joyce8/EMBER2024-capa huggingface dataset:
Function at 0x414431
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41adbc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040d9b7
and dword [ebp - 0x14], 0
cmp dword [0x431e34], 0
mov dword [ebp - 0x18], eax
jne 0x4144e4
push 0x4037dc
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x41458c
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4037d0
push ebx
call edi
test eax, eax
je 0x41458c
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x4037c0
push ebx
mov dword [0x431e34], eax
call edi
push eax
call esi
push 0x4037ac
push ebx
mov dword [0x431e38], eax
call edi
push eax
call esi
push 0x403790
push ebx
mov dword [0x431e3c], eax
call edi
push eax
call esi
mov dword [0x431e44], eax
test eax, eax
je 0x4144e4
push 0x403778
push ebx
call edi
push eax
call esi
mov dword [0x431e40], eax
mov eax, dword [0x431e40]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x41453d
cmp dword [0x431e44], ecx
je 0x41453d
push eax
call esi
push dword [0x431e44]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x41453d
test ebx, ebx
je 0x41453d
call edi
test eax, eax
je 0x414534
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x414534
test byte [ebp - 8], 1
jne 0x41453d
or dword [ebp + 0x10], 0x200000
jmp 0x414570
mov eax, dword [0x431e38]
cmp eax, dword [ebp - 0x18]
je 0x414570
push eax
call esi
test eax, eax
je 0x414570
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x414570
mov eax, dword [0x431e3c]
cmp eax, dword [ebp - 0x18]
je 0x414570
push eax
call esi
test eax, eax
je 0x414570
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x431e34]
call esi
test eax, eax
je 0x41458c
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x41458e
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00408b71
leave
ret
Function at 0x4160a0
Capabilities:
Get common file path
Manipulate console buffer

Disassembly:
mov eax, 0x1b08
call fcn.00414f70
cmp dword [0x8dc2c4], 0x37
push esi
jne 0x41619a
lea eax, [esp + 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualLock]
push 0
lea ecx, [esp + 0x30c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeMountPointW]
mov esi, dword [sym.imp.KERNEL32.dll_WriteConsoleInputA]
lea edx, [esp + 0x14]
push edx
push 0
push 0
push 0
call esi
push 0x403fec
push 0
call dword [sym.imp.KERNEL32.dll_CreateJobObjectW]
push 0
lea eax, [esp + 0xb0c]
push eax
push 0x40402c
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
push 0
lea ecx, [esp + 0x130c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea edx, [esp + 0xe8]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCPInfoExW]
lea eax, [esp + 0xc]
push eax
push 0
push 0
push 0
call esi
push 0x40404c
call dword [sym.imp.KERNEL32.dll_GlobalAddAtomA]
lea ecx, [esp + 0x10]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetCompressedFileSizeA]
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProfileSectionW]
push 0x30
lea eax, [esp + 0x24]
push 0
push eax
mov dword [esp + 0x28], 0
call fcn.00411070
add esp, 0xc
lea ecx, [esp + 0x1c]
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CommConfigDialogW]
mov edx, dword [0x8dea28]
mov dword [esp + 8], edx
mov eax, 0x5d1
add dword [esp + 8], eax
mov eax, dword [esp + 8]
mov cl, byte [eax + edi]
mov edx, dword [0x8daabc]
mov byte [edx + edi], cl
pop esi
add esp, 0x1b08
ret
Function at 0x432005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
je 0x432072
nop
nop
nop
nop
nop
mov ebx, 0x40c7d0
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x62b76f67
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x432060
nop
nop
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
je 0x4320d2
nop
nop
nop
mov ebx, 0x42f314
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x18506a1
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4320c0
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x100058d0
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x100a9040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
je 0x100058e8
jne 0x100058e8
lcall 0x6a, 0x6a006a
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 0x34], eax
push 4
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 0x30], eax
xor edx, edx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
push 0x24
lea ecx, [ebp - 0x2c]
push ecx
push 0
mov edx, dword [ebp - 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
jl 0x10005949
jmp 0x1000594b
je 0x10005946
mov eax, dword [ebp - 0x30]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x28]
mov dword [edx], eax
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp - 0x10]
mov dword [ecx], edx
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007143a
mov esp, ebp
pop ebp
ret

Function at 0x10005ac8
Capabilities:
Access peb ldr_data

Disassembly:
jae 0x10005ac6
jmp 0x10005ac1
call fcn.10005ac8
jae 0x10005ac1
add esp, 4
jmp 0x10005acd
dec dword [esp]
jno 0x10005ad2
jns 0x10005abd
jp 0x10005ad6
add esp, 4
popf
jmp 0x10005add
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x10005af6
jne 0x10005af6
call 0x1fc08e4a
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov dword [eax + 0x20], 0x20000
pushf
push 0xa
jae 0x10005b27
jmp 0x10005b22
call 0x10005b29
jae 0x10005b22
add esp, 4
jmp 0x10005b2e
dec dword [esp]
jno 0x10005b33
jns 0x10005b1e
jp 0x10005b37
add esp, 4
popf
jmp 0x10005b3e
clc
jae 0x10005b43
xchg esi, eax
invalid
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x10005b5c
jne 0x10005b5c
invalid
jl 0x10005b61
jmp 0x10005b63
je 0x10005b5e
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x10005b7d
jne 0x10005b7c
call 0x93044c04
rol byte [ebx + eax*4], 0xf0
add eax, 0x1750374
xor eax, 3
add eax, 4
xor eax, 5
je 0x10005b8b
jne 0x10005b8b
call 0x6d5bb9ee
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x10010380
Capabilities:
Act as tcp client
Connect tcp socket
Connect udp socket
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1e8
mov eax, dword [0x100a9040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov dword [ebp - 0x1d4], ecx
je 0x100103a1
jne 0x100103a1
pop eax
jl 0x100103a6
jmp 0x100103a8
je 0x100103a3
pushf
push 0xa
Function at 0x100119c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x100a9040]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0
push 0x2fa
call fcn.10071464
add esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x10011a08
push 0x2fa
push 0
mov eax, dword [ebp - 0x10]
push eax
call fcn.100730e0
add esp, 0xc
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x14], ecx
jmp 0x10011a0f
mov dword [ebp - 0x14], 0
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0xc], edx
push 0x2fa
push 0
mov eax, dword [ebp - 0xc]
push eax
call fcn.100730e0
add esp, 0xc
mov eax, dword [ebp - 0xc]
cdq
mov ecx, dword [ebp + 0xc]
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], edx
push 0
lea edx, [ebp - 8]
push edx
push 0x270
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x10011a56
xor eax, eax
jmp 0x10011a96
cmp dword [ebp - 8], 0x2fa
je 0x10011a63
xor eax, eax
jmp 0x10011a96
mov edx, dword [ebp - 0xc]
cmp dword [edx + 4], 0x12121212
je 0x10011a73
xor eax, eax
jmp 0x10011a96
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 8]
not ecx
mov edx, dword [ebp + 0xc]
cmp ecx, dword [edx + 8]
je 0x10011a87
xor eax, eax
jmp 0x10011a96
mov eax, dword [ebp + 0xc]
push eax
call fcn.10076873
add esp, 4
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007143a
mov esp, ebp
pop ebp
ret
Function at 0x10049f60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 8]
mov eax, ecx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, edx
mov dword [ebp - 4], eax
and edi, 0x1f
mov dword [ebp - 8], edi
cmp edi, 8
jb 0x1004a086
mov ecx, edi
shr ecx, 3
cmp dword [ebp + 0x10], 1
jne 0x1004a005
mov dword [ebp - 8], ecx
push 0xc2b2ae3d
push 0x27d4eb4f
push dword [eax + 4]
push dword [eax]
call fcn.10071fd0
add dword [ebp - 4], 8
mov ecx, eax
push 0x9e3779b1
shld ecx, edx, 0x1f
shld edx, eax, 0x1f
push 0x85ebca87
push edx
push ecx
call fcn.10071fd0
mov ecx, eax
xor edx, esi
xor ecx, ebx
mov eax, ecx
push 0x9e3779b1
shld eax, edx, 0x1b
shld edx, ecx, 0x1b
push 0x85ebca87
push edx
push eax
call fcn.10071fd0
mov ebx, eax
mov esi, edx
mov eax, dword [ebp - 4]
add ebx, 0xc2b2ae63
adc esi, 0x85ebca77
sub edi, 8
sub dword [ebp - 8], 1
jne 0x10049f93
jmp 0x1004a080
mov dword [ebp - 8], ecx
nop dword [eax + eax]
push 0xc2b2ae3d
push 0x27d4eb4f
push dword [eax + 4]
push dword [eax]
call fcn.10071fd0
add dword [ebp - 4], 8
mov ecx, eax
push 0x9e3779b1
shld ecx, edx, 0x1f
shld edx, eax, 0x1f
push 0x85ebca87
push edx
push ecx
call fcn.10071fd0
mov ecx, eax
xor edx, esi
xor ecx, ebx
mov eax, ecx
push 0x9e3779b1
shld eax, edx, 0x1b
shld edx, ecx, 0x1b
push 0x85ebca87
push edx
push eax
call fcn.10071fd0
mov ebx, eax
mov esi, edx
mov eax, dword [ebp - 4]
add ebx, 0xc2b2ae63
adc esi, 0x85ebca77
sub edi, 8
sub dword [ebp - 8], 1
jne 0x1004a010
mov eax, dword [ebp - 4]
mov dword [ebp - 8], edi
mov ecx, eax
cmp edi, 4
jb 0x1004a0dd
add eax, 4
mov dword [ebp - 4], eax
mov eax, 0x9e3779b1
mul dword [ecx]
push 0xc2b2ae3d
mov edi, eax
mov eax, 0x85ebca87
mul dword [ecx]
push 0x27d4eb4f
add edi, edx
xor eax, ebx
xor edi, esi
mov ecx, eax
shld ecx, edi, 0x17
shld edi, eax, 0x17
push edi
push ecx
call fcn.10071fd0
mov edi, dword [ebp - 8]
mov ebx, eax
mov eax, dword [ebp - 4]
add ebx, 0x9e3779f9
mov esi, edx
adc esi, 0x165667b1
sub edi, 4
test edi, edi
je 0x1004a124
movzx eax, byte [eax]
push 0x27d4eb2f
cdq
push 0x165667c5
push edx
push eax
call fcn.10071fd0
inc dword [ebp - 4]
xor ebx, eax
xor esi, edx
mov eax, ebx
push 0x9e3779b1
shld eax, esi, 0xb
push 0x85ebca87
shld esi, ebx, 0xb
push esi
push eax
call fcn.10071fd0
mov ebx, eax
mov eax, dword [ebp - 4]
mov esi, edx
sub edi, 1
jne 0x1004a0e1
push 0xc2b2ae3d
xor ecx, ecx
mov edx, esi
push 0x27d4eb4f
shr edx, 1
xor ecx, esi
xor edx, ebx
push ecx
push edx
call fcn.10071fd0
mov esi, eax
mov ecx, edx
shrd esi, ecx, 0x1d
push 0x165667b1
shr ecx, 0x1d
xor esi, eax
push 0x9e3779f9
xor ecx, edx
push ecx
push esi
call fcn.10071fd0
mov ecx, edx
xor esi, esi
pop edi
xor eax, ecx
xor edx, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10055d70
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
sub eax, 0x10000
push eax
call fcn.10055f20
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jbe 0x10055e3d
mov edx, dword [ebp - 4]
cmp edx, dword [section..data]
jb 0x10055dba
mov eax, dword [ebp - 4]
cmp eax, dword [0x100a9004]
ja 0x10055dba
mov ecx, dword [ebp - 4]
sub ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x10055d8a
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call fcn.100730e0
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x10055de0
jmp 0x10055e3d
cmp dword [ebp - 0x14], 0x10000
jne 0x10055e23
cmp dword [ebp - 0x18], 0x10000
jb 0x10055e23
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10055e16
mov eax, dword [ebp - 8]
jmp 0x10055e3f
mov eax, dword [ebp - 4]
sub eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x10055e38
mov ecx, dword [ebp - 0x20]
sub ecx, 0x10000
push ecx
call fcn.10055f20
add esp, 4
mov dword [ebp - 4], eax
jmp 0x10055d8a
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x10055e50
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push eax
call fcn.10055f50
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x10055f15
mov edx, dword [ebp - 4]
cmp edx, dword [section..data]
jb 0x10055e95
mov eax, dword [ebp - 4]
cmp eax, dword [0x100a9004]
ja 0x10055e95
mov ecx, dword [ebp - 4]
add ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x10055e65
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call fcn.100730e0
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x10055ebb
jmp 0x10055f15
cmp dword [ebp - 0x14], 0x10000
jne 0x10055efe
cmp dword [ebp - 0x18], 0x10000
jb 0x10055efe
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10055ef1
mov eax, dword [ebp - 8]
jmp 0x10055f17
mov eax, dword [ebp - 4]
add eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x10055f10
mov ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 0x18]
push ecx
call fcn.10055f50
add esp, 4
mov dword [ebp - 4], eax
jmp 0x10055e65
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10070d05
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
call fcn.1007bc76
push 2
lea ecx, [ebp - 4]
push ecx
mov eax, dword [eax + 0x14]
push 0x22
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
movzx eax, word [ebp - 4]
sub eax, 0x30
je 0x10070d44
sub eax, 1
je 0x10070d3f
sub eax, 1
je 0x10070d3b
xor eax, eax
leave
ret
push 3
jmp 0x10070d46
xor eax, eax
inc eax
leave
ret
push 2
pop eax
leave
ret

Function at 0x1007ac5f
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.10072380
mov eax, dword [0x100a9040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.10085138
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x1007aca1
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x1007adfd
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.10094f40
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x100cc6b8]
push dword [edi + eax + 0x24]
push dword [edi + eax + 0x20]
push ebx
call fcn.1008841a
mov ecx, dword [esi*4 + 0x100cc6b8]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [edi + ecx + 0x20]
jne 0x1007adf6
cmp eax, dword [edi + ecx + 0x24]
jne 0x1007adf6
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [edi + ecx + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1007adf6
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.1008841a
add esp, 0x14
test edx, edx
jl 0x1007adf6
jg 0x1007ad6c
test eax, eax
jb 0x1007adf6
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x1007adf6
jl 0x1007ad86
cmp dword [ebp - 0x1008], eax
ja 0x1007adf6
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x1007ada4
test ebx, ebx
je 0x1007addd
cmp ecx, edi
jae 0x1007addd
mov al, byte [ecx]
cmp al, 0xd
jne 0x1007adbe
lea eax, [edi - 1]
cmp ecx, eax
jae 0x1007adca
cmp byte [ecx + 1], 0xa
jne 0x1007adca
inc ecx
jmp 0x1007adca
movzx eax, al
movsx eax, byte [eax + 0x100a92a8]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x1007ada4
cmp edx, ebx
jne 0x1007ada4
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x1007adfb
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.1007143a
leave
ret
Function at 0x10085cc5
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x100cc6b8]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x10085d05
cmp byte [ebx], 0xa
jne 0x10085d05
or byte [eax + edi + 0x28], 4
jmp 0x10085d0a
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x10085e08
mov al, byte [edx]
cmp al, 0x1a
je 0x10085dea
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0x10085d39
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0x10085d5e
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x10085d68
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0x10085d1b
jmp 0x10085e08
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10085de5
cmp dword [ebp - 0xc], 0
je 0x10085de5
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0x100cc6b8]
test byte [eax + edi + 0x28], 0x48
je 0x10085dbf
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x10085daa
mov byte [esi], dl
jmp 0x10085dbb
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x100cc6b8]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x10085e08
cmp byte [ebp - 1], 0xa
jne 0x10085dce
cmp esi, ebx
jne 0x10085dce
mov byte [esi], 0xa
jmp 0x10085e07
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.10088438
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x10085e08
mov byte [esi], 0xd
jmp 0x10085e07
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x100cc6b8]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x10085e04
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x10085e08
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x10085e11
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x100cc6b8]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x10085e54
cmp word [esi], dx
jne 0x10085e54
or byte [edi + eax + 0x28], 4
jmp 0x10085e59
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x10085fac
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x10085f8c
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x10085e9b
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x10085ed1
cmp eax, edx
jae 0x10085edd
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x10085e73
jmp 0x10085fac
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10085f88
cmp dword [ebp - 0x14], 0
je 0x10085f88
mov eax, dword [ebx*4 + 0x100cc6b8]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x10085f60
mov dx, word [ebp - 4]
lea eax, [esi + 2]
pop ecx
mov dword [ebp - 0x18], eax
cmp dx, cx
jne 0x10085f29
mov word [esi], cx
jmp 0x10085f5c
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x100cc6b8]
movzx ecx, dx
shr ecx, 8
push 0xa
mov byte [edi + eax + 0x2a], dl
mov eax, dword [ebx*4 + 0x100cc6b8]
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x100cc6b8]
pop ecx
mov byte [edi + eax + 0x2c], cl
mov eax, dword [ebp - 0x18]
mov esi, eax
jmp 0x10085fac
pop ebx
cmp word [ebp - 4], bx
jne 0x10085f71
cmp esi, dword [ebp + 0xc]
jne 0x10085f71
mov word [esi], bx
jmp 0x10085fa9
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.10088438
add esp, 0x10
cmp word [ebp - 4], bx
je 0x10085fac
push 0xd
jmp 0x10085fa5
mov ecx, dword [ebx*4 + 0x100cc6b8]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x10085fa3
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x10085fac
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x100867cd
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1008663e

Function at 0x10087d44
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1009d05c
push 0x1009d054
push str.FlsAlloc
push 0x1e
call fcn.10087b71
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10087d78
push dword [ebp + 8]
mov ecx, esi
call dword [0x10098328]
call esi
jmp 0x10087d7e
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x10087dc2
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1009d06c
push 0x1009d064
push str.FlsGetValue
push 0x20
call fcn.10087b71
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10087df9
push dword [ebp + 8]
mov ecx, esi
call dword [0x10098328]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]