joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10059786
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
push 8
call fcn.100de068
add esp, 4
mov dword [eax], ebx
mov dword [eax + 4], edi
xor ecx, ecx
push ecx
push ecx
push eax
push 0x100597d0
push ecx
push ecx
call fcn.100ed55a
add esp, 0x18
mov dword [esi], eax
test eax, eax
je 0x100597c5
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
pop esi
pop edi
pop ebx
pop ebp
jmp dword [sym.imp.KERNEL32.dll_GetLastError]

Function at 0x1005a2c0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ebx, dword [0x10128804]
test ebx, ebx
jne 0x1005a360
push 0x28
call fcn.100de068
add esp, 4
mov esi, eax
mov dword [eax], 0
mov dword [eax + 4], 0
mov byte [eax + 8], 0
push 0xc
call fcn.100de068
add esp, 4
mov dword [esi + 0xc], eax
lea ecx, [eax + 0xc]
mov dword [esi + 0x14], ecx
test eax, eax
je 0x1005a36a
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 8], 0
mov dword [esi + 0x10], ecx
mov eax, esi
add eax, 0x1c
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x18], eax
mov dword [esi + 0x24], 1
mov dword [0x10128804], esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
test eax, eax
je 0x1005a385
mov edi, eax
push eax
call fcn.100f6840
add esp, 4
mov ecx, esi
push eax
push edi
call fcn.1005a390
test ebx, ebx
sete al
pop esi
pop edi
pop ebx
pop ebp
ret
push str.null_pointer_given_to_construct_at
push str.__location___nullptr
push 0x23
push str....._buildtools_third_partylibc_trunkinclude__memoryconstruct_at.h
push str._s:_d:_assertion__s_failed:__s
call fcn.1003963c
int3
Function at 0x1005a390
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov edi, ecx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov edx, dword [0x10123014]
xor edx, ebp
mov dword [ebp - 0x10], edx
lea edx, [ebp - 0x20]
push 3
push ecx
push eax
push edx
call fcn.10082280
add esp, 0x10
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x1005a4e3
mov esi, dword [ebp - 0x20]
mov dword [edi], esi
mov dword [edi + 4], eax
mov dword [ebp - 0x14], 0
push 0x800
push 0
push str.api_ms_win_downlevel_shell32_l1_1_0.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
test eax, eax
mov dword [ebp - 0x30], eax
je 0x1005a410
push 0x10115afa
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1005a420
mov ecx, eax
call dword [section..00cfg]
lea eax, [ebp - 0x14]
push eax
push esi
call ecx
jmp 0x1005a41b
lea eax, [ebp - 0x14]
push eax
push esi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [ebp - 0x24], eax
jmp 0x1005a427
mov dword [ebp - 0x24], 0
mov esi, dword [ebp - 0x14]
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
test esi, esi
je 0x1005a497
mov dword [ebp - 0x2c], edi
shl esi, 2
cmp esi, 0x55555555
jae 0x1005a537
lea edi, [esi + esi*2]
push edi
call fcn.100de068
add esp, 4
mov ebx, eax
mov dword [ebp - 0x20], eax
add eax, edi
mov dword [ebp - 0x18], eax
xor edi, edi
mov dword [ebp - 0x28], ebx
test ebx, ebx
je 0x1005a51c
mov ecx, ebx
mov eax, dword [ebp - 0x24]
push dword [eax + edi]
call fcn.10053120
add ebx, 0xc
add edi, 4
cmp esi, edi
jne 0x1005a470
mov dword [ebp - 0x1c], ebx
mov edi, dword [ebp - 0x2c]
jmp 0x1005a4a0
xor ebx, ebx
mov dword [ebp - 0x28], 0
mov ecx, edi
lea eax, [ebp - 0x20]
push eax
call fcn.1005a180
mov dword [edi], 0
mov dword [edi + 4], 0
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 0x30]
test eax, eax
je 0x1005a4cf
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov edi, dword [ebp - 0x28]
test edi, edi
je 0x1005a4e3
cmp ebx, edi
jne 0x1005a506
push edi
call fcn.100de098
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100dea63
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret 8
mov ebx, esi
cmp esi, edi
je 0x1005a4da
lea esi, [ebx - 0xc]
cmp byte [ebx - 1], 0
jns 0x1005a500
push dword [ebx - 0xc]
call fcn.100de098
add esp, 4
jmp 0x1005a500
push str.null_pointer_given_to_construct_at
push str.__location___nullptr
push 0x23
push str....._buildtools_third_partylibc_trunkinclude__memoryconstruct_at.h
push str._s:_d:_assertion__s_failed:__s
call fcn.1003963c
call fcn.100f18b0
int3
Function at 0x1005b0e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov dword [ebp - 0x2c], edx
mov eax, dword [0x10123014]
xor eax, ebp
mov dword [ebp - 0x10], eax
movzx eax, byte [0x1012880c]
and eax, 1
neg eax
cmp eax, 0xfffffffd
je 0x1005b1db
mov edi, ecx
xor esi, esi
jmp 0x1005b13d
cmp byte [ebp - 0x24], 0
js 0x1005b1c0
inc esi
movzx eax, byte [0x1012880c]
xor eax, 3
cmp esi, eax
jae 0x1005b1db
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x14], 0xffffffff
lea ecx, [ebp - 0x1c]
push dword [esi*8 + 0x10115a8c]
push dword [esi*8 + 0x10115a88]
call fcn.10037510
movzx edx, byte [ebp - 0x11]
test dl, dl
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x28], eax
cmovs edx, eax
cmp edx, dword [ebp - 0x2c]
ja 0x1005b120
test edx, edx
je 0x1005b1d0
cmp byte [ebp - 0x24], 0
lea eax, [ebp - 0x1c]
cmovs eax, dword [ebp - 0x20]
xor ebx, ebx
nop word cs:[eax + eax]
movzx ecx, word [edi + ebx*2]
cmp cx, word [eax + ebx*2]
jne 0x1005b120
inc ebx
cmp edx, ebx
jne 0x1005b1a0
jmp 0x1005b1d0
push dword [ebp - 0x20]
call fcn.100de098
add esp, 4
jmp 0x1005b12a
mov eax, dword [ebp - 0x24]
test al, al
js 0x1005b1df
mov esi, eax
jmp 0x1005b1ed
xor esi, esi
jmp 0x1005b1ed
push dword [ebp - 0x20]
call fcn.100de098
add esp, 4
mov esi, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100dea63
mov eax, esi
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10060ad0
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x10]
mov dword [0x10128844], eax
call fcn.10060ba0
mov eax, dword [esi]
mov dword [0x10124bfc], eax
test al, 1
jne 0x10060af4
mov al, 1
pop esi
pop ebp
ret
mov eax, dword [0x1012885c]
test eax, eax
je 0x10060b21
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x1012885c], 0
mov ecx, dword [0x10128848]
test ecx, ecx
jne 0x10060b50
and byte [0x10124bfc], 0xfe
jmp 0x10060b2b
mov ecx, dword [0x10128848]
test ecx, ecx
jne 0x10060b50
push 0xc
call fcn.100de068
add esp, 4
mov ecx, eax
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 8], 0
mov dword [0x10128848], eax
mov eax, dword [esi + 4]
test eax, eax
je 0x10060b7e
push eax
call fcn.10057cbe
cmp dword [esi + 0xc], 0
jne 0x10060b77
mov eax, dword [0x10128848]
cmp byte [eax + 0xb], 0
jns 0x10060b70
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
pop esi
pop ebp
jmp fcn.10060cb0
push str.string::assign_received_nullptr
push str.__s___nullptr
push 0xa70
push str....._buildtools_third_partylibc_trunkinclude_string
push str._s:_d:_assertion__s_failed:__s
call fcn.1003963c
int3
Function at 0x100649c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.10064540
Function at 0x10068fa0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x140c
call fcn.100df380
mov eax, dword [0x10123014]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x10124d10]
cmp eax, 0xffffffff
je 0x100690fa
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test bl, 3
je 0x100690fa
and ebx, 0xfffffffc
lea eax, [ebp - 0x810]
push 0x800
push ebx
push eax
call fcn.100e1250
add esp, 0xc
mov ecx, dword [0x10124d10]
lea eax, [ebp - 0x80f]
push eax
mov dword [ebp - 0x1414], ecx
push ecx
call fcn.100a0710
add esp, 8
test ebx, ebx
je 0x1006901b
push ebx
call fcn.100de0cc
add esp, 4
mov eax, dword [0x101294c4]
mov ecx, dword [0x10126eb8]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x1006911b
mov esi, dword [0x101294c0]
push esi
call dword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x1006910f
lea eax, [ebp - 0x1410]
push 0xc00
push 0x101288c0
push eax
call fcn.100e1250
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov al, 1
mov ecx, 0x101
jmp 0x10069089
mov ecx, dword [ebp - 0x1418]
dec ecx
je 0x100690ea
test al, 1
je 0x100690ea
mov dword [ebp - 0x1418], ecx
xor edi, edi
lea ebx, [ebp - 0x1408]
xor eax, eax
jmp 0x100690ac
inc edi
add ebx, 0xc
cmp edi, 0x100
je 0x10069080
mov esi, dword [ebp + edi*8 - 0x810]
test esi, esi
je 0x100690a0
cmp dword [ebx - 8], 0
je 0x100690a0
mov ecx, dword [ebp + edi*8 - 0x80c]
cmp ecx, dword [ebx]
jne 0x100690a0
mov ecx, dword [ebx - 4]
test ecx, ecx
je 0x100690a0
mov dword [ebp + edi*8 - 0x810], 0
call dword [section..00cfg]
push esi
call ecx
add esp, 4
mov al, 1
jmp 0x100690a0
push 2
push dword [ebp - 0x1414]
call fcn.100a0710
add esp, 8
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100dea63
add esp, 0x140c
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, esi
call fcn.1006ca90
jmp 0x10069051
push 0x101294c4
call fcn.100de107
add esp, 4
cmp dword [0x101294c4], 0xffffffff
jne 0x1006903c
push 4
call fcn.100de068
add esp, 4
mov esi, eax
mov ecx, eax
call fcn.1001f1c0
mov dword [0x101294c0], esi
push 0x101294c4
call fcn.100de17d
add esp, 4
jmp 0x1006903c

Function at 0x10069160
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x10124d10]
cmp eax, 0xffffffff
je 0x10069180
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
and eax, 3
dec eax
cmp eax, 2
setb al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x10069190
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
mov eax, dword [0x10124d10]
cmp eax, 0xffffffff
je 0x100691ad
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
jne 0x100691b2
call fcn.100692b0
mov eax, dword [0x101294c4]
mov ecx, dword [0x10126eb8]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x1006925d
mov edi, dword [0x101294c0]
push edi
call dword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x10069254
mov ecx, dword [0x101288bc]
inc ecx
xor edx, edx
nop dword [eax]
lea eax, [ecx + edx]
movzx ebx, al
lea eax, [ebx + ebx*2]
cmp dword [eax*4 + 0x101288c0], 0
je 0x1006920e
inc edx
cmp edx, 0x100
jne 0x100691f0
jmp 0x1006923e
lea eax, [eax*4 + 0x101288c0]
mov dword [eax], 1
lea eax, [ebx*4]
mov ecx, dword [ebp + 8]
mov dword [eax + eax*2 + 0x101288c4], ecx
mov dword [0x101288bc], ebx
mov dword [esi], ebx
mov eax, dword [eax + eax*2 + 0x101288c8]
mov dword [esi + 4], eax
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
cmp dword [esi], 0x100
jae 0x100692a2
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov ecx, edi
call fcn.1006ca90
jmp 0x100691e4
push 0x101294c4
call fcn.100de107
add esp, 4
cmp dword [0x101294c4], 0xffffffff
jne 0x100691d3
push 4
call fcn.100de068
add esp, 4
mov edi, eax
mov ecx, eax
call fcn.1001f1c0
mov dword [0x101294c0], edi
push 0x101294c4
call fcn.100de17d
add esp, 4
jmp 0x100691d3
int3

Function at 0x100692b0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x808
mov eax, dword [0x10123014]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x810], 0xffffffff
mov ecx, dword [0x10124d10]
mov dword [ebp - 0x810], ecx
cmp ecx, 0xffffffff
jne 0x10069354
lea esi, [ebp - 0x810]
push esi
call fcn.100a06e0
add esp, 4
test al, al
je 0x100693d5
mov ecx, dword [ebp - 0x810]
cmp ecx, 0xffffffff
jne 0x10069330
push esi
call fcn.100a06e0
add esp, 4
test al, al
je 0x100693d8
cmp dword [ebp - 0x810], 0xffffffff
je 0x100693d8
push 0xffffffffffffffff
call fcn.100a0700
add esp, 4
mov ecx, dword [ebp - 0x810]
mov eax, 0xffffffff
lock cmpxchg dword [0x10124d10], ecx
je 0x10069354
push ecx
call fcn.100a0700
add esp, 4
mov ecx, dword [0x10124d10]
mov dword [ebp - 0x810], ecx
push ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
jne 0x100693d2
lea edi, [ebp - 0x80c]
push 0x800
push 0
push edi
call fcn.100e17d0
add esp, 0xc
lea eax, [ebp - 0x809]
push eax
push dword [ebp - 0x810]
call fcn.100a0710
add esp, 8
push 0x800
call fcn.100de0c3
add esp, 4
mov esi, eax
push 0x800
push edi
push eax
call fcn.100e1250
add esp, 0xc
mov eax, esi
or eax, 3
push eax
push dword [ebp - 0x810]
call fcn.100a0710
add esp, 8
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.100dea63
mov eax, esi
add esp, 0x808
pop esi
pop edi
pop ebp
ret
int3
int3
int3
Function at 0x1006b3a0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, ecx
call fcn.100a0650
mov byte [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi], 0x101115c0
mov dword [esi + 0xc], 0
movaps xmm0, xmmword [0x10116290]
movups xmmword [esp], xmm0
call dword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
sub esp, 0x10
cmp dword [esi + 0xc], eax
je 0x1006b427
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov eax, dword [esi + 0xc]
inc eax
cmp eax, 2
jb 0x1006b40b
call fcn.10060950
mov eax, dword [esi + 0xc]
mov dword [esp], eax
call fcn.1006d7a0
mov dword [esi + 0xc], 0
lea eax, [edi + 1]
cmp eax, 2
jb 0x1006b41b
mov dword [esi + 0xc], edi
call fcn.10060950
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
sub esp, 4
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x1006c790
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
mov dword [ecx], 0
test ebx, ebx
je 0x1006c7e0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jb 0x1006c7ca
call fcn.10060950
push dword [esi]
call fcn.1006d7a0
add esp, 4
mov dword [esi], 0
lea eax, [ebx + 1]
cmp eax, 2
jb 0x1006c7d9
mov dword [esi], ebx
call fcn.10060950
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov byte [esi + 4], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp eax, ebx
je 0x1006c7f7
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret 4
int3

Function at 0x1006c800
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, ecx
mov eax, dword [ebp + 8]
mov edi, dword [eax]
mov dword [eax], 0
lea ebx, [edi + 1]
cmp ebx, 2
jb 0x1006c821
call fcn.10060950
mov dword [esi], 0
test edi, edi
je 0x1006c845
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esi]
inc ecx
cmp ecx, 2
jae 0x1006c87c
cmp ebx, 2
jae 0x1006c89c
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [ebp + 8]
movzx eax, byte [edi + 4]
mov byte [esi + 4], al
mov byte [edi + 4], 0
mov eax, dword [edi]
inc eax
cmp eax, 2
jb 0x1006c870
call fcn.10060950
push dword [edi]
call fcn.1006d7a0
add esp, 4
mov dword [edi], 0
mov eax, esi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov dword [ebp - 0x10], eax
call fcn.10060950
push dword [esi]
call fcn.1006d7a0
mov eax, dword [ebp - 0x10]
add esp, 4
mov dword [esi], 0
cmp ebx, 2
jb 0x1006c83e
mov dword [esi], edi
mov edi, eax
call fcn.10060950
mov eax, edi
jmp 0x1006c83e
Function at 0x1006c8b0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, ecx
mov eax, dword [ebp + 8]
mov edi, dword [eax]
mov dword [eax], 0
lea ebx, [edi + 1]
cmp ebx, 2
jae 0x1006c8d2
cmp dword [esi], edi
jne 0x1006c8db
jmp 0x1006c8f5
call fcn.10060950
cmp dword [esi], edi
je 0x1006c8f5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esi]
inc ecx
cmp ecx, 2
jae 0x1006c92c
cmp ebx, 2
jae 0x1006c94c
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [ebp + 8]
movzx eax, byte [edi + 4]
mov byte [esi + 4], al
mov byte [edi + 4], 0
mov eax, dword [edi]
inc eax
cmp eax, 2
jb 0x1006c920
call fcn.10060950
push dword [edi]
call fcn.1006d7a0
add esp, 4
mov dword [edi], 0
mov eax, esi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov dword [ebp - 0x10], eax
call fcn.10060950
push dword [esi]
call fcn.1006d7a0
mov eax, dword [ebp - 0x10]
add esp, 4
mov dword [esi], 0
cmp ebx, 2
jb 0x1006c8ee
mov dword [esi], edi
mov edi, eax
call fcn.10060950
mov eax, edi
jmp 0x1006c8ee

Function at 0x1006caf0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
xor eax, eax
cmp dword [ebp + 0xc], 0
sete al
xor ecx, ecx
cmp dword [ebp + 8], 0
sete cl
push 0
push eax
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi], 0
test eax, eax
je 0x1006cb72
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jb 0x1006cb47
call fcn.10060950
push dword [esi]
call fcn.1006d7a0
add esp, 4
mov dword [esi], 0
lea eax, [edi + 1]
cmp eax, 2
jb 0x1006cb56
mov dword [esi], edi
call fcn.10060950
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esi]
mov byte [esi + 4], 1
inc eax
cmp eax, 1
jbe 0x1006cb79
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret 8
mov byte [esi + 4], 1
int3
int3
Function at 0x1006d0f0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov edi, edx
mov ebx, ecx
mov eax, dword [0x10123014]
xor eax, ebp
mov dword [ebp - 0x10], eax
test ecx, ecx
jne 0x1006d14a
mov eax, dword [0x10124d20]
cmp eax, 0xffffffff
jne 0x1006d130
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0x10124d20
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
je 0x1006d13b
mov eax, dword [0x10124d20]
mov ebx, 0x100000
test eax, eax
jne 0x1006d14a
jmp 0x1006d145
mov dword [0x10124d20], 0
mov ebx, 0x80000
push 0x10
call fcn.100de068
add esp, 4
mov esi, eax
mov eax, edi
shr eax, 0xe
mov ecx, edi
shr ecx, 0x13
mov ecx, dword [ecx*4 + 0x1012b7e0]
bt ecx, eax
jae 0x1006d177
push edi
call fcn.10064cc0
add esp, 4
jmp 0x1006d183
mov eax, edi
shr eax, 0x15
mov byte [eax + 0x101337e0], 1
mov dword [esi], edi
mov edi, dword [ebp + 8]
test edi, edi
setne byte [esi + 4]
mov eax, dword [ebp + 0xc]
mov dword [esi + 8], eax
mov eax, dword [ebp + 0x10]
mov dword [esi + 0xc], eax
push 0
push 0x10000
push esi
push 0x1006d5d0
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x1006d1bc
test edi, edi
je 0x1006d212
mov dword [edi], eax
jmp 0x1006d21d
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 8
je 0x1006d1d5
cmp eax, 0x5af
je 0x1006d1d5
cmp eax, 0xe
jne 0x1006d236
push ebx
call fcn.100985e0
add esp, 4
test esi, esi
mov eax, edi
je 0x1006d21d
mov eax, dword [esi]
mov ecx, eax
shr ecx, 0xe
mov edx, eax
shr edx, 0x13
mov edx, dword [edx*4 + 0x1012b7e0]
bt edx, ecx
jae 0x1006d205
push eax
call fcn.10064dc0
add esp, 4
push esi
call fcn.100de098
add esp, 4
mov eax, edi
jmp 0x1006d21d
push eax
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
test eax, eax
setne bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100dea63
mov eax, ebx
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x20], eax
mov eax, dword [0x1012950c]
mov ecx, dword [0x10126eb8]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x1006d29a
lea ebx, [ebp - 0x1c]
push dword [ebp - 0x20]
push ebx
call fcn.10089d40
add esp, 8
movzx eax, byte [ebp - 0x11]
test al, al
jns 0x1006d273
mov ebx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
push eax
push ebx
push dword [0x10129508]
call fcn.1008b510
add esp, 0xc
cmp byte [ebp - 0x11], 0
jns 0x1006d1de
push dword [ebp - 0x1c]
call fcn.100de098
jmp 0x1006d1db
push 0x1012950c
call fcn.100de107
add esp, 4
cmp dword [0x1012950c], 0xffffffff
jne 0x1006d256
push 0x20
push str.create_thread_last_error
call fcn.1008b4d0
add esp, 8
mov dword [0x10129508], eax
push 0x1012950c
call fcn.100de17d
add esp, 4
jmp 0x1006d256
Function at 0x1006dd20
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, dword [0x10123014]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov ebx, dword [ecx]
lea eax, [ebx + 1]
cmp eax, 2
jae 0x1006dd44
xor ebx, ebx
jmp 0x1006de07
mov esi, ecx
mov dword [ebp - 0x20], eax
cmp dword [ecx + 4], 1
jne 0x1006de1b
mov dword [esi], 0
call fcn.10060950
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
call fcn.10060950
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 0x14], 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [ebp - 0x14]
push 0
push 0
push 5
push ecx
push eax
mov dword [ebp - 0x1c], ebx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov edi, eax
test eax, eax
je 0x1006ddec
mov ebx, dword [ebp - 0x14]
cmp dword [esi], ebx
je 0x1006dde5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esi]
inc ecx
cmp ecx, 2
jb 0x1006ddcb
mov dword [ebp - 0x18], eax
call fcn.10060950
push dword [esi]
call fcn.1006d7a0
mov eax, dword [ebp - 0x18]
add esp, 4
mov dword [esi], 0
lea ecx, [ebx + 1]
cmp ecx, 2
jb 0x1006ddde
mov dword [esi], ebx
mov ebx, eax
call fcn.10060950
mov eax, ebx
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [esi + 4], 0
test edi, edi
setne bl
cmp dword [ebp - 0x20], 2
jb 0x1006de07
call fcn.10060950
push dword [ebp - 0x1c]
call fcn.1006d7a0
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100dea63
mov eax, ebx
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
int3
Function at 0x1006e110
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
movzx edx, byte [0x10129530]
test dl, 1
jne 0x1006e136
test ecx, ecx
je 0x1006e134
push ecx
push eax
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x1006e141
pop ebp
ret
call fcn.100a3790
pop ebp
jmp fcn.100a5510
int3