joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10028920
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x1010e2b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, dword [0x1010e2c4]
mov esi, eax
mov eax, dword [0x1010f3b4]
mov edi, dword [0x1010e2b0]
mov ecx, edi
and ecx, 0x1f
xor edi, eax
ror edi, cl
cmp edi, 0xffffffff
je 0x10028989
test edi, edi
je 0x1006a68b
push ebx
mov ecx, edi
call dword [0x10110268]
call edi
push esi
mov edi, eax
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1005cc20
mov esp, ebp
pop ebp
ret
push ebx
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsGetValue]
jmp 0x1002896d
mov edi, 0x10006a9c
mov ecx, dword [edi]
call fcn.10032fe0
test eax, eax
jne 0x1006a6bc
add edi, 4
cmp edi, 0x10006aa4
jne 0x1006a690
push 0xffffffffffffffff
call fcn.10032d19
add esp, 4
mov ecx, 0x1010f3b4
xchg dword [ecx], eax
jmp 0x10028989
push 0x10006aa4
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_1_0.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x1006a6a6
push edi
call fcn.10032d19
add esp, 4
mov ecx, 0x1010f3b4
xchg dword [ecx], eax
test edi, edi
je 0x10028989
jmp 0x10028962
Function at 0x10029ee0
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1010e2b0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ecx, dword [0x1010e2c0]
mov esi, eax
cmp ecx, 0xffffffff
je 0x1006a7c3
call fcn.10029fa0
mov edi, eax
test edi, edi
je 0x1006a7bd
cmp edi, 0xffffffff
je 0x10029f8a
test edi, edi
je 0x10029f8a
mov eax, dword [0x1010e2c4]
mov edx, 0x10006aa4
push ebx
push 0x10006aa4
push 0x10006a9c
mov ecx, 5
mov dword [ebp - 8], eax
call fcn.10037be0
add esp, 8
mov ebx, eax
push dword [ebp - 8]
test ebx, ebx
je 0x10029f82
mov ecx, ebx
call dword [0x10110268]
call ebx
push esi
mov ebx, eax
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
imul eax, ebx, 0x364
pop ebx
add eax, edi
je 0x10029f91
add eax, 0x10
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1005cc20
mov esp, ebp
pop ebp
ret
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsGetValue]
jmp 0x10029f5b
push esi
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
mov eax, 0x1010eac0
jmp 0x10029f72
mov ecx, dword [0x1010e2c0]
or edx, 0xffffffff
call fcn.10032a89
test eax, eax
je 0x10029f8a
push 0x364
push 2
call sym.ucrtbase.dll__calloc_base
mov ecx, dword [0x1010e2c0]
mov edi, eax
add esp, 8
test edi, edi
jne 0x1006a803
xor edx, edx
call fcn.10032a89
push edi
call sym.ucrtbase.dll__free_base
add esp, 4
jmp 0x10029f8a
mov edx, edi
call fcn.10032a89
test eax, eax
jne 0x1006a81e
mov ecx, dword [0x1010e2c0]
xor edx, edx
call fcn.10032a89
push edi
jmp 0x1006a7f6
mov ecx, edi
call fcn.10031ad6
push 0
call sym.ucrtbase.dll__free_base
add esp, 4
jmp 0x10029f1f

Function at 0x10029fa0
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x1010e2b0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x1010f3b4]
push esi
push edi
mov edi, ecx
mov esi, dword [0x1010e2b0]
mov ecx, esi
and ecx, 0x1f
xor esi, eax
ror esi, cl
cmp esi, 0xffffffff
je 0x1002a02a
test esi, esi
je 0x10029fec
push edi
mov ecx, esi
call dword [0x10110268]
call esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1005cc20
mov esp, ebp
pop ebp
ret
mov esi, 0x10006a9c
mov ecx, dword [esi]
call fcn.10032fe0
test eax, eax
je 0x1006a834
push 0x10006aa4
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_1_0.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x1006a843
push esi
call fcn.10032d19
add esp, 4
mov ecx, 0x1010f3b4
xchg dword [ecx], eax
test esi, esi
jne 0x10029fd1
push edi
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsGetValue]
jmp 0x10029fdc
add esi, 4
cmp esi, 0x10006aa4
jne 0x10029ff1
push 0xffffffffffffffff
call fcn.10032d19
add esp, 4
mov ecx, 0x1010f3b4
xchg dword [ecx], eax
jmp 0x1002a02a
Function at 0x1002d130
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x1010e2b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
lea eax, [ebp + 8]
push esi
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0xc]
push edi
mov dword [ebp - 0x10], eax
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, dword [0x1010e2c4]
mov esi, eax
mov eax, dword [0x1010f3b4]
mov edi, dword [0x1010e2b0]
mov ecx, edi
and ecx, 0x1f
xor edi, eax
ror edi, cl
cmp edi, 0xffffffff
je 0x1002d1c7
test edi, edi
je 0x10075655
push ebx
mov ecx, edi
call dword [0x10110268]
call edi
push esi
mov edi, eax
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
dec edi
lea eax, [ebp - 8]
neg edi
push eax
sbb edi, edi
lea eax, [ebp - 0x14]
push eax
and edi, 0xfffffff5
lea eax, [ebp - 0xc]
add edi, 0xd
push eax
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], edi
call fcn.1002d2f0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1005cc20
mov esp, ebp
pop ebp
ret
push ebx
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsGetValue]
jmp 0x1002d18b
mov edi, 0x10006a9c
mov ecx, dword [edi]
call fcn.10032fe0
test eax, eax
jne 0x10075686
add edi, 4
cmp edi, 0x10006aa4
jne 0x1007565a
push 0xffffffffffffffff
call fcn.10032d19
add esp, 4
mov ecx, 0x1010f3b4
xchg dword [ecx], eax
jmp 0x1002d1c7
push 0x10006aa4
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_1_0.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x10075670
push edi
call fcn.10032d19
add esp, 4
mov ecx, 0x1010f3b4
xchg dword [ecx], eax
test edi, edi
je 0x1002d1c7
jmp 0x1002d180

Function at 0x1002dc80
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x1010e2b0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x1010f3b8]
push esi
push edi
mov edi, dword [0x1010e2c4]
mov esi, dword [0x1010e2b0]
mov ecx, esi
and ecx, 0x1f
xor esi, eax
ror esi, cl
cmp esi, 0xffffffff
je 0x100758a5
test esi, esi
je 0x10075879
push 0
push edi
mov ecx, esi
call dword [0x10110268]
call esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1005cc20
mov esp, ebp
pop ebp
ret
mov esi, 0x10006a9c
mov ecx, dword [esi]
call fcn.10032fe0
test eax, eax
jne 0x100758b3
add esi, 4
cmp esi, 0x10006aa4
jne 0x1007587e
push 0xffffffffffffffff
call fcn.10032d19
add esp, 4
mov ecx, 0x1010f3b8
xchg dword [ecx], eax
push 0
push edi
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsSetValue]
jmp 0x1002dcca
push 0x10006b48
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_1_0.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x10075894
push esi
call fcn.10032d19
add esp, 4
mov ecx, 0x1010f3b8
xchg dword [ecx], eax
test esi, esi
je 0x100758a5
jmp 0x1002dcbd
Function at 0x1002dce0
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x1010e2b0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x1010f3b8]
push esi
push edi
mov edi, dword [0x1010e2c4]
mov esi, dword [0x1010e2b0]
mov ecx, esi
and ecx, 0x1f
xor esi, eax
ror esi, cl
cmp esi, 0xffffffff
je 0x1007590a
test esi, esi
je 0x100758de
push 1
push edi
mov ecx, esi
call dword [0x10110268]
call esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1005cc20
mov esp, ebp
pop ebp
ret
mov esi, 0x10006a9c
mov ecx, dword [esi]
call fcn.10032fe0
test eax, eax
jne 0x10075918
add esi, 4
cmp esi, 0x10006aa4
jne 0x100758e3
push 0xffffffffffffffff
call fcn.10032d19
add esp, 4
mov ecx, 0x1010f3b8
xchg dword [ecx], eax
push 1
push edi
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsSetValue]
jmp 0x1002dd2a
push 0x10006b48
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_1_0.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x100758f9
push esi
call fcn.10032d19
add esp, 4
mov ecx, 0x1010f3b8
xchg dword [ecx], eax
test esi, esi
je 0x1007590a
jmp 0x1002dd1d
Function at 0x10031500
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x1010e2b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
lea eax, [ebp + 8]
push edi
mov dword [ebp - 0xc], eax
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, dword [0x1010e2c4]
mov esi, eax
mov eax, dword [0x1010f3b4]
mov edi, dword [0x1010e2b0]
mov ecx, edi
and ecx, 0x1f
xor edi, eax
ror edi, cl
cmp edi, 0xffffffff
je 0x10031591
test edi, edi
je 0x100775cd
push ebx
mov ecx, edi
call dword [0x10110268]
call edi
push esi
mov edi, eax
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
dec edi
lea eax, [ebp - 8]
neg edi
push eax
sbb edi, edi
lea eax, [ebp - 0xc]
push eax
and edi, 0xfffffff5
lea eax, [ebp - 0x10]
add edi, 0xd
push eax
mov dword [ebp - 8], edi
mov dword [ebp - 0x10], edi
call fcn.1002d1d0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1005cc20
mov esp, ebp
pop ebp
ret
push ebx
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsGetValue]
jmp 0x10031555
mov edi, 0x10006a9c
mov ecx, dword [edi]
call fcn.10032fe0
test eax, eax
jne 0x100775fe
add edi, 4
cmp edi, 0x10006aa4
jne 0x100775d2
push 0xffffffffffffffff
call fcn.10032d19
add esp, 4
mov ecx, 0x1010f3b4
xchg dword [ecx], eax
jmp 0x10031591
push 0x10006aa4
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_1_0.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x100775e8
push edi
call fcn.10032d19
add esp, 4
mov ecx, 0x1010f3b4
xchg dword [ecx], eax
test edi, edi
je 0x10031591
jmp 0x1003154a

Function at 0x10032a89
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x1010e2b0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x1010f3b8]
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
mov esi, dword [0x1010e2b0]
mov ecx, esi
and ecx, 0x1f
xor esi, eax
ror esi, cl
cmp esi, 0xffffffff
je 0x10032b16
test esi, esi
je 0x10032ada
push edi
push ebx
mov ecx, esi
call dword [0x10110268]
call esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1005cc20
mov esp, ebp
pop ebp
ret
mov esi, 0x10006a9c
mov ecx, dword [esi]
call fcn.10032fe0
test eax, eax
je 0x10078849
push 0x10006b48
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_1_0.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x10078862
push esi
call fcn.10032d19
pop ecx
mov ecx, 0x1010f3b8
xchg dword [ecx], eax
test esi, esi
jne 0x10032abd
push edi
push ebx
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsSetValue]
jmp 0x10032ac9
add esi, 4
cmp esi, 0x10006aa4
jne 0x10032adf
xor eax, eax
test eax, eax
jne 0x10032aee
push 0xffffffffffffffff
call fcn.10032d19
pop ecx
mov ecx, 0x1010f3b8
xchg dword [ecx], eax
jmp 0x10032b16
Function at 0x1003326d
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
call dword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_GetEnvironmentStringsW]
mov esi, eax
xor edi, edi
mov dword [ebp - 0xc], esi
test esi, esi
je 0x100332e4
mov ecx, esi
call fcn.10033310
push edi
push ecx
mov ebx, eax
xor ecx, ecx
push edi
sub ebx, esi
push edi
sar ebx, 1
push ebx
push esi
call fcn.1003f803
add esp, 0x18
mov dword [ebp - 8], eax
test eax, eax
je 0x100332e4
push eax
call sym.ucrtbase.dll__malloc_base
mov edi, eax
mov dword [ebp - 4], edi
pop ecx
test edi, edi
je 0x100332da
push 0
push ecx
push dword [ebp - 8]
xor ecx, ecx
push edi
push ebx
push esi
call fcn.1003f803
add esp, 0x18
test eax, eax
je 0x100332da
and dword [ebp - 4], 0
jmp 0x100332dc
xor edi, edi
lea ecx, [ebp - 4]
call fcn.100332f5
lea ecx, [ebp - 0xc]
call fcn.1008a07f
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100348c0
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
push edi
call dword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1003490c
push ebx
mov ecx, esi
call fcn.10033310
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call sym.ucrtbase.dll__malloc_base
mov edi, eax
pop ecx
test edi, edi
je 0x10034910
push ebx
push esi
push edi
call sym.ucrtbase.dll_memcpy
add esp, 0xc
push 0
call sym.ucrtbase.dll__free_base
pop ecx
push esi
call dword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_FreeEnvironmentStringsW]
pop ebx
mov eax, edi
pop edi
pop esi
ret
xor edi, edi
jmp 0x10034907
xor edi, edi
jmp 0x100348f7
Function at 0x10034914
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1410
call fcn.1005d1a0
mov eax, dword [0x1010e2b0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, ecx
and ecx, 0x3f
sar eax, 6
imul ecx, ecx, 0x30
push ebx
mov ebx, dword [ebp + 8]
mov eax, dword [eax*4 + 0x1010f130]
push esi
push edi
mov edi, ebx
mov eax, dword [eax + ecx + 0x18]
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x1408], eax
add ecx, edx
xor eax, eax
mov dword [ebp - 0x1410], ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
cmp edx, ecx
jae 0x100349d1
mov edi, dword [ebp - 0x1408]
lea esi, [ebp - 0x1404]
cmp edx, ecx
jae 0x10034986
mov al, byte [edx]
inc edx
cmp al, 0xa
je 0x100349e4
mov byte [esi], al
inc esi
lea eax, [ebp - 5]
cmp esi, eax
jb 0x10034971
lea eax, [ebp - 0x1404]
mov dword [ebp - 0x1408], edx
sub esi, eax
lea eax, [ebp - 0x140c]
push 0
push eax
push esi
lea eax, [ebp - 0x1404]
push eax
push edi
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_WriteFile]
test eax, eax
je 0x1007991f
mov eax, dword [ebp - 0x140c]
add dword [ebx + 4], eax
cmp eax, esi
jb 0x100349d1
mov edx, dword [ebp - 0x1408]
mov ecx, dword [ebp - 0x1410]
cmp edx, ecx
jb 0x1003496b
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1005cc20
mov esp, ebp
pop ebp
ret
inc dword [ebx + 8]
mov byte [esi], 0xd
inc esi
jmp 0x1003497c
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [ebx], eax
jmp 0x100349d1
Function at 0x10036dcc
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
mov eax, ecx
sar ecx, 6
push ebx
mov dword [esp + 0x1c], eax
mov ebx, edx
and eax, 0x3f
mov dword [esp + 0x10], ecx
push esi
push edi
imul edi, eax, 0x30
mov eax, dword [ecx*4 + 0x1010f130]
mov ecx, dword [eax + edi + 0x18]
mov dword [esp + 0x1c], ecx
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x10036e0a
cmp byte [ebx], 0xa
je 0x10036e72
and byte [eax + edi + 0x28], 0xfb
lea eax, [ebx + ecx]
mov esi, ebx
mov dword [esp + 0x14], eax
cmp ebx, eax
jae 0x10036e3a
mov cl, byte [edx]
cmp cl, 0x1a
je 0x1007c9fe
lea eax, [edx + 1]
cmp cl, 0xd
je 0x10036e45
mov byte [esi], cl
mov edx, eax
inc esi
cmp edx, dword [esp + 0x14]
jb 0x10036e1c
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp eax, dword [esp + 0x14]
jae 0x1007c978
mov ch, byte [eax]
lea eax, [esi + 1]
mov dword [esp + 0x10], eax
cmp ch, 0xa
jne 0x10036e5f
mov cl, ch
xor eax, eax
mov byte [esi], cl
mov esi, dword [esp + 0x10]
cmp ch, 0xa
sete al
inc eax
add edx, eax
jmp 0x10036e34
or byte [eax + edi + 0x28], 4
jmp 0x10036e0f
push 0
mov dword [esp + 0x14], eax
lea eax, [esp + 0x24]
push eax
push 1
lea eax, [esp + 0x1b]
push eax
push dword [esp + 0x2c]
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_ReadFile]
test eax, eax
je 0x1007c9f1
cmp dword [esp + 0x20], 0
je 0x1007c9f1
mov eax, dword [esp + 0x18]
mov eax, dword [eax*4 + 0x1010f130]
test byte [eax + edi + 0x28], 0x48
je 0x1007c9c8
mov cl, byte [esp + 0xf]
cmp cl, 0xa
jne 0x1007c9be
mov byte [esi], cl
jmp 0x1007c9c5
mov byte [esi], 0xd
mov byte [eax + edi + 0x2a], cl
inc esi
jmp 0x1007c9f5
cmp byte [esp + 0xf], 0xa
jne 0x1007c9d8
cmp esi, ebx
jne 0x1007c9d8
mov byte [esi], 0xa
jmp 0x1007c9f4
mov ecx, dword [esp + 0x24]
xor edx, edx
push 0xffffffffffffffff
push 0xffffffffffffffff
inc edx
call fcn.10036464
cmp byte [esp + 0x17], 0xa
pop ecx
pop ecx
je 0x1007c9f5
mov byte [esi], 0xd
inc esi
mov edx, dword [esp + 0x10]
jmp 0x10036e34
mov eax, dword [esp + 0x18]
mov ecx, dword [eax*4 + 0x1010f130]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x1007ca1c
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x10036e3a
mov byte [esi], 0x1a
inc esi
jmp 0x10036e3a
Function at 0x10037896
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x141c
call fcn.1005d1a0
mov eax, dword [0x1010e2b0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, ecx
mov dword [ebp - 0x141c], edx
sar eax, 6
and ecx, 0x3f
imul ecx, ecx, 0x30
push ebx
push esi
mov eax, dword [eax*4 + 0x1010f130]
mov esi, dword [ebp + 8]
push edi
mov edi, esi
mov eax, dword [eax + ecx + 0x18]
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x1410], eax
add ecx, edx
xor eax, eax
mov dword [ebp - 0x140c], ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, edx
cmp edx, ecx
jae 0x100379b9
mov esi, dword [ebp - 0x140c]
lea eax, [ebp - 0x6b0]
cmp edi, esi
jae 0x10037924
movzx ecx, word [edi]
add edi, 2
cmp ecx, 0xa
jne 0x10037917
push 0xd
pop edx
mov word [eax], dx
add eax, 2
mov word [eax], cx
add eax, 2
lea ecx, [ebp - 8]
cmp eax, ecx
jb 0x100378ff
push 0
push ecx
push 0xd55
lea ecx, [ebp - 0x1408]
push ecx
lea ecx, [ebp - 0x6b0]
sub eax, ecx
sar eax, 1
push eax
mov eax, ecx
mov ecx, 0xfde9
push eax
call fcn.1003f803
mov esi, dword [ebp + 8]
add esp, 0x18
mov dword [ebp - 0x1418], eax
test eax, eax
je 0x100379b1
xor ebx, ebx
test eax, eax
je 0x10037996
push 0
lea ecx, [ebp - 0x1414]
sub eax, ebx
push ecx
push eax
lea eax, [ebp - 0x1408]
add eax, ebx
push eax
push dword [ebp - 0x1410]
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_WriteFile]
test eax, eax
je 0x100379b1
add ebx, dword [ebp - 0x1414]
mov eax, dword [ebp - 0x1418]
cmp ebx, eax
jb 0x10037961
mov ecx, dword [ebp - 0x140c]
mov eax, edi
sub eax, dword [ebp - 0x141c]
mov dword [esi + 4], eax
cmp edi, ecx
jb 0x100378f3
jmp 0x100379b9
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [esi], eax
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1005cc20
mov esp, ebp
pop ebp
ret

Function at 0x10037bb0
Capabilities:
Move file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 2
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.api_ms_win_core_file_l2_1_0.dll_MoveFileExW]
test eax, eax
je 0x10037bcb
xor eax, eax
pop ebp
ret
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ecx, eax
call fcn.1003779a
or eax, 0xffffffff
pop ebp
ret

Function at 0x1003877f
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x1010e2b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, dword [0x1010e2c4]
mov edx, 0x10006aa4
push 0x10006aa4
push 0x10006a9c
push 5
pop ecx
mov esi, eax
call fcn.10037be0
pop ecx
mov edi, eax
pop ecx
push ebx
test edi, edi
je 0x100387ea
mov ecx, edi
call dword [0x10110268]
call edi
push esi
mov edi, eax
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
mov ecx, dword [ebp - 4]
cmp edi, 1
pop edi
sete al
xor ecx, ebp
pop esi
pop ebx
call fcn.1005cc20
mov esp, ebp
pop ebp
ret
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsGetValue]
jmp 0x100387ca
Function at 0x100387f2
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.api_ms_win_core_libraryloader_l1_1_0.dll_GetModuleHandleW]
mov ecx, eax
test ecx, ecx
je 0x10038833
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x10038833
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x10038833
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x10038833
cmp dword [eax + 0x74], 0xe
jbe 0x10038833
cmp dword [eax + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x10039b60
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x1010e2b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, dword [0x1010e2c4]
mov esi, eax
mov eax, dword [0x1010f3b4]
mov edi, dword [0x1010e2b0]
mov ecx, edi
and ecx, 0x1f
xor edi, eax
ror edi, cl
cmp edi, 0xffffffff
je 0x10039be2
test edi, edi
je 0x1007e8ef
push ebx
mov ecx, edi
call dword [0x10110268]
call edi
push esi
mov edi, eax
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
mov eax, dword [0x1010e2b0]
mov ecx, eax
mov edx, dword [edi*4 + 0x1010f0f4]
and ecx, 0x1f
xor edx, eax
pop edi
ror edx, cl
pop esi
pop ebx
test edx, edx
jne 0x10039beb
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1005cc20
mov esp, ebp
pop ebp
ret
push ebx
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsGetValue]
jmp 0x10039bad
mov al, 1
jmp 0x10039bd4
mov edi, 0x10006a9c
mov ecx, dword [edi]
call fcn.10032fe0
test eax, eax
jne 0x1007e920
add edi, 4
cmp edi, 0x10006aa4
jne 0x1007e8f4
push 0xffffffffffffffff
call fcn.10032d19
add esp, 4
mov ecx, 0x1010f3b4
xchg dword [ecx], eax
jmp 0x10039be2
push 0x10006aa4
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_1_0.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x1007e90a
push edi
call fcn.10032d19
add esp, 4
mov ecx, 0x1010f3b4
xchg dword [ecx], eax
test edi, edi
je 0x10039be2
jmp 0x10039ba2