joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001f0f1
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10064040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
call fcn.100060ae
mov edi, eax
xor ebx, ebx
mov ecx, dword [edi + 0x90]
cmp dword [ecx + 0x34], ebx
jle 0x1001f122
cmp dword [ecx + 0x14], ebx
jne 0x1001f139
cmp dword [ecx + 0x18], ebx
jne 0x1001f139
push 0xd9
push str.E:Visual_Studio_ProjectsMGRRMGRModLoaderMGRModLoaderimguiimgui_impl_win32.cpp
push str.io.Fonts__IsBuilt_____Font_atlas_not_built__It_is_generally_built_by_the_renderer_back_end._Missing_call_to_renderer__NewFrame___function__e.g._ImGui_ImplOpenGL3_NewFrame__._
call fcn.10038204
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
push dword [0x10066be4]
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x20]
movd xmm1, eax
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x1c]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
lea eax, [ebp - 0x10]
cvtdq2ps xmm0, xmm0
push eax
movss dword [edi + 8], xmm1
movss dword [edi + 0xc], xmm0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ecx, dword [ebp - 0x10]
sub ecx, dword [0x10066be8]
mov edx, dword [ebp - 0xc]
sbb edx, dword [0x10066bec]
call fcn.1004c1b0
mov edx, dword [0x10066bf4]
mov ecx, dword [0x10066bf0]
cvtsd2ss xmm0, xmm0
movss dword [ebp - 0x24], xmm0
call fcn.1004c1b0
movss xmm1, dword [ebp - 0x24]
cvtsd2ss xmm0, xmm0
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
divss xmm1, xmm0
movss dword [edi + 0x10], xmm1
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword [0x10066be8], eax
mov dword [0x10066bec], ecx
call esi
shr eax, 0xf
and al, 1
push 0x10
mov byte [edi + 0xf8], al
call esi
shr eax, 0xf
and al, 1
push 0x12
mov byte [edi + 0xf9], al
call esi
shr eax, 0xf
and al, 1
mov byte [edi + 0xfb], bl
mov byte [edi + 0xfa], al
call fcn.1001ed9b
cmp byte [edi + 0xa8], bl
je 0x1001f216
or eax, 0xffffffff
jmp 0x1001f221
mov eax, dword [0x10066b98]
mov eax, dword [eax + 0x1d8c]
cmp dword [0x10064e18], eax
je 0x1001f233
mov dword [0x10064e18], eax
call fcn.1001ecef
call fcn.1001ee67
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1002ae05
leave
ret
Function at 0x1002914c
Capabilities:
Allocate or change rwx memory

Disassembly:
mov edx, dword [0x1006708c]
push esi
xor esi, esi
jmp 0x1002915e
cmp dword [edx + 4], esi
jne 0x100291b2
mov edx, dword [edx]
test edx, edx
jne 0x10029157
push 0x40
push 0x3000
push 0x1000
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edx, eax
test edx, edx
je 0x100291ae
push edi
push 0x20
lea ecx, [edx + 0x20]
mov dword [edx + 8], esi
pop edi
mov dword [ecx], esi
mov eax, ecx
mov dword [edx + 4], ecx
add edi, 0x20
add ecx, 0x20
mov esi, eax
cmp edi, 0xfe0
jbe 0x10029185
mov eax, dword [0x1006708c]
mov dword [edx], eax
mov dword [0x1006708c], edx
pop edi
test edx, edx
jne 0x100291b2
xor eax, eax
pop esi
ret
mov eax, dword [edx + 4]
pop esi
mov ecx, dword [eax]
inc dword [edx + 8]
mov dword [edx + 4], ecx
ret

Function at 0x10029a01
Capabilities:
Enumerate threads

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x10064040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0
push 4
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
je 0x10029ae1
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x10029ada
push ebx
cmp dword [ebp - 0x20], 0x10
jb 0x10029abf
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [ebp - 0x14], eax
jne 0x10029abf
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp - 0x18], eax
je 0x10029abf
mov edx, dword [esi]
test edx, edx
jne 0x10029a8d
push 0x200
push edx
push dword [0x10066ba0]
mov dword [esi + 4], 0x80
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
mov dword [esi], edx
test edx, edx
je 0x10029ad9
lea ebx, [esi + 8]
jmp 0x10029ab5
mov eax, dword [esi + 4]
lea ebx, [esi + 8]
cmp dword [ebx], eax
jb 0x10029ab5
shl eax, 3
push eax
push edx
push 0
push dword [0x10066ba0]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov edx, eax
test edx, edx
je 0x10029ad9
shl dword [esi + 4], 1
mov dword [esi], edx
mov ecx, dword [ebx]
mov eax, dword [ebp - 0x18]
mov dword [edx + ecx*4], eax
inc dword [ebx]
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x10029a45
pop ebx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1002ae05
leave
ret
Function at 0x10029aef
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], edx
xor ebx, ebx
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
call fcn.10029a01
cmp dword [esi], ebx
je 0x10029b4f
push edi
mov edi, ebx
cmp dword [esi + 8], ebx
jbe 0x10029b4e
mov eax, dword [esi]
push dword [eax + edi*4]
push ebx
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov ebx, eax
test ebx, ebx
je 0x10029b45
push ebx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push dword [ebp + 8]
mov edx, dword [ebp - 4]
mov ecx, ebx
call fcn.100298af
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
push 0
pop ebx
cmp edi, dword [esi + 8]
jb 0x10029b15
pop edi
pop esi
pop ebx
leave
ret

Function at 0x10029b53
Capabilities:
Resume thread

Disassembly:
push esi
mov esi, ecx
cmp dword [esi], 0
je 0x10029b9f
push edi
xor edi, edi
cmp dword [esi + 8], edi
jbe 0x10029b8e
push ebx
mov eax, dword [esi]
push dword [eax + edi*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov ebx, eax
test ebx, ebx
je 0x10029b87
push ebx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, dword [esi + 8]
jb 0x10029b64
pop ebx
push dword [esi]
push 0
push dword [0x10066ba0]
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
ret

Function at 0x10029ba1
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x10064040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
imul esi, ecx, 0x2c
push edi
add esi, dword [0x10067080]
mov eax, dword [esi]
mov cl, byte [esi + 0x14]
and cl, 1
lea edi, [eax - 5]
cmove edi, eax
movzx eax, cl
lea ebx, [eax*2 + 5]
lea eax, [ebp - 8]
push eax
push 0x40
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x10029beb
push 0xa
pop eax
jmp 0x10029c2a
mov byte [edi], 0xe9
mov eax, dword [esi + 4]
sub eax, edi
sub eax, 5
mov dword [edi + 1], eax
test byte [esi + 0x14], 1
je 0x10029c06
mov eax, dword [esi]
mov word [eax], 0xf9eb
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
or byte [esi + 0x14], 6
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1002ae05
leave
ret
Function at 0x10029ed6
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x10064040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov bl, byte [ebp + 0x10]
push esi
mov dword [ebp - 0x18], eax
mov esi, ecx
push edi
mov edi, dword [ebp + 8]
mov ecx, str.false
test bl, bl
mov eax, str.true
cmove eax, ecx
push eax
lea eax, [ebp - 0x14]
push 0x10055960
push eax
call fcn.100012c0
add esp, 0xc
cmp dword [esi + 0x14], 0xf
jbe 0x10029f20
mov esi, dword [esi]
push esi
push 8
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x18]
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
xor edx, edx
lea edi, [ebp - 0xc]
mov ecx, edx
mov esi, str.true
movzx eax, byte [edi + ecx]
cmp al, byte [esi + ecx]
jne 0x10029f54
inc ecx
cmp ecx, 5
jne 0x10029f41
mov al, 1
jmp 0x10029f73
lea esi, [ebp - 0xc]
mov ecx, edx
mov edi, str.false
movzx eax, byte [esi + ecx]
cmp al, byte [edi + ecx]
jne 0x10029f6f
inc ecx
cmp ecx, 6
jne 0x10029f5e
jmp 0x10029f71
mov dl, bl
mov al, dl
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1002ae05
leave
ret 0xc
Function at 0x10029fe9
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x258
mov eax, dword [0x10064040]
xor eax, esp
mov dword [esp + 0x254], eax
push esi
push edi
push str._Mod_Loader___INFO___Reading_profiles...
mov esi, ecx
call fcn.10001901
pop ecx
push esi
lea eax, [esp + 0x154]
push str._s
push eax
call fcn.100012c0
add esp, 0xc
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x154]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x1002a053
mov byte [0x10066f17], 1
mov eax, str._Mod_Loader___ERROR__Reading_failed_
jmp 0x1002a143
test byte [esp + 0x10], 0x10
je 0x1002a123
push 1
lea eax, [esp + 0x40]
push 0x1005ef28
push eax
call fcn.1003b080
add esp, 0xc
test eax, eax
je 0x1002a123
push 2
lea eax, [esp + 0x40]
push 0x1005ef88
push eax
call fcn.1003b080
add esp, 0xc
test eax, eax
je 0x1002a123
lea ecx, [esp + 0x3c]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1002a09d
sub ecx, edx
cmp ecx, 0x40
jae 0x1002a118
push 0x48
call fcn.1002aec8
pop ecx
mov esi, eax
lea ecx, [esp + 0x3c]
mov edx, esi
mov dword [esp + 0xc], esi
mov eax, ecx
sub edx, eax
mov al, byte [ecx]
mov byte [ecx + edx], al
inc ecx
test al, al
jne 0x1002a0c3
lea eax, [esp + 0xc]
mov dword [esi + 0x40], 7
push eax
mov ecx, 0x10064e20
mov byte [esi + 0x44], 1
mov dword [esp + 0x10], esi
call fcn.10002a15
push esi
mov ecx, esi
call fcn.1002a55c
push dword [esi + 0x40]
cmp byte [esi + 0x44], 0
mov ecx, str.Disabled
mov eax, str.Enabled
cmove eax, ecx
push eax
push esi
push str._Mod_Loader___INFO___Loading__s__s___d_
call fcn.10001901
add esp, 0x10
jmp 0x1002a123
push str._Mod_Loader___INFO___Profile_name_exceeds_64_characters__simplify_the_name_
call fcn.10001901
pop ecx
lea eax, [esp + 0x10]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x1002a053
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, str._Mod_Loader___INFO___Profiles_reading_done_
push eax
call fcn.10001901
pop ecx
mov ecx, dword [esp + 0x25c]
pop edi
pop esi
xor ecx, esp
call fcn.1002ae05
mov esp, ebp
pop ebp
ret
Function at 0x1002a15e
Capabilities:
Enumerate files on windows
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x58c
mov eax, dword [0x10064040]
xor eax, esp
mov dword [esp + 0x588], eax
cmp byte [0x10066f14], 0
push ebx
push esi
push edi
jne 0x1002a2f9
lea eax, [esp + 0x488]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push str._Mod_Loader___INFO___Loading_scripts...
call fcn.10001901
mov esi, dword [0x10064e24]
xor edi, edi
mov eax, dword [0x10064e28]
pop ecx
mov dword [esp + 0x10], esi
lea ebx, [esi + eax*4]
mov dword [esp + 0xc], ebx
cmp esi, ebx
je 0x1002a2ec
mov eax, ebx
mov ebx, dword [esi]
cmp byte [ebx + 0x44], 0
je 0x1002a2dd
lea ecx, [esp + 0x18]
call fcn.1002a51b
cmp dword [eax + 0x14], 0xf
jbe 0x1002a1e5
mov eax, dword [eax]
push ebx
push eax
lea eax, [esp + 0x178]
push str._s_s
push eax
call fcn.100012c0
add esp, 0x10
lea ecx, [esp + 0x18]
call fcn.1002a6d1
lea eax, [esp + 0x170]
push eax
lea eax, [esp + 0x27c]
push str._s.asi
push eax
call fcn.100012c0
add esp, 0xc
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x27c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [esp + 0x14], eax
cmp eax, 0xffffffff
je 0x1002a2d9
mov esi, eax
lea eax, [esp + 0x5c]
push eax
lea eax, [esp + 0x174]
push eax
lea eax, [esp + 0x388]
push str._s_s
push eax
call fcn.100012c0
add esp, 0x10
lea eax, [esp + 0x380]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
lea eax, [esp + 0x488]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea eax, [esp + 0x5c]
push eax
test ebx, ebx
je 0x1002a2ae
push str._Mod_Loader___INFO___Loading__s_script...
call fcn.10001901
pop ecx
pop ecx
push str.InitializeASI
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1002a2ab
call eax
inc edi
jmp 0x1002a2ba
push str._Mod_Loader___ERROR__Failed_to_load__s_
call fcn.10001901
pop ecx
pop ecx
lea eax, [esp + 0x30]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x1002a244
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov esi, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
add esi, 4
mov dword [esp + 0x10], esi
cmp esi, eax
jne 0x1002a1c8
push edi
push str._Mod_Loader___INFO____d_scripts_loaded_
call fcn.10001901
pop ecx
pop ecx
mov ecx, dword [esp + 0x594]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1002ae05
mov esp, ebp
pop ebp
ret
Function at 0x1002a55c
Capabilities:
Read .ini file

Disassembly:
push 0x68
mov eax, 0x1004e31d
call fcn.1004b907
mov ebx, ecx
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x74]
push str.profiles.ini
call fcn.1002a6f4
mov esi, eax
and dword [ebp - 4], 0
lea ecx, [ebp - 0x5c]
call fcn.1002a51b
push esi
push eax
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 1
call fcn.1002a927
mov byte [ebp - 4], 2
lea eax, [ebp - 0x44]
cmp dword [ebp - 0x30], 0xf
lea ecx, [ebp - 0x28]
cmova eax, dword [ebp - 0x44]
push eax
call fcn.1002a6f4
lea ecx, [ebp - 0x44]
call fcn.1002a6d1
lea ecx, [ebp - 0x5c]
call fcn.1002a6d1
lea ecx, [ebp - 0x74]
call fcn.1002a6d1
push 1
push str.Enabled
push edi
lea ecx, [ebp - 0x28]
call fcn.10029ed6
cmp dword [ebp - 0x14], 0xf
mov byte [ebx + 0x44], al
lea eax, [ebp - 0x28]
cmova eax, dword [ebp - 0x28]
push eax
push 7
push str.Priority
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
lea ecx, [ebp - 0x28]
mov dword [ebx + 0x40], eax
call fcn.10029ec0
call fcn.1004b8c5
ret 4
Function at 0x1002e846
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.1004bad0
mov eax, dword [0x10064040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.1003cc4f
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x1002e888
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x1002e9e4
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.1004ba20
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x100664e8]
push dword [edi + eax + 0x24]
push dword [edi + eax + 0x20]
push ebx
call fcn.1003ce5f
mov ecx, dword [esi*4 + 0x100664e8]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [edi + ecx + 0x20]
jne 0x1002e9dd
cmp eax, dword [edi + ecx + 0x24]
jne 0x1002e9dd
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [edi + ecx + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1002e9dd
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.1003ce5f
add esp, 0x14
test edx, edx
jl 0x1002e9dd
jg 0x1002e953
test eax, eax
jb 0x1002e9dd
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x1002e9dd
jl 0x1002e96d
cmp dword [ebp - 0x1008], eax
ja 0x1002e9dd
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x1002e98b
test ebx, ebx
je 0x1002e9c4
cmp ecx, edi
jae 0x1002e9c4
mov al, byte [ecx]
cmp al, 0xd
jne 0x1002e9a5
lea eax, [edi - 1]
cmp ecx, eax
jae 0x1002e9b1
cmp byte [ecx + 1], 0xa
jne 0x1002e9b1
inc ecx
jmp 0x1002e9b1
movzx eax, al
movsx eax, byte [eax + 0x10064230]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x1002e98b
cmp edx, ebx
jne 0x1002e98b
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x1002e9e2
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.1002ae05
leave
ret
Function at 0x1003d5d0
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x100664e8]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x1003d610
cmp byte [ebx], 0xa
jne 0x1003d610
or byte [eax + edi + 0x28], 4
jmp 0x1003d615
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x1003d713
mov al, byte [edx]
cmp al, 0x1a
je 0x1003d6f5
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0x1003d644
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0x1003d669
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x1003d673
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0x1003d626
jmp 0x1003d713
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1003d6f0
cmp dword [ebp - 0xc], 0
je 0x1003d6f0
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0x100664e8]
test byte [eax + edi + 0x28], 0x48
je 0x1003d6ca
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x1003d6b5
mov byte [esi], dl
jmp 0x1003d6c6
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x100664e8]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x1003d713
cmp byte [ebp - 1], 0xa
jne 0x1003d6d9
cmp esi, ebx
jne 0x1003d6d9
mov byte [esi], 0xa
jmp 0x1003d712
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.1003ce7d
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x1003d713
mov byte [esi], 0xd
jmp 0x1003d712
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x100664e8]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x1003d70f
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x1003d713
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x1003d71c
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x100664e8]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x1003d75f
cmp word [esi], dx
jne 0x1003d75f
or byte [edi + eax + 0x28], 4
jmp 0x1003d764
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x1003d8b7
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x1003d897
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x1003d7a6
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x1003d7dc
cmp eax, edx
jae 0x1003d7e8
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x1003d77e
jmp 0x1003d8b7
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1003d893
cmp dword [ebp - 0x14], 0
je 0x1003d893
mov eax, dword [ebx*4 + 0x100664e8]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x1003d86b
mov dx, word [ebp - 4]
lea eax, [esi + 2]
pop ecx
mov dword [ebp - 0x18], eax
cmp dx, cx
jne 0x1003d834
mov word [esi], cx
jmp 0x1003d867
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x100664e8]
movzx ecx, dx
shr ecx, 8
push 0xa
mov byte [edi + eax + 0x2a], dl
mov eax, dword [ebx*4 + 0x100664e8]
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x100664e8]
pop ecx
mov byte [edi + eax + 0x2c], cl
mov eax, dword [ebp - 0x18]
mov esi, eax
jmp 0x1003d8b7
pop ebx
cmp word [ebp - 4], bx
jne 0x1003d87c
cmp esi, dword [ebp + 0xc]
jne 0x1003d87c
mov word [esi], bx
jmp 0x1003d8b4
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.1003ce7d
add esp, 0x10
cmp word [ebp - 4], bx
je 0x1003d8b7
push 0xd
jmp 0x1003d8b0
mov ecx, dword [ebx*4 + 0x100664e8]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x1003d8ae
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x1003d8b7
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x1003f084
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10051bf0
push 0x10051be8
push str.FlsAlloc
push 0x1e
call fcn.1003eec5
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1003f0b8
push dword [ebp + 8]
mov ecx, esi
call dword [0x1004f23c]
call esi
jmp 0x1003f0be
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1003f102
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10051c00
push 0x10051bf8
push str.FlsGetValue
push 0x20
call fcn.1003eec5
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1003f139
push dword [ebp + 8]
mov ecx, esi
call dword [0x1004f23c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x100418ae
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1004171f

Function at 0x10041e75
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10041df7
Function at 0x10044984
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x10044a21
push ebx
push esi
call fcn.1004494d
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.10044896
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x100449ce
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10044a20
push edi
push eax
call fcn.1003ec94
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x100449ee
call fcn.1003ea16
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10044a1f
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.10044896
add esp, 0x20
test eax, eax
jne 0x10044a0d
push edi
call fcn.1003ea16
jmp 0x10044a15
push ebx
call fcn.1003ea16
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x10044a24
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x10044a35
pop esi
ret
push ebx
push edi
push esi
call fcn.1004494d
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.1003ec94
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x10044a5d
push ebx
push esi
push edi
call fcn.1002dde0
add esp, 0xc
push 0
call fcn.1003ea16
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x10044e21
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10044a72