joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003b510
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, edx
not ebx
mov esi, ecx
mov eax, ebx
test edi, edi
je 0x1003b571
mov cl, byte [esi]
lea esi, [esi + 1]
dec edi
cmp cl, 0x23
jne 0x1003b554
cmp edi, 2
jb 0x1003b554
cmp byte [esi], cl
jne 0x1003b554
cmp byte [esi + 1], cl
jne 0x1003b554
mov eax, ebx
movzx ecx, cl
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x10104c08]
jmp 0x1003b525
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x10104c08]
test edi, edi
jne 0x1003b525
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
mov cl, byte [esi]
inc esi
test cl, cl
je 0x1003b5a0
cmp cl, 0x23
jne 0x1003b587
cmp byte [esi], cl
jne 0x1003b587
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x10104c08]
test cl, cl
jne 0x1003b578
pop edi
pop esi
not eax
pop ebx
pop ebp
ret

Function at 0x1003b6b0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x1003b6c3
mov dword [edi], 0
mov edx, 0x1010ac34
call fcn.1003b5b0
mov esi, eax
test esi, esi
je 0x1003b7ac
push esi
call fcn.100a2110
add esp, 4
mov dword [ebp + 8], eax
cmp eax, 0xffffffff
je 0x1003b7a3
push 2
push 0
push esi
call fcn.100a2780
add esp, 0xc
test eax, eax
jne 0x1003b7a3
push esi
call fcn.100a2110
mov ebx, eax
add esp, 4
cmp ebx, 0xffffffff
je 0x1003b7a3
push 0
push dword [ebp + 8]
push esi
call fcn.100a2780
add esp, 0xc
test eax, eax
jne 0x1003b7a3
mov eax, dword [0x101273e8]
test eax, eax
je 0x1003b736
inc dword [eax + 0x370]
push dword [0x101273e0]
push ebx
call fcn.1003af30
add esp, 8
mov dword [ebp + 8], eax
test eax, eax
je 0x1003b7a3
push esi
push ebx
push 1
push eax
call fcn.100a3720
add esp, 0x10
push esi
cmp eax, ebx
je 0x1003b78d
call fcn.10093280
mov eax, dword [0x101273e8]
add esp, 4
test eax, eax
je 0x1003b775
dec dword [eax + 0x370]
push dword [0x101273e0]
push dword [ebp + 8]
call fcn.1003af40
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
call fcn.10093280
add esp, 4
test edi, edi
je 0x1003b79b
mov dword [edi], ebx
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
pop ebp
ret
push esi
call fcn.10093280
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x1003df10
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ecx + 0xc0]
mov eax, dword [ecx + 0xc8]
push esi
push edi
lea esi, [ebp + 8]
mov edi, 4
mov eax, dword [eax + edx*4 - 4]
not eax
nop
movzx ecx, byte [esi]
lea esi, [esi + 1]
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x10104c08]
sub edi, 1
jne 0x1003df30
mov ecx, dword [0x101273e8]
not eax
pop edi
pop esi
cmp dword [ecx + 0x1aa4], eax
jne 0x1003df62
mov dword [ecx + 0x1aa8], eax
cmp dword [ecx + 0x1adc], eax
jne 0x1003df71
mov byte [ecx + 0x1ae0], 1
pop ebp
ret 4
Function at 0x10041a30
Capabilities:
Hash data with crc32

Disassembly:
push ebx
mov bl, byte [ecx]
or eax, 0xffffffff
push esi
lea esi, [ecx + 1]
or ecx, 0xffffffff
push edi
test bl, bl
je 0x10041a6f
cmp bl, 0x23
jne 0x10041a51
cmp byte [esi], bl
jne 0x10041a51
cmp byte [esi + 1], bl
cmove eax, ecx
movzx edx, al
movzx ecx, bl
mov bl, byte [esi]
xor edx, ecx
shr eax, 8
inc esi
mov ecx, 0xffffffff
xor eax, dword [edx*4 + 0x10104c08]
test bl, bl
jne 0x10041a42
mov ecx, dword [0x101273e8]
not eax
mov esi, dword [ecx + 0x1a5c]
mov edi, dword [ecx + 0x1a64]
lea ebx, [edi + esi*8]
test esi, esi
je 0x10041aae
nop word [eax + eax]
mov edx, esi
shr edx, 1
cmp dword [edi + edx*8], eax
lea ecx, [edi + edx*8]
jae 0x10041aa8
lea edi, [ecx + 8]
or ecx, 0xffffffff
sub ecx, edx
add esi, ecx
jmp 0x10041aaa
mov esi, edx
test esi, esi
jne 0x10041a90
cmp edi, ebx
je 0x10041abd
cmp dword [edi], eax
jne 0x10041abd
mov eax, dword [edi + 4]
pop edi
pop esi
pop ebx
ret
pop edi
pop esi
xor eax, eax
pop ebx
ret

Function at 0x1004b880
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push esi
mov esi, dword [0x101273e8]
push edi
cmp byte [esi + 0x2db0], 0
je 0x1004b91e
cmp dword [esi + 0x2db8], 0
lea edi, [esi + 0x2dbc]
je 0x1004b910
mov ecx, dword [edi + 4]
test ecx, ecx
jns 0x1004b8c9
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
xor ecx, ecx
test eax, eax
cmovg ecx, eax
push ecx
mov ecx, edi
call fcn.1004d070
lea eax, [ebp + 0xc]
mov dword [edi], 0
push eax
push dword [ebp + 8]
mov ecx, edi
call fcn.1003bc40
mov edx, dword [edi]
mov ecx, 0x101273e4
push dword [esi + 0x2db8]
lea eax, [edx - 1]
neg edx
sbb edx, edx
and edx, eax
mov eax, dword [esi + 0x2dc4]
test eax, eax
push edx
cmovne ecx, eax
push 1
push ecx
call fcn.100a0be0
add esp, 0x10
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [ebp + 0xc]
mov ecx, edi
push eax
push dword [ebp + 8]
call fcn.1003bc40
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10054f40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x10054f7c
mov eax, dword [0x101273e8]
mov dword [esi + 4], 0
mov dword [esi], 0
test eax, eax
je 0x10054f66
dec dword [eax + 0x370]
push dword [0x101273e0]
push ecx
call fcn.1003af40
add esp, 8
mov dword [esi + 8], 0
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x10054fb6
mov eax, dword [0x101273e8]
mov dword [esi + 0x10], 0
mov dword [esi + 0xc], 0
test eax, eax
je 0x10054fa0
dec dword [eax + 0x370]
push dword [0x101273e0]
push ecx
call fcn.1003af40
add esp, 8
mov dword [esi + 0x14], 0
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x10054ff0
mov eax, dword [0x101273e8]
mov dword [esi + 0x1c], 0
mov dword [esi + 0x18], 0
test eax, eax
je 0x10054fda
dec dword [eax + 0x370]
push dword [0x101273e0]
push ecx
call fcn.1003af40
add esp, 8
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov ecx, dword [esi + 0x44]
test ecx, ecx
je 0x10055046
mov eax, dword [0x101273e8]
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
test eax, eax
je 0x10055030
dec dword [eax + 0x370]
push dword [0x101273e0]
push ecx
call fcn.1003af40
add esp, 8
mov dword [esi + 0x44], 0
mov ecx, dword [esi + 0x50]
test ecx, ecx
je 0x10055080
mov eax, dword [0x101273e8]
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
test eax, eax
je 0x1005506a
dec dword [eax + 0x370]
push dword [0x101273e0]
push ecx
call fcn.1003af40
add esp, 8
mov dword [esi + 0x50], 0
mov ecx, dword [esi + 0x5c]
test ecx, ecx
je 0x100550ba
mov eax, dword [0x101273e8]
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0
test eax, eax
je 0x100550a4
dec dword [eax + 0x370]
push dword [0x101273e0]
push ecx
call fcn.1003af40
add esp, 8
mov dword [esi + 0x5c], 0
lea ecx, [esi + 0x78]
pop esi
jmp fcn.100571d0
Function at 0x10068380
Capabilities:
Hash data with crc32

Disassembly:
test dword [ecx + 0xc], 0x100000
push esi
push edi
mov edi, edx
je 0x100683f0
mov cl, byte [edi]
lea esi, [edi + 1]
or eax, 0xffffffff
test cl, cl
je 0x100683c8
or edi, 0xffffffff
nop dword [eax]
cmp cl, 0x23
jne 0x100683af
cmp byte [esi], cl
jne 0x100683af
cmp byte [esi + 1], cl
cmove eax, edi
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x10104c08]
test cl, cl
jne 0x100683a0
mov ecx, dword [0x101273e8]
not eax
cmp dword [ecx + 0x1aa4], eax
jne 0x100683de
mov dword [ecx + 0x1aa8], eax
cmp dword [ecx + 0x1adc], eax
jne 0x10068435
pop edi
mov byte [ecx + 0x1ae0], 1
pop esi
ret
mov esi, dword [0x101273e8]
xor edx, edx
mov eax, dword [esi + 0x1a6c]
mov ecx, dword [eax + 0xc0]
mov eax, dword [eax + 0xc8]
push dword [eax + ecx*4 - 4]
mov ecx, edi
call fcn.1003b510
add esp, 4
cmp dword [esi + 0x1aa4], eax
jne 0x10068426
mov dword [esi + 0x1aa8], eax
cmp dword [esi + 0x1adc], eax
jne 0x10068435
mov byte [esi + 0x1ae0], 1
pop edi
pop esi
ret

Function at 0x1006a900
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push esi
mov esi, dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
mov eax, dword [ebp + 0xc]
xorps xmm0, xmm0
movlpd qword [0x101274cc], xmm0
mov dword [0x101274d4], 0
movlpd qword [0x101274e4], xmm0
mov dword [0x101274ec], 1
mov dword [0x101274f0], 0x1010af70
mov dword [0x101274d8], 1
mov dword [0x101274dc], 0
mov dword [0x101274e0], 0
mov dword [0x101274c8], 0x1006a9f0
sub eax, 0
je 0x1006a9dd
sub eax, 1
jne 0x1006a9e4
push ecx
mov edx, 0x101274c8
mov ecx, esi
call fcn.1001c350
add esp, 4
call fcn.10085b40
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call fcn.10086030
push 0x1007cca0
push 0x101274b0
mov dword [0x101274b0], 0x4b59d0
call fcn.100853e0
call fcn.10085ba0
call fcn.10085ba0
push 0
push 0
push 0
push 0x1007f2b0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret 0xc
mov ecx, esi
call fcn.1001c950
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1006ee30
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x10122064]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [0x101273e8]
lea eax, [ebp - 0x14]
push esi
push edi
push eax
push dword [0x10127734]
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x14]
movd xmm1, eax
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
lea eax, [ebp - 0x30]
cvtdq2ps xmm0, xmm0
push eax
movss dword [ebx + 0x10], xmm1
movss dword [ebx + 0x14], xmm0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov edi, dword [ebp - 0x30]
mov ecx, edi
sub ecx, dword [0x10127738]
mov esi, dword [ebp - 0x2c]
mov edx, esi
sbb edx, dword [0x1012773c]
call fcn.100dbd10
mov edx, dword [0x10127744]
mov ecx, dword [0x10127740]
cvtsd2ss xmm0, xmm0
movss dword [ebp - 0x18], xmm0
call fcn.100dbd10
movss xmm1, dword [ebp - 0x18]
cvtsd2ss xmm0, xmm0
push 0x11
divss xmm1, xmm0
movss dword [ebx + 0x18], xmm1
mov dword [0x1012773c], esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
mov dword [0x10127738], edi
call esi
shr eax, 0xf
and al, 1
push 0x10
mov byte [ebx + 0xfc], al
call esi
shr eax, 0xf
and al, 1
push 0x12
mov byte [ebx + 0xfd], al
call esi
mov ecx, dword [0x101273e8]
shr eax, 0xf
and al, 1
mov byte [ebx + 0xff], 0
mov byte [ebx + 0xfe], al
cmp byte [ecx + 0x357], 0
lea esi, [ecx + 0xe4]
je 0x1006ef57
cvttss2si eax, dword [esi]
mov dword [ebp - 0x1c], eax
cvttss2si eax, dword [ecx + 0xe8]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x1c]
push eax
push dword [0x10127734]
call dword [sym.imp.USER32.dll_ClientToScreen]
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
call dword [sym.imp.USER32.dll_SetCursorPos]
mov dword [esi], 0xff7fffff
mov dword [esi + 4], 0xff7fffff
call dword [sym.imp.USER32.dll_GetForegroundWindow]
test eax, eax
je 0x1006efbf
mov ecx, dword [0x10127734]
cmp eax, ecx
je 0x1006ef84
push ecx
push eax
call dword [sym.imp.USER32.dll_IsChild]
test eax, eax
je 0x1006efbf
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x1006efbf
lea eax, [ebp - 0x24]
push eax
push dword [0x10127734]
call dword [sym.imp.USER32.dll_ScreenToClient]
test eax, eax
je 0x1006efbf
movd xmm0, dword [ebp - 0x24]
movd xmm1, dword [ebp - 0x20]
cvtdq2ps xmm0, xmm0
cvtdq2ps xmm1, xmm1
movss dword [esi], xmm0
movss dword [esi + 4], xmm1
cmp byte [ebx + 0xb0], 0
je 0x1006efcd
or eax, 0xffffffff
jmp 0x1006efd8
mov eax, dword [0x101273e8]
mov eax, dword [eax + 0x1d10]
cmp dword [0x10122de0], eax
je 0x1006efea
mov dword [0x10122de0], eax
call fcn.1006ea90
call fcn.1006ebb0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1008a020
mov esp, ebp
pop ebp
ret
Function at 0x10070ef0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
cmp dword [ecx + 0x38], 0
push ebx
push esi
push edi
mov dword [esp + 0xc], ecx
je 0x10070fd8
mov esi, dword [ebp + 0x10]
mov ebx, esi
mov edx, dword [ebp + 0xc]
mov edi, edx
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], eax
test esi, esi
jl 0x10070fc7
jg 0x10070f30
test edx, edx
je 0x10070fc7
nop dword [eax]
call fcn.1006d680
mov esi, eax
mov eax, edx
mov dword [esp + 0x14], eax
test eax, eax
jl 0x10070f84
jg 0x10070f47
test esi, esi
je 0x10070f84
cmp ebx, eax
jg 0x10070f57
jl 0x10070f51
cmp edi, esi
jae 0x10070f57
mov esi, edi
mov dword [esp + 0x14], ebx
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
push esi
push eax
mov eax, dword [ecx + 0x20]
push dword [eax]
call fcn.1008caf0
mov ecx, dword [esp + 0x18]
add esp, 0xc
sub edi, esi
sbb ebx, dword [esp + 0x14]
mov eax, dword [ecx + 0x30]
sub dword [eax], esi
mov eax, dword [ecx + 0x20]
add dword [eax], esi
jmp 0x10070fab
mov ecx, dword [esp + 0xc]
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
mov eax, dword [esp + 0x10]
movzx eax, byte [eax]
push eax
call edx
cmp eax, 0xffffffff
je 0x10070fc1
mov ecx, dword [esp + 0xc]
add edi, 0xffffffff
mov esi, 1
adc ebx, 0xffffffff
add dword [esp + 0x10], esi
test ebx, ebx
jg 0x10070f30
jl 0x10070fc1
test edi, edi
jne 0x10070f30
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
sub edx, edi
mov eax, edx
sbb esi, ebx
mov edx, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ecx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x20], esi
mov edx, dword [eax]
lea eax, [ecx + 0x30]
mov dword [esp + 0x24], edi
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], eax
test edx, edx
je 0x10071000
mov eax, dword [eax]
mov edx, dword [eax]
jmp 0x10071006
xor edx, edx
mov dword [esp + 0x18], eax
mov eax, edx
cdq
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], edx
test edi, edi
jl 0x1007106e
jg 0x1007101b
test esi, esi
je 0x1007106e
test edx, edx
jl 0x10071069
jg 0x10071025
test eax, eax
je 0x10071069
cmp edi, edx
jg 0x10071039
jl 0x1007102f
cmp esi, eax
jae 0x10071039
mov eax, esi
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], edi
mov ebx, dword [ebp + 8]
push eax
push ebx
push dword [esp + 0x24]
call fcn.1008caf0
mov eax, dword [esp + 0x24]
add esp, 0xc
mov edx, dword [esp + 0x14]
add ebx, edx
mov ecx, dword [esp + 0xc]
sub esi, edx
mov eax, dword [eax]
sbb edi, dword [esp + 0x10]
sub dword [eax], edx
mov eax, dword [ecx + 0x20]
add dword [eax], edx
jmp 0x10071071
mov ebx, dword [ebp + 8]
jmp 0x1007107b
mov ebx, dword [ebp + 8]
test edi, edi
jl 0x10071094
jg 0x1007107b
test esi, esi
je 0x10071094
mov eax, dword [ecx + 0x4c]
test eax, eax
je 0x10071094
push eax
push esi
push 1
push ebx
call fcn.100a0be0
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100715c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x10122064]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x100715f0
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1008a020
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x1007162c
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x1007162c
lea ecx, [edi - 1]
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1008a020
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x10071716
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x10071654
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x10071687
push dword [esi + 0x4c]
movsx eax, bl
push eax
call fcn.100ac9f0
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1008a020
mov esp, ebp
pop ebp
ret 4
mov byte [ebp - 0x25], bl
mov eax, dword [ecx]
mov edx, dword [eax + 0x1c]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [esi + 0x40]
push eax
call edx
sub eax, 0
je 0x100716e9
sub eax, 1
je 0x100716e9
sub eax, 2
jne 0x10071716
push dword [esi + 0x4c]
movsx eax, byte [ebp - 0x25]
push eax
call fcn.100ac9f0
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1008a020
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x10071706
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.100a0be0
add esp, 0x10
cmp edi, eax
jne 0x10071716
lea eax, [ebp - 0x25]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
jne 0x10071617
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1008a020
mov esp, ebp
pop ebp
ret 4
Function at 0x10072080
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x10122064]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x1007213c
cmp byte [esi + 0x3d], 0
je 0x1007213c
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x1007212a
mov ecx, dword [esi + 0x38]
mov eax, dword [ecx]
mov edx, dword [eax + 0x20]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call edx
sub eax, 0
je 0x100720f2
sub eax, 1
je 0x100720f6
sub eax, 2
jne 0x1007212a
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1008a020
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x10072113
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.100a0be0
add esp, 0x10
cmp edi, eax
jne 0x1007212a
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1008a020
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1008a020
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.1008a020
mov esp, ebp
pop ebp
ret

Function at 0x10072490
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e1290
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x10122064]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
push 0x47
push str.C:Program_FilesMicrosoft_Visual_Studio2022CommunityVCToolsMSVC14.30.30705includexlocale
push 2
push 8
mov dword [eax], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.10095680
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10072560
push 1
mov dword [ebp - 4], 0
call fcn.10087940
mov dword [esi + 4], eax
add esp, 4
mov eax, dword [ebp - 0x10]
lea edi, [eax + 0x14]
lea ecx, [eax + 0x18]
lea edx, [eax + 0x24]
mov dword [eax + 0x34], esi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [ebx], 0
mov dword [edi], 0
mov dword [edx], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.10087380
int3
Function at 0x10084290
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
sub eax, 0x10000
push eax
call fcn.10084440
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jbe 0x1008435d
mov edx, dword [ebp - 4]
cmp edx, dword [section..data]
jb 0x100842da
mov eax, dword [ebp - 4]
cmp eax, dword [0x10122004]
ja 0x100842da
mov ecx, dword [ebp - 4]
sub ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x100842aa
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call fcn.1008d070
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x10084300
jmp 0x1008435d
cmp dword [ebp - 0x14], 0x10000
jne 0x10084343
cmp dword [ebp - 0x18], 0x10000
jb 0x10084343
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10084336
mov eax, dword [ebp - 8]
jmp 0x1008435f
mov eax, dword [ebp - 4]
sub eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x10084358
mov ecx, dword [ebp - 0x20]
sub ecx, 0x10000
push ecx
call fcn.10084440
add esp, 4
mov dword [ebp - 4], eax
jmp 0x100842aa
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x10084370
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push eax
call fcn.10084470
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x10084435
mov edx, dword [ebp - 4]
cmp edx, dword [section..data]
jb 0x100843b5
mov eax, dword [ebp - 4]
cmp eax, dword [0x10122004]
ja 0x100843b5
mov ecx, dword [ebp - 4]
add ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x10084385
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call fcn.1008d070
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x100843db
jmp 0x10084435
cmp dword [ebp - 0x14], 0x10000
jne 0x1008441e
cmp dword [ebp - 0x18], 0x10000
jb 0x1008441e
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10084411
mov eax, dword [ebp - 8]
jmp 0x10084437
mov eax, dword [ebp - 4]
add eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x10084430
mov ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 0x18]
push ecx
call fcn.10084470
add esp, 4
mov dword [ebp - 4], eax
jmp 0x10084385
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10090520
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.10090140
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x10090552
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 8]
call dword [0x100e82b8]
call dword [ebp - 8]
jmp 0x1009055c
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esp, ebp
pop ebp
ret

Function at 0x100cd281
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100db9f0

Function at 0x100cd28c
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100ccdc5