joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100021b0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x100356e0
push 0x1000dd70
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x10038080]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov ebx, edx
mov esi, ecx
mov dword [ebp - 4], 0
lea eax, [ebp - 0x20]
push eax
push 0x40
mov edi, dword [ebp + 8]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub ebx, esi
sub ebx, 5
mov byte [esi], 0xe9
mov dword [esi + 1], ebx
mov eax, 5
mov dword [ebp - 0x28], eax
cmp eax, edi
jae 0x10002220
mov byte [esi + eax], 0x60
inc eax
jmp 0x10002212
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x20]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x1000223a
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.1000c80f
mov esp, ebp
pop ebp
ret

Function at 0x10002260
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x10035700
push 0x1000dd70
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x10038080]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov bl, dl
mov edi, ecx
mov dword [ebp - 4], 0
lea eax, [ebp - 0x20]
push eax
push 0x40
push 8
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov byte [edi], bl
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x20]
push 8
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x100022cd
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.1000c80f
mov esp, ebp
pop ebp
ret

Function at 0x100022f0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x10035720
push 0x1000dd70
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x10038080]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov ebx, edx
mov edi, ecx
mov dword [ebp - 4], 0
lea eax, [ebp - 0x20]
push eax
push 0x40
push 8
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [edi], ebx
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x20]
push 8
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x1000235d
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.1000c80f
mov esp, ebp
pop ebp
ret
Function at 0x10003130
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1002ad40
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x10038080]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 4], 0
mov edx, 0x20
mov eax, dword [0x1004a3f8]
add eax, 0x64
mov dword [0x1004a2e4], eax
lea ecx, [eax - 0xc]
call fcn.100022f0
mov edx, esi
mov ecx, 0x18
call fcn.100030c0
xor edx, edx
lea ecx, [edx + 0x30]
call fcn.100030c0
mov edx, dword [ebp + 8]
test edx, edx
je 0x100031a3
mov ecx, 0x1c
call fcn.100030c0
mov edx, dword [ebp + 0xc]
test edx, edx
je 0x100031b4
mov ecx, 0x20
call fcn.100030c0
mov ecx, 0x18
call fcn.1000a570
mov ecx, dword [0x1004a2e4]
mov edx, eax
add ecx, 0xffffffd4
mov dword [0x1004a350], eax
call fcn.100022f0
mov ecx, 0x38
call fcn.1000a570
mov ecx, dword [0x1004a2e4]
mov edx, eax
add ecx, 0xffffffdc
mov dword [0x1004a350], eax
call fcn.100022f0
mov ecx, 0x3c
call fcn.1000a570
mov ecx, dword [0x1004a2e4]
mov edx, eax
mov dword [0x1004a350], eax
lea ecx, [ecx - 0x20]
call fcn.100022f0
mov ecx, 0x30
call fcn.1000a570
mov ecx, dword [0x1004a2e4]
mov dl, al
add ecx, 0xffffffd8
mov dword [0x1004a3b4], eax
call fcn.10002260
mov ecx, 0x31
call fcn.1000a570
mov ecx, dword [0x1004a2e4]
mov dl, al
add ecx, 0xffffffe4
mov dword [0x1004a3b4], eax
call fcn.10002260
mov ecx, 0x4d
call fcn.1000a570
mov ecx, dword [0x1004a2e4]
mov dl, al
mov dword [0x1004a3b4], eax
lea ecx, [ecx - 0x1b]
call fcn.10002260
mov ecx, 0x1c
call fcn.1000a570
mov ecx, dword [0x1004a2e4]
mov edx, eax
mov dword [0x1004a350], eax
lea ecx, [ecx - 0x18]
call fcn.100022f0
mov ecx, 0x20
call fcn.1000a570
mov ecx, dword [0x1004a2e4]
mov edx, eax
add ecx, 0xffffffec
mov dword [0x1004a350], eax
call fcn.100022f0
mov ecx, 0x24
call fcn.1000a570
mov ecx, dword [0x1004a2e4]
mov edx, eax
add ecx, 0xfffffff0
mov dword [0x1004a350], eax
call fcn.100022f0
mov ecx, 0x28
call fcn.1000a570
mov ecx, dword [0x1004a2e4]
mov edx, eax
add ecx, 0xfffffff8
mov dword [0x1004a350], eax
call fcn.100022f0
mov ecx, 0x2c
call fcn.1000a570
mov ecx, dword [0x1004a2e4]
mov edx, eax
add ecx, 0xfffffffc
mov dword [0x1004a350], eax
call fcn.100022f0
mov eax, dword [0x1004a2e4]
sub eax, 0x2c
push eax
call dword [0x1004a3ec]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100044b0
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x70
mov eax, dword [0x10038080]
xor eax, esp
mov dword [esp + 0x6c], eax
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [esp + 0x48]
push 0x2c
push eax
push dword [0x10048fbc]
call dword [sym.imp.KERNEL32.dll_K32GetProcessMemoryInfo]
lea eax, [esp + 8]
mov dword [esp + 8], 0x40
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov esi, dword [esp + 0x10]
mov ecx, esi
sub ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
mov eax, edx
sbb eax, dword [esp + 0x1c]
mov dword [edi + 0x18], ecx
mov ecx, dword [esp + 0x24]
mov dword [edi + 0x2c], edx
mov edx, dword [esp + 0x20]
mov dword [edi + 0x10], edx
sub edx, dword [esp + 0x28]
mov dword [edi + 0x14], ecx
sbb ecx, dword [esp + 0x2c]
mov dword [edi + 0x1c], eax
mov eax, dword [esp + 0x54]
mov dword [edi + 4], ecx
mov ecx, dword [esp + 0x70]
mov dword [edi + 0x20], eax
mov eax, edi
mov dword [edi + 8], ecx
mov ecx, dword [esp + 0x74]
mov dword [edi + 0x28], esi
mov dword [edi + 0x24], 0
mov dword [edi], edx
mov dword [edi + 0xc], 0
pop edi
pop esi
xor ecx, esp
call fcn.1000c80f
mov esp, ebp
pop ebp
ret 4
Function at 0x10005ac0
Capabilities:
Authenticate hmac
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push esi
call fcn.10003b70
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount64]
call esi
mov ecx, dword [0x1004a404]
add ecx, 0x64
test edx, edx
jb 0x10005af4
ja 0x10005ae1
cmp eax, ecx
jbe 0x10005af4
call esi
mov dword [0x1004a404], eax
mov byte [0x1004a30a], 0
call fcn.10005730
call esi
mov ecx, dword [0x1004a400]
add ecx, 0x3e8
test edx, edx
jb 0x10005b19
ja 0x10005b0c
cmp eax, ecx
jbe 0x10005b19
call esi
mov dword [0x1004a400], eax
pop esi
jmp fcn.10002720
pop esi
ret
Function at 0x10005b30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x54
mov eax, dword [0x10038080]
xor eax, esp
mov dword [esp + 0x50], eax
movaps xmm0, xmmword [0x10034010]
xor ecx, ecx
push ebx
push esi
push edi
movups xmmword [esp + 0x10], xmm0
mov al, byte [esp + 0x10]
xor byte [esp + ecx + 0x11], al
inc ecx
cmp ecx, 0xe
jb 0x10005b55
lea edx, [esp + 0x11]
mov byte [esp + 0x1f], 0
lea ecx, [esp + 0x44]
call fcn.10004820
mov esi, dword [esp + 0x58]
lea eax, [esp + 0x44]
mov edx, dword [esp + 0x44]
lea ebx, [esp + 0x44]
cmp esi, 0xf
push 0x20
cmova eax, edx
add eax, dword [esp + 0x58]
cmp esi, 0xf
mov dword [esp + 0x10], eax
lea eax, [esp + 0x48]
cmova ebx, edx
add ebx, dword [esp + 0x58]
cmp esi, 0xf
push ebx
cmova eax, edx
push eax
call fcn.1000b990
mov edi, eax
cmp eax, ebx
je 0x10005bcf
inc eax
cmp eax, ebx
je 0x10005bcf
nop dword [eax + eax]
mov cl, byte [eax]
cmp cl, 0x20
je 0x10005bca
mov byte [edi], cl
inc edi
inc eax
cmp eax, ebx
jne 0x10005bc0
cmp dword [esp + 0x58], 0xf
lea eax, [esp + 0x44]
mov ebx, dword [esp + 0xc]
lea ecx, [esp + 0x44]
cmova eax, dword [esp + 0x44]
mov esi, edi
sub esi, eax
sub ebx, edi
mov edi, dword [esp + 0x54]
mov eax, edi
sub eax, esi
cmp eax, ebx
cmovb ebx, eax
cmp dword [esp + 0x58], 0xf
cmova ecx, dword [esp + 0x44]
sub edi, ebx
add ecx, esi
mov eax, edi
sub eax, esi
inc eax
push eax
lea eax, [ecx + ebx]
push eax
push ecx
call fcn.1000dff0
movaps xmm0, xmmword [0x100340b0]
add esp, 0xc
movups xmmword [esp + 0x20], xmm0
xor ecx, ecx
mov dword [esp + 0x54], edi
movaps xmm0, xmmword [0x100340a0]
movups xmmword [esp + 0x30], xmm0
mov word [esp + 0x40], 0x4e
nop
mov al, byte [esp + 0x20]
xor byte [esp + ecx + 0x21], al
inc ecx
cmp ecx, 0x20
jb 0x10005c40
cmp dword [esp + 0x58], 0xf
lea ecx, [esp + 0x21]
lea eax, [esp + 0x44]
mov byte [esp + 0x41], 0
cmova eax, dword [esp + 0x44]
push ecx
push eax
call fcn.10018e3e
add esp, 8
test eax, eax
jne 0x10005cdc
mov ecx, dword [0x1004a3f0]
mov edx, 0x10005b20
push 5
call fcn.100021b0
mov ecx, dword [0x1004a3e0]
add esp, 4
mov edx, 0x10003040
push 6
call fcn.100021b0
mov ecx, dword [0x1004a3c8]
add esp, 4
mov edx, 0x10003060
push 6
call fcn.100021b0
mov ecx, dword [0x1004a3c4]
add esp, 4
mov edx, 0x10003020
push 6
call fcn.100021b0
mov ecx, dword [0x1004a3e4]
add esp, 4
mov edx, 0x10003340
push 6
call fcn.100021b0
add esp, 4
mov ecx, dword [esp + 0x58]
cmp ecx, 0xf
jbe 0x10005d0e
mov edx, dword [esp + 0x44]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10005d04
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10005d20
push ecx
push edx
call fcn.1000cc21
add esp, 8
mov ecx, dword [esp + 0x5c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1000c80f
mov esp, ebp
pop ebp
ret
call fcn.10016f04
int3

Function at 0x10005dc0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub dword [ebp + 0xc], 1
jne 0x10005de8
push 0
push 0
push 0x10005d30
call fcn.100126ad
push 0
push 0
push 0x10004800
call fcn.100126ad
add esp, 0x18
mov eax, 1
pop ebp
ret 0xc
Function at 0x10006450
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [esp + 0xc], edi
test eax, eax
jg 0x10006482
jl 0x10006475
test ecx, ecx
jne 0x10006482
xor eax, eax
xor edx, edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x10006542
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], eax
mov ecx, ebx
call fcn.10009260
mov esi, eax
mov eax, edx
mov dword [esp + 0x14], eax
test eax, eax
jl 0x100064ee
jg 0x100064ad
test esi, esi
je 0x100064ee
mov ecx, dword [esp + 0xc]
cmp ecx, eax
jg 0x100064c5
mov eax, dword [esp + 0x10]
jl 0x100064bf
cmp eax, esi
jae 0x100064c5
mov esi, eax
mov dword [esp + 0x14], ecx
mov eax, dword [ebx + 0x1c]
push esi
push dword [eax]
push edi
call fcn.1000dff0
mov eax, dword [ebx + 0x2c]
add esp, 0xc
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
sub ecx, esi
sbb edx, dword [esp + 0x14]
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
jmp 0x1000650f
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x1c]
mov edx, dword [esp + 0xc]
cmp eax, 0xffffffff
je 0x1000652b
mov ecx, dword [esp + 0x10]
mov esi, 1
add ecx, 0xffffffff
mov byte [edi], al
adc edx, 0xffffffff
add edi, esi
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], ecx
test edx, edx
jg 0x10006494
jl 0x1000652b
test ecx, ecx
jne 0x10006494
mov eax, dword [ebp + 0xc]
sub eax, dword [esp + 0x10]
mov ecx, dword [ebp + 0x10]
sbb ecx, edx
mov edx, ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
lea esi, [ebx + 0x2c]
mov edi, ecx
mov edx, dword [eax]
test edx, edx
je 0x10006586
mov eax, dword [esi]
mov eax, dword [eax]
test eax, eax
je 0x10006586
mov edi, dword [esp + 0xc]
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push edx
push edi
call fcn.1000dff0
mov eax, dword [ebx + 0x2c]
add edi, esi
mov dword [esp + 0x18], edi
add esp, 0xc
mov edi, dword [ebp + 0xc]
sub edi, esi
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
lea esi, [ebx + 0x2c]
cmp dword [ebx + 0x4c], 0
je 0x100065f7
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x100065ac
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi]
mov dword [eax], edx
mov esi, dword [esp + 0xc]
cmp edi, 0xfff
jbe 0x100065e2
nop dword [eax + eax]
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call fcn.100168b8
add esp, 0x10
add esi, eax
sub edi, eax
cmp eax, 0xfff
jne 0x100065f7
cmp edi, eax
ja 0x100065c0
test edi, edi
je 0x100065f7
push dword [ebx + 0x4c]
push edi
push 1
push esi
call fcn.100168b8
add esp, 0x10
sub edi, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10009a50
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1002b210
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x10038080]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
call fcn.1000c8d7
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.1000be33
add esp, 8
mov dword [esi + 4], eax
mov ecx, edi
mov dword [edi + 0x34], esi
call fcn.100099f0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1000a370
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x10035e80
push 0x1000dd70
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x10038080]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x24], eax
mov dword [ebp - 4], 0
lea eax, [ebp - 0x20]
push eax
push 0x40
push 8
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edi, dword [ebx]
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x20]
push 8
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 4], 0xfffffffe
mov eax, edi
jmp 0x1000a3f2
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.1000c80f
mov esp, ebp
pop ebp
ret

Function at 0x1000a410
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x10035ea0
push 0x1000dd70
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x10038080]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
movss dword [ebp - 0x2c], xmm1
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x24], eax
wait
mov dword [ebp - 4], 0
lea eax, [ebp - 0x20]
push eax
push 0x40
push 8
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
movss xmm0, dword [ebp - 0x2c]
movss dword [edi], xmm0
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x20]
push 8
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
wait
jmp 0x1000a490
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.1000c80f
mov esp, ebp
pop ebp
ret
Function at 0x1000a4c0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x10035ec0
push 0x1000dd70
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x10038080]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x24], eax
wait
mov dword [ebp - 4], 0
lea eax, [ebp - 0x20]
push eax
push 0x40
push 8
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
movss xmm0, dword [edi]
movss dword [ebp - 0x2c], xmm0
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x20]
push 8
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
wait
mov dword [ebp - 4], 0xfffffffe
movss xmm0, dword [ebp - 0x2c]
jmp 0x1000a54e
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.1000c80f
mov esp, ebp
pop ebp
ret

Function at 0x10018293
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x100182d2
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x100182d2
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x100182d2
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x100182d2
cmp dword [ecx + 0x74], 0xe
jbe 0x100182d2
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x1001be52
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100300ac
push 0x100300a4
push str.FlsAlloc
push 0x1f
call fcn.1001bcda
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1001be86
push dword [ebp + 8]
mov ecx, esi
call dword [0x1002c1fc]
call esi
jmp 0x1001be8c
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1001bed0
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100300bc
push 0x100300b4
push str.FlsGetValue
push 0x21
call fcn.1001bcda
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1001bf07
push dword [ebp + 8]
mov ecx, esi
call dword [0x1002c1fc]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1001bf0f
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100300c4
push 0x100300bc
push str.FlsSetValue
push 0x22
call fcn.1001bcda
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1001bf49
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x1002c1fc]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x1001e803
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.1000d7a0
mov eax, dword [0x10038080]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.100193de
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x1001e845
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x1001e9a1
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.1002a3e0
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x10049e88]
push dword [eax + edi + 0x24]
push dword [eax + edi + 0x20]
push ebx
call fcn.1001fff1
mov ecx, dword [esi*4 + 0x10049e88]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [ecx + edi + 0x20]
jne 0x1001e99a
cmp eax, dword [ecx + edi + 0x24]
jne 0x1001e99a
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [ecx + edi + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1001e99a
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.1001fff1
add esp, 0x14
test edx, edx
jl 0x1001e99a
jg 0x1001e910
test eax, eax
jb 0x1001e99a
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x1001e99a
jl 0x1001e92a
cmp dword [ebp - 0x1008], eax
ja 0x1001e99a
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x1001e948
test ebx, ebx
je 0x1001e981
cmp ecx, edi
jae 0x1001e981
mov al, byte [ecx]
cmp al, 0xd
jne 0x1001e962
lea eax, [edi - 1]
cmp ecx, eax
jae 0x1001e96e
cmp byte [ecx + 1], 0xa
jne 0x1001e96e
inc ecx
jmp 0x1001e96e
movzx eax, al
movsx eax, byte [eax + 0x10038330]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x1001e948
cmp edx, ebx
jne 0x1001e948
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x1001e99f
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.1000c80f
leave
ret
Function at 0x1001f489
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x10049e88]
mov dword [ebp - 0xc], ecx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x1001f4c9
cmp byte [ebx], 0xa
jne 0x1001f4c9
or byte [edi + eax + 0x28], 4
jmp 0x1001f4ce
and byte [edi + eax + 0x28], 0xfb
add ecx, ebx
mov eax, ebx
mov dword [ebp - 0x10], ecx
mov esi, ebx
mov dword [ebp - 8], eax
cmp ebx, ecx
jae 0x1001f5cd
mov dl, byte [eax]
cmp dl, 0x1a
je 0x1001f5b0
inc eax
cmp dl, 0xd
je 0x1001f4fa
mov dword [ebp - 8], eax
mov byte [esi], dl
jmp 0x1001f520
cmp eax, ecx
jae 0x1001f52e
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add dword [ebp - 8], eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
xor edx, edx
inc edx
add esi, edx
cmp eax, ecx
jb 0x1001f4e2
jmp 0x1001f5cd
push 0
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1001f5ab
cmp dword [ebp - 0x10], 0
je 0x1001f5ab
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx*4 + 0x10049e88]
test byte [eax + edi + 0x28], 0x48
je 0x1001f585
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x1001f570
mov byte [esi], dl
jmp 0x1001f581
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x10049e88]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x1001f5cd
cmp byte [ebp - 1], 0xa
jne 0x1001f594
cmp esi, ebx
jne 0x1001f594
mov byte [esi], 0xa
jmp 0x1001f5cc
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.1002000f
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x1001f5cd
mov byte [esi], 0xd
jmp 0x1001f5cc
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx*4 + 0x10049e88]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x1001f5ca
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x1001f5cd
mov byte [esi], dl
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret