joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10017455
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006ac3c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x50
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x100175f7
lea eax, [ebp + 0x18]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x100174fb
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x14]
mov dword [eax], 0
jmp 0x100174d9
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x14]
mov dword [ecx], eax
mov eax, dword [ebp - 0x14]
cmp dword [eax], 2
jge 0x100174f6
mov eax, dword [ebp - 0x14]
push dword [eax]
mov ecx, dword [ebp - 0x3c]
call fcn.1000f94c
mov dword [eax], 0xfffffffd
jmp 0x100174ce
jmp 0x100175f5
mov dword [ebp - 0x24], 0x53a0
mov dword [ebp - 0x44], 0x10007c48
cmp dword [ebp - 0x24], 0x570a
jle 0x1001756a
and dword [ebp - 0x1c], 0
jmp 0x1001751f
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xa86
jge 0x10017562
and dword [ebp - 0x20], 0
jmp 0x10017535
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x3ed0
jge 0x10017560
mov eax, dword [ebp - 0x1c]
cdq
idiv dword [ebp - 0x20]
mov eax, edx
cdq
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], edx
push dword [ebp - 0x5c]
push dword [ebp - 0x60]
mov ecx, 0x10612078
call fcn.1000f645
jmp 0x1001752e
jmp 0x10017518
push 0
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x4c], eax
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0x520d
jge 0x1001758a
mov edx, dword [ebp - 0x44]
mov ecx, 0x10612078
call fcn.10011cee
jmp 0x100175a6
or dword [ebp - 4], 0xffffffff
jmp 0x100175b0
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x18]
mov dword [eax], 0
jmp 0x100175d8
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x18]
mov dword [ecx], eax
mov eax, dword [ebp - 0x18]
cmp dword [eax], 4
jge 0x100175f5
mov eax, dword [ebp - 0x18]
push dword [eax]
mov ecx, dword [ebp - 0x54]
call fcn.1000f94c
mov dword [eax], 0x7b5
jmp 0x100175cd
jmp 0x1001760f
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x58], eax
push 0x6848
push dword [ebp - 0x58]
push 0
call fcn.10016218
add esp, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10023b79
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x10023bd5
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 8], eax
lea eax, [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x10023bc7
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ecx]
mov dword [eax], ecx
jmp 0x10023bd3
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_AttachThreadInput]
jmp 0x10023bfb
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x24], eax
push 0x3148
push 0x751a
push 0
push dword [ebp - 0x20]
push dword [ebp - 0x24]
call fcn.1002aabe
add esp, 0x14
mov esp, ebp
pop ebp
ret

Function at 0x10024419
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10024446
mov eax, dword [ebp + 0x10]
mov dword [ebp - 4], eax
push 0
push 0x541
push dword [ebp - 4]
push 0x57c4
call fcn.1002838c
add esp, 0x10
jmp 0x1002447b
lea eax, [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x10024473
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [eax], 0x8ec0ae97
jmp 0x1002447b
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov esp, ebp
pop ebp
ret
Function at 0x10028530
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x10028552
mov eax, dword [ebp + 0x14]
mov dword [ebp - 8], eax
push dword [ebp - 8]
push 1
call fcn.100285c9
pop ecx
pop ecx
jmp 0x100285c5
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x1002857a
push 0
push 0
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
jmp 0x100285c5
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x100285a8
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x100285c5
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x20]
call fcn.1000f94c
mov dword [eax], 0x16df251d
jmp 0x1002859d
mov esp, ebp
pop ebp
ret

Function at 0x100298c4
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10029923
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x10029903
mov byte [ebp - 1], 0
push 1
lea eax, [ebp - 1]
push eax
push 0x444d
push 1
call fcn.10023204
add esp, 0x10
jmp 0x10029921
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x10029921
push 0
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
jmp 0x10029937
push 0x3f94
push 0x6911
push 1
call fcn.1001f598
add esp, 0xc
mov esp, ebp
pop ebp
ret

Function at 0x1002aa0a
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x1002aa2c
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
push dword [ebp - 8]
push 1
call fcn.1002aa9a
pop ecx
pop ecx
jmp 0x1002aa96
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x1002aa82
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x1002aa80
push 0x6a42
push 0x65bf
push 0x443b
push 0
push 0x336c
push 0x344
push 0x817
call fcn.10031bb4
add esp, 0x1c
jmp 0x1002aa96
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1002aa96
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov esp, ebp
pop ebp
ret
Function at 0x1002af00
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1002af1e
push 1
push 0x53c9
call fcn.1002af6f
pop ecx
pop ecx
jmp 0x1002af6b
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1002af54
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x1002af52
push 0
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
jmp 0x1002af6b
mov byte [ebp - 1], 0
push 0xd15
lea eax, [ebp - 1]
push eax
push 0
call fcn.1002402b
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x1003597f
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x1006b288
call fcn.1006a2a0
sub esp, 0x1c
push ebx
mov ebx, ecx
push esi
push edi
xor edi, edi
mov dword [ebp - 0x10], esp
mov eax, dword [ebx + 0x10]
mov esi, edi
mov ecx, eax
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], eax
cmp esi, ecx
jae 0x10035a99
mov dword [ebp - 0x1c], 0x1363
cmp dword [ebp - 0x1c], 0x1570
jle 0x100359fa
push edi
push edi
push edi
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov esi, edi
mov ebx, edi
mov eax, ebx
mov ecx, 0x10612078
or eax, esi
cdq
push edx
push eax
call fcn.1000f645
inc ebx
cmp ebx, 0x2f82
jl 0x100359d1
inc esi
cmp esi, 0x4596
jl 0x100359cf
mov ebx, dword [ebp - 0x20]
mov esi, dword [ebp - 0x14]
cmp dword [ebx + 0x10], esi
ja 0x10035a09
push 0x1000799c
call fcn.1004e94e
cmp dword [ebx + 0x14], 8
jb 0x10035a13
mov eax, dword [ebx]
jmp 0x10035a15
mov eax, ebx
movzx eax, word [eax + esi*2]
mov dword [ebp - 4], edi
cmp dword [ebp - 0x1c], 0x1058
mov dword [ebp - 0x24], eax
jge 0x10035a37
mov edx, 0x10008ce0
mov ecx, 0x10612078
call fcn.10011cee
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x24]
lea edx, [esi + 0x7280]
call fcn.1004ca95
movzx esi, ax
xor edx, edx
mov eax, dword [ebp - 0x24]
movzx eax, ax
add eax, dword [ebp - 0x14]
push 0x19
pop ecx
div ecx
mov eax, dword [ebp - 0x18]
mov ecx, edx
shl esi, cl
mov ecx, dword [ebp - 0x28]
add eax, esi
mov esi, dword [ebp - 0x14]
inc esi
jmp 0x100359a3
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10035ff9
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10036045
lea eax, [ebp + 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x10036027
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
jmp 0x10036043
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x10036043
call dword [sym.imp.KERNEL32.dll_GetTickCount]
jmp 0x1003606b
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push 0x12fe
push 1
push 0x49a0
call fcn.10035d9c
add esp, 0x14
mov esp, ebp
pop ebp
ret
Function at 0x10037157
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006b2ae
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x58
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x1003726c
lea eax, [ebp + 0x24]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x10037249
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x14]
mov dword [eax], 3
jmp 0x100371cc
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x14]
mov dword [ecx], eax
mov eax, dword [ebp - 0x14]
cmp dword [eax], 0
jl 0x10037247
push 4
lea ecx, [ebp - 0x64]
call fcn.1000f8ae
and dword [ebp - 4], 0
lea eax, [ebp - 0x58]
push eax
push 0x213c
push 1
push 1
push 0
push 0x1583
push 0x608b
push 0x788e
push 0x1646
lea eax, [ebp - 0x64]
push eax
push 0x6992
call fcn.1003c69e
add esp, 0x2c
push 0x3b6e
push 0x4eb8
push dword [ebp - 0x14]
push 1
lea eax, [ebp - 0x64]
push eax
push 0
push dword [ebp - 0x30]
call fcn.10036862
add esp, 0x1c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x64]
call fcn.1000f930
jmp 0x100371c1
jmp 0x10037267
mov byte [ebp - 0xd], 0
push 0x3600
push 0x3c01
push 0x3b
lea eax, [ebp - 0xd]
push eax
push 0
call fcn.10049d34
add esp, 0x14
jmp 0x100372f2
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x3c], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax]
test eax, eax
je 0x100372e8
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x18]
mov dword [eax], 0
jmp 0x100372c8
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x18]
mov dword [ecx], eax
mov eax, dword [ebp - 0x18]
cmp dword [eax], 2
jg 0x100372e6
mov eax, dword [ebp - 0x50]
push dword [eax]
mov ecx, dword [ebp - 0x54]
call fcn.1000f94c
cmp dword [eax], 0
je 0x100372e4
jmp 0x100372e6
jmp 0x100372bd
jmp 0x100372f2
push 0
push 0
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x10066875
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1006f740]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.10057768
mov dword [ebp - 0x14], eax
cmp dword [0x10613194], esi
jne 0x10066968
push 0x800
push esi
push 0x1000759c
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x100668f5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x10066a48
push esi
push esi
push 0x1000759c
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x10066a48
push 0x100075b4
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10066a48
push eax
call ebx
push 0x100075c0
push edi
mov dword [0x10613194], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x100075d0
push edi
mov dword [0x10613198], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x100075e4
push edi
mov dword [0x1061319c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x106131a4], eax
test eax, eax
je 0x10066965
push 0x10007600
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x106131a0], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x1006698d
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x10066980
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x100669a2
push 4
pop eax
jmp 0x10066a4a
cmp dword [ebp - 0x14], esi
je 0x100669a2
push dword [0x10613194]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x10066987
mov eax, dword [0x106131a0]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x10066a00
cmp dword [0x106131a4], edi
je 0x10066a00
push eax
call ebx
push dword [0x106131a4]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x10066a00
test eax, eax
je 0x10066a00
call ecx
test eax, eax
je 0x100669f5
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x100669f5
test byte [ebp - 8], 1
jne 0x10066a00
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x10066a30
mov eax, dword [0x10613198]
cmp eax, edi
je 0x10066a2d
push eax
call ebx
test eax, eax
je 0x10066a2d
call eax
mov esi, eax
test esi, esi
je 0x10066a2d
mov eax, dword [0x1061319c]
cmp eax, edi
je 0x10066a2d
push eax
call ebx
test eax, eax
je 0x10066a2d
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x10613194]
call ebx
test eax, eax
je 0x10066a48
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x10066a4a
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100547cc
mov esp, ebp
pop ebp
ret
Function at 0x100045f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1002fbe0
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x1003d068]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
push 8
mov dword [ebx], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.10010066
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.1000f0a4
add esp, 8
mov dword [esi + 4], eax
mov ecx, ebx
mov dword [ebx + 0x34], esi
call fcn.100048c0
mov eax, ebx
lea ecx, [eax + 0x18]
lea edx, [eax + 0x24]
lea esi, [eax + 8]
lea ebx, [eax + 4]
mov dword [eax + 0x20], ecx
mov dword [eax + 0xc], ebx
lea edi, [eax + 0x14]
mov dword [eax + 0x2c], edx
mov dword [eax], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov byte [eax + 0x48], 0
mov byte [eax + 0x3d], 0
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov ecx, dword [0x1003ef80]
mov dword [eax], 0
mov eax, dword [0x1003ef7c]
mov dword [ebx], 0
mov dword [edi], 0
mov dword [edx], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x40], eax
mov eax, edx
mov dword [edx + 0x4c], 0
mov dword [edx + 0x44], ecx
mov dword [edx + 0x38], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100070c0
Capabilities:
Create thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1002fe7d
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x1003d068]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
sub eax, 0
je 0x10007120
sub eax, 1
jne 0x1000715f
push eax
push eax
push dword [ebp + 8]
push 0x10007180
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x10007115
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0xfffffffffffffffe
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
jmp 0x1000715f
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
push 0x80
push ecx
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], 0
call fcn.1000ddf0
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x1000715f
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1001cdf9
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x1001ce38
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1001ce38
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1001ce38
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x1001ce38
cmp dword [ecx + 0x74], 0xe
jbe 0x1001ce38
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x10022876
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100350c0
push 0x100350b8
push str.FlsAlloc
push 0x1f
call fcn.1002273e
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100228aa
push dword [ebp + 8]
mov ecx, esi
call dword [0x10031194]
call esi
jmp 0x100228b0
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x100228f4
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100350d0
push 0x100350c8
push str.FlsGetValue
push 0x21
call fcn.1002273e
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1002292b
push dword [ebp + 8]
mov ecx, esi
call dword [0x10031194]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x10022933
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100350d8
push 0x100350d0
push str.FlsSetValue
push 0x22
call fcn.1002273e
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1002296d
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x10031194]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x10023072
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.10011000
mov eax, dword [0x1003d068]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.1001fdec
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x100230b4
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x10023210
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.1002f3c0
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x1003eb28]
push dword [eax + edi + 0x24]
push dword [eax + edi + 0x20]
push ebx
call fcn.100248d5
mov ecx, dword [esi*4 + 0x1003eb28]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [ecx + edi + 0x20]
jne 0x10023209
cmp eax, dword [ecx + edi + 0x24]
jne 0x10023209
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [ecx + edi + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10023209
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.100248d5
add esp, 0x14
test edx, edx
jl 0x10023209
jg 0x1002317f
test eax, eax
jb 0x10023209
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x10023209
jl 0x10023199
cmp dword [ebp - 0x1008], eax
ja 0x10023209
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x100231b7
test ebx, ebx
je 0x100231f0
cmp ecx, edi
jae 0x100231f0
mov al, byte [ecx]
cmp al, 0xd
jne 0x100231d1
lea eax, [edi - 1]
cmp ecx, eax
jae 0x100231dd
cmp byte [ecx + 1], 0xa
jne 0x100231dd
inc ecx
jmp 0x100231dd
movzx eax, al
movsx eax, byte [eax + 0x1003d460]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x100231b7
cmp edx, ebx
jne 0x100231b7
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x1002320e
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.10010058
leave
ret