joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100178c0
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x28
push esi
push edi
mov ecx, 0xa
xor eax, eax
lea edi, [esp + 8]
lea edx, [esp + 8]
rep stosd dword es:[edi], eax
mov eax, dword [0x10042f10]
mov ecx, dword [sym.imp.USER32.dll_DefWindowProcA]
mov dword [esp + 0x18], eax
mov eax, 0xc
push edx
mov dword [esp + 0x30], str.dummy
mov dword [esp + 0x10], ecx
mov dword [esp + 0x28], 0xf
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
call dword [sym.imp.USER32.dll_RegisterClassA]
test ax, ax
je 0x1001795c
mov eax, dword [0x10042f10]
push 0
push eax
push 0
push 0
push 0x80000000
push 0x80000000
push 0x80000000
push 0x80000000
push 0
push str.dummy
push str.dummy
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov esi, eax
test esi, esi
je 0x1001795c
push 0
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_DestroyWindow]
pop edi
pop esi
add esp, 0x28
ret

Function at 0x1001a0c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edx, dword [eax]
mov esi, dword [eax + 4]
mov eax, dword [0x10033250]
xor edi, edi
mov dword [ebp - 4], eax
mov ebx, 0xcf9fab7e
jmp 0x1001a0eb
mov eax, ebx
jmp 0x1001a0f2
xor ebx, eax
jmp 0x1001a0e2
mov eax, 0x51a8d2c7
jmp 0x1001a0e6
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
mov eax, ecx
dec ecx
test eax, eax
jbe 0x1001a165
mov eax, dword [ebp + 0xc]
inc ecx
mov dword [ebp + 0xc], ecx
mov ebx, dword [eax + 4]
mov dword [ebp - 0xc], ebx
mov ebx, dword [eax]
mov dword [ebp - 4], ebx
mov ebx, dword [eax + 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
mov ebx, dword [ebp - 0xc]
mov ecx, esi
add edi, eax
mov eax, dword [ebp - 4]
shl ecx, 4
add ecx, eax
mov eax, esi
shr eax, 5
add eax, ebx
mov ebx, dword [ebp - 0x14]
xor ecx, eax
lea eax, [edi + esi]
xor ecx, eax
mov eax, dword [ebp - 0x10]
add edx, ecx
mov ecx, edx
shl ecx, 4
add ecx, eax
mov eax, edx
shr eax, 5
add eax, ebx
xor ecx, eax
lea eax, [edi + edx]
xor ecx, eax
mov eax, dword [ebp + 0xc]
add esi, ecx
dec eax
mov dword [ebp + 0xc], eax
jne 0x1001a11d
mov eax, dword [ebp + 8]
pop edi
mov dword [eax + 4], esi
pop esi
mov dword [eax], edx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001a180
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov esi, dword [eax]
mov edx, dword [eax + 4]
mov edi, dword [0x10033250]
jmp 0x1001a1a5
and eax, ebx
jmp 0x1001a1ae
mov ebx, 0x9ef77ff9
jmp 0x1001a19a
je 0x1001a1a7
mov eax, 0xff3ff9bf
jmp 0x1001a19e
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov ecx, edi
shl eax, 5
dec edi
test ecx, ecx
jbe 0x1001a224
mov ecx, dword [ebp + 0xc]
inc edi
mov dword [ebp + 0xc], edi
mov ebx, dword [ecx + 8]
mov dword [ebp - 0xc], ebx
mov ebx, dword [ecx + 0xc]
mov dword [ebp - 8], ebx
mov ebx, dword [ecx + 4]
mov ecx, dword [ecx]
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], ecx
mov edi, dword [ebp - 8]
mov ebx, dword [ebp - 0xc]
mov ecx, esi
shr ecx, 5
add ecx, edi
mov edi, esi
shl edi, 4
add edi, ebx
mov ebx, dword [ebp - 0x14]
xor ecx, edi
lea edi, [eax + esi]
xor ecx, edi
mov edi, dword [ebp - 0x10]
sub edx, ecx
mov ecx, edx
shr ecx, 5
add ecx, edi
mov edi, edx
shl edi, 4
add edi, ebx
xor ecx, edi
lea edi, [eax + edx]
xor ecx, edi
mov edi, dword [ebp - 4]
sub esi, ecx
mov ecx, dword [ebp + 0xc]
sub eax, edi
dec ecx
mov dword [ebp + 0xc], ecx
jne 0x1001a1dc
mov eax, dword [ebp + 8]
pop edi
mov dword [eax], esi
pop esi
mov dword [eax + 4], edx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1001b2e0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
xor esi, esi
push edi
xor ebx, ebx
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLCID]
mov edi, eax
cmp edi, esi
je 0x1001b3de
mov eax, dword [ebp + 0xc]
push edi
push eax
call fcn.1001aa90
add esp, 8
cmp eax, esi
mov dword [ebp + 0xc], eax
je 0x1001b339
call fcn.1001a8a0
mov esi, dword [ebp + 0xc]
mov ebx, eax
push edi
push ebx
push esi
call fcn.1001a960
add esp, 0xc
push esi
call fcn.1001a900
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.1001b2a0
mov ebx, eax
call fcn.1001b2c0
mov ecx, dword [ebp + 8]
push esi
push 0x80
push 3
push esi
push 1
push 0x80000000
push ecx
mov dword [ebp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x1001b3ad
mov edx, dword [ebp + 0xc]
push 0
push 0
push edx
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push ebx
call fcn.10024410
add esp, 4
mov esi, eax
lea eax, [ebp - 4]
push 0
push eax
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1001b39b
cmp dword [ebp - 4], ebx
je 0x1001b3a6
push esi
call fcn.100243a0
add esp, 4
xor esi, esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
jne 0x1001b3ca
call fcn.1001a8a0
push esi
mov ebx, eax
call fcn.100243a0
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
call fcn.1001a940
add esp, 4
mov ebx, eax
push esi
call fcn.100243a0
add esp, 4
pop edi
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10022040
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x50
push ebx
push esi
mov esi, dword [esp + 0x5c]
push edi
push 0x7f00
push 0
mov eax, dword [esi]
mov dword [esp + 0x3c], 3
mov dword [esp + 0x40], 0x10021fb0
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], 0
mov dword [esp + 0x4c], eax
call dword [sym.imp.USER32.dll_LoadIconA]
push 0x7f00
push 0
mov dword [esp + 0x50], eax
call dword [sym.imp.USER32.dll_LoadCursorA]
mov ecx, dword [esi + 4]
lea edx, [esp + 0x34]
push edx
mov dword [esp + 0x50], eax
mov dword [esp + 0x54], 6
mov dword [esp + 0x58], 0
mov dword [esp + 0x5c], ecx
call dword [sym.imp.USER32.dll_RegisterClassA]
test ax, ax
jne 0x100220c0
pop edi
pop esi
pop ebx
add esp, 0x50
ret
mov eax, dword [esi]
lea ecx, [esp + 0x60]
mov dword [0x10044a14], eax
lea edx, [esp + 0xc]
push ecx
lea eax, [esp + 0x14]
push edx
lea ecx, [esp + 0x1c]
push eax
push ecx
call fcn.10021e20
mov edx, dword [esi]
mov eax, dword [esp + 0x70]
mov ecx, dword [esp + 0x1c]
add esp, 0x10
push 0
push edx
mov edx, dword [esp + 0x18]
push 0
push 0
push eax
mov eax, dword [esp + 0x28]
push ecx
mov ecx, dword [esi + 4]
push edx
push eax
push 0x80000000
push 0
push ecx
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov esi, eax
test esi, esi
jne 0x10022123
xor ax, ax
pop edi
pop esi
pop ebx
add esp, 0x50
ret
mov dword [0x10043c04], esi
call fcn.10021900
test ax, ax
je 0x10022137
xor edi, edi
jmp 0x10022143
push esi
mov edi, 1
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push edi
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_UpdateWindow]
mov edx, dword [0x10043c04]
mov esi, dword [sym.imp.USER32.dll_PeekMessageA]
push 1
push 0
push 0
lea eax, [esp + 0x24]
push edx
push eax
call esi
test eax, eax
je 0x100221cc
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageA]
cmp dword [esp + 0x1c], 0x12
je 0x100221b3
lea ecx, [esp + 0x18]
push ecx
call edi
lea edx, [esp + 0x18]
push edx
call ebx
mov eax, dword [0x10043c04]
push 1
push 0
push 0
lea ecx, [esp + 0x24]
push eax
push ecx
call esi
test eax, eax
jne 0x1002217c
mov ax, 1
pop edi
pop esi
pop ebx
add esp, 0x50
ret
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x20]
mov ecx, dword [0x10043c04]
push edx
push eax
push 0x12
push ecx
call dword [sym.imp.USER32.dll_PostMessageA]
pop edi
pop esi
mov ax, 1
pop ebx
add esp, 0x50
ret
Function at 0x10022280
Capabilities:
Check os version
Create thread
Enumerate gui resources
Parse pe header

Disassembly:
sub esp, 0x19c
mov word [0x10043c18], 0
push esi
push edi
call fcn.10021900
test ax, ax
mov word [0x10043c08], 0
jne 0x10022367
lea eax, [esp + 0xa0]
push 1
push eax
call fcn.10021d40
add esp, 8
cmp ax, 1
jne 0x100222d6
lea ecx, [esp + 0xa0]
push ecx
call fcn.100224c0
add esp, 4
mov word [0x10043c08], ax
cmp word [0x10043c08], 0
jne 0x1002235c
lea edx, [esp + 0xa0]
push 2
push edx
call fcn.10021d40
add esp, 8
cmp ax, 1
jne 0x1002230e
lea eax, [esp + 0xa0]
push eax
call fcn.100224c0
add esp, 4
mov word [0x10043c08], ax
cmp word [0x10043c08], 0
jne 0x1002235c
lea ecx, [esp + 0xa0]
push 0
push ecx
call fcn.10021d40
add esp, 8
cmp ax, 1
jne 0x10022346
lea edx, [esp + 0xa0]
push edx
call fcn.100224c0
add esp, 4
mov word [0x10043c08], ax
cmp word [0x10043c08], 0
jne 0x1002235c
xor ax, ax
pop edi
pop esi
add esp, 0x19c
ret
call fcn.10021be0
mov word [0x10043c18], ax
mov eax, dword [esp + 0x1ac]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x10022399
cmp word [eax], 0x5a4d
jne 0x10022399
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10022399
mov ax, word [ecx + 0x16]
shr eax, 0xd
and eax, 1
jmp 0x1002239d
mov ax, 1
mov esi, dword [esp + 0x1a8]
mov word [0x10044a10], ax
test ax, ax
mov dword [0x10044a08], esi
mov dword [0x10044a0c], 0x1003e12c
je 0x100223de
push 0x10044a08
call fcn.10022040
add esp, 4
test ax, ax
jne 0x100224a4
pop edi
pop esi
add esp, 0x19c
ret
or eax, 0xffffffff
mov ecx, 0x20
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
xor eax, eax
lea edi, [esp + 0x20]
mov dword [esp + 0xc], 0x94
rep stosd dword es:[edi], eax
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x10022474
cmp dword [esp + 0x1c], 2
jne 0x10022474
cmp dword [esp + 0x10], 5
jb 0x10022474
push 0x10043c0c
push 0x100227b0
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [0x10043c0c]
test eax, eax
jne 0x10022474
push 0
push esi
push 0
push 0
push 1
push 1
push 0xffffffffffffff9c
push 0xffffffffffffff9c
push 0x80000000
push 0
push str.BUTTON
push 0x80
call dword [sym.imp.USER32.dll_CreateWindowExA]
test eax, eax
mov dword [0x10043c0c], eax
je 0x10022474
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
lea edx, [esp + 8]
push edx
push 0
push 0x10044a08
push 0x100221e0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
mov dword [0x10043c10], eax
jne 0x100224a4
xor ax, ax
pop edi
pop esi
add esp, 0x19c
ret
pop edi
mov ax, 1
pop esi
add esp, 0x19c
ret
Function at 0x100224c0
Capabilities:
Check if file exists
Get disk information
Get file attributes

Disassembly:
sub esp, 0x1a4
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0xb0]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0xb0]
push 3
lea edx, [esp + 0x18]
push ecx
push edx
call fcn.10026830
mov ebx, dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
add esp, 0xc
lea eax, [esp + 0x14]
mov byte [esp + 0x17], 0
push eax
call ebx
cmp eax, 5
jne 0x1002254d
mov ecx, dword [esp + 0x1b8]
lea edx, [esp + 0x14]
push ecx
push edx
push 0x10037d9c
push 0x10043b00
call fcn.10024da0
add esp, 0x10
push 0x10043b00
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov ax, cx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1a4
ret
lea edx, [esp + 0xb0]
push 0x5c
push edx
call fcn.10025e20
mov edi, dword [esp + 0x1c0]
add esp, 8
mov byte [eax + 1], 0
lea eax, [esp + 0xb0]
push edi
push eax
push 0x10037d9c
push 0x10043b00
call fcn.10024da0
mov ebp, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
add esp, 0x10
push 0x10043b00
call ebp
cmp eax, 0xffffffff
je 0x100225a6
mov ax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1a4
ret
call fcn.1001b090
push eax
call fcn.1001af80
lea ecx, [esp + 0x18]
push eax
push ecx
call fcn.1001ee70
add esp, 0xc
cmp ax, 1
jne 0x100225f8
lea edx, [esp + 0x14]
push edi
push edx
push 0x10037d9c
push 0x10043b00
call fcn.10024da0
add esp, 0x10
push 0x10043b00
call ebp
cmp eax, 0xffffffff
je 0x100225f8
mov ax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1a4
ret
lea eax, [esp + 0x18]
push eax
push 0x95
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
mov al, byte [esp + 0x18]
mov byte [esp + 0x10], 0
test al, al
je 0x1002269e
mov eax, dword [esp + 0x10]
and eax, 0xff
lea esi, [esp + eax + 0x18]
push esi
call ebx
cmp eax, 5
jne 0x1002264e
push edi
push esi
push 0x10037d9c
push 0x10043b00
call fcn.10024da0
add esp, 0x10
push 0x10043b00
call ebp
cmp eax, 0xffffffff
jne 0x1002268f
cmp byte [esi], 0
je 0x10022669
inc byte [esp + 0x10]
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov al, byte [esp + ecx + 0x18]
test al, al
jne 0x10022653
inc byte [esp + 0x10]
mov eax, dword [esp + 0x10]
mov edx, eax
and edx, 0xff
mov cl, byte [esp + edx + 0x18]
test cl, cl
jne 0x1002261d
xor ax, ax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1a4
ret
mov ax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1a4
ret
pop edi
pop esi
pop ebp
xor ax, ax
pop ebx
add esp, 0x1a4
ret

Function at 0x100241a1
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 8]
push esi
mov esi, dword [esp + 8]
push edi
mov dl, byte [ecx]
xor eax, eax
xor edi, edi
mov byte [esi], dl
cmp byte [ecx], al
je 0x100241cf
mov edx, esi
push ebx
sub edx, ecx
mov bl, byte [ecx + 1]
inc edi
inc ecx
dec bl
xor bl, byte [edx + ecx - 1]
mov byte [edx + ecx], bl
cmp byte [ecx], al
jne 0x100241bc
pop ebx
mov byte [edi + esi], al
mov eax, esi
pop edi
pop esi
ret
Function at 0x10024bf0
Capabilities:
Terminate process

Disassembly:
push ebx
push ebp
push esi
call fcn.10024cb0
mov eax, dword [0x10044138]
mov ebp, dword [esp + 0x10]
cmp eax, 1
jne 0x10024c14
push ebp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
test eax, eax
mov dword [0x10044134], 1
mov byte [0x10044130], bl
jne 0x10024c6e
mov ecx, dword [0x10049aa0]
test ecx, ecx
je 0x10024c5c
mov esi, dword [0x10049a9c]
sub esi, 4
cmp esi, ecx
jb 0x10024c5c
mov eax, dword [esi]
test eax, eax
je 0x10024c55
call eax
mov ecx, dword [0x10049aa0]
sub esi, 4
cmp esi, ecx
jae 0x10024c47
push 0x1003701c
push 0x10037014
call fcn.10024cd0
add esp, 8
push 0x10037024
push 0x10037020
call fcn.10024cd0
add esp, 8
test ebx, ebx
je 0x10024c8d
call fcn.10024cc0
pop esi
pop ebp
pop ebx
ret
push ebp
mov dword [0x10044138], 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x100268e0
Capabilities:
Accept command line arguments

Disassembly:
mov eax, dword [esp + 8]
cmp eax, 1
jne 0x100269a4
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [0x100440fc], eax
call fcn.100273d0
test eax, eax
jne 0x10026904
ret 0xc
mov ecx, dword [0x100440fc]
xor edx, edx
mov eax, ecx
mov dl, ch
and eax, 0xff
mov dword [0x10044108], edx
mov dword [0x10044104], eax
shl eax, 8
add eax, edx
shr ecx, 0x10
mov dword [0x10044100], eax
mov dword [0x100440fc], ecx
call fcn.1002a470
test eax, eax
jne 0x10026946
call fcn.10027410
xor eax, eax
ret 0xc
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x10049a94], eax
call fcn.1002bdd0
mov ecx, dword [0x10049a94]
mov dword [0x10044160], eax
test ecx, ecx
je 0x10026995
test eax, eax
je 0x10026995
call fcn.1002b2d0
call fcn.10028420
call fcn.1002bb20
call fcn.1002ba30
call fcn.10024b70
mov eax, dword [0x1004415c]
inc eax
mov dword [0x1004415c], eax
mov eax, 1
ret 0xc
call fcn.1002a4d0
call fcn.10027410
xor eax, eax
ret 0xc
test eax, eax
jne 0x100269e4
mov eax, dword [0x1004415c]
test eax, eax
jle 0x100269df
mov ecx, eax
mov eax, dword [0x10044134]
dec ecx
test eax, eax
mov dword [0x1004415c], ecx
jne 0x100269c8
call fcn.10024be0
call fcn.1002b4e0
call fcn.1002a4d0
call fcn.10027410
mov eax, 1
ret 0xc
xor eax, eax
ret 0xc
cmp eax, 3
jne 0x100269f3
push 0
call fcn.1002a5a0
add esp, 4
mov eax, 1
ret 0xc
Function at 0x10029860
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x41c
push ebx
mov ebx, dword [esp + 0x42c]
push ebp
xor ebp, ebp
push esi
cmp ebx, ebp
push edi
mov dword [esp + 0x10], ebp
mov dword [esp + 0x20], ebp
jne 0x1002988c
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x41c
ret
mov ecx, dword [esp + 0x430]
mov eax, ecx
sar eax, 5
lea edi, [eax*4 + 0x10048960]
mov eax, ecx
and eax, 0x1f
mov dword [esp + 0x24], edi
mov edx, dword [edi]
lea esi, [eax + eax*8]
shl esi, 2
mov dword [esp + 0x14], esi
test byte [esi + edx + 4], 0x20
je 0x100298c7
push 2
push ebp
push ecx
call fcn.1002a240
add esp, 0xc
mov eax, dword [edi]
add eax, esi
test byte [eax + 4], 0x80
je 0x10029a29
mov ebp, dword [esp + 0x434]
mov dword [esp + 0x18], 0
test ebx, ebx
mov edi, ebp
jbe 0x10029971
lea eax, [esp + 0x28]
mov ecx, edi
sub ecx, ebp
cmp ecx, ebx
jae 0x10029922
mov cl, byte [edi]
inc edi
cmp cl, 0xa
jne 0x1002990f
mov esi, dword [esp + 0x20]
mov byte [eax], 0xd
inc esi
inc eax
mov dword [esp + 0x20], esi
mov byte [eax], cl
inc eax
mov edx, eax
lea ecx, [esp + 0x28]
sub edx, ecx
cmp edx, 0x400
jl 0x100298f2
mov esi, eax
lea edx, [esp + 0x28]
lea eax, [esp + 0x1c]
sub esi, edx
mov edx, dword [esp + 0x24]
push 0
push eax
lea ecx, [esp + 0x30]
mov eax, dword [edx]
push esi
push ecx
mov ecx, dword [esp + 0x24]
mov edx, dword [ecx + eax]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x10029a1a
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x10]
add edx, eax
cmp eax, esi
mov dword [esp + 0x10], edx
jl 0x1002996d
mov eax, edi
sub eax, ebp
cmp eax, ebx
jb 0x100298ee
mov esi, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x10029a09
mov eax, dword [esp + 0x18]
test eax, eax
je 0x100299c5
cmp eax, 5
jne 0x100299ae
call fcn.1002a1a0
mov dword [eax], 9
call fcn.1002a1b0
mov dword [eax], 5
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x41c
ret
push eax
call fcn.1002a120
add esp, 4
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x41c
ret
mov ecx, dword [esp + 0x24]
mov edx, dword [ecx]
test byte [esi + edx + 4], 0x40
je 0x100299e5
cmp byte [ebp], 0x1a
jne 0x100299e5
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x41c
ret
call fcn.1002a1a0
mov dword [eax], 0x1c
call fcn.1002a1b0
mov dword [eax], 0
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x41c
ret
mov ecx, dword [esp + 0x20]
pop edi
pop esi
pop ebp
sub eax, ecx
pop ebx
add esp, 0x41c
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x18], eax
jmp 0x1002996d
mov edx, dword [eax]
lea ecx, [esp + 0x1c]
push ebp
mov ebp, dword [esp + 0x438]
push ecx
push ebx
push ebp
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x10029a5a
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x18], 0
mov dword [esp + 0x10], eax
jmp 0x10029971
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x18], eax
jmp 0x10029971
Function at 0x1002a470
Capabilities:
Allocate thread local storage
Set thread local storage value

Disassembly:
push esi
call fcn.10027450
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [0x100423b8], eax
je 0x1002a4c8
push 0x74
push 1
call fcn.1002c2d0
mov esi, eax
add esp, 8
test esi, esi
je 0x1002a4c8
mov eax, dword [0x100423b8]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x1002a4c8
push esi
call fcn.1002a500
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [esi], eax
mov dword [esi + 4], 0xffffffff
mov eax, 1
pop esi
ret
xor eax, eax
pop esi
ret

Function at 0x1002a520
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [0x100423b8]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x1002a58e
push 0x74
push 1
call fcn.1002c2d0
mov esi, eax
add esp, 8
test esi, esi
je 0x1002a584
mov ecx, dword [0x100423b8]
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x1002a584
push esi
call fcn.1002a500
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push edi
mov dword [esi], eax
mov dword [esi + 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
pop edi
pop esi
ret
push 0x10
call fcn.10026ab0
add esp, 4
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
pop edi
pop esi
ret

Function at 0x1002a5a0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov eax, dword [0x100423b8]
cmp eax, 0xffffffff
je 0x1002a64f
push esi
mov esi, dword [esp + 8]
test esi, esi
jne 0x1002a5c4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
je 0x1002a640
mov eax, dword [esi + 0x24]
test eax, eax
je 0x1002a5d4
push eax
call fcn.100243a0
add esp, 4
mov eax, dword [esi + 0x28]
test eax, eax
je 0x1002a5e4
push eax
call fcn.100243a0
add esp, 4
mov eax, dword [esi + 0x30]
test eax, eax
je 0x1002a5f4
push eax
call fcn.100243a0
add esp, 4
mov eax, dword [esi + 0x38]
test eax, eax
je 0x1002a604
push eax
call fcn.100243a0
add esp, 4
mov eax, dword [esi + 0x40]
test eax, eax
je 0x1002a614
push eax
call fcn.100243a0
add esp, 4
mov eax, dword [esi + 0x44]
test eax, eax
je 0x1002a624
push eax
call fcn.100243a0
add esp, 4
mov eax, dword [esi + 0x50]
cmp eax, 0x10042ca0
je 0x1002a637
push eax
call fcn.100243a0
add esp, 4
push esi
call fcn.100243a0
add esp, 4
mov eax, dword [0x100423b8]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop esi
ret
Function at 0x1002b540
Capabilities:
Clear file content

Disassembly:
mov eax, 0x1004
call fcn.10025eb0
push ebx
mov ebx, dword [esp + 0x100c]
push ebp
push esi
push edi
xor ebp, ebp
push 1
push ebp
push ebx
call fcn.1002a240
mov edi, eax
add esp, 0xc
cmp edi, 0xffffffff
mov dword [esp + 0x10], edi
je 0x1002b680
push 2
push ebp
push ebx
call fcn.1002a240
add esp, 0xc
cmp eax, 0xffffffff
je 0x1002b680
mov ecx, dword [esp + 0x101c]
mov esi, ecx
sub esi, eax
test esi, esi
jle 0x1002b621
mov ecx, 0x400
xor eax, eax
lea edi, [esp + 0x14]
push 0x8000
rep stosd dword es:[edi], eax
push ebx
call fcn.1002d850
add esp, 8
mov edi, eax
cmp esi, 0x1000
mov eax, 0x1000
jge 0x1002b5c6
mov eax, esi
push eax
lea eax, [esp + 0x18]
push eax
push ebx
call fcn.10029860
add esp, 0xc
cmp eax, 0xffffffff
je 0x1002b5e2
sub esi, eax
test esi, esi
jle 0x1002b5fa
jmp 0x1002b5b7
call fcn.1002a1b0
cmp dword [eax], 5
jne 0x1002b5f7
call fcn.1002a1a0
mov dword [eax], 0xd
or ebp, 0xffffffff
push edi
push ebx
call fcn.1002d850
mov edi, dword [esp + 0x18]
add esp, 8
push 0
push edi
push ebx
call fcn.1002a240
add esp, 0xc
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1004
ret
jge 0x1002b667
push 0
push ecx
push ebx
call fcn.1002a240
add esp, 0xc
push ebx
call fcn.1002b1e0
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov ebp, eax
neg ebp
sbb ebp, ebp
neg ebp
dec ebp
cmp ebp, 0xffffffff
jne 0x1002b667
call fcn.1002a1a0
mov dword [eax], 0xd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call fcn.1002a1b0
mov dword [eax], esi
push 0
push edi
push ebx
call fcn.1002a240
add esp, 0xc
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1004
ret
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x1004
ret