joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41c63d
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x434aa8]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x41c680
cmp word [esi], dx
jne 0x41c680
or byte [edi + eax + 0x28], 4
jmp 0x41c685
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x41c7d8
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x41c7b8
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x41c6c7
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x41c6fd
cmp eax, edx
jae 0x41c709
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x41c69f
jmp 0x41c7d8
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41c7b4
cmp dword [ebp - 0x14], 0
je 0x41c7b4
mov eax, dword [ebx*4 + 0x434aa8]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x41c78c
mov dx, word [ebp - 4]
lea eax, [esi + 2]
pop ecx
mov dword [ebp - 0x18], eax
cmp dx, cx
jne 0x41c755
mov word [esi], cx
jmp 0x41c788
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x434aa8]
movzx ecx, dx
shr ecx, 8
push 0xa
mov byte [edi + eax + 0x2a], dl
mov eax, dword [ebx*4 + 0x434aa8]
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x434aa8]
pop ecx
mov byte [edi + eax + 0x2c], cl
mov eax, dword [ebp - 0x18]
mov esi, eax
jmp 0x41c7d8
pop ebx
cmp word [ebp - 4], bx
jne 0x41c79d
cmp esi, dword [ebp + 0xc]
jne 0x41c79d
mov word [esi], bx
jmp 0x41c7d5
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.0041cf3f
add esp, 0x10
cmp word [ebp - 4], bx
je 0x41c7d8
push 0xd
jmp 0x41c7d1
mov ecx, dword [ebx*4 + 0x434aa8]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x41c7cf
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x41c7d8
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x41e2f0
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x42c288
push 0x42c280
push str.FlsAlloc
push 0x1e
call fcn.0041e18e
mov esi, eax
add esp, 0x10
test esi, esi
je 0x41e324
push dword [ebp + 8]
mov ecx, esi
call dword [0x4281dc]
call esi
jmp 0x41e32a
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x41e36e
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x42c298
push 0x42c290
push str.FlsGetValue
push 0x20
call fcn.0041e18e
mov esi, eax
add esp, 0x10
test esi, esi
je 0x41e3a5
push dword [ebp + 8]
mov ecx, esi
call dword [0x4281dc]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x41f6a4
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x41f741
push ebx
push esi
call fcn.0041f66d
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0041df8a
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x41f6ee
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x41f740
push edi
push eax
call fcn.0041a55d
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x41f70e
call fcn.0041a523
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x41f73f
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0041df8a
add esp, 0x20
test eax, eax
jne 0x41f72d
push edi
call fcn.0041a523
jmp 0x41f735
push ebx
call fcn.0041a523
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x424545
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.004244c1
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x4246bd
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x4246bd
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x42466c
jg 0x42459e
test eax, eax
je 0x424662
push 1
push 0x1000
call fcn.0041e6a7
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x4245c4
mov eax, dword [ebp + 0x14]
push 0xc
pop edi
mov byte [eax + 0x1c], 1
mov dword [eax + 0x18], edi
jmp 0x424659
push 0x8000
push ebx
call fcn.00417c28
mov edi, dword [ebp + 0x14]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x4245f0
jg 0x4245eb
cmp ecx, 0x1000
jb 0x4245f0
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.0041d88a
add esp, 0x10
cmp eax, 0xffffffff
je 0x424635
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x4245eb
jl 0x42461c
test ecx, ecx
jne 0x4245dd
push dword [ebp - 0xc]
push ebx
call fcn.00417c28
push esi
call fcn.0041a523
add esp, 0xc
xor edi, edi
jmp 0x4246ce
cmp byte [edi + 0x24], 0
je 0x42464c
cmp dword [edi + 0x20], 5
jne 0x42464c
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x424657
mov edi, dword [edi + 0x18]
jmp 0x424659
xor edi, edi
push esi
call fcn.0041a523
pop ecx
jmp 0x4246ce
test ecx, ecx
jg 0x42462e
jl 0x42466c
test eax, eax
jae 0x42462e
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.0041cf3f
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x42468f
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x42462e
jmp 0x4246c6
push ebx
call fcn.0041fb0e
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x42462e
mov esi, dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [esi + 0x24], 1
mov dword [esi + 0x20], eax
pop edi
mov byte [esi + 0x1c], 1
mov dword [esi + 0x18], edi
jmp 0x4246ce
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x4246cb
mov edi, dword [edi + 0x18]
jmp 0x4246ce
push 0x16
pop edi
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.0041cf3f
add esp, 0x10
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x425a90
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x425abd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x425abd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x10001840
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
mov ebx, ecx
push esi
push edi
mov edi, edx
lea ecx, [ebx + 0x78]
add ecx, dword [ebx + 0x3c]
mov dword [ebp - 0x18], ecx
mov eax, dword [ecx]
test eax, eax
je 0x100018d8
cmp dword [ecx + 4], 0
je 0x100018d8
mov edx, dword [eax + ebx + 0x20]
lea esi, [eax + ebx]
mov eax, dword [esi + 0x1c]
add edx, ebx
add eax, ebx
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x14], eax
mov eax, dword [esi + 0x24]
add eax, ebx
mov dword [ebp - 8], edx
mov dword [ebp - 0x10], eax
cmp edi, 0xffff
ja 0x10001894
mov eax, dword [esi + 0x10]
cmp edi, eax
jb 0x100018d8
sub edi, eax
jmp 0x100018ed
mov eax, dword [ebp - 0xc]
xor esi, esi
mov ecx, dword [eax + 0x18]
mov dword [ebp - 4], ecx
test ecx, ecx
je 0x100018d8
mov eax, ecx
mov ecx, dword [edx + esi*4]
test ecx, ecx
je 0x100018d3
lea edx, [ecx + ebx]
mov eax, edi
mov cl, byte [edx]
cmp cl, byte [edi]
jne 0x100018cd
sub edx, edi
nop dword [eax]
test cl, cl
je 0x100018e3
mov cl, byte [edx + eax + 1]
inc eax
cmp cl, byte [eax]
je 0x100018c0
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
inc esi
cmp esi, eax
jb 0x100018a5
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp - 0x10]
movzx edi, word [eax + esi*2]
mov esi, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 0xc]
lea ecx, [eax + edi*4]
mov eax, dword [ecx]
add eax, ebx
test edx, edx
je 0x10001900
mov dword [edx], ecx
mov edx, dword [ebp + 8]
test edx, edx
je 0x100018da
cmp eax, esi
jb 0x100018da
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ecx + 4]
add ecx, esi
cmp eax, ecx
jae 0x100018da
pop edi
pop esi
mov dword [edx], eax
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10002130
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x648
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x100
push eax
lea eax, [ebp - 0x248]
push eax
push 0
push 0x41
call dword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
test eax, eax
je 0x1000229c
push 2
push 0x110
lea eax, [ebp - 0x148]
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeAcl]
lea eax, [ebp - 0x248]
push eax
push 0
push 0
push 2
lea eax, [ebp - 0x148]
push eax
call dword [sym.imp.ADVAPI32.dll_AddMandatoryAce]
test eax, eax
je 0x1000229c
push esi
mov eax, 0x5c
mov esi, 1
push 0x3fe
mov word [ebp - 0x648], ax
lea eax, [ebp - 0x646]
push 0
push eax
call fcn.100034a0
mov ecx, dword [ebp + 0xc]
add esp, 0xc
movzx eax, word [ecx]
test ax, ax
je 0x100021e7
mov edx, eax
nop dword [eax + eax]
movzx eax, word [ecx + 2]
lea ecx, [ecx + 2]
mov word [ebp + esi*2 - 0x648], dx
inc esi
mov edx, eax
test ax, ax
jne 0x100021d0
lea eax, [ebp - 0x648]
mov dword [ebp - 8], eax
lea eax, [esi + esi]
mov word [ebp - 0xc], ax
add eax, 2
mov word [ebp - 0xa], ax
lea eax, [ebp - 0x38]
push 1
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
push 0
push 0
push 1
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
push 0
lea eax, [ebp - 0x148]
push eax
push 1
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorSacl]
lea eax, [ebp - 0xc]
mov dword [ebp - 0x24], 0x18
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x38]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x24]
push eax
push 0xf000f
lea eax, [ebp + 0xc]
mov dword [ebp - 0x20], 0
push eax
mov dword [ebp - 0x18], 0xc0
mov dword [ebp - 0x10], 0
mov dword [ebp + 0xc], 0
call dword [sym.imp.ntdll.dll_NtCreateDirectoryObject]
mov esi, eax
test esi, esi
jne 0x10002293
mov edx, dword [ebp + 8]
test edx, edx
je 0x1000228a
mov ecx, dword [ebp + 0xc]
mov dword [edx], ecx
pop esi
mov esp, ebp
pop ebp
ret 8
push dword [ebp + 0xc]
call dword [sym.imp.ntdll.dll_NtClose]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 8
mov eax, 0xc0000001
mov esp, ebp
pop ebp
ret 8
Function at 0x10002cc0
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
push edi
mov dword [ebp - 4], 0
mov ebx, 0x20b
mov eax, 0x5a4d
test ecx, ecx
je 0x10002dca
cmp word [ecx], ax
jne 0x10002dca
mov eax, dword [ecx + 0x3c]
cmp dword [eax + ecx], 0x4550
jne 0x10002dca
cmp word [eax + ecx + 0x18], bx
lea eax, [ebp - 4]
push 0
push eax
jne 0x10002d12
call fcn.10001930
jmp 0x10002d17
call fcn.10001840
test eax, eax
je 0x10002dcc
mov esi, dword [ebp - 4]
test esi, esi
je 0x10002dcc
xor ebx, ebx
xor ecx, ecx
mov dword [ebp - 0xc], ebx
cmp byte [esi], cl
je 0x10002d4d
mov dl, byte [esi]
cmp dl, 0x2e
mov eax, ecx
mov dl, byte [ecx + esi + 1]
cmovne eax, ebx
inc ecx
mov ebx, eax
test dl, dl
jne 0x10002d37
mov dword [ebp - 0xc], eax
push ebx
lea eax, [ebp - 0x10c]
push esi
push eax
call fcn.10003440
mov eax, dword fs:[0x18]
add esp, 0xc
mov byte [ebp + ebx - 0x10c], 0
xor ebx, ebx
mov eax, dword [eax + 0x30]
mov ecx, dword [eax + 0xc]
add ecx, 0x14
mov dword [ebp - 8], ecx
mov esi, dword [ecx]
cmp esi, ecx
je 0x10002dca
mov eax, ecx
movzx ecx, word [esi + 0x24]
test cx, cx
je 0x10002dc3
mov edx, dword [esi + 0x28]
test edx, edx
je 0x10002dc3
test ebx, ebx
js 0x10002dc3
mov edi, ecx
xor eax, eax
shr edi, 1
je 0x10002db6
nop
movsx cx, byte [ebp + eax - 0x10c]
cmp word [edx], cx
jne 0x10002dc0
inc eax
add edx, 2
cmp eax, edi
jb 0x10002da0
cmp byte [ebp + eax - 0x10c], 0
je 0x10002dd3
mov eax, dword [ebp - 8]
mov esi, dword [esi]
inc ebx
cmp esi, eax
jne 0x10002d82
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [esi + 0x10]
test ecx, ecx
je 0x10002dca
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
inc eax
add edx, eax
jmp 0x10002ccc
Function at 0x10003500
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x10], edx
mov ecx, 0x5a4d
mov dword [ebp - 0xc], edi
cmp word [edx], cx
jne 0x100036fd
mov esi, dword [edx + 0x3c]
add esi, edx
cmp dword [esi], 0x4550
jne 0x100036fd
cmp word [edi], cx
jne 0x100036fd
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi], 0x4550
jne 0x100036fd
mov ecx, 0x20b
cmp word [eax + edi + 0x18], cx
mov eax, 0x20b
push ebx
movzx ebx, word [esi + 0x18]
sete cl
cmp bx, ax
sete al
cmp al, cl
je 0x10003577
pop ebx
pop edi
mov eax, 0xfffffffe
pop esi
mov esp, ebp
pop ebp
ret 0x10
mov eax, 0x20b
cmp bx, ax
jne 0x10003589
mov eax, dword [esi + 0x88]
jmp 0x1000358c
mov eax, dword [esi + 0x78]
test eax, eax
jne 0x10003594
xor edx, edx
jmp 0x10003598
add edx, dword [eax + edx + 0xc]
test edx, edx
jne 0x100035a8
pop ebx
pop edi
lea eax, [edx - 3]
pop esi
mov esp, ebp
pop ebp
ret 0x10
push 1
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
mov ecx, edi
xor esi, esi
call fcn.100044c0
test eax, eax
jne 0x100035d6
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
cmp byte [ebp + 0x14], 0
je 0x100035ec
cmp byte [eax], 0
je 0x100035ec
mov byte [eax], 0
lea eax, [eax + 1]
cmp byte [eax], 0
jne 0x100035e1
mov ebx, dword [ebp - 4]
mov eax, dword [ebx]
test eax, eax
je 0x100036c5
mov ecx, dword [ebp - 8]
mov edi, dword [ebp + 8]
sub ecx, ebx
sub dword [ebp + 0xc], edi
cmp dword [ebp + 0x10], 0x2a
mov dword [ebp - 8], ecx
mov dword [ebp + 8], esi
jb 0x100036ef
mov ecx, dword [ebp - 0xc]
mov edx, eax
call fcn.1000ef10
add eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
push 0
push 0
lea esi, [eax + 2]
mov dword [ebp + 0x10], eax
mov edx, esi
call fcn.10001840
mov edx, eax
test edx, edx
je 0x100036a9
mov ecx, dword [ebp - 8]
mov eax, dword [ebp + 0xc]
add eax, edi
mov dword [ecx + ebx], eax
mov dword [ebx], eax
cmp dword [edx + 7], 0x2504f600
jne 0x10003669
mov eax, dword [edx]
mov ecx, dword [edx + 4]
mov dword [edi], eax
mov dword [edi + 4], ecx
mov eax, dword [edx + 0x12]
mov ecx, dword [edx + 0x16]
mov dword [edi + 8], eax
mov dword [edi + 0xc], ecx
jmp 0x10003689
movups xmm0, xmmword [edx]
movups xmmword [edi], xmm0
movups xmm0, xmmword [edx + 0x10]
movups xmmword [edi + 0x10], xmm0
movq xmm0, qword [edx + 0x20]
movq qword [edi + 0x20], xmm0
mov ax, word [edx + 0x28]
mov word [edi + 0x28], ax
cmp byte [ebp + 0x14], 0
je 0x100036a9
cmp byte [esi], 0
je 0x100036a1
mov eax, esi
inc eax
mov byte [esi], 0
mov esi, eax
cmp byte [eax], 0
jne 0x10003696
mov eax, dword [ebp + 0x10]
xor ecx, ecx
mov word [eax], cx
mov esi, dword [ebp + 8]
add ebx, 4
add esi, 0x2a
add edi, 0x2a
mov dword [ebp + 8], esi
mov eax, dword [ebx]
test eax, eax
jne 0x10003614
mov edi, dword [ebp - 0xc]
cmp byte [ebp + 0x14], 0
je 0x100036e4
mov ecx, dword [edi + 0x3c]
mov dword [ecx + edi + 0x84], 0
mov dword [ecx + edi + 0x80], 0
pop ebx
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 0x10
pop ebx
pop edi
mov eax, 0xfffffffc
pop esi
mov esp, ebp
pop ebp
ret 0x10
pop edi
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x10003740
Capabilities:
Enumerate pe sections

Disassembly:
mov edx, dword [ecx + 0x3c]
movzx eax, word [edx + ecx + 0x14]
push esi
lea esi, [edx + ecx]
add eax, edx
lea edx, [ecx + 0x18]
add edx, eax
movzx eax, word [esi + 6]
test ax, ax
jne 0x1000376a
mov eax, dword [esi + 0x54]
add eax, dword [esi + 0x24]
add eax, dword [esi + 0x20]
add eax, dword [esi + 0x1c]
pop esi
ret
mov esi, eax
mov ecx, edx
test esi, esi
je 0x10003783
mov eax, dword [edx + 0x14]
cmp eax, dword [ecx + 0x14]
cmova ecx, edx
add edx, 0x28
sub esi, 1
jne 0x10003772
mov eax, dword [ecx + 0x14]
add eax, dword [ecx + 0x10]
pop esi
ret
Function at 0x100044c0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, dword [ecx + 0x3c]
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], ecx
mov eax, dword [edi + ecx + 0x80]
test eax, eax
je 0x100045cb
mov bl, byte [ebp + 0x10]
test bl, bl
je 0x100044f2
mov edx, eax
call fcn.1000ef10
mov ecx, dword [ebp - 4]
add eax, ecx
xor esi, esi
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], esi
cmp dword [eax + 0x10], esi
je 0x100045cb
mov edx, dword [eax + 0xc]
test bl, bl
je 0x10004556
movzx eax, word [edi + ecx + 0x14]
add edi, 0x18
mov esi, dword [ecx + 0x3c]
add eax, edi
add eax, ecx
xor edi, edi
movzx ebx, word [esi + ecx + 6]
test ebx, ebx
je 0x1000453e
mov esi, dword [eax + 0xc]
cmp esi, edx
ja 0x10004536
mov ecx, dword [eax + 8]
add ecx, esi
cmp ecx, edx
ja 0x10004545
inc edi
add eax, 0x28
cmp edi, ebx
jl 0x10004526
mov ecx, dword [ebp - 4]
xor eax, eax
jmp 0x10004558
sub edx, esi
cmp edx, dword [eax + 0x10]
jae 0x1000453e
mov eax, dword [eax + 0x14]
mov ecx, dword [ebp - 4]
add eax, edx
jmp 0x10004558
mov eax, edx
lea ebx, [eax + ecx]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], ebx
test eax, eax
je 0x100045dc
mov edi, ebx
mov esi, eax
sub edi, eax
nop dword [eax + eax]
mov dh, byte [edi + esi]
mov dl, byte [esi]
lea ecx, [edx - 0x61]
lea eax, [edx - 0x20]
cmp cl, 0x19
movzx ebx, al
movzx eax, dl
mov dl, dh
cmova ebx, eax
mov al, dh
sub al, 0x20
sub dl, 0x61
movzx ecx, al
cmp dl, 0x19
movzx eax, dh
cmova ecx, eax
cmp cl, bl
jne 0x100045a7
test dh, dh
je 0x100045d6
inc esi
jmp 0x10004570
mov ecx, dword [ebp - 8]
mov bl, byte [ebp + 0x10]
inc ecx
mov dword [ebp - 8], ecx
lea eax, [ecx + ecx*4]
mov ecx, dword [ebp - 0xc]
cmp dword [ecx + eax*4 + 0x10], 0
lea eax, [ecx + eax*4]
mov ecx, dword [ebp - 4]
mov edi, dword [ecx + 0x3c]
jne 0x10004505
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ebx, dword [ebp - 0x14]
mov ecx, dword [ebp - 4]
cmp byte [ebp + 0x10], 0
mov esi, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
lea eax, [esi + esi*4]
lea edi, [edx + eax*4]
mov eax, dword [edi]
je 0x10004609
mov edx, eax
call fcn.1000ef10
mov ecx, dword [ebp - 4]
add eax, ecx
mov edx, dword [edi + 0x10]
mov dword [ebp + 0x10], eax
call fcn.1000ef10
jmp 0x10004611
add eax, ecx
mov dword [ebp + 0x10], eax
mov eax, dword [edi + 0x10]
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x10004620
lea eax, [eax + esi*4]
add eax, dword [ebp - 4]
mov dword [ecx], eax
mov edx, dword [ebp + 8]
test edx, edx
je 0x1000462f
mov eax, dword [ebp + 0x10]
lea ecx, [eax + esi*4]
mov dword [edx], ecx
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10004910
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov eax, ecx
or ebx, 0xffffffff
mov dword [ebp - 4], eax
push edi
test esi, esi
jne 0x10004935
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x10004935
mov esi, dword [ecx + 0x24]
mov dword [ebp + 0xc], esi
mov edi, dword [eax + 4]
xor ecx, ecx
mov eax, 0x86186187
mul edi
sub edi, edx
shr edi, 1
add edi, edx
shr edi, 6
mov dword [ebp - 8], edi
test edi, edi
je 0x1000499a
mov edx, dword [ebp + 0x10]
xor edi, edi
mov eax, dword [ebp - 4]
mov eax, dword [eax]
test esi, esi
je 0x10004965
cmp dword [eax + edi + 8], esi
je 0x1000498f
test edx, edx
je 0x1000496f
cmp dword [eax + edi + 0xc], edx
je 0x1000498f
mov eax, dword [eax + edi + 0xc]
test eax, eax
cmove ebx, ecx
inc ecx
add edi, 0x54
cmp ecx, dword [ebp - 8]
jb 0x10004956
test ebx, ebx
js 0x1000499a
mov eax, dword [ebp - 4]
imul edi, ebx, 0x54
add edi, dword [eax]
jmp 0x100049c8
pop edi
pop esi
mov eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov edi, dword [ebp - 4]
mov eax, 0x86186187
mov ecx, edi
mov ebx, dword [edi + 4]
mul ebx
sub ebx, edx
shr ebx, 1
add ebx, edx
shr ebx, 6
imul esi, ebx, 0x54
lea eax, [esi + 0x54]
push eax
call fcn.10009360
mov edi, dword [edi]
mov edx, dword [ebp + 0x10]
add edi, esi
mov esi, dword [ebp + 0xc]
cmp byte [ebp + 0x18], 0
mov eax, dword [ebp + 8]
mov dword [edi + 8], esi
mov dword [edi + 4], ebx
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], eax
je 0x10004aa0
test edx, edx
jne 0x10004aa0
lea eax, [ebp - 0xc]
mov dword [ebp - 8], esi
push eax
lea eax, [ebp - 0x24]
mov dword [ebp - 0xc], edx
push eax
push 0x10007b
lea eax, [edi + 0xc]
mov dword [ebp - 0x24], 0x18
push eax
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x14], edx
call dword [sym.imp.ntdll.dll_NtOpenThread]
test eax, eax
je 0x10004a3e
mov dword [edi + 0xc], 0
or eax, 0xffffffff
mov dword [edi + 8], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov dword [edi], 4
mov eax, dword fs:[0x18]
cmp esi, dword [eax + 0x24]
je 0x10004a66
mov eax, dword [edi + 0xc]
push 0
push eax
call dword [sym.imp.ntdll.dll_NtSuspendThread]
test eax, eax
jne 0x10004a66
mov eax, dword [edi]
or eax, 0x10
mov dword [edi], eax
mov esi, dword [ebp + 0x14]
test esi, esi
je 0x10004aa9
lea eax, [ebp + 0x18]
mov dword [ebp + 0x18], 0
push eax
push 0x20
lea eax, [ebp - 0x44]
push eax
mov eax, dword [edi + 0xc]
push 1
push eax
call dword [sym.imp.ntdll.dll_NtQueryInformationThread]
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x40]
pop edi
mov dword [esi], eax
mov eax, ebx
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov dword [edi], 0
mov dword [edi + 0xc], edx
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x10008930
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0xddc
push ebx
push esi
xorps xmm0, xmm0
push edi
movlpd qword [ebp - 0x10], xmm0
push 0x33
call 0x1000895e
add dword [esp], 5
retf

Function at 0x10008ed0
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
sub esp, 0xa24
mov edx, dword [ebp + 0xc]
mov eax, ecx
or eax, edx
push ebx
push esi
push edi
je 0x100091ef
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x100091ef
cmp byte [eax], 0
je 0x100091ef
lea eax, [ebp - 0x9c]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], edx
push 0x33
call 0x10008f16
add dword [esp], 5
retf
xor eax, eax
xor edx, edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc