joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4230b0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [esp + 0x24]
test eax, eax
jne 0x4230d8
mov ecx, dword [esp + 0x28]
test ecx, ecx
je 0x4231d0
add esp, 0x14
pop ebx
pop esi
ret 0xc
cmp eax, 1
je 0x4231a0
cmp eax, 3
jne 0x4230c9
mov eax, dword [0x43e064]
cmp eax, 0xffffffff
je 0x4230c9
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x4230c9
test byte [eax + 0x20], 0x30
je 0x423200
mov eax, dword [eax + 0xb4]
test eax, eax
je 0x42311b
call fcn.00422df0
mov eax, dword [ebx + 0x14]
test eax, eax
je 0x42314d
mov dword [esp], eax
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
mov eax, dword [ebx + 0x18]
sub esp, 4
test eax, eax
je 0x42313f
mov dword [esp], eax
call esi
sub esp, 4
mov dword [ebx + 0x14], 0
mov dword [ebx + 0x18], 0
lea eax, [ebx + 0x1c]
mov dword [esp], eax
call fcn.00422380
lea eax, [ebx + 0x38]
mov dword [esp], eax
call fcn.00426620
cmp eax, 1
je 0x4232ce
mov eax, dword [ebx + 0xb0]
mov dword [ebx + 0x38], 0xffffffff
test eax, eax
je 0x4232c2
mov eax, dword [0x43e064]
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
jmp 0x4230c9
mov eax, dword [0x458acc]
test eax, eax
je 0x4231ec
mov dword [esp + 4], 0x422530
mov dword [esp], 1
call eax
mov dword [0x458ad0], eax
add esp, 0x14
pop ebx
pop esi
ret 0xc
mov eax, dword [0x458ad0]
test eax, eax
je 0x4230c9
mov edx, dword [0x458ac8]
test edx, edx
je 0x4231ec
mov dword [esp], eax
call edx
mov dword [0x458ad0], 0
add esp, 0x14
pop ebx
pop esi
ret 0xc
mov edx, dword [ebx + 0x68]
mov eax, dword [eax + 0x18]
test edx, edx
jne 0x423274
test eax, eax
je 0x42321a
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov eax, dword [ebx + 0xb4]
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x68], 1
test eax, eax
je 0x423237
call fcn.00422df0
test byte [ebx + 0x24], 4
je 0x4232b2
mov eax, dword [ebx + 0x14]
mov dword [ebx], 0xdeadbeef
test eax, eax
je 0x42314d
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebx + 0x1c]
mov dword [ebx + 0x14], 0
sub esp, 4
mov dword [esp], eax
call fcn.00422380
lea eax, [ebx + 0x38]
jmp 0x42315b
test eax, eax
je 0x4232b2
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebx + 0x1c]
mov dword [ebx + 0x18], 0
sub esp, 4
mov dword [esp], eax
call fcn.00422380
lea eax, [ebx + 0x38]
mov dword [esp], eax
call fcn.00426620
cmp eax, 1
je 0x4232ce
mov dword [ebx + 0x38], 0xffffffff
jmp 0x4230c9
lea eax, [ebx + 0x1c]
mov dword [esp], eax
call fcn.00422380
lea eax, [ebx + 0x38]
jmp 0x423299
mov eax, ebx
call fcn.00422a10
jmp 0x423181
call fcn.004227e0
lea esi, cs:[esi]
lea esi, cs:[esi]
Function at 0x4235b0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
mov ebx, dword [esp + 0x50]
mov edi, dword [esp + 0x54]
mov eax, dword [0x4580ec]
mov dword [esp + 0x2c], eax
mov eax, dword [ebx]
test edi, edi
je 0x4236e8
cmp eax, 1
je 0x423615
mov eax, ebx
call fcn.004225c0
mov esi, eax
lea eax, [eax + 4]
mov dword [esp], eax
mov dword [esp + 0x1c], eax
call fcn.00421eb0
mov ebp, dword [ebx]
test ebp, ebp
je 0x423630
cmp ebp, 1
jne 0x4236b8
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
call fcn.004221e0
test esi, esi
je 0x423615
mov eax, esi
call fcn.00422860
xor eax, eax
mov edx, dword [esp + 0x2c]
sub edx, dword [0x4580ec]
jne 0x42373a
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0x20], 0x422920
mov dword [esp + 0x24], esi
call fcn.00422bd0
mov eax, dword [0x43e064]
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [esp], eax
call ebp
sub esp, 4
test eax, eax
je 0x423728
mov eax, dword [eax + 0xc]
mov dword [esp + 0x28], eax
mfence
call fcn.00422bd0
mov eax, dword [0x43e064]
mov dword [esp], eax
call ebp
sub esp, 4
test eax, eax
je 0x423710
lea ecx, [esp + 0x20]
mov dword [eax + 0xc], ecx
mfence
call edi
call fcn.00422bd0
mov eax, dword [0x43e064]
mov dword [esp], eax
call ebp
sub esp, 4
test eax, eax
je 0x4236f8
mov edx, dword [esp + 0x28]
mov dword [eax + 0xc], edx
mov dword [ebx], 1
jmp 0x4235fe
mov dword [esp], 2
call dword [0x43e04c]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], ebx
mov dword [esp + 4], str._once__p_is__ld_n
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
jmp 0x4235fe
mov eax, 0x16
jmp 0x423617
call fcn.00422c90
test eax, eax
jne 0x4236a2
jmp 0x43d2cf
call fcn.00422c90
test eax, eax
jne 0x423680
jmp 0x43d2c4
call fcn.00422c90
test eax, eax
jne 0x42365c
jmp 0x43d2bd
call fcn.0041c120
nop
mov eax, dword [pe_dos_header]
ud2
lea eax, [esp + 0x20]
mov dword [0], eax
ud2
mov eax, dword [esp + 0x28]
mov dword [0], eax
ud2

Function at 0x423980
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call fcn.00422bd0
mov eax, dword [0x43e064]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x4239f8
lea ebp, [ebx + 0x38]
xor edi, edi
mov dword [esp], ebp
call fcn.00426630
mov eax, dword [ebx + 0x28]
cmp dword [esp + 0x30], eax
jae 0x4239d4
mov eax, dword [ebx + 0x30]
mov edx, dword [esp + 0x30]
cmp byte [eax + edx], 0
je 0x4239d4
mov eax, dword [ebx + 0x2c]
mov edi, dword [eax + edx*4]
mov dword [esp], ebp
call fcn.00426680
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
call fcn.00422c90
mov ebx, eax
jmp 0x4239ab
Function at 0x423a10
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov esi, dword [esp + 0x40]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x14], eax
call fcn.00422bd0
mov eax, dword [0x43e064]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x423b30
lea edi, [ebx + 0x38]
mov dword [esp], edi
call fcn.00426630
cmp esi, dword [ebx + 0x28]
jae 0x423a90
mov edx, dword [ebx + 0x2c]
mov eax, dword [esp + 0x44]
mov dword [edx + esi*4], eax
mov eax, dword [ebx + 0x30]
mov byte [eax + esi], 1
mov dword [esp], edi
call fcn.00426680
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
sub esp, 4
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
lea ebp, [esi + 1]
lea eax, [ebp*4]
mov dword [esp + 4], eax
mov eax, dword [ebx + 0x2c]
mov dword [esp], eax
call sub.msvcrt.dll_realloc
test eax, eax
je 0x423b3c
mov dword [esp + 0x1c], eax
mov dword [esp + 4], ebp
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
call sub.msvcrt.dll_realloc
mov edx, dword [esp + 0x1c]
test eax, eax
mov dword [esp + 0x18], eax
je 0x423b3c
mov ecx, dword [ebx + 0x28]
mov eax, ebp
mov dword [esp + 4], 0
mov dword [esp + 0x1c], edx
sub eax, ecx
lea ecx, [edx + ecx*4]
shl eax, 2
mov dword [esp], ecx
mov dword [esp + 8], eax
call sub.msvcrt.dll_memset
mov eax, dword [ebx + 0x28]
mov edx, dword [esp + 0x18]
mov ecx, ebp
mov dword [esp + 4], 0
sub ecx, eax
add eax, edx
mov dword [esp + 8], ecx
mov dword [esp], eax
call sub.msvcrt.dll_memset
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
mov dword [ebx + 0x28], ebp
mov dword [ebx + 0x2c], edx
mov dword [ebx + 0x30], eax
jmp 0x423a58
call fcn.00422c90
mov ebx, eax
jmp 0x423a45
mov dword [esp], edi
call fcn.00426680
mov eax, 0xc
jmp 0x423a80

Function at 0x423bc0
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 0x1c
call fcn.00422bd0
mov eax, dword [0x43e064]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x423be8
mov eax, dword [eax + 0x18]
add esp, 0x1c
ret
call fcn.00422c90
test eax, eax
jne 0x423bdd
add esp, 0x1c
ret

Function at 0x423c50
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 0x1c
call fcn.00422bd0
mov eax, dword [0x43e064]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x423c78
add eax, 0xc
add esp, 0x1c
ret
call fcn.00422c90
test eax, eax
jne 0x423c6d
jmp 0x423c70
Function at 0x423cb0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov esi, dword [esp + 0x20]
call fcn.00422dc0
mov dword [eax + 4], esi
mov ebx, eax
mov eax, dword [eax + 0xb4]
test eax, eax
je 0x423cd2
call fcn.00422df0
test byte [ebx + 0x20], 0x30
jne 0x423cec
add ebx, 0x70
mov dword [esp + 4], 1
mov dword [esp], ebx
call dword [sym.imp.msvcrt.dll_longjmp]
mov eax, dword [0x43e064]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
push edx
test eax, eax
je 0x423d2d
cmp dword [ebx + 0x14], 0
mov eax, dword [eax + 0x18]
je 0x423d6d
mov dword [ebx + 0x68], 1
mov esi, dword [ebx + 4]
test eax, eax
je 0x423d22
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
xor eax, eax
mov dword [ebx + 0x18], eax
test byte [ebx + 0x24], 4
jne 0x423d36
mov dword [esp], esi
call dword [sym.imp.msvcrt.dll__endthreadex]
mov eax, dword [ebx + 0x14]
mov dword [ebx], 0xdeadbeef
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
push ecx
mov dword [ebx + 0x14], eax
mov eax, ebx
call fcn.00422bb0
xor eax, eax
mov dword [esp + 4], eax
mov eax, dword [0x43e064]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push edx
push edx
jmp 0x423d2d
mov dword [ebx], 0xdeadbeef
test eax, eax
je 0x423d81
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
xor eax, eax
mov esi, dword [ebx + 4]
mov dword [ebx + 0x18], eax
jmp 0x423d4e

Function at 0x423d90
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x458afc]
test eax, eax
jne 0x423da0
xor eax, eax
ret
sub esp, 0x1c
call fcn.00422bd0
mov eax, dword [0x43e064]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x423de0
mov edx, dword [eax + 0x10]
test edx, edx
jle 0x423dd0
xor eax, eax
add esp, 0x1c
ret
test byte [eax + 0x20], 3
je 0x423dc4
mov eax, dword [eax + 0x24]
and eax, 1
jmp 0x423dc6
call fcn.00422c90
test eax, eax
jne 0x423dbd
jmp 0x423dc4

Function at 0x423df0
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 0x1c
call fcn.00422bd0
mov eax, dword [0x43e064]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x423e30
mov edx, dword [esp + 0x20]
test edx, edx
jle 0x423e20
lock add dword [eax + 0x10], 1
add esp, 0x1c
ret
lock sub dword [eax + 0x10], 1
add esp, 0x1c
ret
call fcn.00422c90
test eax, eax
jne 0x423e0d
add esp, 0x1c
ret
Function at 0x423f30
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
call fcn.00422bd0
mov eax, dword [0x43e064]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x423fa0
test byte [ebx + 0x20], 0xc
jne 0x423f60
mov eax, dword [0x458afc]
test eax, eax
jne 0x423f70
add esp, 0x14
pop ebx
pop esi
ret
lea esi, [ebx + 0x1c]
mov dword [esp], esi
call fcn.00421eb0
movzx eax, byte [ebx + 0x20]
test al, 3
je 0x423f92
mov edx, dword [ebx + 0x24]
test dl, 1
je 0x423f92
mov ecx, dword [ebx + 0x10]
test ecx, ecx
jle 0x423fb1
mov dword [esp], esi
call fcn.004221e0
add esp, 0x14
pop ebx
pop esi
ret
call fcn.00422c90
mov ebx, eax
test eax, eax
jne 0x423f51
add esp, 0x14
pop ebx
pop esi
ret
and eax, 0xfffffff3
and edx, 0xfffffffe
or eax, 4
mov dword [ebx + 0x24], edx
mov byte [ebx + 0x20], al
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x423fd1
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push eax
mov dword [esp], esi
call fcn.004221e0
call fcn.00423e40
nop
push edi
push esi
push ebx
sub esp, 0x10
mov eax, dword [esp + 0x20]
test eax, eax
je 0x424060
mov dword [esp], eax
call fcn.00425590
mov edi, eax
mov eax, 0xfffffffe
cmp eax, edi
mov eax, 0
sbb eax, edx
jb 0x4240a0
call fcn.00422bd0
mov eax, dword [0x43e064]
mov esi, edi
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x424100
test edi, edi
je 0x42407a
call fcn.00423f30
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x4240d8
mov dword [esp + 4], esi
mov dword [esp], eax
call fcn.004256b0
call fcn.00423f30
add esp, 0x10
xor eax, eax
pop ebx
pop esi
pop edi
ret
call fcn.00422bd0
mov eax, dword [0x43e064]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x4240f0
call fcn.00423f30
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_Sleep]
sub esp, 4
call fcn.00423f30
add esp, 0x10
xor eax, eax
pop ebx
pop esi
pop edi
ret
call fcn.00422bd0
mov eax, dword [0x43e064]
mov esi, 0xffffffff
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
jne 0x424032
call fcn.00422c90
mov ebx, eax
jmp 0x424032
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_Sleep]
sub esp, 4
jmp 0x42404e
call fcn.00422c90
jmp 0x42407a
call fcn.00422c90
mov ebx, eax
jmp 0x42402e
Function at 0x424110
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov esi, dword [esp + 0x20]
call fcn.00422bd0
mov eax, dword [0x43e064]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x424188
test esi, esi
je 0x424160
call fcn.00423f30
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x424198
mov dword [esp + 4], esi
mov dword [esp], eax
call fcn.004256b0
call fcn.00423f30
add esp, 0x14
xor eax, eax
pop ebx
pop esi
ret
call fcn.00423f30
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_Sleep]
sub esp, 4
call fcn.00423f30
add esp, 0x14
xor eax, eax
pop ebx
pop esi
ret
call fcn.00422c90
mov ebx, eax
jmp 0x424135
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_Sleep]
sub esp, 4
jmp 0x424151
Function at 0x10006520
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ecx, dword [edi + 0x10]
mov eax, dword [ecx + 0x44]
cmp eax, dword [ecx + 0x40]
jb 0x1000653f
mov ecx, edi
call fcn.1000dee0
mov esi, dword [edi + 0x10]
push 0x78
push 0
push 0
push dword [esi + 0x10]
mov eax, dword [esi + 0xc]
call eax
mov ebx, eax
add esp, 0x10
test ebx, ebx
je 0x100066a4
add dword [esi + 0x44], 0x78
mov edx, edi
mov ecx, dword [edi + 0x10]
mov eax, dword [ecx + 0x1c]
mov dword [ebx], eax
movzx eax, byte [ecx + 0x14]
mov dword [ecx + 0x1c], ebx
and al, 3
mov byte [ebx + 5], al
mov ecx, ebx
mov byte [ebx + 4], 8
mov eax, dword [edi + 0x10]
mov dword [ebx + 0x10], eax
xor eax, eax
mov dword [ebx + 0x20], 0
mov dword [ebx + 0x2c], 0
mov dword [ebx + 0x70], 0
mov dword [ebx + 0x44], 0
mov dword [ebx + 0x36], 0x1000000
mov dword [ebx + 0x3c], 0
mov dword [ebx + 0x40], 0
mov dword [ebx + 0x68], 0
mov dword [ebx + 0x30], 0
mov word [ebx + 0x34], ax
mov byte [ebx + 6], al
mov dword [ebx + 0x14], eax
mov dword [ebx + 0x28], eax
mov dword [ebx + 0x18], eax
mov dword [ebx + 0x74], eax
mov dword [ebx + 0x50], eax
call fcn.1001ad80
mov eax, dword [edi + 0x48]
mov ecx, dword [edi + 0x4c]
mov dword [ebx + 0x48], eax
mov dword [ebx + 0x4c], ecx
mov eax, dword [edi + 0x50]
mov dword [ebx + 0x50], eax
movzx eax, byte [edi + 0x38]
mov byte [ebx + 0x38], al
mov ecx, dword [edi + 0x3c]
mov dword [ebx + 0x3c], ecx
mov eax, dword [edi + 0x44]
mov dword [ebx + 0x44], eax
mov dword [ebx + 0x40], ecx
mov eax, dword [edi + 8]
mov dword [eax], ebx
mov dword [eax + 8], 8
add dword [edi + 8], 0x10
mov eax, dword [edi + 0xc]
cmp eax, dword [edi + 8]
jae 0x10006634
cmp eax, 0x100670a0
je 0x10006634
cmp dword [eax + 8], 6
jne 0x10006634
mov eax, dword [eax]
cmp byte [eax + 6], 0
je 0x10006648
push str.Lua_function_expected
mov edx, 1
mov ecx, edi
call fcn.10002160
add esp, 4
mov esi, dword [edi + 8]
mov edx, 0x100670a0
cmp dword [edi + 0xc], esi
cmovb edx, dword [edi + 0xc]
mov eax, dword [edx]
mov ecx, dword [edx + 4]
mov dword [esi], eax
mov dword [esi + 4], ecx
mov eax, dword [edx + 8]
mov dword [esi + 8], eax
mov edx, dword [edi + 8]
mov dword [esp + 0xc], edx
lea eax, [edx + 0x10]
mov dword [edi + 8], eax
cmp edi, ebx
je 0x10006698
mov dword [edi + 8], edx
mov esi, dword [ebx + 8]
lea ecx, [esi + 0x10]
mov dword [ebx + 8], ecx
mov ecx, dword [edx]
mov edx, dword [edx + 4]
mov dword [esi], ecx
mov ecx, dword [esp + 0xc]
mov dword [esi + 4], edx
mov ecx, dword [ecx + 8]
mov dword [esi + 8], ecx
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, 4
mov ecx, edi
call fcn.1000b790
int3
Function at 0x1000f320
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x10073014]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, ecx
mov dword [ebp - 0x218], edx
push edi
mov ebx, eax
mov dword [ebp - 0x21c], eax
lea edi, [ebp - 0x204]
mov dword [ebp - 0x208], ebx
mov esi, 0x200
mov dword [ebp - 0x210], edi
mov dword [ebp - 0x20c], 0
mov dword [ebp - 0x214], esi
nop dword [eax]
lea eax, [ebp - 0x210]
sub edi, eax
sub edi, 0xc
je 0x1000f3d3
mov ecx, dword [ebx + 0x10]
mov eax, dword [ecx + 0x44]
cmp eax, dword [ecx + 0x40]
jb 0x1000f38f
mov ecx, ebx
call fcn.1000dee0
mov esi, dword [ebx + 8]
lea edx, [ebp - 0x204]
push edi
mov ecx, ebx
call fcn.1001af30
mov dword [esi], eax
lea ecx, [ebp - 0x210]
mov dword [esi + 8], 4
lea eax, [ebp - 0x204]
add dword [ebx + 8], 0x10
add esp, 4
inc dword [ebp - 0x20c]
mov dword [ebp - 0x210], eax
call fcn.10003170
mov esi, dword [ebp - 0x214]
mov ebx, dword [ebp + 8]
mov eax, ebx
push dword [ebp - 0x218]
cmp esi, ebx
cmovbe eax, esi
mov esi, eax
mov dword [ebp - 0x214], eax
push esi
lea eax, [ebp - 0x204]
push 1
push eax
call fcn.10032098
mov edi, dword [ebp - 0x210]
add esp, 0x10
add edi, eax
sub ebx, eax
mov dword [ebp - 0x210], edi
mov dword [ebp + 8], ebx
je 0x1000f421
cmp eax, esi
jne 0x1000f421
mov ebx, dword [ebp - 0x208]
jmp 0x1000f370
lea eax, [ebp - 0x210]
sub edi, eax
sub edi, 0xc
je 0x1000f485
mov ebx, dword [ebp - 0x208]
mov ecx, dword [ebx + 0x10]
mov eax, dword [ecx + 0x44]
cmp eax, dword [ecx + 0x40]
jb 0x1000f446
mov ecx, ebx
call fcn.1000dee0
mov esi, dword [ebx + 8]
lea edx, [ebp - 0x204]
push edi
mov ecx, ebx
call fcn.1001af30
mov dword [esi], eax
add esp, 4
mov dword [esi + 8], 4
lea eax, [ebp - 0x204]
add dword [ebx + 8], 0x10
mov esi, dword [ebp - 0x20c]
mov ebx, dword [ebp + 8]
inc esi
mov dword [ebp - 0x210], eax
mov dword [ebp - 0x20c], esi
jmp 0x1000f48b
mov esi, dword [ebp - 0x20c]
mov edi, dword [ebp - 0x208]
cmp esi, 2
jl 0x1000f4ce
mov ecx, dword [edi + 0x10]
mov eax, dword [ecx + 0x44]
cmp eax, dword [ecx + 0x40]
jb 0x1000f4a8
mov ecx, edi
call fcn.1000dee0
mov eax, dword [edi + 8]
mov edx, esi
sub eax, dword [edi + 0xc]
mov ecx, edi
sar eax, 4
dec eax
push eax
call fcn.10022260
shl esi, 4
mov eax, 0x10
sub eax, esi
add esp, 4
add dword [edi + 8], eax
jmp 0x1000f4f3
test esi, esi
jne 0x1000f4f3
mov esi, dword [edi + 8]
mov edx, 0x1006757e
push 0
mov ecx, edi
call fcn.1001af30
add esp, 4
mov dword [esi], eax
mov dword [esi + 8], 4
add dword [edi + 8], 0x10
pop edi
pop esi
test ebx, ebx
mov dword [ebp - 0x20c], 1
pop ebx
je 0x1000f524
mov ecx, dword [ebp - 0x21c]
or edx, 0xffffffff
call fcn.10001960
test eax, eax
jne 0x1000f524
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002989d
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 1
xor ecx, ebp
call fcn.1002989d
mov esp, ebp
pop ebp
ret
Function at 0x1001af30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
push edi
mov dword [esp + 0x10], edx
mov edx, dword [ebp + 8]
mov ebx, edx
mov edi, edx
mov dword [esp + 0xc], ecx
shr edi, 5
mov esi, edx
inc edi
cmp edx, edi
jb 0x1001af7e
mov edx, dword [esp + 0x10]
nop dword [eax]
movzx ecx, byte [edx + esi - 1]
mov eax, ebx
shl eax, 5
sub esi, edi
add ecx, eax
mov eax, ebx
shr eax, 2
add ecx, eax
xor ebx, ecx
cmp esi, edi
jae 0x1001af60
mov edx, dword [ebp + 8]
mov esi, dword [esp + 0xc]
mov eax, dword [esi + 0x10]
mov dword [esp + 0x14], eax
mov ecx, dword [eax + 8]
mov eax, dword [eax]
dec ecx
and ecx, ebx
mov edi, dword [eax + ecx*4]
test edi, edi
je 0x1001b014
cmp dword [edi + 0xc], edx
jne 0x1001b00a
mov esi, dword [ebp + 8]
lea eax, [edi + 0x10]
mov edx, dword [esp + 0x10]
sub esi, 4
jb 0x1001afc1
nop dword [eax]
mov ecx, dword [edx]
cmp ecx, dword [eax]
jne 0x1001afca
add edx, 4
add eax, 4
sub esi, 4
jae 0x1001afb0
cmp esi, 0xfffffffc
je 0x1001b0ba
mov cl, byte [edx]
cmp cl, byte [eax]
jne 0x1001b007
cmp esi, 0xfffffffd
je 0x1001b0ba
mov cl, byte [edx + 1]
cmp cl, byte [eax + 1]
jne 0x1001b007
cmp esi, 0xfffffffe
je 0x1001b0ba
mov cl, byte [edx + 2]
cmp cl, byte [eax + 2]
jne 0x1001b007
cmp esi, 0xffffffff
je 0x1001b0ba
mov cl, byte [edx + 3]
cmp cl, byte [eax + 3]
je 0x1001b0ba
mov edx, dword [ebp + 8]
mov edi, dword [edi]
test edi, edi
jne 0x1001af98
mov esi, dword [esp + 0xc]
lea eax, [edx + 1]
cmp eax, 0xffffffed
jbe 0x1001b02d
push str.memory_allocation_error:_block_too_big
push esi
call fcn.1000b5f0
mov edx, dword [ebp + 8]
add esp, 8
lea eax, [edx + 0x11]
mov ecx, esi
push eax
push 0
xor edx, edx
call fcn.100129a0
mov ecx, dword [esp + 0x14]
mov edi, eax
mov esi, dword [ebp + 8]
push esi
push dword [esp + 0x1c]
mov dword [edi + 0xc], esi
lea eax, [edi + 0x10]
mov dword [edi + 8], ebx
mov ecx, dword [ecx + 0x10]
push eax
mov cl, byte [ecx + 0x14]
and cl, 3
mov byte [edi + 4], 4
mov byte [edi + 5], cl
mov byte [edi + 6], 0
call fcn.1002b570
mov byte [edi + esi + 0x10], 0
add esp, 0x14
mov esi, dword [esp + 0xc]
mov edx, dword [esi + 0x10]
mov eax, dword [edx + 8]
dec eax
and eax, ebx
lea ecx, [eax*4]
mov eax, dword [edx]
mov eax, dword [ecx + eax]
mov dword [edi], eax
mov eax, dword [edx]
mov dword [ecx + eax], edi
inc dword [edx + 4]
mov eax, dword [edx + 8]
cmp dword [edx + 4], eax
jbe 0x1001b0b1
cmp eax, 0x3ffffffe
jg 0x1001b0b1
lea edx, [eax + eax]
mov ecx, esi
call fcn.1001ae50
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x14]
mov al, byte [edi + 5]
movzx edx, byte [ecx + 0x14]
not edx
movzx ecx, al
and edx, ecx
test dl, 3
je 0x1001b0b1
xor al, 3
mov byte [edi + 5], al
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100263d0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 1
jne 0x100263fd
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
push 0
push 0
push dword [ebp + 8]
push 0x100262d0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x10074d30], eax
mov eax, 1
pop ebp
ret 0xc

Function at 0x10028e35
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
push edi
mov edi, dword [ebp + 0xc]
test eax, eax
jg 0x10028e56
jl 0x10028e4d
test edi, edi
jne 0x10028e56
xor eax, eax
xor edx, edx
jmp 0x10028f17
cmp dword [ebx + 0x38], 0
je 0x10028e6b
push eax
push edi
push dword [ebp + 8]
call fcn.10028f1d
jmp 0x10028f17
mov eax, dword [ebx + 0x1c]
push esi
mov esi, edi
mov ecx, dword [eax]
test ecx, ecx
je 0x10028eb2
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax]
mov dword [ebp - 4], eax
test eax, eax
je 0x10028eb2
cmp eax, edi
jb 0x10028e8c
mov eax, edi
mov dword [ebp - 4], edi
push eax
push ecx
push dword [ebp + 8]
call fcn.1002b570
mov ecx, dword [ebp - 4]
add esp, 0xc
mov eax, dword [ebp + 8]
sub esi, ecx
add eax, ecx
mov dword [ebp - 4], eax
mov eax, dword [ebx + 0x2c]
sub dword [eax], ecx
mov eax, dword [ebx + 0x1c]
add dword [eax], ecx
jmp 0x10028eb8
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp dword [ebx + 0x4c], 0
je 0x10028f0c
mov ecx, ebx
call fcn.1002869d
mov ecx, dword [ebp - 4]
mov edx, esi
mov eax, 0xfff
cmp esi, eax
jbe 0x10028ef7
push dword [ebx + 0x4c]
push eax
push 1
push ecx
call fcn.10032098
mov ecx, dword [ebp - 4]
sub esi, eax
add ecx, eax
add esp, 0x10
mov dword [ebp - 4], ecx
mov edx, esi
cmp eax, 0xfff
jne 0x10028f0c
jmp 0x10028eca
test edx, edx
je 0x10028f0c
push dword [ebx + 0x4c]
push esi
push 1
push ecx
call fcn.10032098
add esp, 0x10
sub esi, eax
mov edx, dword [ebp + 0x10]
sub edi, esi
mov eax, edi
sbb edx, 0
pop esi
pop edi
pop ebx
leave
ret 0xc