joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003ece0
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x1003ed13
push esi
call fcn.10041de0
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x1003ed0c
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x1003ed99
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x1003ed82
mov eax, dword [esi + 8]
test eax, eax
je 0x1003ed37
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x1003ed7e
cmp eax, 2
je 0x1003ed82
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x1003ed2a
cmp eax, 3
je 0x1003ed5d
cmp eax, 1
jne 0x1003ed2a
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x1003ed2a
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x1003ed2a
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.1003edc0
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x1003eda8
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.1003edc0
add esp, 4
pop esi
ret

Function at 0x1004a2e0
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0xa0
push ebx
push ebp
mov ebp, dword [esp + 0xac]
push esi
push edi
push ebp
call sub.RASAPI32.dll_RasHangUpA
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x28
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov dword [esp + 0x10], 0xa0
call esi
mov edi, eax
call esi
sub eax, edi
cmp eax, 0xbb8
jae 0x1004a346
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x10]
push eax
push ebp
call sub.RASAPI32.dll_RasGetConnectStatusA
cmp eax, 6
je 0x1004a346
push 0
call ebx
call esi
sub eax, edi
cmp eax, 0xbb8
jb 0x1004a327
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa0
ret

Function at 0x1004a6d0
Capabilities:
Create http request

Disassembly:
push esi
mov esi, ecx
cmp dword [esi], 0
jne 0x1004a708
mov edx, dword [esi + 4]
xor eax, eax
push 0
push 0
mov ecx, dword [edx - 8]
test ecx, ecx
setne al
mov ecx, eax
neg ecx
sbb ecx, ecx
and ecx, edx
neg eax
sbb eax, eax
push ecx
and eax, 2
inc eax
push eax
push str.Mozilla_4.0__compatible__MSIE_6.0__Windows_NT_5.0_
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [esi], eax
mov ecx, dword [esi]
xor eax, eax
test ecx, ecx
setne al
pop esi
ret
Function at 0x1004b340
Capabilities:
Get socket status

Disassembly:
sub esp, 0x10c
mov eax, dword [ecx]
lea ecx, [esp]
push ecx
push 0
lea edx, [esp + 0x10]
push 0
push edx
push 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 1
call sub.WS2_32.dll_select
cmp eax, 0xffffffff
jne 0x1004b389
xor eax, eax
add esp, 0x10c
ret 4
mov edx, dword [esp + 0x110]
xor ecx, ecx
test eax, eax
setne cl
mov dword [edx], ecx
mov eax, 1
add esp, 0x10c
ret 4

Function at 0x1004b800
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1006f050
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.1004b3b0
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.1004b430
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.1004b430
lea ecx, [esi + 0xc]
call fcn.10061198
lea ecx, [esi + 0x10]
call fcn.10061198
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.1004c9c0
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.1004c9c0
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.1004c9c0
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call fcn.1006120d
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.1006120d
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x10063597
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x100635cf
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.10061668
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.10061640
jmp 0x100635db
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x10064c88
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x10064cca
call fcn.1006a8e5
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x10064cca
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x10064cc1
xor eax, eax
jmp 0x10064cd2
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.10064cd8
pop edi
pop esi
pop ebx
ret 4
Function at 0x100011d0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub dword [ebp + 0xc], 1
jne 0x100011f4
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
xor eax, eax
push eax
push eax
push eax
push 0x1000162d
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
xor eax, eax
inc eax
pop ebp
ret 0xc

Function at 0x100011fb
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x10068180]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
mov dword [ebp - 0xc], edx
push esi
push edi
mov dword [ebp - 8], ebx
mov edi, ebx
mov dword [ebp - 8], ebx
xor eax, eax
push 0x23f7
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor edi, edi
mov dword [ebx], edi
mov dword [ebx + 4], edi
mov dword [ebx + 8], edi
call fcn.10001b09
mov esi, eax
mov dword [esp], 0x23f7
push edi
mov dword [ebx], esi
push esi
lea eax, [esi + 0x23f7]
mov dword [ebx + 8], eax
call fcn.1002f9b0
lea eax, [esi + 0x23f7]
add esp, 0xc
mov dword [ebx + 4], eax
mov eax, dword [ebp - 0xc]
cmp dword [eax + 0x14], 7
jbe 0x10001266
mov eax, dword [eax]
push edi
push 0x80
push 3
push edi
push 1
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push edi
push edi
mov esi, eax
push 0x8d6af
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push edi
lea eax, [ebp - 8]
push eax
push 0x23f7
push dword [ebx]
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1002e340
leave
ret
Function at 0x10001b60
Capabilities:
Allocate thread local storage

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push edi
mov edi, ecx
lea ebp, [edi + 0x84]
push ebp
call esi
lea eax, [edi + 0x9c]
push eax
call esi
lea eax, [edi + 0xbc]
push eax
call esi
lea eax, [edi + 0xd4]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeConditionVariable]
lea eax, [edi + 0xd8]
push eax
call esi
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [edi + 0xb8], eax
lea eax, [edi + 0x7c]
mov dword [eax + 4], eax
mov dword [eax], eax
lea eax, [edi + 0xf8]
mov dword [eax + 4], eax
mov dword [eax], eax
lea eax, [edi + 0x100]
push 0
mov dword [eax + 4], eax
mov dword [eax], eax
lea eax, [edi + 0x110]
push 0
mov dword [eax + 4], eax
mov dword [eax], eax
lea eax, [edi + 0x118]
push 1
push 0
mov dword [eax + 4], eax
mov dword [eax], eax
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [edi + 0xc], eax
test eax, eax
jne 0x10001c17
xor ecx, ecx
call fcn.10006320
push eax
push str.CreateEvent_failed:__s
push str.usbi_create_event
push 1
push 0
call fcn.10006070
mov ebx, 0xffffff9d
jmp 0x10001cfb
push ecx
mov edx, eax
mov ecx, edi
call fcn.10003580
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, eax
add esp, 4
test ebx, ebx
js 0x10001cd7
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerW]
mov dword [edi + 0x10], eax
test eax, eax
jne 0x10001c7e
xor ecx, ecx
call fcn.10006320
push eax
push str.CreateWaitableTimer_failed:__s
push str.usbi_create_timer
push 2
push 0
call fcn.10006070
push str.timer_not_available_for_timeouts
push str.usbi_io_init
push 4
push edi
call fcn.10006070
add esp, 0x24
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
push str.using_timer_for_timeouts
push str.usbi_io_init
push 4
push edi
call fcn.10006070
mov edx, dword [edi + 0x10]
add esp, 0xc
mov ecx, edi
call fcn.10003580
mov ebx, eax
add esp, 4
test ebx, ebx
jns 0x10001c77
push dword [edi + 0x10]
call esi
test eax, eax
jne 0x10001ccd
xor ecx, ecx
call fcn.10006320
push eax
push str.CloseHandle_failed:__s
push str.usbi_destroy_timer
push 2
push 0
call fcn.10006070
add esp, 0x14
mov edx, dword [edi + 0xc]
mov ecx, edi
call fcn.10003630
push dword [edi + 0xc]
call esi
test eax, eax
jne 0x10001cfe
xor ecx, ecx
call fcn.10006320
push eax
push str.CloseHandle_failed:__s
push str.usbi_destroy_event
push 2
push 0
call fcn.10006070
add esp, 0x14
mov esi, dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push ebp
call esi
lea eax, [edi + 0x9c]
push eax
call esi
lea eax, [edi + 0xbc]
push eax
call esi
lea eax, [edi + 0xd8]
push eax
call esi
push dword [edi + 0xb8]
call dword [sym.imp.KERNEL32.dll_TlsFree]
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
ret
Function at 0x10006410
Capabilities:
Get common file path

Disassembly:
sub esp, 0x110
mov eax, dword [0x10068180]
xor eax, esp
mov dword [esp + 0x10c], eax
push ebx
push esi
push edi
push 0x104
lea eax, [esp + 0x10]
mov edi, edx
push eax
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edx, eax
test edx, edx
je 0x100064a4
cmp edx, 0x104
jae 0x100064a4
mov ecx, edi
lea ebx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10006450
sub ecx, ebx
lea eax, [edx + 6]
add eax, ecx
cmp eax, 0x104
jb 0x1000646c
push str.program_assertion_failed___library_path_buffer_overflow
jmp 0x100064a9
push edi
lea eax, [esp + 0x10]
add eax, edx
push str._s.dll
push eax
call fcn.100062e0
add esp, 0xc
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x10c]
xor ecx, esp
call fcn.1002e340
add esp, 0x110
ret
push str.program_assertion_failed___could_not_get_system_directory
push str.load_system_library
push 1
push esi
call fcn.10006070
mov ecx, dword [esp + 0x128]
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1002e340
add esp, 0x110
ret
Function at 0x10006530
Capabilities:
Hash data using djb2

Disassembly:
sub esp, 8
push ebx
mov ebx, ecx
mov edx, 0x1505
mov dword [esp + 4], ebx
push esi
mov esi, ebx
test ebx, ebx
jne 0x1000654e
pop esi
xor eax, eax
pop ebx
add esp, 8
ret
movsx ecx, byte [ebx]
test ecx, ecx
je 0x10006568
mov eax, edx
lea esi, [esi + 1]
shl edx, 5
add edx, ecx
movsx ecx, byte [esi]
add edx, eax
test ecx, ecx
jne 0x10006555
push ebp
test edx, edx
mov ebp, 1
mov ecx, ebp
mov eax, 0xc0906d
cmovne ecx, edx
mul ecx
mov eax, ecx
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 9
imul eax, eax, 0x3fd
push edi
push 0x10069e68
sub ecx, eax
cmovne ebp, ecx
mov esi, ebp
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x10069e58]
mov ecx, dword [eax + esi*8]
test ecx, ecx
je 0x10006690
lea edi, [eax + esi*8]
cmp ecx, ebp
jne 0x100065ed
mov ecx, dword [edi + 4]
mov eax, ebx
nop dword [eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x100065e0
test dl, dl
je 0x100065dc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x100065e0
add eax, 2
add ecx, 2
test dl, dl
jne 0x100065c0
xor eax, eax
jmp 0x100065e5
sbb eax, eax
or eax, 1
test eax, eax
je 0x100066f7
push dword [edi + 4]
push ebx
push str.hash_collision___s_vs__s_
push str.htab_hash
push 4
push 0
call fcn.10006070
mov eax, 0x14191f7
add esp, 0x18
mul ebp
mov eax, ebp
sub eax, edx
shr eax, 1
add eax, edx
mov edx, ebp
shr eax, 9
imul eax, eax, 0x3fb
sub edx, eax
inc edx
mov dword [esp + 0x14], edx
mov ecx, esi
sub ecx, edx
cmp esi, edx
lea eax, [ecx + 0x3fd]
cmova eax, ecx
mov esi, eax
mov edi, esi
cmp edi, ebp
je 0x1000668c
mov eax, dword [0x10069e58]
mov ebx, dword [eax + edi*8]
cmp ebx, ebp
jne 0x10006680
mov eax, dword [eax + edi*8 + 4]
mov ecx, dword [esp + 0x10]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x10006673
test dl, dl
je 0x1000666f
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x10006673
add ecx, 2
add eax, 2
test dl, dl
jne 0x10006653
xor eax, eax
jmp 0x10006678
sbb eax, eax
or eax, 1
test eax, eax
je 0x10006688
mov edx, dword [esp + 0x14]
mov esi, edi
test ebx, ebx
je 0x1000668c
jmp 0x10006628
mov esi, edi
jmp 0x100066f7
mov ebx, dword [esp + 0x10]
cmp dword [0x10069d3c], 0x3fd
jb 0x100066bb
push 0x3fd
push str.hash_table_is_full___lu_entries_
push str.htab_hash
push 1
push 0
call fcn.10006070
add esp, 0x14
xor esi, esi
jmp 0x100066f7
push ebx
call fcn.10038551
mov ecx, eax
add esp, 4
mov eax, dword [0x10069e58]
mov dword [eax + esi*8 + 4], ecx
lea eax, [eax + esi*8]
test ecx, ecx
jne 0x100066ef
push str.could_not_duplicate_string_for_hash_table
push str.htab_hash
push 1
push ecx
call fcn.10006070
add esp, 0x10
xor esi, esi
jmp 0x100066f7
inc dword [0x10069d3c]
mov dword [eax], ebp
push 0x10069e68
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop ebp
mov eax, esi
pop esi
pop ebx
add esp, 8
ret
Function at 0x10006e30
Capabilities:
Create thread

Disassembly:
mov eax, dword [0x10069e80]
push ebx
inc eax
xor bl, bl
mov dword [0x10069e80], eax
push esi
mov esi, dword [esp + 0xc]
push edi
cmp eax, 1
jne 0x10006f58
call fcn.100067a0
mov dword [0x1006a03c], eax
test eax, eax
jne 0x10006e7a
push str.failed_to_detect_Windows_version
push str.windows_init
push 1
push esi
call fcn.10006070
add esp, 0x10
mov edi, 0xfffffff4
jmp 0x10006fe3
cmp eax, 4
jge 0x10006e86
push str.Windows_version_is_too_old
jmp 0x10006e60
cmp dword [0x10069e58], 0
je 0x10006ee0
push str.program_assertion_failed___hash_table_already_allocated
push str.htab_create
push 1
push esi
call fcn.10006070
add esp, 0x10
push esi
call fcn.10008c00
mov edi, eax
add esp, 4
test edi, edi
jne 0x10006fe3
push esi
mov bl, 1
call fcn.100109d0
add esp, 4
test eax, eax
jne 0x10006f43
push str.UsbDk_backend_is_available
push str.windows_init
push 4
push esi
call fcn.10006070
mov byte [0x10069d11], bl
jmp 0x10006f55
push 0x10069e68
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x3fd
push str.using__lu_entries_hash_table
push str.htab_create
push 4
push esi
call fcn.10006070
push 8
push 0x3fe
mov dword [0x10069d3c], 0
call fcn.100358d2
add esp, 0x1c
mov dword [0x10069e58], eax
test eax, eax
jne 0x10006ea4
push str.could_not_allocate_space_for_hash_table
push str.htab_create
push 1
push esi
call fcn.10006070
add esp, 0x10
mov edi, 0xfffffff5
jmp 0x10006fe3
push str.UsbDk_backend_is_not_available
push str.windows_init
push 3
push esi
call fcn.10006070
add esp, 0x10
push 1
push 0
push 0
push 0xffffffffffffffff
mov dword [esi + fcn.10008c00], 0x1005fdd0
mov edi, 0xfffffff5
call dword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
mov dword [esi + 0x12c], eax
test eax, eax
jne 0x10006f9e
xor ecx, ecx
call fcn.10006320
push eax
push str.failed_to_create_I_O_completion_port:__s
push str.windows_init
push 1
push esi
call fcn.10006070
add esp, 0x14
jmp 0x10006fe3
push 0
push 0
push esi
push 0x10006be0
push 0
push 0
call fcn.100384c0
add esp, 0x18
mov dword [esi + 0x130], eax
test eax, eax
jne 0x10006fe1
push str.failed_to_create_I_O_completion_port_thread
push str.windows_init
push 1
push esi
call fcn.10006070
add esp, 0x10
push dword [esi + 0x12c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10006fe3
xor edi, edi
cmp dword [0x10069e80], 1
jne 0x10007032
test edi, edi
je 0x10007032
cmp byte [0x10069d11], 0
je 0x1000701a
mov eax, dword [0x10069fec]
test eax, eax
je 0x10007013
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x10069fec], 0
mov byte [0x10069d11], 0
test bl, bl
je 0x10007027
push esi
call fcn.10008c80
add esp, 4
call fcn.100064e0
dec dword [0x10069e80]
mov eax, edi
pop edi
pop esi
pop ebx
ret
Function at 0x1002ae90
Capabilities:
Enumerate pe sections

Disassembly:
push ecx
push edi
push 0
call fcn.10001e50
mov edi, eax
test edi, edi
jne 0x1002aea4
xor al, al
pop edi
pop ecx
ret
push ebx
mov ebx, dword [esp + 0x20]
lea eax, [ebx + 0x10]
push eax
push 1
call fcn.100358d2
mov edx, eax
add esp, 8
test edx, edx
jne 0x1002aee3
call fcn.100358bf
push dword [eax]
push str.Unable_to_allocate_buffer_for_libusb_control_transfer._Error:__d.
push dword [esp + 0x18]
push 2
call fcn.1002a8d0
add esp, 0x10
push edi
call fcn.10001ea0
pop ebx
xor al, al
pop edi
pop ecx
ret
mov eax, dword [esp + 0x24]
push esi
lea esi, [ebx + 8]
add esi, edx
test eax, eax
je 0x1002aef3
mov dword [esi], eax
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x1c]
mov dword [esi + 4], eax
mov al, byte [esp + 0x18]
mov byte [edx + 1], al
mov eax, ecx
shr eax, 8
mov byte [esp + 0xd], al
mov byte [esp + 0xc], cl
movzx eax, word [esp + 0xc]
mov ecx, dword [esp + 0x20]
mov word [edx + 2], ax
mov eax, ecx
shr eax, 8
mov byte [esp + 0xd], al
mov byte [esp + 0xc], cl
movzx eax, word [esp + 0xc]
mov word [edx + 4], ax
mov eax, ebx
shr eax, 8
mov byte [esp + 0xd], al
mov byte [edx], 0xc0
mov byte [esp + 0xc], bl
movzx eax, word [esp + 0xc]
mov word [edx + 6], ax
mov eax, dword [esp + 0x14]
push edi
mov eax, dword [eax + 8]
mov dword [edi], eax
mov word [edi + 5], 0
mov dword [edi + 8], 0
mov dword [edi + 0x20], edx
movzx eax, word [edx + 6]
mov ecx, eax
mov dword [edi + 0x1c], esi
and ecx, 0xffffff00
movzx eax, al
or ecx, eax
mov dword [edi + 0x18], 0x1002ac80
add ecx, 8
mov byte [edi + 4], 2
mov dword [edi + 0x10], ecx
call fcn.10002220
mov esi, eax
call fcn.100358bf
test esi, esi
mov dword [eax], esi
pop esi
jne 0x1002aed7
pop ebx
mov al, 1
pop edi
pop ecx
ret
Function at 0x1002bdc0
Capabilities:
Create thread

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0
push 0
push esi
push 0x1002bd50
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x1c], eax
call fcn.100358bf
pop esi
mov dword [eax], 0
mov al, 1
ret
Function at 0x10035e74
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x10035eb3
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10035eb3
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10035eb3
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x10035eb3
cmp dword [ecx + 0x74], 0xe
jbe 0x10035eb3
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x10042a4d
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10056034
push 0x1005602c
push str.FlsAlloc
push 0x1f
call fcn.100428cc
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10042a81
push dword [ebp + 8]
mov ecx, esi
call dword [0x100501ec]
call esi
jmp 0x10042a87
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x10042acb
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10056044
push 0x1005603c
push str.FlsGetValue
push 0x21
call fcn.100428cc
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10042b02
push dword [ebp + 8]
mov ecx, esi
call dword [0x100501ec]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x10042b0a
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1005604c
push 0x10056044
push str.FlsSetValue
push 0x22
call fcn.100428cc
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10042b44
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x100501ec]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x10045c92
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x10045d2f
push ebx
push esi
call fcn.10045c5b
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1004151e
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x10045cdc
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10045d2e
push edi
push eax
call fcn.1003f0f1
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x10045cfc
call fcn.1003e9c2
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10045d2d
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1004151e
add esp, 0x20
test eax, eax
jne 0x10045d1b
push edi
call fcn.1003e9c2
jmp 0x10045d23
push ebx
call fcn.1003e9c2
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x10045d32
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x10045d43
pop esi
ret
push ebx
push edi
push esi
call fcn.10045c5b
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.1003f0f1
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x10045d6b
push ebx
push esi
push edi
call fcn.1002fb10
add esp, 0xc
push 0
call fcn.1003e9c2
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x100464c5
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10045fe0

Function at 0x1004e140
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1004e16d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1004e16d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret