joyce8/EMBER2024-capa huggingface dataset:
Function at 0x50f400
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
mov eax, dword [0x5ac004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ecx + 0x30]
mov eax, 0x38
push esi
push edi
mov esi, ebx
mov dword [ebp - 0x54], edx
and esi, 0x3f
mov dword [ebp - 0x50], ecx
sub eax, esi
mov edi, 0x78
sub edi, esi
cmp esi, 0x38
cmovb edi, eax
lea eax, [edi - 1]
push eax
lea eax, [ebp - 0x4b]
push 0
push eax
call fcn.0051fd40
mov esi, dword [ebp - 0x50]
lea edx, [ebp - 0x4c]
mov eax, ebx
mov byte [ebp - 0x4c], 0x80
shr eax, 0x1d
add esp, 0xc
mov ecx, dword [esi + 0x2c]
shl ecx, 3
or ecx, eax
lea eax, [ebx*8]
bswap eax
bswap ecx
mov dword [ebp + edi - 0x48], eax
lea eax, [edi + 8]
mov dword [ebp + edi - 0x4c], ecx
mov ecx, esi
push eax
call fcn.0050f340
mov ecx, dword [esi + 0x18]
mov edx, ecx
mov ebx, dword [ebp - 0x54]
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shr edx, 8
shl eax, 8
or edx, eax
mov dword [ebx], edx
mov ecx, dword [esi + 0x1c]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shr edx, 8
shl eax, 8
or edx, eax
mov dword [ebx + 4], edx
mov ecx, dword [esi + 0x20]
mov edx, ecx
mov eax, ecx
and edx, 0xff0000
shr eax, 0x10
or edx, eax
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shr edx, 8
shl eax, 8
or edx, eax
mov dword [ebx + 8], edx
mov ecx, dword [esi + 0x24]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shr edx, 8
shl eax, 8
or edx, eax
mov dword [ebx + 0xc], edx
mov ecx, dword [esi + 0x28]
mov edx, ecx
mov eax, ecx
and edx, 0xff0000
shr eax, 0x10
or edx, eax
mov eax, ecx
and ecx, 0xff00
shl eax, 0x10
or eax, ecx
shr edx, 8
mov ecx, dword [ebp - 4]
shl eax, 8
xor ecx, ebp
or edx, eax
mov dword [ebx + 0x10], edx
pop edi
mov dword [esi + 0x18], 0x67452301
mov dword [esi + 0x1c], 0xefcdab89
mov dword [esi + 0x20], 0x98badcfe
mov dword [esi + 0x24], 0x10325476
mov dword [esi + 0x28], 0xc3d2e1f0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
pop esi
pop ebx
call fcn.0051e068
mov esp, ebp
pop ebp
ret
Function at 0x50ffe0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x2020
call fcn.0053da50
mov eax, dword [0x5ac004]
xor eax, esp
mov dword [esp + 0x201c], eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
push 0x5b0860
mov dword [esp + 0xc], eax
lea eax, [esp + 0x18]
push fcn.005107a0
push 0
mov dword [esp + 0x18], eax
lea eax, [esp + 0x2020]
push edx
lea edx, [esp + 0x18]
mov dword [esp + 0x20], eax
call fcn.00512360
test eax, eax
js 0x5100b4
jle 0x51004a
lea eax, [esp + 8]
push eax
push 0xa
call fcn.005107a0
test eax, eax
js 0x5100b4
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x14]
cmp eax, ecx
jne 0x51006e
xor ecx, ecx
mov eax, ecx
mov ecx, dword [esp + 0x201c]
xor ecx, esp
call fcn.0051e068
mov esp, ebp
pop ebp
ret 0xc
push 0
push 0
lea ecx, [esp + 0x10]
sub eax, ecx
sub eax, 0xc
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x10]
push eax
push 0
push 0
push 0
push dword [esp + 0x28]
call dword [sym.imp.ntdll.dll_NtWriteFile]
xor ecx, ecx
test eax, eax
setns cl
dec ecx
mov eax, ecx
mov ecx, dword [esp + 0x201c]
xor ecx, esp
call fcn.0051e068
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [esp + 0x201c]
or eax, 0xffffffff
xor ecx, esp
call fcn.0051e068
mov esp, ebp
pop ebp
ret 0xc
Function at 0x5107a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 0xc]
push edi
mov ecx, dword [esi + 4]
cmp ecx, dword [esi + 8]
jb 0x5107e0
lea edi, [esi + 0xc]
cmp ecx, edi
je 0x5107e0
push 0
push 0
sub ecx, esi
lea eax, [ebp - 8]
sub ecx, 0xc
push ecx
push edi
push eax
push 0
push 0
push 0
push dword [esi]
call dword [sym.imp.ntdll.dll_NtWriteFile]
test eax, eax
js 0x5107f2
mov dword [esi + 4], edi
mov ecx, edi
mov al, byte [ebp + 8]
mov byte [ecx], al
inc dword [esi + 4]
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
pop edi
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x510800
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, ecx
push edi
test esi, esi
je 0x51084b
push 0
push 0
push 0x2000
lea edi, [esi + 0xc]
push edi
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0
push dword [esi]
call dword [sym.imp.ntdll.dll_NtReadFile]
test eax, eax
js 0x51084b
mov eax, dword [ebp - 4]
test eax, eax
je 0x51084b
add eax, 0xc
mov dword [esi + 4], edi
add eax, esi
mov dword [esi + 8], eax
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
pop edi
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x510860
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, ecx
push edi
test esi, esi
je 0x5108a4
mov eax, dword [esi + 4]
lea edi, [esi + 0xc]
cmp eax, edi
je 0x51089c
push 0
push 0
sub eax, esi
sub eax, 0xc
push eax
push edi
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0
push dword [esi]
call dword [sym.imp.ntdll.dll_NtWriteFile]
test eax, eax
js 0x5108a4
mov dword [esi + 4], edi
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
pop edi
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x5365f8
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.005362a9

Function at 0x536603
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00536433
Function at 0x10002920
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub dword [ebp + 0xc], 1
jne 0x1000293e
push 0
push 0
push 0
push 0x100028b0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
pop ebp
ret 0xc
Function at 0x10004840
Capabilities:
Enumerate threads

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push esi
push edi
lea edi, [ebp - 0x30]
mov ecx, 0xc
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x1002a380]
xor eax, ebp
mov dword [ebp - 4], eax
push 0
push 4
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x100049e6
mov dword [ebp - 0x28], 0x1c
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp - 8]
push ecx
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x100049d3
cmp dword [ebp - 0x28], 0x10
jb 0x100049b7
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp esi, esp
call fcn.10008c8c
cmp dword [ebp - 0x1c], eax
jne 0x100049b7
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp esi, esp
call fcn.10008c8c
cmp dword [ebp - 0x20], eax
je 0x100049b7
mov edx, dword [ebp + 8]
cmp dword [edx], 0
jne 0x10004917
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0x80
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
shl edx, 2
mov esi, esp
push edx
push 0
mov eax, dword [0x1002b214]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp esi, esp
call fcn.10008c8c
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov edx, dword [ebp + 8]
cmp dword [edx], 0
jne 0x10004912
jmp 0x100049d3
jmp 0x10004997
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
mov edx, dword [eax + 8]
cmp edx, dword [ecx + 4]
jb 0x10004997
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
shl ecx, 1
shl ecx, 2
mov esi, esp
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
push 0
mov ecx, dword [0x1002b214]
push ecx
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
cmp esi, esp
call fcn.10008c8c
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jne 0x10004981
mov esi, esp
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
push 0
mov ecx, dword [0x1002b214]
push ecx
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp esi, esp
call fcn.10008c8c
mov edx, dword [ebp + 8]
mov dword [edx], 0
jmp 0x100049d3
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
shl ecx, 1
mov edx, dword [ebp + 8]
mov dword [edx + 4], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x30]
mov dword [eax], ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 8]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x20]
mov dword [edx + eax*4], ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 8]
add eax, 1
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], eax
mov dword [ebp - 0x28], 0x1c
lea edx, [ebp - 0x28]
push edx
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x10004893
mov esi, esp
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.10008c8c
push edx
mov ecx, ebp
push eax
lea edx, [0x10004a14]
call fcn.10008c38
pop eax
pop edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10008861
add esp, 0x30
cmp ebp, esp
call fcn.10008c8c
mov esp, ebp
pop ebp
ret
Function at 0x10004a30
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov dword [ebp - 0xc], 0xcccccccc
mov dword [ebp - 8], 0xcccccccc
mov dword [ebp - 4], 0xcccccccc
mov eax, dword [ebp + 8]
mov dword [eax], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], 0
mov edx, dword [ebp + 8]
mov dword [edx + 8], 0
mov eax, dword [ebp + 8]
push eax
call fcn.10004840
add esp, 4
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 8]
cmp dword [ecx], 0
je 0x10004b0b
mov dword [ebp - 8], 0
jmp 0x10004a9a
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 8]
cmp ecx, dword [eax + 8]
jae 0x10004b09
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov esi, esp
mov ecx, dword [ebp - 8]
mov edx, dword [eax + ecx*4]
push edx
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
cmp esi, esp
call fcn.10008c8c
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x10004b07
mov esi, esp
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp esi, esp
call fcn.10008c8c
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0xc]
push eax
call fcn.10004660
add esp, 0xc
mov esi, esp
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.10008c8c
jmp 0x10004a91
jmp 0x10004b12
mov dword [ebp - 4], 9
mov eax, dword [ebp - 4]
pop esi
add esp, 0xc
cmp ebp, esp
call fcn.10008c8c
mov esp, ebp
pop ebp
ret

Function at 0x10004b30
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov dword [ebp - 8], 0xcccccccc
mov dword [ebp - 4], 0xcccccccc
mov dword [ebp - 4], 0
jmp 0x10004b57
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 4]
cmp edx, dword [ecx + 8]
jae 0x10004bb2
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov esi, esp
mov edx, dword [ebp - 4]
mov eax, dword [ecx + edx*4]
push eax
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
cmp esi, esp
call fcn.10008c8c
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10004bb0
mov esi, esp
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp esi, esp
call fcn.10008c8c
mov esi, esp
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.10008c8c
jmp 0x10004b4e
mov esi, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
push 0
mov edx, dword [0x1002b214]
push edx
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp esi, esp
call fcn.10008c8c
pop esi
add esp, 8
cmp ebp, esp
call fcn.10008c8c
mov esp, ebp
pop ebp
ret
Function at 0x10004be0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
push edi
mov eax, 0xcccccccc
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
imul eax, dword [ebp + 8], 0x2c
add eax, dword [0x1002c000]
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], 5
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 4]
mov cl, byte [eax + 0x14]
and cl, 1
movzx edx, cl
test edx, edx
je 0x10004c43
mov eax, dword [ebp - 0x18]
sub eax, 5
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x14]
add ecx, 2
mov dword [ebp - 0x14], ecx
mov esi, esp
lea edx, [ebp - 0xc]
push edx
push 0x40
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, esp
call fcn.10008c8c
test eax, eax
jne 0x10004c6e
mov eax, 0xa
jmp 0x10004d70
cmp dword [ebp + 0xc], 0
je 0x10004cba
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
mov byte [eax], 0xe9
mov ecx, dword [ebp - 0x18]
add ecx, 5
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
sub eax, ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 1], eax
mov edx, dword [ebp - 4]
mov al, byte [edx + 0x14]
and al, 1
movzx ecx, al
test ecx, ecx
je 0x10004cb8
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
mov byte [ecx], 0xeb
mov edx, dword [ebp - 0x20]
mov byte [edx + 1], 0xf9
jmp 0x10004cf6
mov eax, dword [ebp - 4]
mov cl, byte [eax + 0x14]
and cl, 1
movzx edx, cl
test edx, edx
je 0x10004ce1
push 7
mov eax, dword [ebp - 4]
add eax, 0xc
push eax
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.1000a720
add esp, 0xc
jmp 0x10004cf6
push 5
mov edx, dword [ebp - 4]
add edx, 0xc
push edx
mov eax, dword [ebp - 0x18]
push eax
call fcn.1000a720
add esp, 0xc
mov esi, esp
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, esp
call fcn.10008c8c
mov esi, esp
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x18]
push eax
mov edi, esp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp edi, esp
call fcn.10008c8c
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
cmp esi, esp
call fcn.10008c8c
mov cl, byte [ebp + 0xc]
and cl, 1
shl cl, 1
mov edx, dword [ebp - 4]
mov al, byte [edx + 0x14]
and al, 0xfd
or al, cl
mov ecx, dword [ebp - 4]
mov byte [ecx + 0x14], al
mov dl, byte [ebp + 0xc]
and dl, 1
shl dl, 2
mov eax, dword [ebp - 4]
mov cl, byte [eax + 0x14]
and cl, 0xfb
or cl, dl
mov edx, dword [ebp - 4]
mov byte [edx + 0x14], cl
xor eax, eax
push edx
mov ecx, ebp
push eax
lea edx, [0x10004d94]
call fcn.10008c38
pop eax
pop edx
pop edi
pop esi
add esp, 0x20
cmp ebp, esp
call fcn.10008c8c
mov esp, ebp
pop ebp
ret
Function at 0x10005440
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov dword [ebp - 8], 0xcccccccc
mov dword [ebp - 4], 0xcccccccc
mov eax, dword [0x1002bff8]
mov dword [ebp - 4], eax
jmp 0x10005467
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
je 0x10005480
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
je 0x1000547e
mov eax, dword [ebp - 4]
jmp 0x10005504
jmp 0x1000545f
mov esi, esp
push 0x40
push 0x3000
push 0x1000
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
cmp esi, esp
call fcn.10008c8c
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x10005501
mov ecx, dword [ebp - 4]
add ecx, 0x20
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 4]
mov dword [edx + 4], 0
mov eax, dword [ebp - 4]
mov dword [eax + 8], 0
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
mov dword [ecx], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [ecx + 4], edx
mov eax, dword [ebp - 8]
add eax, 0x20
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 4]
cmp ecx, 0xfe0
jbe 0x100054c3
mov edx, dword [ebp - 4]
mov eax, dword [0x1002bff8]
mov dword [edx], eax
mov ecx, dword [ebp - 4]
mov dword [0x1002bff8], ecx
mov eax, dword [ebp - 4]
pop esi
add esp, 8
cmp ebp, esp
call fcn.10008c8c
mov esp, ebp
pop ebp
ret

Function at 0x100059f0
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp + 8]
movzx eax, byte [edx + ecx]
test eax, eax
je 0x10005a39
mov ecx, 1
imul edx, ecx, 0
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + edx]
cmp ecx, 0x90
je 0x10005a39
mov edx, 1
imul eax, edx, 0
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + eax]
cmp edx, 0xcc
je 0x10005a39
xor eax, eax
jmp 0x10005a7a
mov dword [ebp - 4], 1
jmp 0x10005a4b
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x10005a75
mov edx, dword [ebp + 8]
add edx, dword [ebp - 4]
movzx eax, byte [edx]
mov ecx, 1
imul edx, ecx, 0
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + edx]
cmp eax, edx
je 0x10005a73
xor eax, eax
jmp 0x10005a7a
jmp 0x10005a42
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x10007a6f
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
push edi
mov edi, dword [ebp + 0xc]
test eax, eax
jg 0x10007a90
jl 0x10007a87
test edi, edi
jne 0x10007a90
xor eax, eax
xor edx, edx
jmp 0x10007b51
cmp dword [ebx + 0x38], 0
je 0x10007aa5
push eax
push edi
push dword [ebp + 8]
call fcn.10007b57
jmp 0x10007b51
mov eax, dword [ebx + 0x1c]
push esi
mov esi, edi
mov ecx, dword [eax]
test ecx, ecx
je 0x10007aec
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax]
mov dword [ebp - 4], eax
test eax, eax
je 0x10007aec
cmp eax, edi
jb 0x10007ac6
mov eax, edi
mov dword [ebp - 4], edi
push eax
push ecx
push dword [ebp + 8]
call fcn.1000a720
mov ecx, dword [ebp - 4]
add esp, 0xc
mov eax, dword [ebp + 8]
sub esi, ecx
add eax, ecx
mov dword [ebp - 4], eax
mov eax, dword [ebx + 0x2c]
sub dword [eax], ecx
mov eax, dword [ebx + 0x1c]
add dword [eax], ecx
jmp 0x10007af2
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp dword [ebx + 0x4c], 0
je 0x10007b46
mov ecx, ebx
call fcn.100072c2
mov ecx, dword [ebp - 4]
mov edx, esi
mov eax, 0xfff
cmp esi, eax
jbe 0x10007b31
push dword [ebx + 0x4c]
push eax
push 1
push ecx
call fcn.1000eaca
mov ecx, dword [ebp - 4]
sub esi, eax
add ecx, eax
add esp, 0x10
mov dword [ebp - 4], ecx
mov edx, esi
cmp eax, 0xfff
jne 0x10007b46
jmp 0x10007b04
test edx, edx
je 0x10007b46
push dword [ebx + 0x4c]
push esi
push 1
push ecx
call fcn.1000eaca
add esp, 0x10
sub esi, eax
mov edx, dword [ebp + 0x10]
sub edi, esi
mov eax, edi
sbb edx, 0
pop esi
pop edi
pop ebx
leave
ret 0xc

Function at 0x10010ad5
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x10010b14
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10010b14
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10010b14
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x10010b14
cmp dword [ecx + 0x74], 0xe
jbe 0x10010b14
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x10013e25
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10023a00
push 0x100239f8
push str.FlsAlloc
push 0x1f
call fcn.10013ced
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10013e59
push dword [ebp + 8]
mov ecx, esi
call dword [0x10020184]
call esi
jmp 0x10013e5f
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x10013ea3
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10023a10
push 0x10023a08
push str.FlsGetValue
push 0x21
call fcn.10013ced
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10013eda
push dword [ebp + 8]
mov ecx, esi
call dword [0x10020184]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x10013ee2
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10023a18
push 0x10023a10
push str.FlsSetValue
push 0x22
call fcn.10013ced
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10013f1c
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x10020184]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x1001586e
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.1000a0e0
mov eax, dword [0x1002a380]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.100144b5
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x100158b0
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x10015a0c
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.1001ebc0
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x1002bca0]
push dword [eax + edi + 0x24]
push dword [eax + edi + 0x20]
push ebx
call fcn.1001686b
mov ecx, dword [esi*4 + 0x1002bca0]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [ecx + edi + 0x20]
jne 0x10015a05
cmp eax, dword [ecx + edi + 0x24]
jne 0x10015a05
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [ecx + edi + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10015a05
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.1001686b
add esp, 0x14
test edx, edx
jl 0x10015a05
jg 0x1001597b
test eax, eax
jb 0x10015a05
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x10015a05
jl 0x10015995
cmp dword [ebp - 0x1008], eax
ja 0x10015a05
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x100159b3
test ebx, ebx
je 0x100159ec
cmp ecx, edi
jae 0x100159ec
mov al, byte [ecx]
cmp al, 0xd
jne 0x100159cd
lea eax, [edi - 1]
cmp ecx, eax
jae 0x100159d9
cmp byte [ecx + 1], 0xa
jne 0x100159d9
inc ecx
jmp 0x100159d9
movzx eax, al
movsx eax, byte [eax + 0x1002a638]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x100159b3
cmp edx, ebx
jne 0x100159b3
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x10015a0a
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.10008861
leave
ret