joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10025e92
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0
push ecx
xor ecx, ecx
jne 0x10025edc
mov ecx, esp
xor dword [ecx - 0x55], edi
pop ecx
call 0x10025e83
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
call 0x10025e92
cld
test edx, ebx
or ebp, eax
add dword [esi - 0x7cc26b19], esp
les ecx, [eax]
or dword [esp], ebp
mov ebp, esp
sub esp, 0x100
push ebx
push edx
push ecx
push edi
push esi
mov ebx, dword [ebp + 8]
mov edx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
lea ebx, [ebx + edx]
mov eax, dword [ebx + 0x24]
add eax, edx
xor edi, edi
jne 0x1042bb35
or edi, dword [ebx + 0x20]
add edi, edx
mov ecx, dword [ebx + 0x18]
mov esi, dword [edi]
add esi, edx
push 0
push ecx
mov ecx, esp
push 0x55d34c8a
call 0x10025ee3
sti
sbb byte [ecx + 0x56], dh
xlatb
les ebp, [ebp + 0x8c483e2]
xchg dword [ecx + 4], eax
xor eax, edx
shl eax, 3
xor ecx, 0
shl eax, 0x1d
add eax, dword [ecx + 4]
pop ecx
push esi
call fcn.1000cd59
cmp eax, dword [ebp + 0xc]
pop eax
je 0x10025f82
add edi, 4
add eax, 2
dec ecx
jne 0x10025ec8
call 0x10025f2f
loope 0x10025f25
invalid
sbb esi, ebx
mov edi, 0xdbead58c
js 0x10025f7f
mov dh, pe_nt_image_headers32
or byte [eax], al
add byte [eax], al
mov bh, 0x24
lea eax, [edx + 0x53]
nop
mov dword [esi + 0x2308c483], ecx
sal byte [ecx], 0xc0
fsub st(7)
int 0xf
mov bh, 0
movzx eax, word [eax]
jmp 0x10025f90
shl eax, 2
add eax, dword [ebx + 0x1c]
add eax, edx
mov eax, dword [eax]
add eax, edx
mov ebx, edx
add ebx, dword [edx + 0x3c]
mov ecx, dword [ebx + 0x7c]
mov ebx, dword [ebx + 0x78]
add ebx, edx
add ecx, ebx
cmp eax, ebx
jb 0x10025f43
cmp eax, ecx
ja 0x10025f43
mov esi, eax
lea edi, [ebp - 0x100]
mov al, byte [esi]
mov byte [edi], al
inc edi
inc esi
js 0x10025fcd
or ecx, ecx
xor dword [esp - 0x6b], eax
cmp al, 0x2e
jne 0x10025fc3
lea edi, [ebp - 0x100]
push 0x100
push edi
push esi
call fcn.1000d238
lea esp, [esp - 0x60]
mov dword [esp + 0x5c], edi
lea esp, [esp + 0x5c]
Function at 0x4afce4
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffb4
mov dword [esp], eax
lea esi, [esp + 0x30]
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edi, dword [esp]
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
jmp 0x4afda3
cmp dword [esi + 0x10], 0x1000
jne 0x4afd8f
test byte [esi + 0x15], 1
jne 0x4afd8f
mov byte [esp + 4], 0
mov ebp, dword [esi + 0x14]
cmp ebp, 1
je 0x4afd40
cmp ebp, 2
je 0x4afd40
cmp ebp, 0x10
je 0x4afd40
cmp ebp, 0x20
jne 0x4afd5c
lea eax, [esp + 8]
push eax
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4afd5c
mov byte [esp + 4], 1
xor ebx, ebx
jmp 0x4afd6d
mov eax, dword [esi]
add eax, ebx
call fcn.004afcdc
add ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0xc]
jb 0x4afd60
cmp byte [esp + 4], 0
je 0x4afd8f
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov edi, eax
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
mov eax, dword [esi + 4]
cmp eax, dword [esp]
je 0x4afd15
add esp, 0x4c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x430001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x430072
nop
nop
nop
mov ebx, 0x408f6c
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x34062f03
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x430060
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4300d2
nop
nop
nop
nop
mov ebx, 0x42e3d0
nop
nop
nop
nop
mov ecx, ebx
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x46123e08
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x404aa3
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov word [ebp + 0xc], ax
mov dword [ebp - 4], 0x7f83677c
sub dword [ebp - 4], 0x1715
xor esi, esi
mov eax, dword [ebp - 4]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
mul dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], eax
mov word [ebp - 0x10], 0
jmp 0x404bc4
mov eax, ebx
add eax, esi
push eax
call fcn.0040423c
pop ecx
mov edx, eax
mov byte [ebp - 5], dl
mov eax, dword [ebp - 4]
mov edx, eax
add edx, eax
mov dword [ebp - 4], edx
cmp byte [ebp - 5], 0
jne 0x404b09
mov byte [ebp - 6], 0
jmp 0x404b33
call 0x409b00
mov dword [ebp - 0x20], eax
mov eax, 0x7fff
mov edi, 7
movzx edx, byte [ebp - 5]
mov ecx, edi
sub ecx, edx
cdq
idiv ecx
mov ecx, eax
mov eax, dword [ebp - 0x20]
cdq
idiv ecx
mov edx, eax
mov byte [ebp - 6], dl
mov al, byte [esi + ebx]
cmp al, 0x70
jb 0x404b4e
cmp al, 0x7f
ja 0x404b4e
mov eax, ebx
add eax, esi
inc eax
movzx edx, byte [eax]
movzx ecx, byte [ebp - 6]
sub edx, ecx
mov byte [eax], dl
movzx eax, byte [esi + ebx]
cmp eax, 0xe2
jne 0x404b69
mov eax, ebx
add eax, esi
inc eax
movzx edx, byte [eax]
movzx ecx, byte [ebp - 6]
sub edx, ecx
mov byte [eax], dl
mov eax, 0x3e96
mul dword [ebp - 4]
mov dword [ebp - 0x24], eax
mov dword [ebp - 4], eax
push 8
push 0x90
lea eax, [ebp - 0xe]
push eax
call 0x409adc
movzx eax, byte [ebp - 5]
push eax
mov eax, ebx
add eax, esi
push eax
lea eax, [ebp - 0xe]
movzx edx, byte [ebp - 6]
add eax, edx
push eax
call 0x409ad0
push 6
lea eax, [ebp - 0xe]
push eax
mov eax, ebx
add eax, esi
push eax
call 0x409ad0
add esp, 0x24
mov eax, dword [ebp - 4]
mov edx, eax
xor edx, eax
mov dword [ebp - 4], edx
add esi, 6
inc word [ebp - 0x10]
movzx eax, word [ebp + 0xc]
dec eax
cmp esi, eax
jb 0x404ae3
pop edi
pop esi
pop ebx
leave
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x430072
nop
nop
nop
mov ebx, 0x408ecc
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x52803440
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x430060
nop
nop
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4300d2
nop
nop
nop
mov ebx, 0x42e1d0
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x4da53cb6
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x401c00
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
mov edx, eax
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
mov edx, eax
cmp word [edx], 0x5a4d
je 0x401c25
or eax, 0xffffffff
jmp 0x401cd2
mov eax, dword [edx + 0x3c]
mov ecx, edx
add eax, ecx
mov ecx, eax
cmp dword [ecx], 0x4550
je 0x401c3e
or eax, 0xffffffff
jmp 0x401cd2
mov eax, dword [ecx + 0x78]
mov edx, dword [ebp - 0x10]
lea ecx, [edx + eax]
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x20]
add eax, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x18]
mov ebx, eax
test ebx, ebx
jne 0x401c66
or eax, 0xffffffff
jmp 0x401cd2
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x24]
mov edx, dword [ebp - 0x10]
add eax, edx
mov dword [ebp - 0xc], eax
xor esi, esi
or edi, 0xffffffff
test ebx, ebx
jle 0x401cb8
mov eax, dword [ebp - 4]
mov eax, dword [eax + esi*4]
mov edx, dword [ebp - 0x10]
add eax, edx
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp + 0xc]
xor eax, eax
mov al, byte [edx]
mov ah, byte [ecx]
sub ah, al
jne 0x401ca3
test al, al
je 0x401ca8
inc edx
inc ecx
jmp 0x401c93
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x401cb0
mov edi, esi
jmp 0x401cb8
inc esi
or edi, 0xffffffff
cmp esi, ebx
jl 0x401c7d
cmp edi, 0xffff
jne 0x401cc5
or eax, 0xffffffff
jmp 0x401cd2
mov eax, dword [ebp - 0xc]
movzx eax, word [eax + edi*2]
mov edx, dword [ebp - 8]
add eax, dword [edx + 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x401ce0
Capabilities:
Parse pe header

Disassembly:
push ebx
push esi
push edi
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, eax
mov ebx, ecx
cmp word [ebx], 0x5a4d
je 0x401cfa
xor eax, eax
jmp 0x401d3e
mov eax, dword [ebx + 0x3c]
mov esi, ebx
add eax, esi
mov esi, eax
cmp dword [esi], 0x4550
je 0x401d0f
xor eax, eax
jmp 0x401d3e
mov eax, dword [esi + 0x78]
mov ebx, ecx
lea esi, [ebx + eax]
mov eax, dword [esi + 0x1c]
add eax, ebx
mov ebx, eax
mov eax, dword [esi + 0x10]
cmp edx, eax
jb 0x401d2e
neg eax
add eax, edx
cmp eax, dword [esi + 0x14]
jbe 0x401d32
xor eax, eax
jmp 0x401d3e
mov eax, edx
sub eax, dword [esi + 0x10]
mov eax, dword [ebx + eax*4]
mov edi, ecx
add eax, edi
pop edi
pop esi
pop ebx
ret 8
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40c7d0
mov ecx, 0x49ad73f9
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43204e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x432024
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f314
nop
mov ecx, 0x5b897a07
nop
nop
nop
nop
test eax, eax
nop
je 0x432084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x414ac0
Capabilities:
Encode data using xor

Disassembly:
sbb dword [ecx - 0x60433613], esi
cli
add byte [ecx], bl
popfd
in eax, dx
mov cl, 0xbc
lahf
cli
aad 0xd9
mov eax, dword [0xd3b48871]
cmp esi, dword [edx - 0x5d]
pop ebx
salc
xchg ebp, eax
mov byte [0x615c8d05], al
add eax, 0x5615c8d
lea ebx, [ecx + 5]
fcom st(5)
test byte [esi + 0x44015cb0], al
lea ebx, [ebp + edx + 0x10]
jb 0x414a67
popal
int3
add eax, 0x5615c8d
xchg edi, eax
sahf
cli
jb 0x4149c5
popal
add eax, 0x5615c8d
lea ebx, [ecx + 5]
dec esi
pop esp
popal
add eax, 0x5615c8d
lea ebx, [ecx + 5]
lea ebx, [ecx + 5]
dec esi
pop esp
popal
add eax, 0x5615c8d
add eax, 0x5615c4e
lea ebx, [ecx + 5]
lea ebx, [ecx + 5]
lea ebx, [ecx + 5]
pop esp
popal
add eax, 0x5615c8d
pop esp
popal
add eax, 0x44312c2d
invalid
sub eax, 0x8d44312c
inc byte [ecx + 0x65]
int3
inc eax
adc edi, 0x610d1534
mov eax, dword [0x615ccc54]
xlatb
xor al, 0x15
or eax, 0xcc54a161
pop esp
popal
jo 0x414a3f
fistp word [ecx - reloc.ole32.dll_CoInitializeEx]
in eax, dx
push ds
loop 0x414a69
mov word [eax], gs
insd dword es:[edi], dx
xchg byte [ebp + 0x5d], ah
adc eax, 0x60b40e16
pushal
jno 0x414a1b
mov bh, 0x50
in eax, dx
sub eax, 0x65fa9e01
xchg edi, eax
pop es
cli
jb 0x414a4d
inc esp
in eax, dx
mov dword [esi], edi
sahf
cli
xor eax, 0x8c05615c
mov ah, 0x4b
pop edx
jb 0x414a49
mov dl, byte [ecx]
jb 0x414b13
xor dword [esp + ecx*8 + 0x5c], ebx
mov dword [eax], edi
dec edx
mov byte [0x284d809e], al
in eax, dx
jns 0x414abd
sahf
cli
inc esp
sahf
insd dword es:[edi], dx
add eax, 0xc384d5d8
fcom st(5)
test bl, al
fcom st(5)
test bl, al
mov byte [eax + esi + 0x95d8d44], cl
aad 0x4f
push ds
popal
outsd dx, dword [esi]
jnp 0x414a86
sbb eax, eax
jae 0x414a79
xor ebp, ebp
sub dword [edx + 0x5c34fa9f], ebx
lahf
cli
xor al, 0x5c
add dword [edi - 0x73], 0xcfe565e6
pop esp
fnstenv [0xed611ded]
frstor dword [ebx + 0x765fa9e]
sahf
cli
jb 0x414ada
jno 0x414b5d
int3
cli
lea ebx, [ecx + 5]
jb 0x414abd
sahf
cli
lea ebx, [ecx + 5]
lea ebx, [ecx + 5]
lea ebx, [ecx + 5]
lea ebx, [edx - 0x17]
mov dword [ebx - 0xb9ede9b], ebx
and eax, dword [0x6d2ea784]
lea ebp, [eax]
add eax, 0xddd91bc3
pcmpgtd mm4, mm7
mov esi, 0x40010d42
movsb byte es:[edi], byte [esi]
mov dword [0x4c8dbc27], eax
and dword [0x5609b0c], eax
lea ebx, [eax - 0x15]
sub ch, byte fs:[ecx - 0x19]
or al, 0xb2
pushal
mov dl, 0x60
add eax, 0x25db5c8d
invalid
Function at 0x10002b20
Capabilities:
Access peb ldr_data
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x1002c040]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x10022470
jmp 0x10002bf1
lea esp, [esp + 4]
jmp loc.1002ea4d

Function at 0x100060a0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1002181d
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x1002c040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 8
mov dword [esi + 0x30], 0
mov dword [esi + 8], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0x201
mov dword [esi + 0x18], 6
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0xc], 0
call fcn.100072f8
mov edi, eax
add esp, 4
test edi, edi
je 0x10006144
xorps xmm0, xmm0
movq qword [edi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.100083f5
add esp, 4
mov dword [edi + 4], eax
jmp 0x10006146
xor edi, edi
mov eax, dword [ebp + 8]
mov dword [esi + 0x30], edi
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], 0
mov ecx, dword [edi + 4]
mov dword [ebp - 0x10], ecx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 1
push eax
call fcn.10003fa0
add esp, 4
mov ecx, dword [eax]
push 0x20
mov edx, dword [ecx + 0x20]
mov ecx, eax
call edx
mov ecx, dword [ebp - 0x10]
mov bl, al
mov dword [ebp - 4], 0xffffffff
test ecx, ecx
je 0x100061a0
mov edx, dword [ecx]
call dword [edx + 8]
test eax, eax
je 0x100061a0
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
cmp dword [esi + 0x38], 0
mov byte [esi + 0x40], bl
jne 0x100061bc
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x10]
and eax, 0x13
or eax, 4
mov dword [esi + 0xc], eax
and ecx, eax
jne 0x100061df
cmp byte [ebp + 0xc], 0
je 0x100061cb
push esi
call fcn.1000888b
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
test cl, 4
je 0x100061eb
mov esi, str.ios_base::badbit_set
jmp 0x100061fb
test cl, 2
mov esi, str.ios_base::failbit_set
mov eax, str.ios_base::eofbit_set
cmove esi, eax
lea eax, [ebp - 0x14]
push 1
push eax
call fcn.10006230
add esp, 8
lea ecx, [ebp - 0x28]
push eax
push esi
call fcn.100048e0
push 0x1002a8a8
lea eax, [ebp - 0x28]
push eax
call fcn.10009128
int3
Function at 0x10006e30
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], edi
test eax, eax
jg 0x10006e5c
jl 0x10006e50
test ecx, ecx
jne 0x10006e5c
pop edi
xor eax, eax
xor edx, edx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
push esi
je 0x10006f0e
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
nop dword [eax]
mov ecx, ebx
call fcn.10005410
mov esi, eax
mov eax, edx
mov dword [ebp - 0xc], eax
test eax, eax
jl 0x10006ec3
jg 0x10006e88
test esi, esi
je 0x10006ec3
mov ecx, dword [ebp - 4]
cmp ecx, eax
jg 0x10006e9d
mov eax, dword [ebp - 8]
jl 0x10006e98
cmp eax, esi
jae 0x10006e9d
mov esi, eax
mov dword [ebp - 0xc], ecx
mov eax, dword [ebx + 0x1c]
push esi
push dword [eax]
push edi
call fcn.10009600
mov eax, dword [ebx + 0x2c]
add esp, 0xc
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
sub ecx, esi
sbb edx, dword [ebp - 0xc]
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
jmp 0x10006ee2
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x1c]
mov edx, dword [ebp - 4]
cmp eax, 0xffffffff
je 0x10006ef8
mov ecx, dword [ebp - 8]
mov esi, 1
add ecx, 0xffffffff
mov byte [edi], al
adc edx, 0xffffffff
add edi, esi
mov dword [ebp - 4], edx
mov dword [ebp - 8], ecx
test edx, edx
jg 0x10006e70
jl 0x10006ef8
test ecx, ecx
jne 0x10006e70
mov eax, dword [ebp + 0xc]
sub eax, dword [ebp - 8]
mov esi, dword [ebp + 0x10]
sbb esi, edx
mov edx, esi
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
lea esi, [ebx + 0x2c]
mov edi, ecx
mov edx, dword [eax]
test edx, edx
je 0x10006f4a
mov eax, dword [esi]
mov eax, dword [eax]
test eax, eax
je 0x10006f4a
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push edx
push dword [ebp - 4]
call fcn.10009600
mov eax, dword [ebx + 0x2c]
sub edi, esi
add dword [ebp - 4], esi
add esp, 0xc
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
lea esi, [ebx + 0x2c]
cmp dword [ebx + 0x4c], 0
je 0x10006fb7
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x10006f70
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi]
mov dword [eax], edx
mov esi, dword [ebp - 4]
cmp edi, 0xfff
jbe 0x10006fa2
nop dword [eax + eax]
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call fcn.1000db4d
add esp, 0x10
add esi, eax
sub edi, eax
cmp eax, 0xfff
jne 0x10006fb7
cmp edi, eax
ja 0x10006f80
test edi, edi
je 0x10006fb7
push dword [ebx + 0x4c]
push edi
push 1
push esi
call fcn.1000db4d
add esp, 0x10
sub edi, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop esi
pop edi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1000ee66
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x1000eea5
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1000eea5
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1000eea5
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x1000eea5
cmp dword [ecx + 0x74], 0xe
jbe 0x1000eea5
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x10013eec
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10025638
push 0x10025630
push str.FlsAlloc
push 0x1f
call fcn.10013d57
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10013f20
push dword [ebp + 8]
mov ecx, esi
call dword [0x10022174]
call esi
jmp 0x10013f26
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x10013f6a
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10025648
push 0x10025640
push str.FlsGetValue
push 0x21
call fcn.10013d57
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10013fa1
push dword [ebp + 8]
mov ecx, esi
call dword [0x10022174]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x10013fa9
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10025650
push 0x10025648
push str.FlsSetValue
push 0x22
call fcn.10013d57
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10013fe3
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x10022174]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x10015a6a
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.10020e50
mov eax, dword [0x1002c040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.1001451f
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x10015aac
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x10015c08
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.10020e80
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x1002da00]
push dword [eax + edi + 0x24]
push dword [eax + edi + 0x20]
push ebx
call fcn.10016a67
mov ecx, dword [esi*4 + 0x1002da00]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [ecx + edi + 0x20]
jne 0x10015c01
cmp eax, dword [ecx + edi + 0x24]
jne 0x10015c01
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [ecx + edi + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10015c01
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.10016a67
add esp, 0x14
test edx, edx
jl 0x10015c01
jg 0x10015b77
test eax, eax
jb 0x10015c01
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x10015c01
jl 0x10015b91
cmp dword [ebp - 0x1008], eax
ja 0x10015c01
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x10015baf
test ebx, ebx
je 0x10015be8
cmp ecx, edi
jae 0x10015be8
mov al, byte [ecx]
cmp al, 0xd
jne 0x10015bc9
lea eax, [edi - 1]
cmp ecx, eax
jae 0x10015bd5
cmp byte [ecx + 1], 0xa
jne 0x10015bd5
inc ecx
jmp 0x10015bd5
movzx eax, al
movsx eax, byte [eax + 0x1002c338]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x10015baf
cmp edx, ebx
jne 0x10015baf
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x10015c06
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.10007538
leave
ret