + eax + 0x23]
cmp edi, ecx
je 0x1972a2e
lea eax, [esp + 0x24]
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1972a20
sub eax, edx
mov byte [esp + eax + 0x24], 0x5c
mov eax, dword [esp + 0x138]
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1972a37
lea edi, [esp + 0x24]
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x1972a45
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov al, byte [esp + 0x24]
mov ebp, dword [ebx + 0x8c]
xor edi, edi
test al, al
lea esi, [esp + 0x24]
je 0x1972a8d
nop
xor edx, edx
mov dl, byte [esi]
push edx
call ebp
test eax, eax
je 0x1972a80
add esi, 2
jmp 0x1972a88
cmp byte [esi], 0x5c
jne 0x1972a87
mov edi, esi
inc esi
cmp byte [esi], 0
jne 0x1972a70
lea eax, [esp + 0x24]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1972a94
sub eax, edx
lea eax, [esp + eax + 0x23]
cmp edi, eax
je 0x1972abe
lea eax, [esp + 0x24]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1972ab0
sub eax, edx
mov byte [esp + eax + 0x24], 0x5c
lea eax, [esp + 0x10]
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1972ac4
lea edi, [esp + 0x24]
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x1972ad2
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push 0
push 0x10000000
push 2
push 0
mov ecx, eax
and ecx, 3
push 0
rep movsb byte es:[edi], byte [esi]
push 0xc0000000
lea ecx, [esp + 0x3c]
push ecx
call dword [ebx + 0x10]
cmp eax, 0xffffffff
mov edx, dword [esp + 0x12c]
mov dword [edx + 0x2c], eax
jne 0x1972b38
lea eax, [esp + 0x24]
push eax
call dword [ebx + 0x78]
mov ecx, dword [esp + 0x134]
push eax
push ecx
call fcn.019720d0
add esp, 0xc
pop edi
pop esi
pop ebp
xor ax, ax
pop ebx
add esp, 0x118
ret
pop edi
pop esi
pop ebp
mov ax, 1
pop ebx
add esp, 0x118
ret
Function at 0x1973be0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x14
push ebx
push ebp
mov ebp, dword [esp + 0x28]
mov ebx, dword [ebp]
push esi
push edi
push 0x33
xor esi, esi
call fcn.01971070
mov dl, byte [eax]
mov byte [esp + 0x14], dl
mov dl, byte [eax]
add esp, 4
xor ecx, ecx
test dl, dl
je 0x1973c23
lea edi, [esp + 0x10]
sub edi, eax
mov edi, edi
mov dl, byte [eax + 1]
inc ecx
inc eax
dec dl
xor dl, byte [edi + eax - 1]
mov byte [edi + eax], dl
cmp byte [eax], 0
jne 0x1973c10
lea eax, [esp + 0x10]
push eax
push 0
push 0
mov byte [esp + ecx + 0x1c], 0
call dword [ebx + 0x50]
mov edi, eax
test edi, edi
jne 0x1973c52
call dword [ebx + 0x78]
push eax
push ebp
call fcn.01972590
add esp, 8
pop edi
pop esi
pop ebp
xor ax, ax
pop ebx
add esp, 0x14
ret
push 0xffffffffffffffff
push edi
call dword [ebx + 0x74]
test eax, eax
je 0x1973c81
cmp eax, 0xffffffff
jne 0x1973cca
call dword [ebx + 0x78]
push eax
push ebp
call fcn.01972590
add esp, 8
push edi
call dword [ebx + 0x60]
push edi
call dword [ebx + 0x1c]
pop edi
mov ax, si
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x3c]
mov eax, dword [esp + 0x38]
push ecx
mov ecx, dword [esp + 0x38]
push edx
mov edx, dword [esp + 0x34]
push eax
push ecx
push edx
mov edx, dword [esp + 0x3c]
mov eax, ebp
call fcn.01973ad0
add esp, 0x14
mov esi, eax
cmp si, 1
jne 0x1973cca
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x2c]
push eax
push ecx
push ebp
push edx
call fcn.01972b50
add esp, 0x10
mov esi, eax
push edi
call dword [ebx + 0x60]
push edi
call dword [ebx + 0x1c]
pop edi
mov ax, si
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x10014630
Capabilities:
Enumerate process modules
Get common file path

Disassembly:
push esi
mov esi, ecx
call fcn.10018b90
call fcn.1000d420
call fcn.100190f0
call fcn.100092f0
call fcn.1002aff0
mov ecx, eax
call fcn.10037430
call fcn.1002aff0
mov ecx, eax
call fcn.1002aff0
mov esi, dword [esi]
test esi, esi
je 0x10014675
mov ecx, esi
call fcn.1002aff0
push esi
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
add esp, 4
call fcn.10013770
call fcn.1002d0f0
pop esi
jmp fcn.1001f4d0

Function at 0x10016a60
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003ef28
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x1006b894]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x40], eax
cmp dword [esi + 0x30], ebx
jne 0x10016ad9
movzx ecx, word [esi + 0x28]
mov eax, dword [esi + 4]
push ecx
lea edx, [esi + 0xc]
push edx
push eax
call fcn.1000d760
mov ecx, eax
call fcn.1002aff0
mov dword [esi + 0x30], eax
cmp eax, ebx
jne 0x10016ad9
push str.Hyphenation_service_not_supported
push 0xffffff36
lea ecx, [ebp - 0x3c]
call fcn.1002aff0
push 0x1005d268
lea ecx, [ebp - 0x3c]
push ecx
call sub.MSVCR100.dll__CxxThrowException
call fcn.1002aff0
mov ecx, eax
call fcn.10037410
test al, al
je 0x10016b61
cmp byte [esi + 0x3d], bl
jne 0x10016b61
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x4c], esp
push 6
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], ebx
push 0x10046540
mov byte [ecx], bl
call fcn.1002aff0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x44], esp
push 0xffffffffffffffff
push ebx
lea edx, [esi + 0xc]
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], ebx
push edx
mov dword [ebp - 4], ebx
mov byte [ecx], bl
call fcn.1002aff0
mov ecx, dword [esi + 4]
mov eax, dword [ecx]
mov eax, dword [eax + 4]
push ecx
mov edx, esp
mov dword [ebp - 0x48], esp
mov bl, 1
push edx
mov byte [ebp - 4], bl
call eax
mov byte [ebp - 4], 2
call fcn.1002aff0
mov ecx, eax
mov dword [ebp - 4], 0xffffffff
call fcn.1002aff0
mov byte [esi + 0x3d], bl
mov ecx, dword [esi + 0x30]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x40]
mov edx, dword [edx + 0xc]
push eax
call edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1003c1ea
mov esp, ebp
pop ebp
ret 4
Function at 0x10022c80
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1004081c
mov eax, dword fs:[0]
push eax
sub esp, 0x478
mov eax, dword [0x1006b894]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, dword [sym.imp.kernel32.dll_ReadFile]
xor ebx, ebx
mov esi, ecx
mov dword [ebp - 0x484], ebx
cmp byte [esi + 0x28], bl
je 0x10022de1
mov edx, dword [esi + 4]
push ebx
lea eax, [ebp - 0x480]
push eax
push 0x400
lea ecx, [ebp - 0x414]
push ecx
push edx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x480], ebx
call edi
cmp eax, ebx
jne 0x10022d19
call dword [sym.imp.kernel32.dll_GetLastError]
push str.MailSlotRead
push eax
lea ecx, [ebp - 0x47c]
call fcn.1002aff0
push 0x1005d268
lea eax, [ebp - 0x47c]
push eax
call sub.MSVCR100.dll__CxxThrowException
cmp dword [ebp - 0x480], ebx
jne 0x10022d2a
mov dword [ebp - 4], 0xffffffff
jmp 0x10022cc1
mov dword [ebp - 0x420], 0xf
mov dword [ebp - 0x424], ebx
mov byte [ebp - 0x434], bl
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 1
call fcn.1002aff0
lea ecx, [ebp - 0x450]
mov byte [ebp - 4], 2
call fcn.10036db0
mov edx, dword [esi]
mov edx, dword [edx + 8]
lea eax, [ebp - 0x450]
push eax
lea ecx, [ebp - 0x434]
push ecx
lea eax, [ebp - 0x414]
push eax
mov ecx, esi
mov byte [ebp - 4], 3
call edx
cmp al, bl
je 0x10022d99
lea eax, [ebp - 0x450]
push eax
lea ecx, [ebp - 0x434]
push ecx
mov ecx, esi
call fcn.1002aff0
lea ecx, [ebp - 0x450]
mov byte [ebp - 4], 2
call fcn.10035170
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 4
call sym.AdobeLinguistic.dll_public:_void___thiscall_devtech::RCPtr_struct_devtech::LM_UniString::StringValue_::destructor_void_
cmp dword [ebp - 0x420], 0x10
jb 0x10022dcf
mov edx, dword [ebp - 0x434]
push edx
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [ebp - 4], 0xffffffff
jmp 0x10022cc1
mov eax, dword [ebp - 0x484]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1003c1ea
mov esp, ebp
pop ebp
ret
Function at 0x1002aff0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x1002afff
pop dword [ebp - 0x28]
mov eax, 0x44d8cb78
add eax, 0xcb29e487
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0x3575ac4e
add dword [ebp - 0x38], 0x18dc98fd
mov dword [ebp - 0x34], 0xfc4ba10a
add dword [ebp - 0x34], 0x35e7ab3b
mov dword [ebp - 0x30], 0xb7a5e7ab
sub dword [ebp - 0x30], 0x6b59a37d
mov dword [ebp - 0x2c], 0xac66d9fa
sub dword [ebp - 0x2c], 0xac66d9fa
lea eax, [ebp - 0x38]
push eax
mov eax, 0x78417fa0
sub eax, 0x683d2ed4
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0x132ac139
sub dword [ebp - 0x38], 0x9eb857e3
mov dword [ebp - 0x34], 0x16fe86d4
add dword [ebp - 0x34], 0x2a6ddaa1
mov dword [ebp - 0x30], 0x2e5932ea
sub dword [ebp - 0x30], 0xcae9c67e
mov dword [ebp - 0x2c], 0x93e8b13c
sub dword [ebp - 0x2c], 0x93e8b13c
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x46405
push 0
call eax
mov ecx, 0xd942327f
add ecx, 0x26be1f9f
mov edi, eax
mov esi, 0x10079c00
add esi, dword [ebp - 0x28]
mov ebx, 0x30eb1575
add dword [ebp - 0x1c], 0x3557fff4
mov edx, dword [esi]
add dword [ebp - 0x18], edx
xor edx, ebx
xor dword [ebp - 0x1c], esi
mov dword [edi], edx
add edi, 0xb5216644
add edi, 0x4ade99c0
add esi, 0x2be6afc5
sub esi, 0x2be6afc1
loop 0x1002b110
add eax, 0x9978b135
sub eax, 0x997775ea
mov ebx, eax
add eax, 0x95dcd05
add eax, 0xf6a23300
mov ecx, 0x10000000
add ecx, dword [ebp - 0x28]
call ebx
leave
ret

Function at 0x1003ba10
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x1006bd68]
test eax, eax
je 0x1003ba3b
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x1003ba3b
mov eax, dword [eax + 0x14]
test eax, eax
je 0x1003ba3b
mov ecx, dword [esp + 4]
nop
cmp dword [eax], ecx
je 0x1003ba3e
mov eax, dword [eax + 0x10]
test eax, eax
jne 0x1003ba30
xor eax, eax
ret
mov eax, dword [eax + 0xc]
ret

Function at 0x1003bc40
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov eax, dword [0x1006bd68]
push edi
mov edi, dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x1003bc57
push eax
call edi
test eax, eax
jne 0x1003bc8d
push esi
call fcn.1002aff0
push 0x1003b950
push 0x1006bd64
mov esi, eax
call fcn.1002aff0
mov eax, dword [0x1006bd68]
add esp, 8
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov eax, dword [0x1006bd68]
pop esi
test eax, eax
jne 0x1003bc8a
pop edi
ret
push eax
call edi
pop edi
ret
Function at 0x1003bd80
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push 0xffffffffffffffff
push 0x10043248
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x1006b894]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov eax, dword [0x1006bd68]
test eax, eax
jne 0x1003bdb2
xor esi, esi
jmp 0x1003bdbb
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov esi, eax
mov dword [esp + 0x14], esi
mov ebp, dword [sym.imp.kernel32.dll_HeapFree]
mov dword [esp + 0x20], 0
test esi, esi
je 0x1003bdfd
cmp dword [esi + 0x14], 0
jne 0x1003be3f
cmp dword [esi + 0x10], 0
jne 0x1003be45
push 0x1003b950
push 0x1006bd64
call fcn.1002aff0
mov eax, dword [0x1006bd68]
add esp, 8
push 0
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov dword [esp + 0x20], 0xffffffff
test esi, esi
je 0x1003be2b
lea ecx, [esi + 4]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x1003be2b
mov eax, dword [esi]
mov edx, dword [eax]
push 0
mov ecx, esi
call edx
push esi
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call ebp
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
cmp dword [esi + 0x10], 0
je 0x1003be85
mov ebx, dword [esi + 0x10]
mov eax, dword [ebx + 4]
mov dword [esi + 0x10], eax
mov ecx, dword [ebx]
test ecx, ecx
je 0x1003be73
mov edx, dword [ecx]
mov eax, dword [edx + 4]
call eax
mov edi, dword [ebx]
mov edx, dword [edi]
mov eax, dword [edx]
push 0
mov ecx, edi
call eax
push edi
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call ebp
push ebx
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call ebp
cmp dword [esi + 0x10], 0
jne 0x1003be45
cmp dword [esi + 0x14], 0
je 0x1003bdd7
mov edi, dword [esi + 0x14]
mov ecx, dword [edi + 0x10]
mov dword [esi + 0x14], ecx
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x1003beaa
mov edx, dword [ecx]
mov eax, dword [edi + 0xc]
mov edx, dword [edx + 4]
push eax
call edx
mov ebx, dword [edi + 8]
test ebx, ebx
je 0x1003bedb
lea eax, [ebx + 4]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x1003bedb
mov edx, dword [ebx]
mov eax, dword [edx + 4]
mov ecx, ebx
call eax
lea ecx, [ebx + 8]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x1003bedb
mov eax, dword [ebx]
mov edx, dword [eax + 8]
mov ecx, ebx
call edx
push edi
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call ebp
cmp dword [esi + 0x14], 0
jne 0x1003be8f
jmp 0x1003bdd1
jmp 0x1003bd80
Function at 0x1003bf00
Capabilities:
Get thread local storage value

Disassembly:
push 0xffffffffffffffff
push 0x10043278
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x1006b894]
xor eax, esp
push eax
lea eax, [esp + 8]
mov dword fs:[0], eax
mov eax, dword [0x1006bd68]
mov dword [esp + 0x10], 0
test eax, eax
je 0x1003bf53
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x1003bf53
mov esi, dword [eax + 0x14]
test esi, esi
je 0x1003bf53
mov eax, dword [esp + 0x18]
cmp dword [esi], eax
je 0x1003bfc0
mov esi, dword [esi + 0x10]
test esi, esi
jne 0x1003bf48
call fcn.1003bc40
lea esi, [eax + 0x14]
push esi
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x24]
push edx
call fcn.1002aff0
add esp, 0x10
mov dword [esi], eax
mov esi, dword [esp + 0x20]
mov dword [esp + 0x10], 0xffffffff
test esi, esi
je 0x1003bfaf
lea eax, [esi + 4]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x1003bfaf
mov edx, dword [esi]
mov eax, dword [edx + 4]
mov ecx, esi
call eax
lea ecx, [esi + 8]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x1003bfaf
mov eax, dword [esi]
mov edx, dword [eax + 8]
mov ecx, esi
call edx
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0xc
ret
cmp byte [esp + 0x28], 0
je 0x1003bfd9
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x1003bfd9
mov eax, dword [ecx]
mov edx, dword [esi + 0xc]
mov eax, dword [eax + 4]
push edx
call eax
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [esi + 4]
call fcn.1003bb20
mov edx, dword [esp + 0x24]
mov dword [esi + 0xc], edx
jmp 0x1003bf75
Function at 0x1003bff0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push 0xffffffffffffffff
push 0x10043248
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x1006b894]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov eax, dword [0x1006bd68]
test eax, eax
jne 0x1003bdb2
xor esi, esi
jmp 0x1003bdbb
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov esi, eax
mov dword [esp + 0x14], esi
mov ebp, dword [sym.imp.kernel32.dll_HeapFree]
mov dword [esp + 0x20], 0
test esi, esi
je 0x1003bdfd
cmp dword [esi + 0x14], 0
jne 0x1003be3f
cmp dword [esi + 0x10], 0
jne 0x1003be45
push 0x1003b950
push 0x1006bd64
call fcn.1002aff0
mov eax, dword [0x1006bd68]
add esp, 8
push 0
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov dword [esp + 0x20], 0xffffffff
test esi, esi
je 0x1003be2b
lea ecx, [esi + 4]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x1003be2b
mov eax, dword [esi]
mov edx, dword [eax]
push 0
mov ecx, esi
call edx
push esi
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call ebp
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
cmp dword [esi + 0x10], 0
je 0x1003be85
mov ebx, dword [esi + 0x10]
mov eax, dword [ebx + 4]
mov dword [esi + 0x10], eax
mov ecx, dword [ebx]
test ecx, ecx
je 0x1003be73
mov edx, dword [ecx]
mov eax, dword [edx + 4]
call eax
mov edi, dword [ebx]
mov edx, dword [edi]
mov eax, dword [edx]
push 0
mov ecx, edi
call eax
push edi
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call ebp
push ebx
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call ebp
cmp dword [esi + 0x10], 0
jne 0x1003be45
cmp dword [esi + 0x14], 0
je 0x1003bdd7
mov edi, dword [esi + 0x14]
mov ecx, dword [edi + 0x10]
mov dword [esi + 0x14], ecx
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x1003beaa
mov edx, dword [ecx]
mov eax, dword [edi + 0xc]
mov edx, dword [edx + 4]
push eax
call edx
mov ebx, dword [edi + 8]
test ebx, ebx
je 0x1003bedb
lea eax, [ebx + 4]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x1003bedb
mov edx, dword [ebx]
mov eax, dword [edx + 4]
mov ecx, ebx
call eax
lea ecx, [ebx + 8]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x1003bedb
mov eax, dword [ebx]
mov edx, dword [eax + 8]
mov ecx, ebx
call edx
push edi
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call ebp
cmp dword [esi + 0x14], 0
jne 0x1003be8f
jmp 0x1003bdd1
jmp 0x1003bd80

Function at 0x1003c1ea
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1006b894]
jne 0x1003c1f4
repz ret
jmp fcn.1003c9ee
Function at 0x101011a
Capabilities:
Get file size

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push esi
xor esi, esi
cmp dword [eax - 8], esi
je 0x101015c
push edi
push esi
push 0x80
push 3
push esi
push esi
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x101015b
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, esi
pop esi
pop ebp
ret 4