joyce8/EMBER2024-capa huggingface dataset:
Function at 0x449b70
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [ebp + 0x10]
lea ecx, [ebp - 0xc]
cdq
xorps xmm0, xmm0
mov dword [ebp - 0x98], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x90], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x94], edx
cdq
mov dword [ebp - 0x80], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x78], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x74], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x70], eax
mov eax, dword [ebp + 0x2c]
push ebx
push esi
mov esi, dword [0x4b3d08]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp + 0x30]
push edi
push dword [ebp + 0x10]
mov edi, dword [0x4b3d0c]
mov dword [ebp - 0x7c], edx
cdq
mov dword [ebp - 0x68], eax
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x98]
mov dword [ebp - 0x8c], 0
push eax
movlpd qword [ebp - 0x88], xmm0
mov dword [ebp - 0x64], edx
movlpd qword [ebp - 0x60], xmm0
mov dword [ebp - 0x58], 0x1000
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x50], 0x100000
mov dword [ebp - 0x4c], 0
movlpd qword [ebp - 0x48], xmm0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
call fcn.0044a040
mov ebx, dword [ebp - 0xc]
xorps xmm0, xmm0
mov dword [ebp + 0x20], 7
mov dword [ebp + 0x24], 0
mov dword [ebp - 0x40], esi
mov eax, dword [ebx]
mov dword [ebp - 0x18], eax
mov eax, dword [ebx + 4]
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 8]
mov dword [ebp - 0x20], eax
mov eax, dword [ebx + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebx + 0x10]
mov dword [ebp - 0x28], eax
mov eax, dword [ebx + 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebx + 0x18]
mov dword [ebp - 0x30], eax
mov eax, dword [ebx + 0x1c]
mov dword [ebp - 0x2c], eax
lea eax, [ebx + 0x20]
cdq
movlpd qword [ebp + 0x28], xmm0
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x3c], edi
mov dword [ebp + 0x10], 0
mov dword [ebp + 0x10], esp
and esp, 0xfffffff0
push 0x33
call 0x449c9f
add dword [esp], 5
retf

Function at 0x449d30
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
mov eax, dword [ebp + 0x10]
lea ecx, [ebp - 0x54]
cdq
push ebx
mov dword [ebp - 0x48], eax
mov eax, dword [ebp + 0x14]
push esi
push edi
push dword [ebp + 0x10]
mov dword [ebp - 0x44], edx
cdq
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x48]
mov dword [ebp - 0x3c], edx
push eax
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x4c], 0
call fcn.0044a040
mov ebx, dword [ebp - 0x54]
xorps xmm0, xmm0
movlpd qword [ebp - 0x30], xmm0
movlpd qword [ebp - 0x38], xmm0
movlpd qword [ebp - 0x40], xmm0
mov eax, dword [ebx]
mov dword [ebp - 0x10], eax
mov eax, dword [ebx + 4]
mov dword [ebp - 0xc], eax
mov eax, dword [ebx + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebx + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
movlpd qword [ebp - 8], xmm0
movlpd qword [ebp - 0x28], xmm0
mov dword [ebp - 0x1c], eax
mov dword [ebp + 0x10], 0
mov dword [ebp + 0x10], esp
and esp, 0xfffffff0
push 0x33
call 0x449dcb
add dword [esp], 5
retf
Function at 0x449ed0
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x78
mov eax, dword [ebp + 0x10]
lea ecx, [ebp - 0x4c]
cdq
xorps xmm0, xmm0
mov dword [ebp - 0x78], eax
mov eax, dword [ebp + 0x18]
push ebx
mov dword [ebp - 0x74], edx
cdq
push esi
mov esi, dword [0x4b3cb0]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp + 0x20]
push edi
push dword [ebp + 0x10]
mov edi, dword [0x4b3cb4]
mov dword [ebp - 0x64], edx
cdq
mov dword [ebp - 0x58], eax
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x78]
movlpd qword [ebp - 0x70], xmm0
push eax
mov dword [ebp - 0x60], 0x30
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x54], edx
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 0
call fcn.0044a040
mov ebx, dword [ebp - 0x4c]
xorps xmm0, xmm0
mov dword [ebp - 8], 1
mov dword [ebp - 4], 0
mov dword [ebp - 0x40], esi
mov eax, dword [ebx]
mov dword [ebp - 0x18], eax
mov eax, dword [ebx + 4]
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 8]
mov dword [ebp - 0x20], eax
mov eax, dword [ebx + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebx + 0x10]
mov dword [ebp - 0x28], eax
mov eax, dword [ebx + 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebx + 0x18]
mov dword [ebp - 0x30], eax
mov eax, dword [ebx + 0x1c]
mov dword [ebp - 0x2c], eax
lea eax, [ebx + 0x20]
cdq
movlpd qword [ebp - 0x10], xmm0
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x3c], edi
mov dword [ebp + 0x10], 0
mov dword [ebp + 0x10], esp
and esp, 0xfffffff0
push 0x33
call 0x449fad
add dword [esp], 5
retf

Function at 0x44a5d0
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x20d0
call fcn.0044e630
push ebx
push esi
push edi
push 0x1838
lea eax, [ebp - 0x20d0]
xorps xmm0, xmm0
push 0
push eax
mov ebx, ecx
movlpd qword [ebp - 0x10], xmm0
call fcn.004663d0
add esp, 0xc
lea eax, [ebp - 0x498]
push 0x388
push 0
push eax
call fcn.004663d0
add esp, 0xc
lea eax, [ebp - 0x110]
push 0x58
push 0
push eax
call fcn.004663d0
xorps xmm0, xmm0
add esp, 0xc
movlpd qword [ebp - 8], xmm0
push 0x33
call 0x44a638
add dword [esp], 5
retf
Function at 0x44a9e0
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [ebp + 0x10]
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x6c], eax
xorps xmm0, xmm0
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp + 0x18]
cdq
push ebx
mov dword [ebp - 0x64], eax
mov eax, dword [ebp + 0x20]
push esi
push edi
push dword [ebp + 0x18]
mov dword [ebp - 0x60], edx
cdq
mov dword [ebp - 0x54], eax
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x6c]
movlpd qword [ebp - 0x5c], xmm0
push eax
mov dword [ebp - 0x50], edx
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x40], 0
call fcn.0044a040
mov ebx, dword [ebp - 0x48]
xorps xmm0, xmm0
movlpd qword [ebp - 0x3c], xmm0
movlpd qword [ebp - 0x34], xmm0
mov eax, dword [ebx]
mov dword [ebp - 0xc], eax
mov eax, dword [ebx + 4]
mov dword [ebp - 8], eax
mov eax, dword [ebx + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebx + 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebx + 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebx + 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebx + 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0xc]
movlpd qword [ebp + 0x10], xmm0
mov dword [ebp - 0x28], eax
mov dword [ebp + 0x18], 0
mov dword [ebp + 0x18], esp
and esp, 0xfffffff0
push 0x33
call 0x44aa9d
add dword [esp], 5
retf
Function at 0x4501d8
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x475270
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004750ef

Function at 0x47b332
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0047aff2
Function at 0x100013ec
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, ecx
mov cl, byte [esp + 0x20]
mov edx, dword [esp + 0x28]
mov bl, byte [esp + 0x24]
mov byte [eax], cl
mov byte [eax + 1], bl
mov dword [eax + 4], edx
xor edx, edx
cmp cl, 0x1a
mov dword [eax + 0x24], edx
mov dword [eax + 0x28], edx
mov dword [eax + 0x60], 0x7fffffff
jg 0x1000145c
mov edx, ecx
add dl, 0xf1
cmp dl, 8
ja case.0x1000142b.240
movzx edx, dl
jmp dword [edx*4 + 0x1002e098]
mov esi, 5
mov ebp, 6
xor edi, edi
mov edx, 5
mov dword [eax + 0xc], esi
mov dword [eax + 0x10], 6
mov dword [eax + 0x14], esi
mov dword [eax + 0x1c], 0
jmp 0x10001528
cmp cl, 0x1b
je 0x10001501
cmp cl, 0x1f
je 0x100015f4
cmp cl, 0x2a
jne case.0x1000142b.240
mov esi, 0xa
mov edi, 2
mov ebp, 0xa
mov edx, 0xa
mov dword [eax + 0xc], esi
mov dword [eax + 0x10], esi
mov dword [eax + 0x14], esi
mov dword [eax + 0x1c], 2
jmp 0x10001528
xor edx, edx
mov esi, 8
inc edx
mov dword [eax + 0xc], esi
mov dword [eax + 0x10], esi
mov dword [eax + 0x14], esi
mov dword [eax + 0x1c], 0
mov dword [eax + 0x24], edx
mov dword [eax + 0x60], edx
jmp 0x100014fd
mov edi, 8
mov dword [eax + 0xc], edi
mov dword [eax + 0x10], edi
mov dword [eax + 0x14], edi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x28], 1
mov dword [eax + 0x60], 2
jmp 0x10001519
mov esi, 8
mov dword [eax + 0xc], esi
mov dword [eax + 0x10], esi
mov dword [eax + 0x14], esi
mov dword [eax + 0x1c], 0
mov dword [eax + 0x24], 1
xor edi, edi
jmp 0x1000151e
mov edi, 8
mov dword [eax + 0xc], edi
mov dword [eax + 0x10], edi
mov dword [eax + 0x14], edi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x28], 1
mov esi, 8
mov ebp, 8
mov edx, 8
add ebp, edx
mov ch, byte [esp + 0x14]
movaps xmm0, xmmword [0x1002e040]
mov bh, bl
xor edx, edx
add ebp, esi
mov esi, dword [esp + 0x18]
add bh, 0x7e
mov dword [eax + 0x18], edx
add ebp, edi
mov edi, dword [esp + 0x1c]
cmp bh, 3
mov dword [eax + 8], ebp
mov dword [eax + 0x20], edx
movups xmmword [eax + 0x2c], xmm0
ja case.default.0x1000155d
movzx ebp, bh
jmp dword [ebp*4 + 0x1002e0bc]
mov ebp, 0x10
jmp 0x10001587
test bl, bl
mov ebp, 0
je 0x10001587
jmp 0x1000158d
mov ebp, 0x20
jmp 0x10001587
mov edx, 8
mov ebp, 0x18
mov dword [eax + 0x3c], ebp
mov dword [eax + 0x74], edx
movaps xmm0, xmmword [0x1002e050]
xor edx, edx
xor ebx, ebx
movups xmmword [eax + 0x40], xmm0
mov dword [eax + 0x50], 0x1000000
mov dword [eax + 0x54], edi
mov dword [eax + 0x58], esi
mov esi, dword [esp + 0x28]
movaps xmm0, xmmword [0x1002e060]
mov dword [eax + 0x5c], edx
mov dword [eax + 0x64], edx
mov dword [eax + 0x68], 0x45
test esi, esi
setg bl
mov dword [eax + 0x6c], ebx
mov dword [eax + 0x70], esi
movups xmmword [eax + 0x78], xmm0
mov dword [eax + 0x88], edx
xor edx, edx
cmp ch, cl
sete dl
mov dword [eax + 0x90], edx
mov dword [eax + 0x8c], 1
pop esi
pop edi
pop ebx
pop ebp
ret 0x18
xor edi, edi
mov esi, 5
mov ebp, 5
mov edx, 5
mov dword [eax + 0xc], esi
mov dword [eax + 0x10], esi
mov dword [eax + 0x14], esi
mov dword [eax + 0x1c], 1
inc edi
jmp 0x10001528
mov edx, dword [eax + 0xc]
mov ebp, dword [eax + 0x10]
mov esi, dword [eax + 0x14]
mov edi, dword [eax + 0x1c]
jmp 0x10001528
Function at 0x100026e4
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov edi, dword [ecx]
mov ebx, dword [esp + 0x24]
mov eax, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
mov ebp, dword [edi + 4]
cmp byte [ebp + 0xd], 0
je 0x1000270a
mov dword [esp + 4], edi
mov esi, edi
jmp 0x10002753
mov edx, dword [edx]
xor ebx, ebx
mov dword [esp], ecx
mov esi, ebp
mov ebp, dword [ebp + 0x10]
xor ecx, ecx
cmp ebp, edx
setge cl
xor eax, eax
cmp edx, ebp
setl al
cmp byte [esp + 0x28], 0
cmovne eax, ecx
mov ecx, eax
xor cl, 1
movzx ecx, cl
mov ebp, dword [esi + ecx*8]
cmp byte [ebp + 0xd], bl
je 0x10002711
mov ebx, dword [esp + 0x24]
mov edx, dword [esp + 0x2c]
test al, al
mov dword [esp + 4], esi
je 0x1000277e
mov eax, dword [esp + 0x30]
mov ecx, dword [esp]
cmp esi, dword [edi]
je 0x10002773
mov edi, ebx
lea ebx, [esp + 4]
mov dword [esp], ecx
mov ebp, edx
mov ecx, ebx
call fcn.1000225e
mov ecx, dword [ebx]
mov edx, ebp
mov al, 1
mov ebx, edi
jmp 0x10002782
lea edi, [esp + 0xc]
push eax
push edx
push esi
push 1
jmp 0x1000279a
xor eax, eax
mov ecx, esi
mov ecx, dword [ecx + 0x10]
cmp ecx, dword [edx]
jge 0x100027aa
mov ecx, dword [esp]
lea edi, [esp + 8]
movzx eax, al
push dword [esp + 0x30]
push edx
push esi
push eax
push edi
call fcn.100025ac
mov eax, dword [edi]
mov dword [ebx], eax
mov byte [ebx + 4], 1
jmp 0x100027c2
push 0x18
push dword [esp + 0x34]
call fcn.10007683
add esp, 8
mov eax, dword [esp + 4]
mov dword [ebx], eax
mov byte [ebx + 4], 0
mov eax, ebx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x100047f6
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x2c
mov edi, dword [ecx]
mov ebx, dword [esp + 0x40]
mov edx, dword [esp + 0x48]
mov ebp, dword [edi + 4]
cmp byte [ebp + 0xd], 0
je 0x10004818
mov dword [esp + 0x20], edi
mov esi, edi
jmp 0x1000485f
mov edx, dword [edx]
xor ebx, ebx
mov dword [esp + 0x14], ecx
mov esi, ebp
mov ebp, dword [ebp + 0x10]
xor ecx, ecx
cmp ebp, edx
setae cl
xor eax, eax
cmp edx, ebp
setb al
cmp byte [esp + 0x44], 0
cmovne eax, ecx
mov ecx, eax
xor cl, 1
movzx ecx, cl
mov ebp, dword [esi + ecx*8]
cmp byte [ebp + 0xd], bl
je 0x10004820
mov ebx, dword [esp + 0x40]
test al, al
mov dword [esp + 0x20], esi
je 0x1000489a
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x48]
cmp esi, dword [edi]
je 0x1000487c
mov edi, ebx
lea ebx, [esp + 0x20]
mov dword [esp + 0x14], ecx
mov ecx, ebx
call fcn.1000225e
mov ecx, dword [ebx]
mov al, 1
mov ebx, edi
jmp 0x1000489e
mov al, byte [esp + 0x1c]
mov byte [esp + 0x10], al
mov dword [esp + 8], esi
lea esi, [esp + 0x28]
mov dword [esp + 0xc], edx
mov dword [esp + 4], 1
jmp 0x100048ca
xor eax, eax
mov ecx, esi
mov edx, dword [ecx + 0x10]
mov edi, dword [esp + 0x48]
cmp edx, dword [edi]
jae 0x100048df
mov cl, byte [esp + 0x18]
movzx eax, al
mov edx, edi
mov byte [esp + 0x10], cl
mov dword [esp + 8], esi
lea esi, [esp + 0x24]
mov dword [esp + 0xc], edi
mov dword [esp + 4], eax
mov ecx, dword [esp + 0x14]
mov dword [esp], esi
call fcn.100048f2
sub esp, 0x14
mov eax, dword [esi]
mov dword [ebx], eax
mov byte [ebx + 4], 1
jmp 0x100048e5
mov dword [ebx], ecx
mov byte [ebx + 4], 0
mov eax, ebx
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x10004b14
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x2c
mov edi, dword [ecx]
mov ebx, dword [esp + 0x40]
mov edx, dword [esp + 0x48]
mov ebp, dword [edi + 4]
cmp byte [ebp + 0xd], 0
je 0x10004b36
mov dword [esp + 0x20], edi
mov esi, edi
jmp 0x10004b7d
mov edx, dword [edx]
xor ebx, ebx
mov dword [esp + 0x14], ecx
mov esi, ebp
mov ebp, dword [ebp + 0x10]
xor ecx, ecx
cmp ebp, edx
setae cl
xor eax, eax
cmp edx, ebp
setb al
cmp byte [esp + 0x44], 0
cmovne eax, ecx
mov ecx, eax
xor cl, 1
movzx ecx, cl
mov ebp, dword [esi + ecx*8]
cmp byte [ebp + 0xd], bl
je 0x10004b3e
mov ebx, dword [esp + 0x40]
test al, al
mov dword [esp + 0x20], esi
je 0x10004bb8
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x48]
cmp esi, dword [edi]
je 0x10004b9a
mov edi, ebx
lea ebx, [esp + 0x20]
mov dword [esp + 0x14], ecx
mov ecx, ebx
call fcn.1000225e
mov ecx, dword [ebx]
mov al, 1
mov ebx, edi
jmp 0x10004bbc
mov al, byte [esp + 0x1c]
mov byte [esp + 0x10], al
mov dword [esp + 8], esi
lea esi, [esp + 0x28]
mov dword [esp + 0xc], edx
mov dword [esp + 4], 1
jmp 0x10004be8
xor eax, eax
mov ecx, esi
mov edx, dword [ecx + 0x10]
mov edi, dword [esp + 0x48]
cmp edx, dword [edi]
jae 0x10004bfd
mov cl, byte [esp + 0x18]
movzx eax, al
mov edx, edi
mov byte [esp + 0x10], cl
mov dword [esp + 8], esi
lea esi, [esp + 0x24]
mov dword [esp + 0xc], edi
mov dword [esp + 4], eax
mov ecx, dword [esp + 0x14]
mov dword [esp], esi
call fcn.10004c10
sub esp, 0x14
mov eax, dword [esi]
mov dword [ebx], eax
mov byte [ebx + 4], 1
jmp 0x10004c03
mov dword [ebx], ecx
mov byte [ebx + 4], 0
mov eax, ebx
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret 0x10

Function at 0x10006764
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push ebx
push edi
push esi
mov esi, dword [section..data]
cmp esi, 0xffffffff
jne 0x10006784
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov esi, eax
cmp eax, 0xffffffff
mov dword [section..data], eax
je 0x100067cd
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push eax
call fcn.1002365f
add esp, 4
mov ebx, dword [sym.imp.KERNEL32.dll_TlsSetValue]
push 0
push esi
call ebx
push 0x14
call fcn.1002367a
add esp, 4
mov edi, eax
push eax
push esi
call ebx
xor eax, eax
mov dword [edi], 0x3000
mov dword [edi + 4], 0x30a0
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
mov dword [edi + 0x10], eax
mov eax, edi
pop esi
pop edi
pop ebx
ret
xor edi, edi
jmp 0x100067af

Function at 0x100067d1
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
xor esi, esi
push esi
push esi
push esi
push esi
call sym.libEGL.dll_eglMakeCurrent
mov edi, dword [section..data]
push edi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push eax
call fcn.1002365f
add esp, 4
push esi
push edi
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop esi
pop edi
ret

Function at 0x10006892
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push dword [section..data]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je fcn.10006764
ret
Function at 0x1000a330
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x100259e5
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10031c90
push 0x10031c88
push str.FlsAlloc
push 0x1e
call fcn.10025cc8
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10025a19
push dword [ebp + 8]
mov ecx, esi
call dword [section..00cfg]
call esi
jmp 0x10025a1f
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x10025a63
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10031ca0
push 0x10031c98
push str.FlsGetValue
push 0x20
call fcn.10025cc8
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10025a9a
push dword [ebp + 8]
mov ecx, esi
call dword [section..00cfg]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x100284df
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1002857c
push ebx
push esi
call fcn.1002857f
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.10028428
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x10028529
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1002857b
push edi
push eax
call fcn.100275c8
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x10028549
call fcn.10026f9e
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1002857a
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.10028428
add esp, 0x20
test eax, eax
jne 0x10028568
push edi
call fcn.10026f9e
jmp 0x10028570
push ebx
call fcn.10026f9e
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x42e002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..rdata
nop
mov ebx, 0x407ef8
nop
mov ecx, 0xbe866bb
nop
nop
nop
test eax, eax
nop
nop
je 0x42e04e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x42e024
nop
mov eax, section._RDATA
nop
mov ebx, 0x42cd70
nop
nop
mov ecx, 0x742934c6
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x42211b
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x42215a
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x42215a
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x42215a
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x42215a
cmp dword [ecx + 0x74], 0xe
jbe 0x42215a
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x4347a0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4347cd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4347cd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x100593d7
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push dword [esp + 4]
lea esp, [esp + 0x44]
je 0x1005eb2f
shl si, 0xf
mov esi, dword [eax + 0x3c]
rcl edx, 0x14
add esi, eax
pushfd
cmp ah, ch
movzx dx, bl
mov edx, dword [esi + 0x78]
pushal
lea eax, [esp + 0x2349f599]
aad 0x3c
push ebp
lea eax, [ebx - 0x13f5e1cc]
aad 0x89
add eax, 0xab85a7b6
inc bp
mov ebp, esp
aam 0xa
sub esp, 0x10
aaa
test dl, 0x7b
aam 0x37
bsr eax, ebx
push esi
shl eax, cl
bt edi, 0xb
push edi
bsr ax, ax
lea eax, [ebx + 0x44663835]
add al, al
push ebx
pushal
bsf eax, eax
mov dword [esp + 0x1c], edx
cwde
shrd ax, dx, 6
aam 0x61
mov eax, dword [ebp + 8]
clc
bt bx, 5
mov word [esp + 4], 0x4a31
stc
test eax, eax
pushfd
pushal
jmp 0x10040379