joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10008d40
Capabilities:
Get thread local storage value
Resolve function by parsing pe exports
Set thread local storage value

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [0x10056a08]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [esp + 0x20]
test ebx, ebx
je 0x10008e0e
lea esi, [ebx + 8]
test esi, esi
je 0x10008e0e
lea eax, [esp + 0x10]
mov edx, 0x10057260
push eax
lea eax, [esi + 0x17c]
mov ecx, esi
push edi
push eax
call fcn.10001430
add esp, 0xc
test al, al
jne 0x10008e0e
cmp byte [esp + 0x19], al
je 0x10008e0e
mov eax, dword [esp + 0x10]
xor ebp, ebp
mov ebx, dword [eax*4 + 0x10055e80]
add ebx, dword [esi + 0x250]
adc ebp, dword [esi + 0x254]
cmp ebp, dword [esi + 0x25c]
ja 0x10008e0e
jb 0x10008dcc
cmp ebx, dword [esi + 0x258]
jae 0x10008e0e
lea ecx, [eax*2 + 0x4d]
add ecx, eax
mov ax, word [esi + ecx*8]
cmp ax, word [esi + ecx*8 + 0x12]
lea ecx, [esi + ecx*8]
je 0x10008e0e
add dword [ecx], 0xfffffffc
mov eax, dword [ecx]
mov dword [eax], edi
movzx eax, word [ecx]
mov dx, word [ecx + 0x12]
push eax
call fcn.100010c0
add esp, 4
mov dword [esi + 0x250], ebx
mov dword [esi + 0x254], ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
mov ecx, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
jmp fcn.10008390

Function at 0x10008e20
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [0x10056a08]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edx, dword [esp + 0x14]
test edi, edi
je 0x10008ed1
lea esi, [edi + 8]
test esi, esi
je 0x10008ed1
cmp edx, 0x1000
ja 0x10008ed1
lea eax, [edx + 7]
xor ebx, ebx
shr eax, 3
movzx eax, byte [eax + 0x10056040]
mov edi, dword [eax*4 + 0x10055e80]
add edi, dword [esi + 0x250]
adc ebx, dword [esi + 0x254]
cmp ebx, dword [esi + 0x25c]
ja 0x10008ed1
jb 0x10008e8f
cmp edi, dword [esi + 0x258]
jae 0x10008ed1
lea ecx, [eax*2 + 0x4d]
add ecx, eax
mov ax, word [esi + ecx*8]
cmp ax, word [esi + ecx*8 + 0x12]
lea ecx, [esi + ecx*8]
je 0x10008ed1
add dword [ecx], 0xfffffffc
mov edx, dword [ecx]
mov eax, dword [esp + 0x10]
mov dword [edx], eax
movzx eax, word [ecx]
mov dx, word [ecx + 0x12]
push eax
call fcn.100010c0
add esp, 4
mov dword [esi + 0x250], edi
mov dword [esi + 0x254], ebx
pop edi
pop esi
pop ebx
ret
mov ecx, dword [esp + 0x10]
push 0
call fcn.1000cf50
add esp, 4
pop edi
pop esi
pop ebx
ret
Function at 0x1000c450
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 0xd8
cmp byte [0x10051de2], 0
jne 0x1000c463
xor eax, eax
jmp 0x1000c4a5
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [0x10056a08]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
test edi, edi
je 0x1000c4a1
lea eax, [edi + 8]
test eax, eax
je 0x1000c4a1
cmp byte [eax + 0x23c], 0
je 0x1000c4a3
xor dl, dl
mov ecx, eax
call fcn.10032cd0
jmp 0x1000c4a3
xor eax, eax
pop edi
pop esi
test eax, eax
jne 0x1000c4b6
lea ecx, [esp + 0x18]
call fcn.1002afe0
mov eax, ecx
jmp 0x1000c4bb
add eax, 0x17c
push dword [esp + 0xdc]
mov edx, 0x10057260
push eax
lea eax, [esp + 0x14]
push eax
call fcn.100012a0
movq xmm0, qword [eax]
movq qword [esp + 0xc], xmm0
mov eax, dword [esp + 0xc]
mov eax, dword [eax*4 + 0x10055e80]
add esp, 0xe4
ret
Function at 0x1000daa0
Capabilities:
Get thread local storage value

Disassembly:
push ecx
cmp dword [esp + 0x10], 0
push ebp
push esi
push edi
mov edi, dword [esp + 0x18]
jne 0x1000db6a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [0x10056a08]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
test ebp, ebp
je 0x1000db6a
lea esi, [ebp + 8]
test esi, esi
je 0x1000db6a
cmp edi, 0x1000
ja 0x1000db6a
lea eax, [edi + 7]
xor ecx, ecx
shr eax, 3
movzx eax, byte [eax + 0x10056040]
mov ebp, dword [eax*4 + 0x10055e80]
add ebp, dword [esi + 0x250]
adc ecx, dword [esi + 0x254]
mov dword [esp + 0xc], ecx
cmp ecx, dword [esi + 0x25c]
ja 0x1000db6a
jb 0x1000db23
cmp ebp, dword [esi + 0x258]
jae 0x1000db6a
lea ecx, [eax*2 + 0x4d]
add ecx, eax
mov ax, word [esi + ecx*8]
cmp ax, word [esi + ecx*8 + 0x12]
lea ecx, [esi + ecx*8]
je 0x1000db6a
add dword [ecx], 0xfffffffc
mov edx, dword [ecx]
mov eax, dword [esp + 0x14]
mov dword [edx], eax
movzx eax, word [ecx]
mov dx, word [ecx + 0x12]
push eax
call fcn.100010c0
mov eax, dword [esp + 0x10]
add esp, 4
mov dword [esi + 0x250], ebp
mov dword [esi + 0x254], eax
pop edi
pop esi
pop ebp
pop ecx
ret
push dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
mov edx, edi
call fcn.1000cf50
add esp, 4
pop edi
pop esi
pop ebp
pop ecx
ret
Function at 0x1000db90
Capabilities:
Get thread local storage value

Disassembly:
cmp dword [0x10050928], 0
je 0x1000dba5
call fcn.100052f0
test al, al
je 0x1000dba5
xor eax, eax
ret
cmp byte [0x10051de2], 0
push esi
push edi
je 0x1000dbe8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [0x10056a08]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
test edi, edi
je 0x1000dbe8
lea ecx, [edi + 8]
test ecx, ecx
je 0x1000dbe8
cmp byte [ecx + 0x23c], 0
je 0x1000dbe8
xor dl, dl
call fcn.10032cd0
mov ecx, dword [esp + 0x10]
mov esi, 1
and ecx, 0x3f
mov edi, esi
shl edi, cl
and edi, 0xfffffffe
jne 0x1000dc7a
mov edi, dword [esp + 0xc]
cmp edi, 0x1000
ja 0x1000dc2d
lea eax, [edi + 7]
shr eax, 3
pop edi
pop esi
movzx eax, byte [eax + 0x10056040]
mov edx, dword [eax*4 + 0x10055e80]
xor eax, eax
cmp edx, 0x70000000
cmova edx, eax
mov eax, edx
ret
cmp edi, 0x70000000
jbe 0x1000dc47
xor edx, edx
xor eax, eax
cmp edx, 0x70000000
pop edi
cmova edx, eax
mov eax, edx
pop esi
ret
lea ecx, [edi*2 - 1]
call fcn.10001000
mov ecx, 4
cmp eax, 7
jb 0x1000dc60
lea ecx, [eax - 3]
shl esi, cl
xor eax, eax
dec esi
lea edx, [edi + esi]
not esi
and edx, esi
cmp edx, 0x70000000
pop edi
cmova edx, eax
mov eax, edx
pop esi
ret
push ebx
mov ebx, dword [esp + 0x10]
cmp ebx, 0x3800
ja 0x1000dcff
cmp edi, 0x1000
ja 0x1000dcff
dec ebx
mov eax, edi
add ebx, edi
neg eax
and ebx, eax
cmp ebx, 0x1000
ja 0x1000dcb6
lea eax, [ebx + 7]
shr eax, 3
movzx eax, byte [eax + 0x10056040]
mov edx, dword [eax*4 + 0x10055e80]
jmp 0x1000dce6
cmp ebx, 0x70000000
jbe 0x1000dcc2
xor edx, edx
jmp 0x1000dce6
lea ecx, [ebx*2 - 1]
call fcn.10001000
mov ecx, 4
cmp eax, 7
jb 0x1000dcdb
lea ecx, [eax - 3]
shl esi, cl
lea edx, [ebx - 1]
add edx, esi
neg esi
and edx, esi
cmp edx, 0x4000
jae 0x1000dd0f
xor eax, eax
cmp edx, 0x70000000
pop ebx
cmova edx, eax
pop edi
mov eax, edx
pop esi
ret
cmp edi, 0x70000000
ja 0x1000dd77
cmp ebx, 0x4000
ja 0x1000dd16
mov edx, 0x4000
jmp 0x1000dd45
cmp ebx, 0x70000000
ja 0x1000dd77
lea ecx, [ebx*2 - 1]
call fcn.10001000
mov ecx, 4
cmp eax, 7
jb 0x1000dd37
lea ecx, [eax - 3]
shl esi, cl
dec esi
lea edx, [ebx + esi]
not esi
and edx, esi
cmp edx, ebx
jb 0x1000dd77
mov eax, dword [0x10056a18]
lea ecx, [edi + 0xfff]
and ecx, 0xfffff000
add eax, 0xfffff000
add ecx, edx
add eax, ecx
xor ecx, ecx
cmp eax, edx
pop ebx
cmovb edx, ecx
xor eax, eax
cmp edx, 0x70000000
pop edi
cmova edx, eax
mov eax, edx
pop esi
ret
xor edx, edx
xor eax, eax
pop ebx
cmp edx, 0x70000000
pop edi
cmova edx, eax
mov eax, edx
pop esi
ret
Function at 0x1000ec40
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x18
cmp byte [0x10051de2], 0
push esi
push edi
je 0x1000ec92
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [0x10056a08]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
test edi, edi
je 0x1000ec92
lea esi, [edi + 8]
test esi, esi
je 0x1000ec92
cmp byte [esi + 0x23c], 0
je 0x1000ec94
xor dl, dl
mov ecx, esi
call fcn.10032cd0
mov esi, eax
jmp 0x1000ec94
xor esi, esi
mov eax, dword [ebp + 8]
test eax, eax
je 0x1000eca1
mov dword [esp + 8], eax
jmp 0x1000ecb4
mov eax, dword [sym.jemalloc.dll_je_malloc_message]
mov ecx, fcn.10027bb0
test eax, eax
cmovne ecx, eax
mov dword [esp + 8], ecx
mov eax, dword [ebp + 0xc]
mov edx, 0x10000
mov ecx, esi
mov dword [esp + 0xc], eax
call fcn.10016380
push dword [ebp + 0x10]
mov dword [esp + 0x14], eax
lea edx, [esp + 0xc]
neg eax
mov byte [esp + 0x20], 1
mov ecx, 0x10016450
mov dword [esp + 0x1c], 0
sbb eax, eax
and eax, 0xffff
mov dword [esp + 0x18], eax
call fcn.100303f0
mov edx, dword [esp + 0x14]
add esp, 4
test edx, edx
je 0x1000ed24
mov eax, dword [esp + 0x18]
mov byte [edx + eax], 0
push dword [esp + 0x10]
push dword [esp + 0x10]
call dword [esp + 0x10]
mov edx, dword [esp + 0x18]
add esp, 8
mov dword [esp + 0x18], 0
cmp byte [esp + 0x1c], 0
je 0x1000ed32
mov ecx, esi
call fcn.10016410
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1000ed40
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 0xd8
cmp byte [0x10051de2], 0
jne 0x1000ed53
xor eax, eax
jmp 0x1000ed95
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [0x10056a08]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
test edi, edi
je 0x1000ed91
lea eax, [edi + 8]
test eax, eax
je 0x1000ed91
cmp byte [eax + 0x23c], 0
je 0x1000ed93
xor dl, dl
mov ecx, eax
call fcn.10032cd0
jmp 0x1000ed93
xor eax, eax
pop edi
pop esi
mov edx, dword [esp + 0xdc]
test edx, edx
jne 0x1000eda9
xor eax, eax
add esp, 0xd8
ret
test eax, eax
jne 0x1000edba
lea ecx, [esp + 0x18]
call fcn.1002afe0
mov eax, ecx
jmp 0x1000edbf
add eax, 0x17c
push edx
push eax
lea eax, [esp + 0x14]
mov edx, 0x10057260
push eax
call fcn.100012a0
add esp, 0xc
movq xmm0, qword [eax]
movq qword [esp], xmm0
mov eax, dword [esp]
mov eax, dword [eax*4 + 0x10055e80]
add esp, 0xd8
ret
Function at 0x10015fe0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x3c]
mov esi, edi
shr esi, 0x16
mov ebx, edi
mov eax, esi
mov dword [esp + 0x18], edx
mov edx, dword [esp + 0x38]
and eax, 0xf
and ebx, 0xffc00000
cmp dword [edx + eax*8], ebx
lea ebp, [edx + eax*8]
jne 0x10016015
mov eax, dword [ebp + 4]
jmp 0x10016102
lea eax, [edx + 0x80]
mov dword [esp + 0x10], eax
cmp dword [eax], ebx
jne 0x1001604e
mov ecx, dword [edx + 0x84]
mov esi, dword [ebp]
shr edi, 0xc
mov dword [eax], esi
and edi, 0x3ff
mov eax, dword [ebp + 4]
mov dword [edx + 0x84], eax
mov dword [ebp], ebx
mov dword [ebp + 4], ecx
lea edx, [ecx + edi*8]
jmp 0x1001610e
lea eax, [edx + 0x88]
mov ecx, 1
mov dword [esp + 0x1c], eax
nop dword [eax]
cmp dword [eax], ebx
je 0x100160b1
inc ecx
add eax, 8
cmp ecx, 8
jb 0x10016060
mov eax, dword [esp + 0x18]
push 0x38
push dword [esp + 0x14]
push dword [esp + 0x24]
mov esi, dword [eax + esi*4 + 0x50]
call fcn.10036c90
mov ecx, dword [esp + 0x1c]
add esp, 0xc
mov eax, dword [ebp]
shr edi, 0xc
and edi, 0x3ff
mov dword [ecx], eax
mov ecx, dword [esp + 0x38]
mov eax, dword [ebp + 4]
lea edx, [esi + edi*8]
mov dword [ecx + 0x84], eax
mov dword [ebp], ebx
mov dword [ebp + 4], esi
jmp 0x1001610e
mov eax, dword [edx + ecx*8 + 0x84]
mov dword [esp + 0x1c], eax
test ecx, ecx
je 0x100160e6
mov eax, dword [edx + ecx*8 + 0x78]
mov dword [edx + ecx*8 + 0x80], eax
mov eax, dword [edx + ecx*8 + 0x7c]
mov dword [edx + ecx*8 + 0x84], eax
mov eax, dword [ebp]
mov dword [edx + ecx*8 + 0x78], eax
mov eax, dword [ebp + 4]
mov dword [edx + ecx*8 + 0x7c], eax
jmp 0x100160f8
mov ecx, dword [ebp]
mov dword [edx + 0x80], ecx
mov eax, dword [ebp + 4]
mov dword [edx + 0x84], eax
mov eax, dword [esp + 0x1c]
mov dword [ebp], ebx
mov dword [ebp + 4], eax
shr edi, 0xc
and edi, 0x3ff
lea edx, [eax + edi*8]
mov ecx, dword [edx + 4]
mov al, cl
and al, 1
mov byte [esp + 0x2d], al
mov eax, ecx
shr eax, 1
and al, 1
mov byte [esp + 0x2c], al
mov eax, ecx
shr eax, 2
and eax, 7
shr ecx, 5
mov dword [esp + 0x28], eax
mov eax, dword [edx]
pop edi
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 0x20], ecx
movups xmm0, xmmword [esp + 0x1c]
pop esi
pop ebp
movups xmmword [eax], xmm0
pop ebx
add esp, 0x20
ret
Function at 0x10016150
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x3c]
mov esi, edi
shr esi, 0x16
mov ebx, edi
mov eax, esi
mov dword [esp + 0x18], edx
mov edx, dword [esp + 0x38]
and eax, 0xf
and ebx, 0xffc00000
cmp dword [edx + eax*8], ebx
lea ebp, [edx + eax*8]
jne 0x10016185
mov eax, dword [ebp + 4]
jmp 0x10016272
lea eax, [edx + 0x80]
mov dword [esp + 0x10], eax
cmp dword [eax], ebx
jne 0x100161be
mov ecx, dword [edx + 0x84]
mov esi, dword [ebp]
shr edi, 0xc
mov dword [eax], esi
and edi, 0x3ff
mov eax, dword [ebp + 4]
mov dword [edx + 0x84], eax
mov dword [ebp + 4], ecx
mov dword [ebp], ebx
lea ecx, [ecx + edi*8]
jmp 0x1001627e
lea eax, [edx + 0x88]
mov ecx, 1
mov dword [esp + 0x1c], eax
nop dword [eax]
cmp dword [eax], ebx
je 0x10016221
inc ecx
add eax, 8
cmp ecx, 8
jb 0x100161d0
mov eax, dword [esp + 0x18]
push 0x38
push dword [esp + 0x14]
push dword [esp + 0x24]
mov esi, dword [eax + esi*4 + 0x50]
call fcn.10036c90
mov ecx, dword [esp + 0x1c]
add esp, 0xc
mov eax, dword [ebp]
shr edi, 0xc
and edi, 0x3ff
mov dword [ecx], eax
mov ecx, dword [esp + 0x38]
mov eax, dword [ebp + 4]
mov dword [ecx + 0x84], eax
lea ecx, [esi + edi*8]
mov dword [ebp], ebx
mov dword [ebp + 4], esi
jmp 0x1001627e
mov eax, dword [edx + ecx*8 + 0x84]
mov dword [esp + 0x1c], eax
test ecx, ecx
je 0x10016256
mov eax, dword [edx + ecx*8 + 0x78]
mov dword [edx + ecx*8 + 0x80], eax
mov eax, dword [edx + ecx*8 + 0x7c]
mov dword [edx + ecx*8 + 0x84], eax
mov eax, dword [ebp]
mov dword [edx + ecx*8 + 0x78], eax
mov eax, dword [ebp + 4]
mov dword [edx + ecx*8 + 0x7c], eax
jmp 0x10016268
mov ecx, dword [ebp]
mov dword [edx + 0x80], ecx
mov eax, dword [ebp + 4]
mov dword [edx + 0x84], eax
mov eax, dword [esp + 0x1c]
mov dword [ebp], ebx
mov dword [ebp + 4], eax
shr edi, 0xc
and edi, 0x3ff
lea ecx, [eax + edi*8]
mov ecx, dword [ecx + 4]
mov al, cl
and al, 1
mov byte [esp + 0x2d], al
mov eax, ecx
shr eax, 1
and al, 1
mov byte [esp + 0x2c], al
mov eax, ecx
shr eax, 2
and eax, 7
shr ecx, 5
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x34]
pop edi
mov dword [esp + 0x20], ecx
movq xmm0, qword [esp + 0x20]
mov ecx, dword [esp + 0x28]
pop esi
pop ebp
movq qword [eax], xmm0
mov dword [eax + 8], ecx
pop ebx
add esp, 0x20
ret
Function at 0x10030cb0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x20
push ebx
push ebp
mov ebp, edx
xor eax, eax
lea edx, [ecx + 0x17c]
mov dword [esp + 0x24], ebp
push esi
push edi
mov dword [esp + 0x20], edx
mov dword [esp + 0x14], eax
cmp dword [esp + 0x38], eax
jbe 0x10030e54
mov ecx, dword [esp + 0x3c]
nop dword [eax + eax]
lea ebx, [eax*4]
mov eax, dword [ebp + 4]
mov dword [esp + 0x28], ebx
mov edi, dword [ebx + eax]
mov eax, edi
shr eax, 0x16
mov ebp, edi
mov dword [esp + 0x18], eax
and ebp, 0xffc00000
and eax, 0xf
lea ebx, [edx + eax*8]
mov eax, dword [ebx]
cmp eax, ebp
jne 0x10030d16
mov eax, dword [ebx + 4]
jmp 0x10030e04
lea esi, [edx + 0x80]
mov dword [esp + 0x10], esi
cmp dword [esi], ebp
jne 0x10030d4f
mov ecx, dword [edx + 0x84]
shr edi, 0xc
mov dword [esi], eax
and edi, 0x3ff
mov eax, dword [ebx + 4]
mov dword [edx + 0x84], eax
mov dword [ebx + 4], ecx
lea eax, [ecx + edi*8]
mov dword [ebx], ebp
mov ecx, dword [esp + 0x3c]
jmp 0x10030e10
lea eax, [edx + 0x88]
mov ecx, 1
mov dword [esp + 0x1c], eax
nop
cmp dword [eax], ebp
je 0x10030db6
inc ecx
add eax, 8
cmp ecx, 8
jb 0x10030d60
mov esi, dword [esp + 0x18]
push 0x38
push dword [esp + 0x14]
push dword [esp + 0x24]
mov esi, dword [esi*4 + 0x100572b0]
call fcn.10036c90
mov ecx, dword [esp + 0x1c]
add esp, 0xc
mov eax, dword [ebx]
mov edx, dword [esp + 0x20]
shr edi, 0xc
mov dword [ecx], eax
and edi, 0x3ff
mov eax, dword [ebx + 4]
mov ecx, dword [esp + 0x3c]
mov dword [edx + 0x84], eax
mov dword [ebx], ebp
lea eax, [esi + edi*8]
mov dword [ebx + 4], esi
jmp 0x10030e10
mov eax, dword [edx + ecx*8 + 0x84]
mov dword [esp + 0x1c], eax
test ecx, ecx
je 0x10030dea
mov eax, dword [edx + ecx*8 + 0x78]
mov dword [edx + ecx*8 + 0x80], eax
mov eax, dword [edx + ecx*8 + 0x7c]
mov dword [edx + ecx*8 + 0x84], eax
mov eax, dword [ebx]
mov dword [edx + ecx*8 + 0x78], eax
mov eax, dword [ebx + 4]
mov dword [edx + ecx*8 + 0x7c], eax
jmp 0x10030df7
mov eax, dword [ebx]
mov dword [esi], eax
mov eax, dword [ebx + 4]
mov dword [edx + 0x84], eax
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x3c]
mov dword [ebx], ebp
mov dword [ebx + 4], eax
shr edi, 0xc
and edi, 0x3ff
lea eax, [eax + edi*8]
mov esi, dword [esp + 0x28]
mov ebx, dword [esp + 0x38]
mov ebp, dword [esp + 0x2c]
mov dword [ecx + esi], eax
mov eax, dword [esp + 0x14]
inc eax
mov dword [esp + 0x14], eax
cmp eax, ebx
jb 0x10030ce0
xor esi, esi
mov eax, dword [ecx + esi*4]
mov edx, dword [eax]
xor eax, eax
mov dword [ecx + esi*4], edx
nop dword [eax]
mov cl, byte [eax + edx]
add eax, 0x40
cmp eax, 0x78
jb 0x10030e40
mov ecx, dword [esp + 0x3c]
inc esi
cmp esi, ebx
jb 0x10030e32
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
Function at 0x1003886d
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x100388ac
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x100388ac
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x100388ac
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x100388ac
cmp dword [ecx + 0x74], 0xe
jbe 0x100388ac
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x1003a30f
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x10051b60]
mov dword [ebp - 0xc], ecx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x1003a34f
cmp byte [ebx], 0xa
jne 0x1003a34f
or byte [edi + eax + 0x28], 4
jmp 0x1003a354
and byte [edi + eax + 0x28], 0xfb
add ecx, ebx
mov eax, ebx
mov dword [ebp - 0x10], ecx
mov esi, ebx
mov dword [ebp - 8], eax
cmp ebx, ecx
jae 0x1003a453
mov dl, byte [eax]
cmp dl, 0x1a
je 0x1003a436
inc eax
cmp dl, 0xd
je 0x1003a380
mov dword [ebp - 8], eax
mov byte [esi], dl
jmp 0x1003a3a6
cmp eax, ecx
jae 0x1003a3b4
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add dword [ebp - 8], eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
xor edx, edx
inc edx
add esi, edx
cmp eax, ecx
jb 0x1003a368
jmp 0x1003a453
push 0
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1003a431
cmp dword [ebp - 0x10], 0
je 0x1003a431
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx*4 + 0x10051b60]
test byte [eax + edi + 0x28], 0x48
je 0x1003a40b
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x1003a3f6
mov byte [esi], dl
jmp 0x1003a407
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x10051b60]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x1003a453
cmp byte [ebp - 1], 0xa
jne 0x1003a41a
cmp esi, ebx
jne 0x1003a41a
mov byte [esi], 0xa
jmp 0x1003a452
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.1003e7d5
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x1003a453
mov byte [esi], 0xd
jmp 0x1003a452
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx*4 + 0x10051b60]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x1003a450
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x1003a453
mov byte [esi], dl
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x1003a45c
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
push esi
sar ecx, 6
push edi
imul edi, eax, 0x38
mov dword [ebp - 8], ecx
mov eax, dword [ecx*4 + 0x10051b60]
push 0xa
pop edx
mov dword [ebp - 0x18], edx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x1003a4a2
cmp word [ebx], dx
jne 0x1003a4a2
or byte [eax + edi + 0x28], 4
jmp 0x1003a4a7
and byte [eax + edi + 0x28], 0xfb
lea edx, [ebx + ecx*2]
mov eax, ebx
mov dword [ebp - 0xc], edx
mov esi, ebx
mov dword [ebp - 4], eax
cmp ebx, edx
jae 0x1003a60a
mov dword [ebp - 0x10], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0xc]
cmp ecx, 0x1a
je 0x1003a5ea
add eax, 2
cmp cx, word [ebp - 0x10]
je 0x1003a4e8
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x1003a51e
cmp eax, edx
jae 0x1003a52c
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x18]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 0xc]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
push 2
pop ecx
add esi, ecx
cmp eax, edx
jb 0x1003a4c3
jmp 0x1003a60a
push 0
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1003a5e5
cmp dword [ebp - 0x18], 0
je 0x1003a5e5
mov edx, dword [ebp - 8]
push 0xa
mov eax, dword [edx*4 + 0x10051b60]
test byte [eax + edi + 0x28], 0x48
je 0x1003a5bb
lea eax, [esi + 2]
mov dword [ebp - 0x1c], eax
mov ax, word [ebp - 4]
pop ecx
mov word [ebp - 2], ax
cmp ax, cx
jne 0x1003a57f
mov word [esi], cx
jmp 0x1003a5b6
push 0xd
pop ecx
mov word [esi], cx
movzx ecx, ax
mov eax, dword [edx*4 + 0x10051b60]
mov dx, word [ebp - 2]
shr ecx, 8
push 0xa
mov byte [eax + edi + 0x2a], dl
mov edx, dword [ebp - 8]
mov eax, dword [edx*4 + 0x10051b60]
mov byte [eax + edi + 0x2b], cl
mov eax, dword [edx*4 + 0x10051b60]
pop ecx
mov byte [eax + edi + 0x2c], cl
mov esi, dword [ebp - 0x1c]
jmp 0x1003a60a
pop eax
cmp word [ebp - 4], ax
jne 0x1003a5cb
cmp esi, ebx
jne 0x1003a5cb
mov word [esi], ax
jmp 0x1003a607
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.1003e7d5
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x1003a60a
push 0xd
pop eax
jmp 0x1003a5c6
mov edx, dword [ebp - 8]
mov edx, dword [edx*4 + 0x10051b60]
mov al, byte [edx + edi + 0x28]
test al, 0x40
jne 0x1003a604
or al, 2
mov byte [edx + edi + 0x28], al
jmp 0x1003a60a
mov word [esi], cx
add esi, 2
sub esi, ebx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret