joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5aaec0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5ab06a
sub esp, 0x48
movzx eax, word [esp + 0x78]
cmp ax, 0x303
jb 0x5aaeee
movzx ecx, byte [esp + 0x80]
jmp 0x5aaefb
movzx ecx, byte [esp + 0x80]
cmp cl, 0xe4
jne 0x5aaf33
mov edx, dword [esp + 0x6c]
test edx, edx
je 0x5ab051
cmp cl, 0xe4
je 0x5aaf12
cmp ax, 0x303
jmp 0x5aaf37
mov eax, dword [esp + 0x70]
mov ecx, dword [esp + 0x74]
mov dword [esp + 0x94], edx
mov dword [esp + 0x98], eax
mov dword [esp + 0x9c], ecx
add esp, 0x48
ret
cmp ax, 0x303
jae 0x5aafc5
cmp cl, 0xe3
jne 0x5aaf8f
mov eax, dword [esp + 0x54]
mov ecx, dword [esp + 0x58]
mov eax, dword [eax + 0x1c]
mov dword [esp], ecx
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
call eax
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esp + 0x94], eax
mov dword [esp + 0x98], ecx
mov dword [esp + 0x9c], edx
add esp, 0x48
ret
lea edi, [esp]
lea esi, [esp + 0x4c]
call fcn.0045face
call fcn.005aaba0
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x3c]
mov dword [esp + 0x94], eax
mov dword [esp + 0x98], ecx
mov dword [esp + 0x9c], edx
add esp, 0x48
ret
mov eax, dword [esp + 0x84]
mov dword [esp], eax
call fcn.00479b60
mov eax, dword [esp + 4]
mov dword [esp + 0x40], eax
mov ecx, dword [esp + 8]
mov dword [esp + 0x44], ecx
mov edx, dword [eax + 0x20]
mov ebx, dword [esp + 0x6c]
mov ebp, dword [esp + 0x70]
mov esi, dword [esp + 0x74]
mov dword [esp], ecx
mov dword [esp + 4], ebx
mov dword [esp + 8], ebp
mov dword [esp + 0xc], esi
call edx
mov eax, dword [esp + 0x40]
mov eax, dword [eax + 0x1c]
mov ecx, dword [esp + 0x44]
mov dword [esp], ecx
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
call eax
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esp + 0x94], eax
mov dword [esp + 0x98], ecx
mov dword [esp + 0x9c], edx
add esp, 0x48
ret
lea eax, [0x634440]
mov dword [esp], eax
lea eax, [0x6ced1c]
mov dword [esp + 4], eax
call fcn.00434270
nop
call fcn.0045df90
jmp fcn.005aaec0
Function at 0x4f60b0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xab000]
push edi
or ebp, 0xffffffff
jmp 0x4f60d2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4f60d9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4f60c8
mov eax, 1
add ebx, ebx
jne 0x4f60eb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4f60fc
jne 0x4f611b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4f611b
dec eax
add ebx, ebx
jne 0x4f6108
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4f60e0
add ebx, ebx
jne 0x4f6117
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4f616d
xor ecx, ecx
sub eax, 3
jb 0x4f6133
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4f61a2
sar eax, 1
mov ebp, eax
jmp 0x4f613e
add ebx, ebx
jne 0x4f613e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4f610c
inc ecx
add ebx, ebx
jne 0x4f614c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4f610c
add ebx, ebx
jne 0x4f6159
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4f614e
jne 0x4f616a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4f614e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4f618c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4f617e
jmp 0x4f60ce
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4f618c
add edi, ecx
jmp 0x4f60ce
pop esi
mov edi, esi
mov ecx, 0x45dc
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4f61aa
cmp byte [edi], 0x21
jne 0x4f61aa
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4f61af
lea edi, [esi + 0xf1000]
mov eax, dword [edi]
or eax, eax
je 0x4f621e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xf6000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xf6074]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4f61dc
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xf607c]
or eax, eax
je 0x4f6218
mov dword [ebx], eax
add ebx, 4
jmp 0x4f61f9
call dword [esi + 0xf6078]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x4f624f
cmp al, 0xef
ja 0x4f6242
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x4f6224
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x4f6231
mov ebp, dword [esi + 0xf6080]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4f6283
sub esp, 0xffffff80
jmp 0x4011d6
Function at 0x10004250
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x10]
xor eax, eax
xor ebx, ebx
test ebp, ebp
je 0x100042a3
push esi
push edi
mov ecx, dword [esp + 0x14]
mov esi, eax
shr esi, 8
movzx ecx, byte [ebx + ecx]
xor ecx, eax
movzx edi, cl
mov eax, edi
mov edx, edi
and eax, 0xf
shr edx, 4
shl edi, 6
mov cl, byte [eax + sym.VPCmdIF.dll_char_const__const_const__public:_static_void___cdecl_CVPcmd::crc16_unsigned_int___unsigned_int_::_2::op]
mov eax, esi
xor eax, 0xc001
cmp byte [edx + sym.VPCmdIF.dll_char_const__const_const__public:_static_void___cdecl_CVPcmd::crc16_unsigned_int___unsigned_int_::_2::op], cl
lea ecx, [edi + edi]
cmove eax, esi
inc ebx
xor eax, ecx
xor eax, edi
cmp ebx, ebp
jb 0x10004260
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x10030950
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006ed00
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x1009c00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
push 8
mov dword [eax], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.10041ce4
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.100433b3
mov dword [esi + 4], eax
add esp, 8
mov eax, dword [ebp - 0x10]
lea edi, [eax + 0x14]
lea ecx, [eax + 0x18]
lea edx, [eax + 0x24]
mov dword [eax + 0x34], esi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [ebx], 0
mov dword [edi], 0
mov dword [edx], 0
mov dword [eax], vtable.std::basic_stringbuf_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov dword [eax + 0x38], 0
mov dword [eax + 0x3c], 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10033500
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
mov eax, ecx
mov dword [ebp - 0x20], edx
lea ecx, [ebp - 4]
mov dword [ebp - 0x14], eax
push ecx
xor esi, esi
lea ecx, [ebp - 0x10]
push esi
push ecx
push esi
push str.PortName
push dword [eax]
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10033541
mov eax, dword [ebp - 0x10]
cmp eax, 1
je 0x1003354f
cmp eax, 2
je 0x1003354f
mov eax, 0xd
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
push ebx
shr eax, 1
push edi
lea edi, [eax*2 + 2]
push edi
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebx, eax
mov dword [ebp - 0x1c], ebx
test ebx, ebx
je 0x100336c3
xor eax, eax
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], edi
mov word [ebx], ax
lea eax, [ebp - 0xc]
push eax
push ebx
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0x14]
push 0
push str.PortName
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test edi, edi
je 0x100335b6
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop ebx
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 8]
cmp eax, 1
je 0x100335db
cmp eax, 2
je 0x100335db
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 0xd
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop ebx
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0xc]
test al, 1
jne 0x100335c3
shr eax, 1
cmp word [ebx + eax*2 - 2], si
je 0x100335f1
xor ecx, ecx
mov word [ebx + eax*2], cx
mov esi, ebx
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x100335f6
sub esi, ecx
sar esi, 1
mov dword [ebp - 0x18], esi
cmp esi, 3
jbe 0x100336ba
push 3
push 0x10085340
push ebx
call fcn.100549fb
add esp, 0xc
test eax, eax
jne 0x100336ba
lea ecx, [ebx + 6]
mov edi, ecx
lea edx, [edi + 2]
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x10033631
sub edi, edx
sar edi, 1
je 0x100336ba
mov eax, 1
test edi, edi
je 0x10033679
xor esi, esi
mov ebx, ecx
nop
test eax, eax
je 0x1003366e
movzx eax, word [ebx + esi*2]
push eax
call fcn.1005495a
add esp, 4
neg eax
sbb eax, eax
inc esi
neg eax
cmp esi, edi
jb 0x10033650
test eax, eax
mov esi, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x1c]
je 0x100336ba
lea ecx, [ebx + 6]
push ecx
call fcn.100548dc
mov ecx, dword [ebp - 0x20]
add esp, 4
mov dword [ecx], eax
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x100336a5
mov eax, 0x14
cmp esi, eax
cmovb eax, esi
push eax
push ebx
push 0x14
push ecx
call fcn.1004e0b3
add esp, 0x10
push ebx
mov esi, 1
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
pop ebx
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
push ebx
xor esi, esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
pop ebx
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100361e0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push edi
mov edi, ecx
mov dword [ebp - 8], edx
mov eax, dword [edi + 8]
mov dword [ebp - 4], eax
movzx eax, byte [edi + 0x14]
push eax
movzx eax, byte [edi + 0xc]
push eax
push str.open__d._d
push str.libusb_open
push 4
push 0
call fcn.10036f50
add esp, 0x18
cmp dword [edi + 0x3c], 0
jne 0x10036222
mov eax, 0xfffffffc
pop edi
mov esp, ebp
pop ebp
ret
push esi
push 0x19c
call fcn.10054cc4
mov esi, eax
add esp, 4
test esi, esi
jne 0x1003623f
lea eax, [esi - 0xb]
pop esi
pop edi
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi], eax
test eax, eax
jne 0x10036265
push esi
call fcn.10053caa
add esp, 4
mov eax, 0xffffff9d
pop esi
pop edi
mov esp, ebp
pop ebp
ret
push ebx
push 0xffffffffffffffff
push dword [edi]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
inc dword [edi + 4]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push 0x184
lea eax, [esi + 0x18]
mov dword [esi + 0x10], edi
push 0
push eax
mov dword [esi + 0x14], 0
mov dword [esi + 4], 0
call fcn.100448d0
push esi
call fcn.1003bb70
mov ebx, eax
add esp, 0x10
test ebx, ebx
jns 0x100362f7
movzx ecx, byte [edi + 0x14]
push ebx
push ecx
movzx ecx, byte [edi + 0xc]
push ecx
push str.open__d._d_returns__d
push str.libusb_open
push 4
push 0
call fcn.10036f50
add esp, 0x1c
mov ecx, edi
call fcn.10035f70
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x100362e5
mov dword [esi], 0
push esi
call fcn.10053caa
add esp, 4
mov eax, ebx
pop ebx
pop esi
pop edi
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp - 4]
lea edi, [ebx + 0x24]
test edi, edi
je 0x1003630b
push 0xffffffffffffffff
push dword [edi]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebx + 0x20]
lea edx, [ebx + 0x1c]
mov dword [esi + 0xc], eax
lea ecx, [esi + 8]
mov dword [ecx], edx
mov dword [eax], ecx
mov dword [edx + 4], ecx
test edi, edi
je 0x1003632a
push dword [edi]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, dword [ebp - 8]
pop ebx
mov dword [eax], esi
xor eax, eax
pop esi
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x100364e0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, ecx
push esi
push edi
test ebx, ebx
je 0x1003664d
push 0x1007cabc
push str.libusb_close
push 4
push 0
call fcn.10036f50
mov eax, dword [ebx + 0x10]
add esp, 0x10
mov esi, dword [eax + 8]
push dword [esi + 0x54]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
xor ecx, ecx
test eax, eax
setne cl
mov dword [ebp - 4], ecx
test eax, eax
jne 0x10036595
lea edi, [esi + 0x6c]
test edi, edi
je 0x10036535
push 0xffffffffffffffff
push dword [edi]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [esi + 0x70], 0
jne 0x1003656d
cmp dword [esi + 0x74], 0
jne 0x1003656d
lea eax, [esi + 0x88]
cmp dword [esi + 0x8c], eax
jne 0x1003656d
lea eax, [esi + 0x90]
cmp dword [esi + 0x94], eax
jne 0x1003656d
mov ecx, esi
mov dword [esi + 0x74], 1
call fcn.10036050
jmp 0x10036570
inc dword [esi + 0x74]
test edi, edi
je 0x1003657d
push dword [edi]
mov eax, dword [sym.imp.KERNEL32.dll_ReleaseMutex]
call eax
lea eax, [esi + 0x4c]
test eax, eax
je 0x1003658e
push 0xffffffffffffffff
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [esi + 0x50], 1
mov edx, ebx
mov ecx, esi
call fcn.10036340
cmp dword [ebp - 4], 0
jne 0x1003664d
lea edi, [esi + 0x6c]
test edi, edi
je 0x100365b9
push 0xffffffffffffffff
push dword [edi]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esi + 0x74]
dec eax
cmp dword [esi + 0x70], 0
mov dword [esi + 0x74], eax
jne 0x100365ed
test eax, eax
jne 0x100365ed
lea eax, [esi + 0x88]
cmp dword [esi + 0x8c], eax
jne 0x100365ed
lea eax, [esi + 0x90]
cmp dword [esi + 0x94], eax
jne 0x100365ed
mov ecx, esi
call fcn.10036100
mov ebx, dword [sym.imp.KERNEL32.dll_ReleaseMutex]
test edi, edi
je 0x100365fb
push dword [edi]
call ebx
lea eax, [esi + 0x4c]
mov dword [esi + 0x50], 0
test eax, eax
je 0x1003660d
push dword [eax]
call ebx
lea ebx, [esi + 0x58]
test ebx, ebx
je 0x1003661e
push 0xffffffffffffffff
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea edi, [esi + 0x5c]
test edi, edi
je 0x10036640
mov esi, dword [edi + 4]
cmp esi, edi
je 0x10036640
nop dword [eax]
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov esi, dword [esi + 4]
cmp esi, edi
jne 0x10036630
test ebx, ebx
je 0x1003664d
push dword [ebx]
mov eax, dword [sym.imp.KERNEL32.dll_ReleaseMutex]
call eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10038670
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, ecx
mov dword [ebp - 4], 0
mov eax, dword [ebx + 0x10]
mov eax, dword [eax + 8]
push dword [eax + 0x54]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x1003869d
mov eax, 0xfffffffa
pop ebx
mov esp, ebp
pop ebp
ret 0x18
push esi
push edi
push 0x7c
push 1
call fcn.100539fa
mov esi, eax
add esp, 8
test esi, esi
je 0x10038701
lea edi, [esi + 0x28]
mov dword [esi], 0
test edi, edi
je 0x100386cc
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [edi], eax
add esi, 0x2c
push esi
push str.transfer__p
push str.libusb_alloc_transfer
push 4
push 0
call fcn.10036f50
add esp, 0x14
test esi, esi
je 0x10038701
push 8
call fcn.10054cc4
mov edx, eax
add esp, 4
test edx, edx
jne 0x1003870f
mov ecx, esi
call fcn.10037440
pop edi
pop esi
mov eax, 0xfffffff5
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov ecx, dword [ebp + 0xc]
mov eax, ecx
shr eax, 8
mov byte [ebp + 0xd], al
mov byte [ebp + 0xc], cl
xor cl, cl
movzx eax, word [ebp + 0xc]
mov word [edx + 2], ax
mov word [ebp + 0xc], 0
movzx eax, word [ebp + 0xc]
mov word [edx + 4], ax
mov word [ebp + 0xc], 0
movzx eax, word [ebp + 0xc]
mov word [edx + 6], ax
mov eax, dword [ebp + 0xc]
shr eax, 8
mov byte [ebp + 0xd], al
mov byte [ebp + 0xc], cl
mov ecx, esi
movzx eax, word [ebp + 0xc]
add eax, 8
mov word [edx], 0x900
mov dword [esi + 0x10], eax
lea eax, [ebp - 4]
mov dword [esi], ebx
mov word [esi + 5], 0
mov dword [esi + 8], 0x3e8
mov dword [esi + 0x20], edx
mov dword [esi + 0x1c], eax
mov dword [esi + 0x18], 0x100385e0
mov byte [esi + 4], 2
call fcn.100374a0
mov edi, eax
mov ecx, esi
test edi, edi
js 0x10038854
call fcn.10038610
mov eax, dword [esi + 0xc]
cmp eax, 6
ja case.default.0x100387a5
jmp dword [eax*4 + 0x10038864]
mov edi, dword [esi + 0x14]
mov ecx, esi
call fcn.10037440
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov ecx, esi
mov edi, 0xfffffff9
call fcn.10037440
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov ecx, esi
mov edi, 0xfffffff7
call fcn.10037440
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov ecx, esi
mov edi, 0xfffffffc
call fcn.10037440
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov ecx, esi
mov edi, 0xfffffff8
call fcn.10037440
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov ecx, esi
or edi, 0xffffffff
call fcn.10037440
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
push eax
mov eax, dword [ebx + 0x10]
push str.unrecognised_status_code__d
push str.libusb_control_transfer
push 2
push dword [eax + 8]
call fcn.10036f50
add esp, 0x14
mov edi, 0xffffff9d
mov ecx, esi
call fcn.10037440
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
Function at 0x10038880
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, ecx
mov dword [ebp - 8], 0
push esi
push edi
mov byte [ebp - 1], dl
mov eax, dword [ebx + 0x10]
mov eax, dword [eax + 8]
push dword [eax + 0x54]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x100388b4
mov eax, 0xfffffffa
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x7c
push 1
call fcn.100539fa
mov esi, eax
add esp, 8
test esi, esi
je 0x10038a12
lea edi, [esi + 0x28]
mov dword [esi], 0
test edi, edi
je 0x100388e5
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [edi], eax
add esi, 0x2c
push esi
push str.transfer__p
push str.libusb_alloc_transfer
push 4
push 0
call fcn.10036f50
add esp, 0x14
test esi, esi
je 0x10038a12
mov al, byte [ebp - 1]
mov ecx, esi
mov byte [esi + 5], al
mov eax, dword [ebp + 0x14]
mov dword [esi + 8], eax
mov eax, dword [ebp + 8]
mov dword [esi + 0x20], eax
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x10], eax
lea eax, [ebp - 8]
mov dword [esi], ebx
mov dword [esi + 0x1c], eax
mov dword [esi + 0x18], 0x100385e0
mov byte [esi + 6], 2
call fcn.100374a0
mov edi, eax
mov ecx, esi
test edi, edi
js 0x10038a04
call fcn.10038610
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x10038956
mov eax, dword [esi + 0x14]
mov dword [ecx], eax
mov eax, dword [esi + 0xc]
cmp eax, 6
ja case.default.0x10038962
jmp dword [eax*4 + 0x10038a20]
mov ecx, esi
xor edi, edi
call fcn.10037440
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, esi
mov edi, 0xfffffff9
call fcn.10037440
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, esi
mov edi, 0xfffffff7
call fcn.10037440
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, esi
mov edi, 0xfffffff8
call fcn.10037440
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, esi
mov edi, 0xfffffffc
call fcn.10037440
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, esi
or edi, 0xffffffff
call fcn.10037440
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push eax
mov eax, dword [ebx + 0x10]
push str.unrecognised_status_code__d
push str.do_sync_bulk_transfer
push 2
push dword [eax + 8]
call fcn.10036f50
add esp, 0x14
mov edi, 0xffffff9d
mov ecx, esi
call fcn.10037440
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 0xfffffff5
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10040a70
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
mov edx, 0x1505
mov dword [ebp - 4], edi
mov esi, edi
test edi, edi
jne 0x10040a92
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
movsx ecx, byte [edi]
test ecx, ecx
je 0x10040ab3
nop dword [eax]
mov eax, edx
lea esi, [esi + 1]
shl edx, 5
add edx, ecx
movsx ecx, byte [esi]
add edx, eax
test ecx, ecx
jne 0x10040aa0
test edx, edx
mov ebx, 1
mov ecx, ebx
mov eax, 0xc0906d
cmovne ecx, edx
mul ecx
mov eax, ecx
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 9
imul eax, eax, 0x3fd
push 0xffffffffffffffff
push dword [0x100aa984]
sub ecx, eax
cmovne ebx, ecx
mov esi, ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [0x100aa978]
lea ecx, [eax + esi*8]
mov eax, dword [ecx]
mov dword [ebp - 8], ecx
test eax, eax
je 0x10040bdb
cmp eax, ebx
jne 0x10040b40
mov ecx, dword [ecx + 4]
mov eax, edi
nop word [eax + eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10040b30
test dl, dl
je 0x10040b2c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10040b30
add eax, 2
add ecx, 2
test dl, dl
jne 0x10040b10
xor eax, eax
jmp 0x10040b35
sbb eax, eax
or eax, 1
test eax, eax
je 0x10040c42
mov ecx, dword [ebp - 8]
push dword [ecx + 4]
push edi
push str.hash_collision___s_vs__s_
push str.htab_hash
push 4
push 0
call fcn.10036f50
mov eax, 0x14191f7
add esp, 0x18
mul ebx
mov eax, ebx
sub eax, edx
shr eax, 1
add eax, edx
mov edx, ebx
shr eax, 9
imul eax, eax, 0x3fb
sub edx, eax
inc edx
mov dword [ebp - 8], edx
nop word [eax + eax]
mov ecx, esi
sub ecx, edx
cmp esi, edx
lea eax, [ecx + 0x3fd]
cmova eax, ecx
mov esi, eax
cmp esi, ebx
je 0x10040bd8
mov eax, dword [0x100aa978]
mov edi, dword [eax + esi*8]
cmp edi, ebx
jne 0x10040bd4
mov eax, dword [eax + esi*8 + 4]
mov ecx, dword [ebp - 4]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x10040bc8
test dl, dl
je 0x10040bc4
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x10040bc8
add ecx, 2
add eax, 2
test dl, dl
jne 0x10040ba8
xor eax, eax
jmp 0x10040bcd
sbb eax, eax
or eax, 1
test eax, eax
je 0x10040c42
mov edx, dword [ebp - 8]
test edi, edi
jne 0x10040b80
mov edi, dword [ebp - 4]
cmp dword [0x100aa958], 0x3fd
jb 0x10040c06
push 0x3fd
push str.hash_table_is_full___lu_entries_
push str.htab_hash
push 1
push 0
call fcn.10036f50
add esp, 0x14
xor esi, esi
jmp 0x10040c42
push edi
call fcn.100559af
mov ecx, eax
add esp, 4
mov eax, dword [0x100aa978]
mov dword [eax + esi*8 + 4], ecx
lea eax, [eax + esi*8]
test ecx, ecx
jne 0x10040c3a
push str.could_not_duplicate_string_for_hash_table
push str.htab_hash
push 1
push ecx
call fcn.10036f50
add esp, 0x10
xor esi, esi
jmp 0x10040c42
inc dword [0x100aa958]
mov dword [eax], ebx
push dword [0x100aa984]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret