joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000bca0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0x70]
mov ecx, 0x1c
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 8], ecx
mov ecx, 0x10076174
call fcn.100151f0
mov dword [ebp - 0x14], 0x26f
mov dword [ebp - 0x20], 0xe3
mov dword [ebp - 0x2c], 0
jmp 0x1000bcea
mov eax, dword [ebp - 0x2c]
add eax, 1
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0xe3
jae 0x1000bd5f
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + eax*4 + 0x9c4]
and edx, 0x80000000
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 8]
mov eax, dword [ecx + eax*4 + 0x9c8]
and eax, 0x7fffffff
or edx, eax
mov dword [ebp - 0x38], edx
mov eax, dword [ebp - 0x38]
and eax, 1
je 0x1000bd31
mov dword [ebp - 0x130], 0x9908b0df
jmp 0x1000bd3b
mov dword [ebp - 0x130], 0
mov ecx, dword [ebp - 0x38]
shr ecx, 1
xor ecx, dword [ebp - 0x130]
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 8]
xor ecx, dword [eax + edx*4 + 0xff8]
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 8]
mov dword [eax + edx*4 + 4], ecx
jmp 0x1000bce1
mov dword [ebp - 0x44], 0xe3
jmp 0x1000bd71
mov eax, dword [ebp - 0x44]
add eax, 1
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0x26f
jae 0x1000bde6
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + eax*4 + 0x9c4]
and edx, 0x80000000
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 8]
mov eax, dword [ecx + eax*4 + 0x9c8]
and eax, 0x7fffffff
or edx, eax
mov dword [ebp - 0x50], edx
mov eax, dword [ebp - 0x50]
and eax, 1
je 0x1000bdb8
mov dword [ebp - 0x130], 0x9908b0df
jmp 0x1000bdc2
mov dword [ebp - 0x130], 0
mov ecx, dword [ebp - 0x50]
shr ecx, 1
xor ecx, dword [ebp - 0x130]
mov edx, dword [ebp - 0x44]
mov eax, dword [ebp - 8]
xor ecx, dword [eax + edx*4 - 0x388]
mov edx, dword [ebp - 0x44]
mov eax, dword [ebp - 8]
mov dword [eax + edx*4 + 4], ecx
jmp 0x1000bd68
mov dword [ebp - 0x5c], 0x26f
mov eax, 4
imul ecx, eax, 0x4df
mov edx, dword [ebp - 8]
mov eax, dword [edx + ecx + 4]
and eax, 0x80000000
mov ecx, 4
imul edx, ecx, 0
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + edx + 4]
and edx, 0x7fffffff
or eax, edx
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x68]
and eax, 1
je 0x1000be32
mov dword [ebp - 0x130], 0x9908b0df
jmp 0x1000be3c
mov dword [ebp - 0x130], 0
mov ecx, dword [ebp - 0x68]
shr ecx, 1
xor ecx, dword [ebp - 0x130]
mov edx, 4
imul eax, edx, 0x18c
mov edx, dword [ebp - 8]
xor ecx, dword [edx + eax + 4]
mov eax, 4
imul edx, eax, 0x26f
mov eax, dword [ebp - 8]
mov dword [eax + edx + 4], ecx
mov eax, dword [ebp - 8]
mov dword [eax], 0
pop edi
pop esi
pop ebx
add esp, 0x130
cmp ebp, esp
call fcn.100151c0
mov esp, ebp
pop ebp
ret
Function at 0x1000be90
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe8
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0x28]
mov ecx, 0xa
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 8], ecx
mov ecx, 0x10076174
call fcn.100151f0
mov dword [ebp - 0x14], 0x270
jmp 0x1000becc
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x4e0
jae 0x1000bf41
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + eax*4 - 0x9bc]
and edx, 0x80000000
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 8]
mov eax, dword [ecx + eax*4 - 0x9b8]
and eax, 0x7fffffff
or edx, eax
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x20]
and eax, 1
je 0x1000bf13
mov dword [ebp - 0xe8], 0x9908b0df
jmp 0x1000bf1d
mov dword [ebp - 0xe8], 0
mov ecx, dword [ebp - 0x20]
shr ecx, 1
xor ecx, dword [ebp - 0xe8]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
xor ecx, dword [eax + edx*4 - 0x388]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
mov dword [eax + edx*4 + 4], ecx
jmp 0x1000bec3
pop edi
pop esi
pop ebx
add esp, 0xe8
cmp ebp, esp
call fcn.100151c0
mov esp, ebp
pop ebp
ret
Function at 0x10010520
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0x58]
mov ecx, 0x16
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 8], ecx
mov ecx, 0x1007616a
call fcn.100151f0
cmp dword [ebp + 0x10], 0
jg 0x10010561
jl 0x10010558
cmp dword [ebp + 0xc], 0
ja 0x10010561
xor eax, eax
xor edx, edx
jmp 0x10010698
mov eax, dword [ebp - 8]
cmp dword [eax + 0x38], 0
je 0x10010583
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 8]
call fcn.10010700
jmp 0x10010698
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], ecx
mov ecx, dword [ebp - 8]
call fcn.1000ae70
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jbe 0x100105f2
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x14]
push ecx
call fcn.100021b0
add esp, 8
mov edx, dword [eax]
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp - 0x3c]
push eax
mov ecx, dword [ebp - 8]
call fcn.1000e170
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.10004590
add esp, 0xc
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x3c]
mov dword [ebp + 8], eax
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x3c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x3c]
push eax
mov ecx, dword [ebp - 8]
call fcn.1000dbd0
mov eax, dword [ebp - 8]
cmp dword [eax + 0x4c], 0
je 0x10010689
mov ecx, dword [ebp - 8]
call fcn.1000bf60
mov dword [ebp - 0x48], 0xfff
cmp dword [ebp - 0x14], 0xfff
jbe 0x10010662
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x4c]
push ecx
push 0xfff
push 1
mov edx, dword [ebp + 8]
push edx
call fcn.100226e0
add esp, 0x10
mov dword [ebp - 0x54], eax
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x54]
mov dword [ebp + 8], eax
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x54]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x54], 0xfff
je 0x10010660
xor eax, eax
mov ecx, dword [ebp - 0x24]
sub ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x20]
sbb edx, eax
mov eax, ecx
jmp 0x10010698
jmp 0x1001060e
cmp dword [ebp - 0x14], 0
jbe 0x10010689
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp - 0x14]
push edx
push 1
mov eax, dword [ebp + 8]
push eax
call fcn.100226e0
add esp, 0x10
mov ecx, dword [ebp - 0x14]
sub ecx, eax
mov dword [ebp - 0x14], ecx
xor eax, eax
mov ecx, dword [ebp - 0x24]
sub ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x20]
sbb edx, eax
mov eax, ecx
push edx
mov ecx, ebp
push eax
lea edx, [0x100106c0]
call fcn.10015160
pop eax
pop edx
pop edi
pop esi
pop ebx
add esp, 0x118
cmp ebp, esp
call fcn.100151c0
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10012880
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
sub eax, 0x10000
push eax
call fcn.10012a30
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jbe 0x1001294d
mov edx, dword [ebp - 4]
cmp edx, dword [0x1007308c]
jb 0x100128ca
mov eax, dword [ebp - 4]
cmp eax, dword [0x10073090]
ja 0x100128ca
mov ecx, dword [ebp - 4]
sub ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x1001289a
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call fcn.10018df0
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x100128f0
jmp 0x1001294d
cmp dword [ebp - 0x14], 0x10000
jne 0x10012933
cmp dword [ebp - 0x18], 0x10000
jb 0x10012933
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10012926
mov eax, dword [ebp - 8]
jmp 0x1001294f
mov eax, dword [ebp - 4]
sub eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x10012948
mov ecx, dword [ebp - 0x20]
sub ecx, 0x10000
push ecx
call fcn.10012a30
add esp, 4
mov dword [ebp - 4], eax
jmp 0x1001289a
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x10012960
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push eax
call fcn.10012a60
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x10012a25
mov edx, dword [ebp - 4]
cmp edx, dword [0x1007308c]
jb 0x100129a5
mov eax, dword [ebp - 4]
cmp eax, dword [0x10073090]
ja 0x100129a5
mov ecx, dword [ebp - 4]
add ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x10012975
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call fcn.10018df0
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x100129cb
jmp 0x10012a25
cmp dword [ebp - 0x14], 0x10000
jne 0x10012a0e
cmp dword [ebp - 0x18], 0x10000
jb 0x10012a0e
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10012a01
mov eax, dword [ebp - 8]
jmp 0x10012a27
mov eax, dword [ebp - 4]
add eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x10012a20
mov ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 0x18]
push ecx
call fcn.10012a60
add esp, 4
mov dword [ebp - 4], eax
jmp 0x10012975
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10013e30
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x10074358], eax
je 0x10013e4e
mov eax, 0x10dd
jmp 0x10013f2f
mov eax, dword [0x10074368]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x10013ecc
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x14]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
movzx eax, byte [edx + 0x36]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
jne 0x10013eaa
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x10], 0
je 0x10013eaa
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
push eax
call fcn.10012ee0
add esp, 4
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
push edx
call fcn.100160e0
add esp, 4
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
jmp 0x10013e56
mov dword [0x10074368], 0
call fcn.100137c0
mov ecx, dword [0x10074364]
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
je 0x10013f19
mov edx, dword [ebp - 8]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.100160e0
add esp, 4
mov edx, dword [ebp - 0x18]
mov dword [ebp - 8], edx
jmp 0x10013ee4
mov dword [0x10074364], 0
mov dword [0x10074358], 0
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x10014410
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x1007435c], 0
je 0x10014429
mov eax, dword [0x1007435c]
jmp 0x100144c9
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp dword [ebp + 8], eax
jne 0x1001443b
xor eax, eax
jmp 0x100144c9
push 8
call fcn.100150f0
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10014491
mov dword [ebp - 8], 8
cmp dword [ebp - 4], 0
je 0x1001447a
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
push edx
call fcn.100160e0
add esp, 4
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov dword [0x1007435c], eax
mov dword [0x10074360], 0
mov eax, dword [ebp - 8]
jmp 0x100144c9
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x100144ab
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
jmp 0x1001445b
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov dword [edx + 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [0x10074364]
mov dword [ecx], edx
mov eax, dword [ebp - 4]
mov dword [0x10074364], eax
xor eax, eax
mov esp, ebp
pop ebp
ret 4
Function at 0x1001b8e0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.1001b500
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1001b912
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 8]
call dword [0x1005a190]
call dword [ebp - 8]
jmp 0x1001b91c
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esp, ebp
pop ebp
ret
Function at 0x1003ab00
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.1003a380
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1003ab34
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 8]
call dword [0x1005a190]
call dword [ebp - 8]
jmp 0x1003ab3a
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov esp, ebp
pop ebp
ret 4

Function at 0x1003ab90
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.1003a3c0
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1003abc4
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 8]
call dword [0x1005a190]
call dword [ebp - 8]
jmp 0x1003abce
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esp, ebp
pop ebp
ret 4

Function at 0x1003abe0
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.1003a3e0
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1003ac18
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
call dword [0x1005a190]
call dword [ebp - 8]
jmp 0x1003ac26
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov esp, ebp
pop ebp
ret 8

Function at 0x1003ac30
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.1003a460
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1003ac70
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 8]
call dword [0x1005a190]
call dword [ebp - 8]
jmp 0x1003ac8e
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 0
mov eax, dword [ebp + 8]
push eax
call fcn.1003ae80
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov esp, ebp
pop ebp
ret 0x10

Function at 0x1003b340
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1003b367
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.10025650
add esp, 4
or eax, 0xffffffff
jmp 0x1003b369
xor eax, eax
pop ebp
ret
Function at 0x1003d610
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1434
call fcn.100158f0
mov eax, dword [0x100730c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
sar eax, 6
mov ecx, dword [ebp + 0xc]
and ecx, 0x3f
imul edx, ecx, 0x38
mov eax, dword [eax*4 + 0x10074b78]
mov ecx, dword [eax + edx + 0x18]
mov dword [ebp - 0x1434], ecx
mov edx, dword [ebp + 0x10]
add edx, dword [ebp + 0x14]
mov dword [ebp - 0x1424], edx
xor eax, eax
mov dword [ebp - 0x1410], eax
mov dword [ebp - 0x140c], eax
mov dword [ebp - 0x1408], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x1420], ecx
mov edx, dword [ebp - 0x1420]
cmp edx, dword [ebp - 0x1424]
jae 0x1003d7e8
lea eax, [ebp - 5]
mov dword [ebp - 0x1430], eax
lea ecx, [ebp - 0x1404]
mov dword [ebp - 0x1418], ecx
mov edx, dword [ebp - 0x1418]
cmp edx, dword [ebp - 0x1430]
jae 0x1003d737
mov eax, dword [ebp - 0x1420]
cmp eax, dword [ebp - 0x1424]
jae 0x1003d737
mov ecx, dword [ebp - 0x1420]
mov dl, byte [ecx]
mov byte [ebp - 0x1419], dl
mov eax, dword [ebp - 0x1420]
add eax, 1
mov dword [ebp - 0x1420], eax
mov cl, byte [ebp - 0x1419]
mov byte [ebp - 0x1411], cl
movsx edx, byte [ebp - 0x1411]
cmp edx, 0xa
jne 0x1003d715
mov eax, dword [ebp - 0x1408]
add eax, 1
mov dword [ebp - 0x1408], eax
mov ecx, dword [ebp - 0x1418]
mov byte [ecx], 0xd
mov edx, dword [ebp - 0x1418]
add edx, 1
mov dword [ebp - 0x1418], edx
mov eax, dword [ebp - 0x1418]
mov cl, byte [ebp - 0x1411]
mov byte [eax], cl
mov edx, dword [ebp - 0x1418]
add edx, 1
mov dword [ebp - 0x1418], edx
jmp 0x1003d699
mov eax, dword [ebp - 0x1418]
lea ecx, [ebp - 0x1404]
sub eax, ecx
mov dword [ebp - 0x142c], eax
push 0
lea edx, [ebp - 0x1428]
push edx
mov eax, dword [ebp - 0x142c]
push eax
lea ecx, [ebp - 0x1404]
push ecx
mov edx, dword [ebp - 0x1434]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1003d7a1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1410], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x1410]
mov dword [eax], ecx
mov edx, dword [ebp - 0x140c]
mov dword [eax + 4], edx
mov ecx, dword [ebp - 0x1408]
mov dword [eax + 8], ecx
mov eax, dword [ebp + 8]
jmp 0x1003d808
mov edx, dword [ebp - 0x140c]
add edx, dword [ebp - 0x1428]
mov dword [ebp - 0x140c], edx
mov eax, dword [ebp - 0x1428]
cmp eax, dword [ebp - 0x142c]
jae 0x1003d7e3
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x1410]
mov dword [ecx], edx
mov eax, dword [ebp - 0x140c]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x1408]
mov dword [ecx + 8], edx
mov eax, dword [ebp + 8]
jmp 0x1003d808
jmp 0x1003d672
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x1410]
mov dword [eax], ecx
mov edx, dword [ebp - 0x140c]
mov dword [eax + 4], edx
mov ecx, dword [ebp - 0x1408]
mov dword [eax + 8], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10015230
mov esp, ebp
pop ebp
ret
Function at 0x1003d820
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1434
call fcn.100158f0
mov eax, dword [0x100730c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
sar eax, 6
mov ecx, dword [ebp + 0xc]
and ecx, 0x3f
imul edx, ecx, 0x38
mov eax, dword [eax*4 + 0x10074b78]
mov ecx, dword [eax + edx + 0x18]
mov dword [ebp - 0x1434], ecx
mov edx, dword [ebp + 0x10]
add edx, dword [ebp + 0x14]
mov dword [ebp - 0x1424], edx
xor eax, eax
mov dword [ebp - 0x1410], eax
mov dword [ebp - 0x140c], eax
mov dword [ebp - 0x1408], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x141c], ecx
mov edx, dword [ebp - 0x141c]
cmp edx, dword [ebp - 0x1424]
jae 0x1003da0b
lea eax, [ebp - 6]
mov dword [ebp - 0x1430], eax
lea ecx, [ebp - 0x1404]
mov dword [ebp - 0x1414], ecx
mov edx, dword [ebp - 0x1414]
cmp edx, dword [ebp - 0x1430]
jae 0x1003d956
mov eax, dword [ebp - 0x141c]
cmp eax, dword [ebp - 0x1424]
jae 0x1003d956
mov ecx, dword [ebp - 0x141c]
mov dx, word [ecx]
mov word [ebp - 0x141e], dx
mov eax, dword [ebp - 0x141c]
add eax, 2
mov dword [ebp - 0x141c], eax
mov cx, word [ebp - 0x141e]
mov word [ebp - 0x1418], cx
movzx edx, word [ebp - 0x1418]
cmp edx, 0xa
jne 0x1003d932
mov eax, dword [ebp - 0x1408]
add eax, 2
mov dword [ebp - 0x1408], eax
mov ecx, 0xd
mov edx, dword [ebp - 0x1414]
mov word [edx], cx
mov eax, dword [ebp - 0x1414]
add eax, 2
mov dword [ebp - 0x1414], eax
mov ecx, dword [ebp - 0x1414]
mov dx, word [ebp - 0x1418]
mov word [ecx], dx
mov eax, dword [ebp - 0x1414]
add eax, 2
mov dword [ebp - 0x1414], eax
jmp 0x1003d8a9
mov ecx, dword [ebp - 0x1414]
lea edx, [ebp - 0x1404]
sub ecx, edx
sar ecx, 1
shl ecx, 1
mov dword [ebp - 0x142c], ecx
push 0
lea eax, [ebp - 0x1428]
push eax
mov ecx, dword [ebp - 0x142c]
push ecx
lea edx, [ebp - 0x1404]
push edx
mov eax, dword [ebp - 0x1434]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1003d9c4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1410], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x1410]
mov dword [ecx], edx
mov eax, dword [ebp - 0x140c]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x1408]
mov dword [ecx + 8], edx
mov eax, dword [ebp + 8]
jmp 0x1003da2b
mov eax, dword [ebp - 0x140c]
add eax, dword [ebp - 0x1428]
mov dword [ebp - 0x140c], eax
mov ecx, dword [ebp - 0x1428]
cmp ecx, dword [ebp - 0x142c]
jae 0x1003da06
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x1410]
mov dword [edx], eax
mov ecx, dword [ebp - 0x140c]
mov dword [edx + 4], ecx
mov eax, dword [ebp - 0x1408]
mov dword [edx + 8], eax
mov eax, dword [ebp + 8]
jmp 0x1003da2b
jmp 0x1003d882
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x1410]
mov dword [ecx], edx
mov eax, dword [ebp - 0x140c]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x1408]
mov dword [ecx + 8], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10015230
mov esp, ebp
pop ebp
ret
Function at 0x1004aee0
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x38
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
push eax
lea ecx, [ebp - 4]
call fcn.1001c580
lea ecx, [ebp - 4]
call fcn.1004aeb0
movzx eax, al
test eax, eax
jne 0x1004af1d
mov dword [ebp - 0x18], 0
lea ecx, [ebp - 4]
call fcn.1004adf0
mov eax, dword [ebp - 0x18]
jmp 0x1004b045
lea ecx, [ebp - 4]
call fcn.1001be70
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.1004ae70
add esp, 4
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x10]
sar edx, 1
mov dword [ebp - 0x14], edx
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0x14]
push eax
lea ecx, [ebp - 4]
call fcn.1001be70
push eax
push 0
push 0
call fcn.10048870
add esp, 0x20
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x1004af83
mov dword [ebp - 0x20], 0
lea ecx, [ebp - 4]
call fcn.1004adf0
mov eax, dword [ebp - 0x20]
jmp 0x1004b045
push 0x66
push str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
push 2
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.10020370
add esp, 0x10
push eax
lea ecx, [ebp - 8]
call fcn.10012250
lea ecx, [ebp - 8]
call fcn.10012730
movzx edx, al
test edx, edx
jne 0x1004afcc
mov dword [ebp - 0x24], 0
lea ecx, [ebp - 8]
call fcn.10012710
lea ecx, [ebp - 4]
call fcn.1004adf0
mov eax, dword [ebp - 0x24]
jmp 0x1004b045
lea ecx, [ebp - 8]
call fcn.100122c0
mov dword [ebp - 0x28], eax
lea ecx, [ebp - 4]
call fcn.1001be70
mov dword [ebp - 0x2c], eax
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x28]
push ecx
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x2c]
push eax
push 0
push 0
call fcn.10048870
add esp, 0x20
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jne 0x1004b027
mov dword [ebp - 0x34], 0
lea ecx, [ebp - 8]
call fcn.10012710
lea ecx, [ebp - 4]
call fcn.1004adf0
mov eax, dword [ebp - 0x34]
jmp 0x1004b045
lea ecx, [ebp - 8]
call fcn.100206b0
mov dword [ebp - 0x38], eax
lea ecx, [ebp - 8]
call fcn.10012710
lea ecx, [ebp - 4]
call fcn.1004adf0
mov eax, dword [ebp - 0x38]
mov esp, ebp
pop ebp
ret