joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10003490
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x1001e008]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
mov ebx, ecx
push esi
push edi
mov dword [ebp - 0x1c], ebx
mov edx, dword [ebx + 0x2c]
mov eax, dword [edx]
cmp eax, edx
je 0x100034c1
cmp dword [eax + 0x30], 0
jne 0x10003599
mov eax, dword [eax]
cmp eax, edx
jne 0x100034b1
cmp dword [ebx + 0x60], 0
jne 0x10003599
cmp dword [ebx + 0xc], 3
jne 0x1000359d
cmp byte [ebx + 0x24], 0
jne 0x10003571
mov eax, dword [ebx + 4]
mov dword [ebp - 0xc], eax
mov esi, dword [eax]
cmp esi, eax
mov dword [ebp - 0x18], esi
je 0x1000356d
mov ecx, dword [esi + 0x14]
mov eax, dword [esi + 0xc]
mov edx, dword [ebx + 0x1c]
mov dword [ebp - 0x10], eax
cmp ecx, 2
jne 0x10003503
add eax, edx
jmp 0x10003509
test ecx, ecx
je 0x1000350c
sub eax, edx
mov dword [ebp - 0x10], eax
mov edi, dword [esi + 0x10]
cmp edi, 4
je 0x10003529
cmp edi, 1
je 0x10003529
mov eax, edi
cmp edi, 2
je 0x10003529
cmp eax, 8
jne 0x100035b0
mov eax, dword [esi + 8]
xor ebx, ebx
add eax, edx
mov dword [ebp - 0x20], eax
test edi, edi
je 0x10003560
mov esi, dword [ebp - 0x10]
xor ecx, ecx
mov dword [ebp - 0x14], ecx
nop
mov eax, esi
xor edx, edx
call fcn.10014870
mov ecx, dword [ebp - 0x20]
mov byte [ebx + ecx], al
inc ebx
mov ecx, dword [ebp - 0x14]
add ecx, 8
mov dword [ebp - 0x14], ecx
cmp ebx, edi
jb 0x10003540
mov esi, dword [ebp - 0x18]
mov esi, dword [esi]
mov ebx, dword [ebp - 0x1c]
cmp esi, dword [ebp - 0xc]
jmp 0x100034e9
mov byte [ebx + 0x24], 1
mov ecx, dword [ebx + 0x14]
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
test al, al
je 0x1000359d
lea eax, [ebp - 0xc]
push eax
push 0x40
push dword [ebx + 0x18]
push dword [ebx + 0x1c]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1000359d
push 0xe
jmp 0x100035b2
push 0xb
jmp 0x100035b2
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100089d8
mov esp, ebp
pop ebp
ret 4
push 0xd
lea ecx, [ebp - 0x30]
call fcn.10001370
push 0x1001d248
mov eax, ecx
push eax
call fcn.10009e68
int3
Function at 0x100041b0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 0x18
mov edx, dword [ebp + 8]
push ebx
mov ebx, ecx
cmp edx, eax
je 0x10004304
mov eax, dword [ebx + 4]
mov dword [ebp - 0x14], eax
mov eax, dword [edx + 4]
mov dword [ebp - 8], eax
movzx eax, byte [edx + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 9]
push esi
push edi
mov edi, dword [ebx + 0xc]
mov esi, edx
xor ecx, eax
mov dword [ebp - 0x18], edi
movzx eax, byte [edx + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [ebx + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [edi + eax*8]
mov dword [ebp - 4], ecx
lea eax, [edi + eax*8]
mov dword [ebp - 0xc], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov eax, esi
mov edi, esi
mov esi, dword [esi]
push 0xc
push eax
call fcn.10008d30
dec dword [ebx + 8]
add esp, 8
cmp edi, dword [ebp - 0x10]
je 0x10004269
mov eax, dword [ebp + 0xc]
cmp esi, eax
jne 0x10004227
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jne 0x100042fa
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
pop edi
mov dword [edx], esi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
cmp ecx, dword [ebp + 8]
jne 0x1000427d
mov eax, dword [ebp - 0x14]
mov ecx, eax
mov dword [edx], eax
jmp 0x10004280
mov ecx, dword [ebp - 8]
mov eax, dword [ebp + 0xc]
mov dword [edx + 4], ecx
cmp esi, eax
je 0x100042fa
nop word [eax + eax]
movzx eax, byte [esi + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 9]
xor ecx, eax
movzx eax, byte [esi + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [ebp - 0x18]
and eax, dword [ebx + 0x18]
lea eax, [ecx + eax*8]
mov dword [ebp - 4], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov eax, esi
mov edi, esi
mov esi, dword [esi]
push 0xc
push eax
call fcn.10008d30
dec dword [ebx + 8]
add esp, 8
mov eax, dword [ebp + 0xc]
cmp edi, dword [ebp - 0x10]
je 0x1000430b
cmp esi, eax
jne 0x100042d5
mov ecx, dword [ebp - 4]
mov dword [ecx], esi
mov ecx, dword [ebp - 8]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x14]
mov dword [ecx], edx
mov dword [ecx + 4], edx
cmp esi, eax
jne 0x10004290
mov ecx, dword [ebp - 8]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10004330
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 0x18
mov edx, dword [ebp + 8]
push ebx
mov ebx, ecx
cmp edx, eax
je 0x10004484
mov eax, dword [ebx + 4]
mov dword [ebp - 0x14], eax
mov eax, dword [edx + 4]
mov dword [ebp - 8], eax
movzx eax, byte [edx + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 9]
push esi
push edi
mov edi, dword [ebx + 0xc]
mov esi, edx
xor ecx, eax
mov dword [ebp - 0x18], edi
movzx eax, byte [edx + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [ebx + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [edi + eax*8]
mov dword [ebp - 4], ecx
lea eax, [edi + eax*8]
mov dword [ebp - 0xc], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov eax, esi
mov edi, esi
mov esi, dword [esi]
push 0x1c
push eax
call fcn.10008d30
dec dword [ebx + 8]
add esp, 8
cmp edi, dword [ebp - 0x10]
je 0x100043e9
mov eax, dword [ebp + 0xc]
cmp esi, eax
jne 0x100043a7
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jne 0x1000447a
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
pop edi
mov dword [edx], esi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
cmp ecx, dword [ebp + 8]
jne 0x100043fd
mov eax, dword [ebp - 0x14]
mov ecx, eax
mov dword [edx], eax
jmp 0x10004400
mov ecx, dword [ebp - 8]
mov eax, dword [ebp + 0xc]
mov dword [edx + 4], ecx
cmp esi, eax
je 0x1000447a
nop word [eax + eax]
movzx eax, byte [esi + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 9]
xor ecx, eax
movzx eax, byte [esi + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [ebp - 0x18]
and eax, dword [ebx + 0x18]
lea eax, [ecx + eax*8]
mov dword [ebp - 4], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov eax, esi
mov edi, esi
mov esi, dword [esi]
push 0x1c
push eax
call fcn.10008d30
dec dword [ebx + 8]
add esp, 8
mov eax, dword [ebp + 0xc]
cmp edi, dword [ebp - 0x10]
je 0x1000448b
cmp esi, eax
jne 0x10004455
mov ecx, dword [ebp - 4]
mov dword [ecx], esi
mov ecx, dword [ebp - 8]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x14]
mov dword [ecx], edx
mov dword [ecx + 4], edx
cmp esi, eax
jne 0x10004410
mov ecx, dword [ebp - 8]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x100044b0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 0x18
mov edx, dword [ebp + 8]
push ebx
mov ebx, ecx
cmp edx, eax
je 0x10004604
mov eax, dword [ebx + 4]
mov dword [ebp - 0x14], eax
mov eax, dword [edx + 4]
mov dword [ebp - 8], eax
movzx eax, byte [edx + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 9]
push esi
push edi
mov edi, dword [ebx + 0xc]
mov esi, edx
xor ecx, eax
mov dword [ebp - 0x18], edi
movzx eax, byte [edx + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [ebx + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [edi + eax*8]
mov dword [ebp - 4], ecx
lea eax, [edi + eax*8]
mov dword [ebp - 0xc], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov eax, esi
mov edi, esi
mov esi, dword [esi]
push 0x14
push eax
call fcn.10008d30
dec dword [ebx + 8]
add esp, 8
cmp edi, dword [ebp - 0x10]
je 0x10004569
mov eax, dword [ebp + 0xc]
cmp esi, eax
jne 0x10004527
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jne 0x100045fa
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
pop edi
mov dword [edx], esi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
cmp ecx, dword [ebp + 8]
jne 0x1000457d
mov eax, dword [ebp - 0x14]
mov ecx, eax
mov dword [edx], eax
jmp 0x10004580
mov ecx, dword [ebp - 8]
mov eax, dword [ebp + 0xc]
mov dword [edx + 4], ecx
cmp esi, eax
je 0x100045fa
nop word [eax + eax]
movzx eax, byte [esi + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 9]
xor ecx, eax
movzx eax, byte [esi + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [ebp - 0x18]
and eax, dword [ebx + 0x18]
lea eax, [ecx + eax*8]
mov dword [ebp - 4], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov eax, esi
mov edi, esi
mov esi, dword [esi]
push 0x14
push eax
call fcn.10008d30
dec dword [ebx + 8]
add esp, 8
mov eax, dword [ebp + 0xc]
cmp edi, dword [ebp - 0x10]
je 0x1000460b
cmp esi, eax
jne 0x100045d5
mov ecx, dword [ebp - 4]
mov dword [ecx], esi
mov ecx, dword [ebp - 8]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x14]
mov dword [ecx], edx
mov dword [ecx + 4], edx
cmp esi, eax
jne 0x10004590
mov ecx, dword [ebp - 8]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10004d10
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, ecx
mov eax, 0x1fffffff
bsr ecx, eax
push esi
push edi
mov edi, 1
mov dword [ebp - 0x10], ebx
mov eax, edi
shl eax, cl
mov ecx, dword [ebp + 8]
cmp ecx, eax
ja 0x10004e6b
lea eax, [ecx - 1]
mov esi, dword [ebx + 4]
or eax, edi
mov dword [ebp - 8], esi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
lea ecx, [ebx + 0xc]
lea eax, [edi + edi]
push eax
call fcn.10004630
lea eax, [edi - 1]
mov dword [ebx + 0x1c], edi
mov dword [ebx + 0x18], eax
mov eax, dword [ebx + 4]
mov eax, dword [eax]
mov ecx, eax
cmp eax, esi
je 0x10004e3e
movzx edx, byte [eax + 8]
xor edx, 0x811c9dc5
mov ecx, dword [ecx]
imul edi, edx, 0x1000193
movzx edx, byte [eax + 9]
xor edi, edx
movzx edx, byte [eax + 0xa]
imul edi, edi, 0x1000193
xor edi, edx
movzx edx, byte [eax + 0xb]
imul edi, edi, 0x1000193
xor edi, edx
imul edx, edi, 0x1000193
mov edi, dword [ebx + 0x18]
and edi, edx
mov edx, dword [ebx + 0xc]
mov ebx, dword [edx + edi*8]
lea edx, [edx + edi*8]
mov dword [ebp - 0xc], edx
cmp ebx, esi
jne 0x10004dc4
mov dword [edx], eax
mov dword [edx + 4], eax
jmp 0x10004e31
mov edx, dword [edx + 4]
mov edi, dword [eax + 8]
cmp edi, dword [edx + 8]
jne 0x10004dfe
mov edx, dword [edx]
mov dword [ebp - 4], edx
cmp edx, eax
je 0x10004df6
mov ebx, dword [eax + 4]
mov esi, dword [ebp - 4]
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp - 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
mov edx, dword [ebp - 0xc]
mov dword [edx + 4], eax
jmp 0x10004e31
cmp ebx, edx
je 0x10004e0e
mov edx, dword [edx + 4]
cmp edi, dword [edx + 8]
je 0x10004e47
cmp ebx, edx
jne 0x10004e02
mov ebx, dword [eax + 4]
mov dword [ebp - 4], ebx
mov dword [ebx], ecx
mov ebx, dword [ecx + 4]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov dword [edx + 4], ebx
mov edx, dword [ebp - 4]
mov dword [ecx + 4], edx
mov edx, dword [ebp - 0xc]
mov dword [eax + 4], edi
mov dword [edx], eax
mov ebx, dword [ebp - 0x10]
mov eax, ecx
cmp ecx, esi
jne 0x10004d72
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ebx, dword [eax + 4]
mov edx, dword [edx]
mov dword [ebp - 4], edx
mov esi, edx
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp - 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
jmp 0x10004e31
push str.invalid_hash_bucket_count
call fcn.100089b2
int3
Function at 0x10004e80
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1001e008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 8]
mov esi, ecx
mov ecx, dword [ebp + 8]
push eax
push 0x40
push 5
push ecx
mov dword [esi], ecx
mov dword [esi + 4], 5
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp - 8]
cmp ecx, 2
jne 0x10004ed0
mov dword [esi + 8], 0
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100089d8
mov esp, ebp
pop ebp
ret 8
cmp ecx, 4
jne 0x10004eef
mov dword [esi + 8], 1
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100089d8
mov esp, ebp
pop ebp
ret 8
cmp ecx, 0x20
mov edx, 2
mov ecx, dword [ebp - 4]
mov eax, 3
cmove eax, edx
xor ecx, ebp
mov dword [esi + 8], eax
mov eax, esi
pop esi
call fcn.100089d8
mov esp, ebp
pop ebp
ret 8
Function at 0x10005b10
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10014e79
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x1001e008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov ebx, dword [ebp + 8]
push 0x24
mov dword [ebp - 0x14], edi
mov eax, dword [ebx]
mov dword [edi], eax
mov dword [edi + 4], 0
mov dword [edi + 8], 0
call fcn.100089e6
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [edi + 4], eax
mov dword [ebp - 4], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
push eax
push ecx
lea ecx, [edi + 0xc]
mov byte [ebp - 4], 1
call fcn.10004780
mov ecx, dword [edi + 4]
mov eax, dword [ebx + 4]
mov dword [edi + 4], eax
mov eax, dword [ebx + 8]
mov dword [ebx + 4], ecx
mov ecx, dword [edi + 8]
mov dword [edi + 8], eax
mov eax, dword [ebx + 0xc]
mov dword [ebx + 8], ecx
mov ecx, dword [edi + 0xc]
mov dword [edi + 0xc], eax
mov eax, dword [ebx + 0x10]
mov dword [ebx + 0xc], ecx
mov ecx, dword [edi + 0x10]
mov dword [edi + 0x10], eax
mov eax, dword [ebx + 0x14]
mov dword [ebx + 0x10], ecx
mov ecx, dword [edi + 0x14]
mov dword [edi + 0x14], eax
mov eax, dword [ebx + 0x18]
mov dword [ebx + 0x14], ecx
mov dword [ebx + 0x18], 7
mov dword [edi + 0x18], eax
mov eax, dword [ebx + 0x1c]
mov dword [ebx + 0x1c], 8
mov dword [edi + 0x1c], eax
add edi, 0x20
mov dword [ebp - 4], 2
mov eax, dword [ebx + 0x20]
push 0x30
mov dword [ebp + 8], edi
mov dword [edi], eax
mov dword [edi + 4], 0
mov dword [edi + 8], 0
call fcn.100089e6
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [edi + 4], eax
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
push eax
push ecx
lea ecx, [edi + 0xc]
mov byte [ebp - 4], 4
call fcn.10004780
mov ecx, dword [edi + 4]
mov eax, dword [ebx + 0x24]
mov dword [edi + 4], eax
mov eax, dword [ebx + 0x28]
mov dword [ebx + 0x24], ecx
mov ecx, dword [edi + 8]
mov dword [edi + 8], eax
mov dword [ebx + 0x28], ecx
mov ecx, dword [edi + 0xc]
mov eax, dword [ebx + 0x2c]
mov dword [edi + 0xc], eax
mov eax, dword [ebx + 0x30]
mov dword [ebx + 0x2c], ecx
mov ecx, dword [edi + 0x10]
mov dword [edi + 0x10], eax
mov eax, dword [ebx + 0x34]
mov dword [ebx + 0x30], ecx
mov ecx, dword [edi + 0x14]
mov dword [edi + 0x14], eax
mov eax, dword [ebx + 0x38]
mov dword [ebx + 0x34], ecx
mov dword [ebx + 0x38], 7
mov dword [edi + 0x18], eax
mov eax, dword [ebx + 0x3c]
mov dword [ebx + 0x3c], 8
mov dword [edi + 0x1c], eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1000dc8c
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10017a50
push 0x10017a48
push str.FlsAlloc
push 0x1e
call fcn.1000dbaa
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1000dcc0
push dword [ebp + 8]
mov ecx, esi
call dword [0x10016128]
call esi
jmp 0x1000dcc6
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1000dd0a
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10017a60
push 0x10017a58
push str.FlsGetValue
push 0x20
call fcn.1000dbaa
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1000dd41
push dword [ebp + 8]
mov ecx, esi
call dword [0x10016128]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x1000fc81
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1000fd1e
push ebx
push esi
call fcn.1000fc4a
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1000fb93
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x1000fccb
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1000fd1d
push edi
push eax
call fcn.1000e4a8
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x1000fceb
call fcn.1000da57
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1000fd1c
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1000fb93
add esp, 0x20
test eax, eax
jne 0x1000fd0a
push edi
call fcn.1000da57
jmp 0x1000fd12
push ebx
call fcn.1000da57
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x100147c0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x100147ed
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x100147ed
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x433270
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x49fc4b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.004924c7
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x4332f2
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.0048fc9d
mov eax, dword [eax]
push 0x4c11f4
push eax
call fcn.00482964
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.00492752
test bl, bl
je 0x4332f2
push 0x4c11f4
lea ecx, [esp + 0xc]
call fcn.00492b2e
push 0x4c4d64
lea ecx, [esp + 0xc]
call fcn.00492b2e
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x43332e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.00492752
jmp 0x4333f9
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x4333b2
lea edx, [esp + 0x7c]
push 0x4c4d60
push edx
call fcn.00482964
add esp, 8
test eax, eax
je 0x4333b2
lea eax, [esp + 0x7c]
push 0x4c4d5c
push eax
call fcn.00482964
add esp, 8
test eax, eax
je 0x4333b2
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x433342
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.00492752
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x433c10
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x433c72
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x433c80
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x49fccb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x4cbd10]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x433db8
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x433ce6
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.00492752
xor eax, eax
jmp 0x433e2f
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.004928db
push esi
lea ecx, [esp + 0xc]
call fcn.00492b6a
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x433e0d
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push SysReAllocStringLen
call fcn.00433c10
test eax, eax
jne 0x433e0d
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push SysReAllocStringLen
mov ecx, edi
call fcn.00433c10
test eax, eax
jne 0x433e0d
lea eax, [esp + 0x14]
push 0x4c4d78
push eax
call fcn.00483b10
mov esi, eax
add esp, 8
test esi, esi
jne 0x433dec
lea ecx, [esp + 0x14]
push 0x4c4d74
push ecx
call fcn.00483a90
mov esi, eax
add esp, 8
test esi, esi
jne 0x433dec
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x433def
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.0049288b
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x433cfe
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.00492752
xor eax, eax
jmp 0x433e2f
mov byte [esi], 0
push 0x4c4d70
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.00492752
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4