joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10004a80
Capabilities:
Create thread

Disassembly:
push 0
push 0
push 0
push 0x10004360
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret

Function at 0x10004ab0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [0x10047354]
lea eax, [ebp - 4]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push eax
push 0x40
push 4
push esi
call edi
mov eax, dword [0x10046058]
mov dword [esi], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
push 4
push esi
call edi
mov esi, dword [0x10047364]
lea eax, [ebp - 4]
push eax
push 0x40
push 8
push esi
call edi
mov eax, dword [0x10046068]
mov ecx, dword [0x1004606c]
mov dword [esi], eax
lea eax, [ebp - 8]
push eax
mov dword [esi + 4], ecx
push dword [ebp - 4]
push 8
push esi
call edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x100057e0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push edi
mov edi, dword [0x10047350]
lea eax, [ebp - 4]
push eax
push 0x40
push 8
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [0x10046028]
mov ecx, dword [0x1004602c]
mov dword [edi], eax
lea eax, [ebp - 8]
push eax
mov dword [edi + 4], ecx
push dword [ebp - 4]
push 8
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x10005830
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push edi
mov edi, dword [0x10047368]
lea eax, [ebp - 4]
push eax
push 0x40
push 0x10
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [0x10046020]
mov ecx, dword [0x10046024]
mov dword [edi + 8], eax
mov eax, dword [0x10046018]
mov dword [edi], eax
lea eax, [ebp - 8]
mov dword [edi + 0xc], ecx
mov ecx, dword [0x1004601c]
push eax
mov dword [edi + 4], ecx
push dword [ebp - 4]
push 0x10
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x10005ce0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [0x10047354]
lea eax, [ebp - 4]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push eax
push 0x40
push 4
push esi
call edi
mov eax, dword [0x10046054]
mov dword [esi], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
push 4
push esi
call edi
mov esi, dword [0x10047364]
lea eax, [ebp - 4]
push eax
push 0x40
push 8
push esi
call edi
mov eax, dword [0x10046060]
mov ecx, dword [0x10046064]
mov dword [esi], eax
lea eax, [ebp - 8]
push eax
mov dword [esi + 4], ecx
push dword [ebp - 4]
push 8
push esi
call edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10005d50
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp byte [0x100473f6], 0
je 0x10005d77
push dword [0x10046004]
mov ecx, dword [0x10047350]
mov edx, 0x10004280
call fcn.1000aff0
jmp 0x10005d85
cmp byte [0x10047385], 0
jne 0x10005d85
call fcn.100057e0
cmp byte [0x100473f4], 0
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
je 0x10005dae
push dword [0x10046008]
mov ecx, dword [0x10047360]
mov edx, 0x10004350
call fcn.1000aff0
jmp 0x10005dfe
mov esi, dword [0x10047360]
lea eax, [ebp - 4]
push eax
push 0x40
push dword [0x10046008]
push esi
call edi
mov ax, word [0x10046014]
mov ecx, dword [0x1004603c]
mov word [esi + 0x10], ax
mov eax, dword [0x10046038]
mov dword [esi + 8], eax
mov eax, dword [0x10046030]
mov dword [esi], eax
lea eax, [ebp - 8]
mov dword [esi + 0xc], ecx
mov ecx, dword [0x10046034]
push eax
mov dword [esi + 4], ecx
push dword [ebp - 4]
push dword [0x10046008]
push esi
call edi
cmp byte [0x100473f5], 0
je 0x10005e23
push dword [0x1004600c]
mov ecx, dword [0x10047358]
mov edx, 0x100042e0
call fcn.1000aff0
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov esi, dword [0x10047358]
lea eax, [ebp - 4]
push eax
push 0x40
push dword [0x1004600c]
push esi
call edi
mov ax, word [0x10046050]
mov ecx, dword [0x1004604c]
mov word [esi + 0x10], ax
mov eax, dword [0x10046048]
mov dword [esi + 8], eax
mov eax, dword [0x10046040]
mov dword [esi], eax
lea eax, [ebp - 8]
mov dword [esi + 0xc], ecx
mov ecx, dword [0x10046044]
push eax
mov dword [esi + 4], ecx
push dword [ebp - 4]
push dword [0x1004600c]
push esi
call edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10005e80
Capabilities:
Create thread
Log keystrokes via polling

Disassembly:
movsx eax, byte [0x100473e8]
push eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
bt ax, 0xf
jae 0x10005fcd
cmp byte [0x10047378], 0
jne 0x10005fcd
cmp byte [0x10047384], 0
jne 0x10005fc2
cmp byte [0x10047385], 0
sete al
mov byte [0x10047385], al
test al, al
je 0x10005f82
push dword [section..data]
mov ecx, dword [0x10047368]
xorps xmm0, xmm0
movups xmmword [0x100473c4], xmm0
mov edx, 0x100042f0
mov byte [0x100473e4], 0
movaps xmm0, xmmword [0x10034890]
movups xmmword [0x100473d4], xmm0
call fcn.1000aff0
push dword [0x10046004]
mov ecx, dword [0x10047350]
mov edx, 0x10004280
call fcn.1000aff0
call fcn.10004ab0
push dword [0x1004605c]
mov ecx, dword [0x10047364]
mov edx, 0x10004340
call fcn.1000aff0
push 0x100473b0
push 0x100473ac
call fcn.1000cbf0
mov eax, dword [0x100473b0]
cdq
sub eax, edx
sar eax, 1
push eax
mov eax, dword [0x100473ac]
cdq
sub eax, edx
sar eax, 1
push eax
call dword [sym.imp.USER32.dll_SetCursorPos]
push 0
push 0
push 0
push 0x10004aa0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x100473b4], eax
call fcn.1000c940
push eax
push str.__s__AC4Tweaker:_Freecam_Enabled_n
jmp 0x10005fb5
mov eax, dword [0x100473b4]
test eax, eax
je 0x10005f92
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.10005830
cmp byte [0x100473f6], 0
jne 0x10005fa5
call fcn.100057e0
call fcn.10005ce0
call fcn.1000c940
push eax
push str.__s__AC4Tweaker:_Freecam_Disabled_n
mov dword [0x10047750], eax
call fcn.1000b720
add esp, 8
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
ret
Function at 0x10007340
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003362d
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x100462d0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 8
mov dword [esi + 0x30], 0
mov dword [esi + 8], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0x201
mov dword [esi + 0x18], 6
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0xc], 0
call fcn.1000da28
mov edi, eax
add esp, 4
test edi, edi
je 0x100073dd
push 1
mov dword [ebp - 4], 0
call fcn.1000d0f7
add esp, 4
mov dword [edi + 4], eax
jmp 0x100073df
xor edi, edi
mov eax, dword [ebp + 8]
mov dword [esi + 0x30], edi
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], 0
mov edi, dword [edi + 4]
mov ecx, edi
mov dword [ebp - 0x10], edi
mov eax, dword [edi]
call dword [eax + 4]
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 1
push eax
call fcn.10002160
add esp, 4
mov ecx, dword [eax]
push 0x20
mov edx, dword [ecx + 0x20]
mov ecx, eax
call edx
mov dword [ebp - 4], 0xffffffff
mov bl, al
test edi, edi
je 0x1000743a
mov edx, dword [edi]
mov ecx, edi
call dword [edx + 8]
test eax, eax
je 0x1000743a
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
cmp dword [esi + 0x38], 0
mov byte [esi + 0x40], bl
jne 0x10007456
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x10]
and eax, 0x13
or eax, 4
mov dword [esi + 0xc], eax
and ecx, eax
jne 0x10007479
cmp byte [ebp + 0xc], 0
je 0x10007465
push esi
call fcn.1000d58c
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
test cl, 4
je 0x10007485
mov esi, str.ios_base::badbit_set
jmp 0x10007495
test cl, 2
mov esi, str.ios_base::failbit_set
mov eax, str.ios_base::eofbit_set
cmove esi, eax
lea eax, [ebp - 0x14]
push 1
push eax
call fcn.100074c0
add esp, 8
lea ecx, [ebp - 0x28]
push eax
push esi
call fcn.10002a80
push 0x10044424
lea eax, [ebp - 0x28]
push eax
call fcn.1000ebec
int3
Function at 0x10009ad0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp byte [0x1004748c], 0
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
je 0x10009aff
push dword [0x100460a8]
mov ecx, dword [0x10047484]
mov edx, 0x10009790
call fcn.1000aff0
jmp 0x10009b2b
mov esi, dword [0x10047484]
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push esi
call edi
mov al, byte [0x100460bc]
mov byte [esi + 4], al
mov eax, dword [0x100460b8]
mov dword [esi], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
push 5
push esi
call edi
cmp byte [0x10047494], 0
je 0x10009b4c
push dword [0x100460ac]
mov ecx, dword [0x1004747c]
mov edx, 0x10009770
call fcn.1000aff0
jmp 0x10009b83
mov esi, dword [0x1004747c]
lea eax, [ebp - 4]
push eax
push 0x40
push 0xa
push esi
call edi
mov ax, word [0x100460c8]
mov ecx, dword [0x100460c4]
mov word [esi + 8], ax
mov eax, dword [0x100460c0]
mov dword [esi], eax
lea eax, [ebp - 8]
push eax
mov dword [esi + 4], ecx
push dword [ebp - 4]
push 0xa
push esi
call edi
cmp byte [0x100474a0], 0
je 0x10009ba4
push dword [0x100460b0]
mov ecx, dword [0x10047478]
mov edx, 0x100097a0
call fcn.1000aff0
jmp 0x10009bd9
mov esi, dword [0x10047478]
lea eax, [ebp - 4]
push eax
push 0x40
push 0xc
push esi
call edi
mov eax, dword [0x100460cc]
mov ecx, dword [0x100460d4]
mov dword [esi + 8], eax
mov eax, dword [0x100460d0]
mov dword [esi], eax
lea eax, [ebp - 8]
push eax
mov dword [esi + 4], ecx
push dword [ebp - 4]
push 0xc
push esi
call edi
cmp byte [0x100474ac], 0
je 0x10009bfe
push dword [0x100460b4]
mov ecx, dword [0x10047474]
mov edx, 0x100097c0
call fcn.1000aff0
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov esi, dword [0x10047474]
lea eax, [ebp - 4]
push eax
push 0x40
push 8
push esi
call edi
mov eax, dword [0x100460d8]
mov ecx, dword [0x100460dc]
mov dword [esi], eax
lea eax, [ebp - 8]
push eax
mov dword [esi + 4], ecx
push dword [ebp - 4]
push 8
push esi
call edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1000ad80
Capabilities:
Log keystrokes via polling

Disassembly:
movsx eax, byte [0x10047588]
push eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
bt ax, 0xf
jae 0x1000adbe
cmp byte [0x10047529], 0
mov ecx, dword [0x10047584]
mov eax, dword [0x100461c4]
sete dl
mov byte [0x10047529], dl
push 0xc8
mov byte [eax + ecx], dl
call dword [sym.imp.KERNEL32.dll_Sleep]
ret
Function at 0x1000adc0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp byte [0x10047548], 0
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
je 0x1000ae05
push dword [0x1004612c]
mov ecx, dword [0x1004750c]
mov edx, 0x1000ad70
call fcn.1000aff0
push dword [0x10046130]
mov ecx, dword [0x100474ec]
mov edx, 0x1000ad60
call fcn.1000aff0
jmp 0x1000ae5f
mov esi, dword [0x1004750c]
lea eax, [ebp - 4]
push eax
push 0x40
push 8
push esi
call edi
mov eax, dword [0x10046138]
mov ecx, dword [0x1004613c]
mov dword [esi], eax
lea eax, [ebp - 8]
push eax
mov dword [esi + 4], ecx
push dword [ebp - 4]
push 8
push esi
call edi
mov esi, dword [0x100474ec]
lea eax, [ebp - 4]
push eax
push 0x40
push 8
push esi
call edi
mov eax, dword [0x10046140]
mov ecx, dword [0x10046144]
mov dword [esi], eax
lea eax, [ebp - 8]
push eax
mov dword [esi + 4], ecx
push dword [ebp - 4]
push 8
push esi
call edi
mov esi, dword [0x10047510]
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push esi
call edi
cmp byte [0x10047535], 0
movzx eax, byte [0x10046199]
movzx ecx, byte [0x10046198]
cmovne ecx, eax
lea eax, [ebp - 8]
push eax
mov byte [esi], cl
push dword [ebp - 4]
push 1
push esi
call edi
mov esi, dword [0x10047518]
lea eax, [ebp - 4]
push eax
push 0x40
push 8
push esi
call edi
cmp byte [0x10047550], 0
je 0x1000aebd
mov eax, dword [0x10046188]
mov ecx, dword [0x1004618c]
jmp 0x1000aec8
mov eax, dword [0x10046190]
mov ecx, dword [0x10046194]
mov dword [esi], eax
lea eax, [ebp - 8]
push eax
mov dword [esi + 4], ecx
push dword [ebp - 4]
push 8
push esi
call edi
mov esi, dword [0x100474f8]
lea eax, [ebp - 4]
push eax
push 0x40
push 8
push esi
call edi
cmp byte [0x10047560], 0
je 0x1000af00
mov eax, dword [0x10046148]
mov ecx, dword [0x1004614c]
jmp 0x1000af0b
mov eax, dword [0x10046150]
mov ecx, dword [0x10046154]
mov dword [esi], eax
lea eax, [ebp - 8]
push eax
mov dword [esi + 4], ecx
push dword [ebp - 4]
push 8
push esi
call edi
mov esi, dword [0x100474f4]
lea eax, [ebp - 4]
push eax
push 0x40
push 8
push esi
call edi
cmp byte [0x10047568], 0
je 0x1000af43
mov eax, dword [0x10046158]
mov ecx, dword [0x1004615c]
jmp 0x1000af4e
mov eax, dword [0x10046160]
mov ecx, dword [0x10046164]
mov dword [esi], eax
lea eax, [ebp - 8]
push eax
mov dword [esi + 4], ecx
push dword [ebp - 4]
push 8
push esi
call edi
mov esi, dword [0x1004751c]
lea eax, [ebp - 4]
push eax
push 0x40
push 8
push esi
call edi
cmp byte [0x10047570], 0
je 0x1000af86
mov eax, dword [0x10046168]
mov ecx, dword [0x1004616c]
jmp 0x1000af91
mov eax, dword [0x10046170]
mov ecx, dword [0x10046174]
mov dword [esi], eax
lea eax, [ebp - 8]
push eax
mov dword [esi + 4], ecx
push dword [ebp - 4]
push 8
push esi
call edi
mov esi, dword [0x10047500]
lea eax, [ebp - 4]
push eax
push 0x40
push 8
push esi
call edi
cmp byte [0x10047578], 0
je 0x1000afc9
mov eax, dword [0x10046178]
mov ecx, dword [0x1004617c]
jmp 0x1000afd4
mov eax, dword [0x10046180]
mov ecx, dword [0x10046184]
mov dword [esi], eax
lea eax, [ebp - 8]
push eax
mov dword [esi + 4], ecx
push dword [ebp - 4]
push 8
push esi
call edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1000aff0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 4]
push esi
push edi
push eax
push 0x40
mov edi, ecx
mov esi, edx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esi, edi
mov byte [edi], 0xe9
sub esi, 5
mov dword [edi + 1], esi
cmp ebx, 5
jbe 0x1000b031
lea eax, [ebx - 5]
push eax
lea eax, [edi + 5]
push 0x90
push eax
call fcn.1000f640
add esp, 0xc
lea eax, [ebp + 8]
push eax
push dword [ebp - 4]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x1000b670
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp byte [0x10046224], 0
je 0x1000b699
push dword [0x1004621c]
mov ecx, dword [0x10047594]
mov edx, 0x1000b4a0
call fcn.1000aff0
mov esp, ebp
pop ebp
ret
push edi
mov edi, dword [0x10047594]
lea eax, [ebp - 4]
push eax
push 0x40
push 6
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, 0x468b
mov dword [edi + 2], 0x70568b6c
mov word [edi], ax
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
push 6
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x1000c360
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push edi
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
nop
movsx eax, byte [0x10047640]
push eax
call edi
bt ax, 0xf
jae 0x1000c3c3
call fcn.1000c420
call fcn.1000a040
call fcn.10009ad0
call fcn.1000ca90
call fcn.1000b670
call fcn.1000adc0
call fcn.10005d50
call fcn.1000c940
push eax
push str.__s__AC4Tweaker:_Updated_settings_n
mov dword [0x10047750], eax
call fcn.1000b720
add esp, 8
push 0xc8
call esi
call fcn.10005e80
call fcn.1000ad80
movsx eax, byte [0x10047641]
push eax
call edi
bt ax, 0xf
jae 0x1000c3ea
call fcn.1000b8b0
push 0xc8
call esi
movsx eax, byte [0x10047642]
push eax
call edi
bt ax, 0xf
jae 0x1000c407
call fcn.10009fe0
push 0xc8
call esi
push 0x32
call esi
jmp 0x1000c370

Function at 0x1000c6b0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
cmp eax, 1
jne 0x1000c741
call fcn.1000c420
call fcn.1000c760
call fcn.10009620
call fcn.10009650
call fcn.10009d40
call fcn.10009d60
call fcn.10009ce0
call fcn.10009d00
call fcn.10009cc0
call fcn.10009d20
call fcn.1000b830
call fcn.1000b850
call fcn.1000b870
call fcn.1000b890
call fcn.1000b810
call fcn.1000b480
call fcn.1000a3d0
call fcn.1000a3f0
call fcn.10004a80
call fcn.10004a60
push 0
push 0
push 0
push 0x1000c410
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
pop ebp
ret 0xc
test eax, eax
jne 0x1000c74a
call fcn.1000b700
mov eax, 1
pop ebp
ret 0xc
Function at 0x1000ca90
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [ebp - 4]
cmp byte [0x1004775c], 0
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push eax
push 0x40
push 1
push 0x159f765
je 0x1000cb48
call esi
lea eax, [ebp - 8]
mov byte [0x159f765], 0xeb
push eax
push dword [ebp - 4]
push 1
push 0x159f765
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x1b09f45
call esi
lea eax, [ebp - 8]
mov byte [0x1b09f45], 0xeb
push eax
push dword [ebp - 4]
push 1
push 0x1b09f45
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 2
push 0x13ae26f
call esi
mov eax, 0x9090
mov word [0x13ae26f], ax
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
push 2
push 0x13ae26f
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 8
push 0x12e7e7e
call esi
mov dword [0x12e7e7e], 0x7de9
mov dword [0x12e7e82], 0xd18b9000
jmp 0x1000cbd4
call esi
lea eax, [ebp - 8]
mov byte [0x159f765], 0x74
push eax
push dword [ebp - 4]
push 1
push 0x159f765
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x1b09f45
call esi
lea eax, [ebp - 8]
mov byte [0x1b09f45], 0x74
push eax
push dword [ebp - 4]
push 1
push 0x1b09f45
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 2
push 0x13ae26f
call esi
mov eax, 0xd375
mov word [0x13ae26f], ax
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
push 2
push 0x13ae26f
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 8
push 0x12e7e7e
call esi
mov dword [0x12e7e7e], 0x7c840f
mov dword [0x12e7e82], 0xd18b0000
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
push 8
push 0x12e7e7e
call esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1002101a
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100392c8
push 0x100392c0
push str.FlsAlloc
push 0x1e
call fcn.10020e87
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1002104e
push dword [ebp + 8]
mov ecx, esi
call dword [0x10034180]
call esi
jmp 0x10021054
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x10021098
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100392d8
push 0x100392d0
push str.FlsGetValue
push 0x20
call fcn.10020e87
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100210cf
push dword [ebp + 8]
mov ecx, esi
call dword [0x10034180]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x10022b45
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100229b6

Function at 0x10022f3f
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.1000e970
mov eax, dword [0x100462d0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.10021b7f
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x10022f81
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x100230dd
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.10032a70
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x10048110]
push dword [edi + eax + 0x24]
push dword [edi + eax + 0x20]
push ebx
call fcn.10023f36
mov ecx, dword [esi*4 + 0x10048110]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [edi + ecx + 0x20]
jne 0x100230d6
cmp eax, dword [edi + ecx + 0x24]
jne 0x100230d6
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [edi + ecx + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x100230d6
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.10023f36
add esp, 0x14
test edx, edx
jl 0x100230d6
jg 0x1002304c
test eax, eax
jb 0x100230d6
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x100230d6
jl 0x10023066
cmp dword [ebp - 0x1008], eax
ja 0x100230d6
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x10023084
test ebx, ebx
je 0x100230bd
cmp ecx, edi
jae 0x100230bd
mov al, byte [ecx]
cmp al, 0xd
jne 0x1002309e
lea eax, [edi - 1]
cmp ecx, eax
jae 0x100230aa
cmp byte [ecx + 1], 0xa
jne 0x100230aa
inc ecx
jmp 0x100230aa
movzx eax, al
movsx eax, byte [eax + 0x10046558]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x10023084
cmp edx, ebx
jne 0x10023084
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x100230db
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.1000da6b
leave
ret
Function at 0x100233d4
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x10048110]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x10023414
cmp byte [ebx], 0xa
jne 0x10023414
or byte [eax + edi + 0x28], 4
jmp 0x10023419
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x10023517
mov al, byte [edx]
cmp al, 0x1a
je 0x100234f9
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0x10023448
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0x1002346d
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x10023477
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0x1002342a
jmp 0x10023517
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x100234f4
cmp dword [ebp - 0xc], 0
je 0x100234f4
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0x10048110]
test byte [eax + edi + 0x28], 0x48
je 0x100234ce
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x100234b9
mov byte [esi], dl
jmp 0x100234ca
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x10048110]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x10023517
cmp byte [ebp - 1], 0xa
jne 0x100234dd
cmp esi, ebx
jne 0x100234dd
mov byte [esi], 0xa
jmp 0x10023516
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.10023f54
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x10023517
mov byte [esi], 0xd
jmp 0x10023516
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x10048110]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x10023513
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x10023517
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret