joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001cc10
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x1002d6f4]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x1002da0c], 0
mov eax, dword [ebp + 8]
je 0x1001cc38
push eax
call dword [sym.imp.kernel32.dll_DeleteFileW]
jmp 0x1001cc52
lea ecx, [ebp - 0x108]
push ecx
push eax
call sym.drvSOFT.x3d_int___stdcall_CmpNameExW_unsigned_short_int_const___unsigned_short_int_const__
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
mov ecx, dword [ebp - 4]
test eax, eax
setne al
xor ecx, ebp
call fcn.10022930
leave
ret 4

Function at 0x1001ce20
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x310
mov eax, dword [0x1002d6f4]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x1002da0c], 0
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
je 0x1001ce56
push ebx
push dword [ebp + 0x10]
push edi
push esi
call dword [sym.imp.kernel32.dll_GetTempFileNameW]
jmp 0x1001ceb5
push 0x104
lea eax, [ebp - 0x108]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x310]
push eax
push esi
call sym.drvSOFT.x3d_int___stdcall_CmpNameExW_unsigned_short_int_const___unsigned_short_int_const__
lea eax, [ebp - 0x20c]
push eax
push edi
call sym.drvSOFT.x3d_int___stdcall_CmpNameExW_unsigned_short_int_const___unsigned_short_int_const__
lea eax, [ebp - 0x108]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x310]
push eax
call dword [sym.imp.kernel32.dll_GetTempFileNameA]
mov esi, eax
lea eax, [ebp - 0x108]
push ebx
push eax
call sym.drvSOFT.x3d_int___stdcall_CmpNameExW_unsigned_short_int_const___unsigned_short_int_const__
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10022930
leave
ret 0x10

Function at 0x1001ced0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x1002d6f4]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x1002da0c], 0
push esi
mov esi, dword [ebp + 0xc]
je 0x1001cefc
push esi
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetTempPathW]
jmp 0x1001cf2d
lea eax, [ebp - 0x108]
push eax
push 0x104
call dword [sym.imp.kernel32.dll_GetTempPathA]
test eax, eax
je 0x1001cf2b
push dword [ebp + 8]
lea eax, [ebp - 0x108]
push esi
push eax
call sym.drvSOFT.x3d_int___stdcall_CmpNameExW_unsigned_short_int_const___unsigned_short_int_const__
push esi
call dword [sym.imp.kernel32.dll_lstrlenW]
jmp 0x1001cf2d
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.10022930
leave
ret 8
Function at 0x4226cc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x4226db
pop dword [ebp - 8]
mov eax, 0x3c38d76d
sub eax, 0x3bf6b092
sub dword [ebp - 8], eax
push 0x40
push 0x1000
push 0x3b8fe
push 0
mov eax, 0x5c093816
add eax, 0xa4391a02
add eax, dword [ebp - 8]
call dword [eax]
mov ecx, 0xbc72daff
sub ecx, 0xbc729c07
xor edx, edx
add edx, eax
mov ebx, 0x983ad755
sub ebx, 0x97f78355
add ebx, dword [ebp - 8]
mov edi, 0xa1012f7a
add edi, 0xc42dca65
xor dword [ebp - 4], 0x69e04603
mov esi, dword [ebx]
xor esi, edi
add dword [ebp - 4], ecx
mov dword [edx], esi
add dword [ebp - 4], esi
add edx, 0xca7e3bdb
sub edx, 0xca7e3bd7
add ebx, 4
loop 0x42273c
add eax, 0x411fc37a
sub eax, 0x411ed4c7
mov ebx, eax
add eax, 0xf7dc030d
sub eax, 0xf7dc0308
mov ecx, 0x400000
add ecx, dword [ebp - 8]
call ebx
leave
ret
Function at 0x408c23
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
lea ebx, [ebp - 0x244]
sub esp, 0x254
mov dword [esp + 4], 0x104
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push edx
push edx
lea edx, [eax - 1]
cmp edx, 0x103
ja 0x408c61
xor edx, edx
cmp word [ebp + eax*2 - 0x246], 0x5c
sete dl
jmp 0x408c68
xor eax, eax
mov edx, 1
mov ecx, dword [ebp + 8]
add edx, edx
add eax, eax
mov dword [esp + 4], str._s_S.dll
add edx, 0x40c688
add eax, ebx
mov dword [esp + 0xc], ecx
mov dword [esp + 8], edx
mov dword [esp], eax
call dword [sym.imp.USER32.dll_wsprintfW]
mov dword [esp], ebx
mov dword [esp + 8], 8
mov dword [esp + 4], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov ebx, dword [ebp - 4]
sub esp, 0xc
leave
ret 4

Function at 0x408e34
Capabilities:
Hash data with crc32

Disassembly:
push ebp
cmp dword [0x43b424], 0
mov ebp, esp
push esi
mov edx, dword [ebp + 0xc]
push ebx
jne 0x408e71
xor ecx, ecx
mov eax, ecx
mov ebx, 8
mov esi, eax
shr esi, 1
and eax, 1
je 0x408e5c
mov eax, 0xedb88320
xor eax, esi
dec ebx
jne 0x408e4e
mov dword [ecx*4 + 0x43b420], eax
inc ecx
cmp ecx, 0x100
jne 0x408e47
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
not eax
add ebx, edx
cmp edx, ebx
je 0x408e94
inc edx
mov cl, byte [edx - 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x43b420]
jmp 0x408e7b
pop ebx
not eax
pop esi
pop ebp
ret 0xc
Function at 0x4011b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
movzx eax, word [esp + 4]
movzx ecx, word [esp + 8]
push esi
push eax
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
jne 0x4011cf
xor al, al
pop esi
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x401207
mov esi, dword [esp + 0x10]
movzx edx, byte [eax]
mov byte [esi], dl
movzx edx, byte [eax]
dec ecx
inc esi
inc eax
test dl, dl
je 0x401207
test ecx, ecx
jne 0x4011f4
mov al, 1
pop esi
ret

Function at 0x401210
Capabilities:
Extract resource via kernel32 functions

Disassembly:
movzx eax, word [esp + 4]
push esi
push 0x64
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
jne 0x401229
pop esi
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0xc]
push esi
push 0
mov dword [ecx], eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
pop esi
ret

Function at 0x401250
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x214
mov eax, dword [0x40c010]
xor eax, esp
mov dword [esp + 0x210], eax
push ebx
mov ebx, dword [esp + 0x224]
push ebp
mov ebp, dword [esp + 0x220]
push esi
mov esi, dword [esp + 0x228]
push edi
lea eax, [esp + 0x14]
push eax
push ebp
mov dword [ebx], 0
call fcn.00401210
mov edi, eax
add esp, 8
test edi, edi
je 0x401346
push 0x104
lea ecx, [esp + 0x120]
push ecx
push ebp
push 0x65
call fcn.004011b0
add esp, 0x10
test al, al
je 0x401340
push esi
lea edx, [esp + 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x4091f8
lea eax, [esp + 0x1c]
push eax
call esi
lea ecx, [esp + 0x11c]
push ecx
lea edx, [esp + 0x1c]
push edx
call esi
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x401340
mov ebp, dword [esp + 0x14]
push 0
lea ecx, [esp + 0x14]
push ecx
push ebp
push edi
push esi
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x401340
cmp ebp, dword [esp + 0x10]
jne 0x401340
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x401348
mov dword [ebx], 1
xor eax, eax
mov ecx, dword [esp + 0x220]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00402169
add esp, 0x214
ret
Function at 0x402169
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c010]
jne 0x402173
repz ret
jmp fcn.00402329

Function at 0x4043f3
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004032d7
and dword [ebp - 4], 0
cmp dword [0x40d7a8], 0
mov ebx, eax
jne 0x4044a4
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x404555
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x409ad8
push edi
call esi
test eax, eax
je 0x404555
push eax
call fcn.00403265
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x40d7a8], eax
call esi
push eax
call fcn.00403265
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x40d7ac], eax
call esi
push eax
call fcn.00403265
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x40d7b0], eax
call esi
push eax
call fcn.00403265
pop ecx
mov dword [0x40d7b8], eax
test eax, eax
je 0x4044a4
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00403265
pop ecx
mov dword [0x40d7b4], eax
mov eax, dword [0x40d7b4]
cmp eax, ebx
je 0x4044fc
cmp dword [0x40d7b8], ebx
je 0x4044fc
push eax
call fcn.004032e0
push dword [0x40d7b8]
mov esi, eax
call fcn.004032e0
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4044fc
test edi, edi
je 0x4044fc
call esi
test eax, eax
je 0x4044f3
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4044f3
test byte [ebp - 0xc], 1
jne 0x4044fc
or dword [ebp + 0x10], 0x200000
jmp 0x404535
mov eax, dword [0x40d7ac]
cmp eax, ebx
je 0x404535
push eax
call fcn.004032e0
pop ecx
test eax, eax
je 0x404535
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x404535
mov eax, dword [0x40d7b0]
cmp eax, ebx
je 0x404535
push eax
call fcn.004032e0
pop ecx
test eax, eax
je 0x404535
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x40d7a8]
call fcn.004032e0
pop ecx
test eax, eax
je 0x404555
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x404557
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10002480
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, ecx
mov dword [ebp - 4], edx
mov dword [ebp - 8], esi
test esi, esi
jne 0x1000249a
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
push ebx
push edi
mov ebx, esi
mov edi, esi
mov esi, dword [ebp - 4]
xor edx, edx
mov eax, ebx
mov ecx, edx
xor ecx, edi
and al, 1
cmove ecx, edx
add edi, edi
mov eax, edi
mov edx, ecx
xor eax, esi
cmp edi, 0x100
cmovb eax, edi
shr ebx, 1
mov edi, eax
jne 0x100024a5
mov esi, dword [ebp - 8]
xor edi, edi
mov ebx, esi
test edx, edx
je 0x100024fa
mov esi, dword [ebp - 4]
mov eax, edx
mov ecx, edi
xor ecx, ebx
and al, 1
cmove ecx, edi
add ebx, ebx
mov eax, ebx
mov edi, ecx
xor eax, esi
cmp ebx, 0x100
cmovb eax, ebx
shr edx, 1
mov ebx, eax
jne 0x100024d5
mov esi, dword [ebp - 8]
xor edx, edx
mov ebx, edi
test edi, edi
je 0x1000252a
mov esi, dword [ebp - 4]
mov eax, edi
mov ecx, edx
xor ecx, ebx
and al, 1
cmove ecx, edx
add ebx, ebx
mov eax, ebx
mov edx, ecx
xor eax, esi
cmp ebx, 0x100
cmovb eax, ebx
shr edi, 1
mov ebx, eax
jne 0x10002505
mov esi, dword [ebp - 8]
xor edi, edi
test edx, edx
je 0x10002553
mov ecx, edi
mov eax, edx
xor ecx, esi
and al, 1
cmove ecx, edi
add esi, esi
mov edi, ecx
mov ecx, esi
xor ecx, dword [ebp - 4]
cmp esi, 0x100
cmovb ecx, esi
shr edx, 1
mov esi, ecx
jne 0x10002530
mov eax, edi
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100026d0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov edx, dword [ebp + 8]
push ebx
push esi
mov esi, ecx
movzx ebx, byte [edx]
movzx eax, byte [edx + 1]
movzx ecx, byte [edx + 5]
shl ebx, 8
or ebx, eax
movzx eax, byte [edx + 2]
shl ebx, 8
or ebx, eax
movzx eax, byte [edx + 3]
shl ebx, 8
or ebx, eax
movzx eax, byte [edx + 4]
shl eax, 8
or eax, ecx
mov dword [ebp - 4], ebx
movzx ecx, byte [edx + 6]
shl eax, 8
or eax, ecx
movzx ecx, byte [edx + 7]
mov edx, dword [esi + 4]
shl eax, 8
or eax, ecx
test edx, edx
jle 0x10002851
push edi
mov edi, dword [esi + 8]
lea ecx, [edx - 1]
add edi, 0x10
shr ecx, 1
inc ecx
mov dword [ebp + 8], edi
mov dword [ebp - 8], ecx
nop dword [eax + eax]
mov ebx, eax
mov ecx, eax
shr ecx, 0x10
mov edx, eax
and ecx, 0x3ff
ror ebx, 0xe
and edx, 0x3ff00
and ebx, 0xffc00
or ebx, ecx
shl edx, 2
mov ecx, eax
and ecx, 0x3ff
or edx, ecx
mov ecx, edx
xor ecx, ebx
and ecx, dword [edi - 8]
mov edi, dword [edi - 0x10]
mov esi, ecx
xor esi, edx
xor edi, ecx
mov ecx, dword [ebp + 8]
xor edi, ebx
xor esi, dword [ecx - 0xc]
mov ecx, edi
mov edx, esi
shr ecx, 0xa
shr edx, 0xa
and esi, 0x3ff
and edi, 0x3ff
mov edx, dword [edx*4 + 0x10092070]
or edx, dword [ecx*4 + 0x10090070]
or edx, dword [esi*4 + 0x10093070]
or edx, dword [edi*4 + 0x10091070]
mov esi, dword [ebp - 4]
xor esi, edx
mov ebx, esi
mov dword [ebp - 4], esi
mov ecx, esi
ror ebx, 0xe
shr ecx, 0x10
mov edx, esi
and ecx, 0x3ff
and edx, 0x3ff00
shl edx, 2
and ebx, 0xffc00
or ebx, ecx
mov ecx, esi
mov esi, dword [ebp + 8]
and ecx, 0x3ff
or edx, ecx
mov ecx, edx
xor ecx, ebx
and ecx, dword [esi + 4]
mov esi, ecx
xor esi, edx
mov edx, dword [ebp + 8]
mov edi, dword [edx - 4]
xor esi, dword [edx]
xor edi, ecx
xor edi, ebx
mov edx, esi
shr edx, 0xa
mov ecx, edi
shr ecx, 0xa
and esi, 0x3ff
and edi, 0x3ff
mov edx, dword [edx*4 + 0x10092070]
or edx, dword [ecx*4 + 0x10090070]
or edx, dword [esi*4 + 0x10093070]
or edx, dword [edi*4 + 0x10091070]
mov edi, dword [ebp + 8]
xor eax, edx
add edi, 0x18
sub dword [ebp - 8], 1
mov dword [ebp + 8], edi
jne 0x10002740
mov ebx, dword [ebp - 4]
pop edi
mov ecx, dword [ebp + 0xc]
pop esi
mov byte [ecx + 3], al
mov byte [ecx + 7], bl
shr eax, 8
mov byte [ecx + 2], al
shr ebx, 8
mov byte [ecx + 6], bl
shr eax, 8
shr ebx, 8
mov byte [ecx + 1], al
mov byte [ecx + 5], bl
shr eax, 8
shr ebx, 8
mov byte [ecx], al
mov byte [ecx + 4], bl
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10002890
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov edx, dword [ebp + 8]
push ebx
push esi
push edi
movzx ebx, byte [edx]
mov edi, ecx
movzx eax, byte [edx + 1]
movzx ecx, byte [edx + 5]
shl ebx, 8
mov esi, dword [edi + 4]
or ebx, eax
movzx eax, byte [edx + 2]
dec esi
shl ebx, 8
or ebx, eax
movzx eax, byte [edx + 3]
shl ebx, 8
or ebx, eax
movzx eax, byte [edx + 4]
shl eax, 8
or eax, ecx
mov dword [ebp - 4], ebx
movzx ecx, byte [edx + 6]
shl eax, 8
or eax, ecx
movzx ecx, byte [edx + 7]
shl eax, 8
or eax, ecx
test esi, esi
jle 0x10002a12
mov edx, dword [edi + 8]
lea ecx, [esi - 1]
lea ecx, [esi + ecx*2]
lea edi, [edx + ecx*4]
lea ecx, [esi - 1]
mov dword [ebp + 8], edi
shr ecx, 1
inc ecx
mov dword [ebp - 8], ecx
mov ebx, eax
mov ecx, eax
shr ecx, 0x10
mov edx, eax
and ecx, 0x3ff
ror ebx, 0xe
and edx, 0x3ff00
and ebx, 0xffc00
or ebx, ecx
shl edx, 2
mov ecx, eax
and ecx, 0x3ff
or edx, ecx
mov ecx, edx
xor ecx, ebx
and ecx, dword [edi + 0x10]
mov edi, dword [edi + 8]
mov esi, ecx
xor esi, edx
xor edi, ecx
mov ecx, dword [ebp + 8]
xor edi, ebx
xor esi, dword [ecx + 0xc]
mov ecx, edi
mov edx, esi
shr ecx, 0xa
shr edx, 0xa
and esi, 0x3ff
and edi, 0x3ff
mov edx, dword [edx*4 + 0x10092070]
or edx, dword [ecx*4 + 0x10090070]
or edx, dword [esi*4 + 0x10093070]
or edx, dword [edi*4 + 0x10091070]
mov esi, dword [ebp - 4]
xor esi, edx
mov ebx, esi
mov dword [ebp - 4], esi
mov ecx, esi
ror ebx, 0xe
shr ecx, 0x10
mov edx, esi
and ecx, 0x3ff
and edx, 0x3ff00
shl edx, 2
and ebx, 0xffc00
or ebx, ecx
mov ecx, esi
mov esi, dword [ebp + 8]
and ecx, 0x3ff
or edx, ecx
mov ecx, edx
xor ecx, ebx
and ecx, dword [esi + 4]
mov esi, ecx
xor esi, edx
mov edx, dword [ebp + 8]
mov edi, dword [edx - 4]
xor esi, dword [edx]
xor edi, ecx
xor edi, ebx
mov edx, esi
shr edx, 0xa
mov ecx, edi
shr ecx, 0xa
and esi, 0x3ff
and edi, 0x3ff
mov edx, dword [edx*4 + 0x10092070]
or edx, dword [ecx*4 + 0x10090070]
or edx, dword [esi*4 + 0x10093070]
or edx, dword [edi*4 + 0x10091070]
mov edi, dword [ebp + 8]
xor eax, edx
sub edi, 0x18
sub dword [ebp - 8], 1
mov dword [ebp + 8], edi
jne 0x10002902
mov ebx, dword [ebp - 4]
mov ecx, dword [ebp + 0xc]
pop edi
pop esi
mov byte [ecx + 3], al
mov byte [ecx + 7], bl
shr eax, 8
mov byte [ecx + 2], al
shr ebx, 8
mov byte [ecx + 6], bl
shr eax, 8
shr ebx, 8
mov byte [ecx + 1], al
mov byte [ecx + 5], bl
shr eax, 8
shr ebx, 8
mov byte [ecx], al
mov byte [ecx + 4], bl
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10002d90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [0x10094080], 0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
jne 0x10002dba
push 0
call fcn.10033a7a
push eax
call fcn.100339e5
add esp, 8
mov byte [0x10094080], 1
xor ecx, ecx
mov eax, 8
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.10028acb
add esp, 4
mov edi, eax
xor esi, esi
lea ebx, [esi + 0x57]
nop
call fcn.100339c4
xor edx, edx
div ebx
movsx ecx, byte [edx + str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789_._:____________]
mov eax, ecx
shl eax, 5
add eax, 0x11
add eax, ecx
imul eax, eax, 0x273a2392
add eax, ecx
xor eax, 0x273a2392
mov dword [edi + esi*4], eax
inc esi
cmp esi, 8
jb 0x10002de0
mov ebx, dword [ebp - 4]
movq xmm0, qword [edi]
push edi
movq qword [ebx], xmm0
call fcn.10028ac6
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10002e60
Capabilities:
Print debug messages
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x13b0
call fcn.100489c0
mov eax, dword [0x10059008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov ebx, edx
mov dword [ebp - 0x13ac], eax
mov esi, ebx
push edi
mov edi, ecx
lea ecx, [esi + 1]
nop dword [eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x10002e90
sub esi, ecx
cmp esi, 0x139c
jb 0x10002eb8
push 0x9d
mov edx, str.D:_build_partners_boostmaster_rungoldsrc_client_apprunmsvc....public_tier0dbg.cpp
mov ecx, str.Assertion_failed__tcslen_pMsgFormat____sizeof_pTempBuffer_
call fcn.10003340
add esp, 4
xor esi, esi
cmp edi, 2
jne 0x10002f01
push dword [0x10094070]
lea eax, [ebp - 0x13a8]
push dword [0x1008e034]
push str._s___d__:
push 0x139b
push eax
call fcn.10003420
mov esi, eax
add esp, 0x14
cmp esi, 0xffffffff
jne 0x10002f01
mov eax, 2
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100288b6
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x13ac]
mov edx, 0x139b
push ecx
lea ecx, [ebp - 0x13a8]
sub edx, esi
push ebx
add ecx, esi
call fcn.10001840
add esp, 0xc
cmp eax, 0xffffffff
je 0x10002eeb
add esi, eax
cmp esi, 0x139c
jb 0x10002f46
push 0xb5
mov edx, str.D:_build_partners_boostmaster_rungoldsrc_client_apprunmsvc....public_tier0dbg.cpp
mov ecx, str.Assertion_failed_len__sizeof_pMsgFormat____sizeof_pTempBuffer_
call fcn.10003340
add esp, 4
cmp edi, 2
jne 0x10002f70
lea eax, [ebp - 0x13a8]
add eax, esi
push 0x1005290c
push eax
call fcn.10003400
add esp, 8
add esi, eax
lea eax, [ebp - 0x13a8]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp esi, 0x139b
jb 0x10002f8f
push 0xc1
mov edx, str.D:_build_partners_boostmaster_rungoldsrc_client_apprunmsvc....public_tier0dbg.cpp
mov ecx, str.Assertion_failed__uint32_t_len____sizeof_pTempBuffer____sizeof_pTempBuffer_0_____1_
call fcn.10003340
add esp, 4
lea eax, [ebp - 0x13a8]
push eax
push 0x10052704
call fcn.10002460
add esp, 8
xor ebx, ebx
cmp edi, 2
je 0x10002fb1
cmp edi, 3
sete bl
inc ebx
mov eax, ebx
sub eax, 0
je 0x10002fdf
sub eax, 2
jne 0x10002fe5
push 1
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, ebx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100288b6
mov esp, ebp
pop ebp
ret
cmp edi, 2
je 0x10002fe5
int3
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100288b6
mov esp, ebp
pop ebp
ret
Function at 0x100031f0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x13a8
call fcn.100489c0
mov eax, dword [0x10059008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10003210
sub ecx, edx
cmp ecx, 0x139c
jb 0x10003238
push 0x9d
mov edx, str.D:_build_partners_boostmaster_rungoldsrc_client_apprunmsvc....public_tier0dbg.cpp
mov ecx, str.Assertion_failed__tcslen_pMsgFormat____sizeof_pTempBuffer_
call fcn.10003340
add esp, 4
lea eax, [ebp + 0xc]
mov edx, 0x139b
push eax
push ecx
push esi
lea ecx, [ebp - 0x13a8]
call fcn.10001840
mov esi, eax
add esp, 0xc
cmp esi, 0xffffffff
je 0x100032b9
cmp esi, 0x139c
jb 0x10003277
push 0xb5
mov edx, str.D:_build_partners_boostmaster_rungoldsrc_client_apprunmsvc....public_tier0dbg.cpp
mov ecx, str.Assertion_failed_len__sizeof_pMsgFormat____sizeof_pTempBuffer_
call fcn.10003340
add esp, 4
cmp esi, 0x139b
jb 0x10003296
push 0xc1
mov edx, str.D:_build_partners_boostmaster_rungoldsrc_client_apprunmsvc....public_tier0dbg.cpp
mov ecx, str.Assertion_failed__uint32_t_len____sizeof_pTempBuffer____sizeof_pTempBuffer_0_____1_
call fcn.10003340
add esp, 4
lea eax, [ebp - 0x13a8]
push eax
push 0x10052704
call fcn.10002460
add esp, 8
push 1
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.100288b6
mov esp, ebp
pop ebp
ret

Function at 0x100039d0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x108
mov eax, dword [0x10059008]
xor eax, esp
mov dword [esp + 0x104], eax
mov eax, dword [0x1008df80]
cmp eax, 0xffffffff
je 0x10003a0d
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.100288b6
mov esp, ebp
pop ebp
ret
push str.Bad_thread_local
lea eax, [esp + 4]
push str.Assertion_failed__s
push eax
call fcn.10001880
add esp, 0xc
mov edx, str.D:_build_partners_boostmaster_rungoldsrc_client_apprunmsvc....public_tier0_threadtools.cpp
mov ecx, eax
push 0x333
call fcn.10003340
mov ecx, dword [esp + 0x108]
add esp, 4
xor ecx, esp
xor eax, eax
call fcn.100288b6
mov esp, ebp
pop ebp
ret

Function at 0x10003a50
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x108
mov eax, dword [0x10059008]
xor eax, esp
mov dword [esp + 0x104], eax
mov eax, dword [0x1008df80]
mov ecx, dword [ebp + 8]
cmp eax, 0xffffffff
je 0x10003a93
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.100288b6
mov esp, ebp
pop ebp
ret 4
push str.Bad_thread_local
lea eax, [esp + 4]
push str.Assertion_failed__s
push eax
call fcn.10001880
add esp, 0xc
mov edx, str.D:_build_partners_boostmaster_rungoldsrc_client_apprunmsvc....public_tier0_threadtools.cpp
mov ecx, eax
push 0x341
call fcn.10003340
mov ecx, dword [esp + 0x108]
add esp, 4
xor ecx, esp
call fcn.100288b6
mov esp, ebp
pop ebp
ret 4