joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10006fe0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1004a434]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword fs:[0x2c]
mov ecx, dword [0x10081438]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x10081f18]
cmp eax, dword [ecx + 4]
jle 0x10007043
push 0x10081f18
call fcn.10014ed2
add esp, 4
cmp dword [0x10081f18], 0xffffffff
jne 0x10007043
push 0x10035720
mov dword [0x10081f30], 0x10043494
call fcn.10014d54
push 0x10081f18
call fcn.10014e88
add esp, 8
push ebx
push esi
push edi
push 0x10037f02
push 5
mov dword [ebp - 8], 0
call fcn.10014fa8
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esi, eax
mov ebx, dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
add esp, 8
test esi, esi
je 0x100070ca
lea eax, [ebp - 8]
mov byte [esi], 0xe9
push eax
push 0x40
mov ecx, 0x100071e0
push 5
sub ecx, 0x4e0546
push 0x4e0541
mov dword [esi + 1], ecx
call edi
test eax, eax
je 0x100070ca
mov eax, dword [esi]
mov ecx, 0x4e0541
mov dword [ecx], eax
mov al, byte [esi + 4]
mov byte [ecx + 4], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 5
push ecx
call edi
test eax, eax
je 0x100070ca
push 5
push 0x4e0541
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call ebx
push esi
call fcn.10014d9a
add esp, 4
push 0x10037f02
push 6
mov dword [ebp - 8], 0
call fcn.10014fa8
mov esi, eax
add esp, 8
test esi, esi
je 0x10007148
lea eax, [ebp - 8]
mov byte [esi], 0xe9
push eax
push 0x40
mov ecx, 0x10007210
sub ecx, 0x50d979
push 6
mov dword [esi + 1], ecx
push 0x50d974
mov byte [esi + 5], 0x90
call edi
test eax, eax
je 0x10007148
mov eax, dword [esi]
mov ecx, 0x50d974
mov dword [ecx], eax
mov ax, word [esi + 4]
mov word [ecx + 4], ax
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 6
push ecx
call edi
test eax, eax
je 0x10007148
push 6
push 0x50d974
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call ebx
push esi
call fcn.10014d9a
add esp, 4
push 0x10037f02
push 6
mov dword [ebp - 8], 0
call fcn.10014fa8
mov esi, eax
add esp, 8
test esi, esi
je 0x100071c6
lea eax, [ebp - 8]
mov byte [esi], 0xe9
push eax
push 0x40
mov ecx, 0x10007240
sub ecx, 0x4df308
push 6
mov dword [esi + 1], ecx
push 0x4df303
mov byte [esi + 5], 0x90
call edi
test eax, eax
je 0x100071c6
mov eax, dword [esi]
mov ecx, 0x4df303
mov dword [ecx], eax
mov ax, word [esi + 4]
mov word [ecx + 4], ax
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 6
push ecx
call edi
test eax, eax
je 0x100071c6
push 6
push 0x4df303
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call ebx
push esi
call fcn.10014d9a
add esp, 4
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100148fc
mov esp, ebp
pop ebp
ret
Function at 0x10007330
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10035310
mov eax, dword fs:[0]
push eax
sub esp, 0x130
mov eax, dword [0x1004a434]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push ecx
lea ecx, [ebp - 0x13c]
call fcn.10007310
sub esp, 0x18
lea ecx, [ebp - 0x13c]
call fcn.1000dad0
lea ecx, [ebp - 0x13c]
mov dword [ebp - 4], 0
call fcn.1000dc30
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0xa
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x100073a0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x1004a434]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x20], ebx
cmp eax, 1
jne 0x10007549
push esi
push edi
push 0
push eax
lea eax, [ebp - 0x1c]
mov dword [0x10081f38], ebx
xorps xmm0, xmm0
push eax
push str.1216883658909024366
movups xmmword [ebp - 0x1c], xmm0
movq qword [ebp - 0xc], xmm0
call fcn.1000fba0
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
add esp, 0x10
push 0
push 0
push 0
push 0x100072d0
push 0
push 0
call esi
push 0
push 0
push 0
push 0x10007720
push 0
push 0
call esi
push 0
push 0
push 0
push 0x10001d60
push 0
push 0
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.ws2_32.dll
mov dword [0x10083e84], eax
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push str.recv
push str.ws2_32.dll
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call esi
push str.send
push str.ws2_32.dll
mov dword [0x10083e9c], eax
call edi
push eax
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0
push 6
push 0x10083ea4
push dword [0x10083e9c]
mov dword [0x10083ea0], eax
call edi
mov esi, dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push eax
call esi
push 0
push 6
push 0x10083e94
push dword [0x10083ea0]
call edi
push eax
call esi
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
push str.shell32.dll
call ebx
push str.discord_rpc.dll
call ebx
cmp dword [ebp + 0x10], 0
pop edi
pop esi
jne 0x10007536
mov eax, dword fs:[0x2c]
mov ecx, dword [0x10081438]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x100846cc]
cmp eax, dword [ecx + 4]
jle 0x10007510
push 0x100846cc
call fcn.10014ed2
add esp, 4
cmp dword [0x100846cc], 0xffffffff
jne 0x10007510
push 0x10035750
mov dword [0x100846d0], 0x10043584
call fcn.10014d54
push 0x100846cc
call fcn.10014e88
add esp, 8
mov ecx, 0x100846d0
call fcn.100061a0
test al, al
jne 0x100075ac
push 0
push str.Erro:_ClientPatch.dll
push 0x1004353c
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100148fc
mov esp, ebp
pop ebp
ret 0xc
test eax, eax
jne 0x10007536
cmp dword [ebp + 0x10], eax
je 0x10007536
mov eax, dword fs:[0x2c]
mov ecx, dword [0x10081438]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x100846cc]
cmp eax, dword [ecx + 4]
jle 0x100075a5
push 0x100846cc
call fcn.10014ed2
add esp, 4
cmp dword [0x100846cc], 0xffffffff
jne 0x100075a5
push 0x10035750
mov dword [0x100846d0], 0x10043584
call fcn.10014d54
push 0x100846cc
call fcn.10014e88
add esp, 8
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov eax, 1
xor ecx, ebp
pop ebx
call fcn.100148fc
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1000d0a0
Capabilities:
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x1004a434]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
lea eax, [ebp - 8]
push eax
mov ecx, dword [0x10083e84]
push ecx
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [ebp - 8], 0x103
je 0x1000d0d4
mov edi, 0
jmp edi
mov edx, dword [0x10083e84]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x1000d0fd
mov eax, dword [0x10083e84]
push eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov edi, 0
jmp edi
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100148fc
mov esp, ebp
pop ebp
ret
Function at 0x1000d110
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x1004a434]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x10083e80]
push ebx
mov ebx, dword [ebp + 8]
inc eax
mov dword [0x10083e80], eax
push esi
push edi
cmp eax, 0x64
jl 0x1000d145
call fcn.1000d0a0
mov dword [0x10083e80], 0
movzx eax, word [ebx + 4]
mov ecx, 0x667
cmp ax, cx
jne 0x1000d19e
push 0x1388
push 0
push 0x10081f58
call fcn.10016c20
add esp, 0xc
lea ecx, [ebx + 0xc]
push 0x1388
push ecx
push 0x10081f58
call fcn.100166a0
mov ecx, dword [ebx + 0x1394]
add esp, 0xc
mov dword [0x1008331c], ecx
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100148fc
mov esp, ebp
pop ebp
ret 8
mov ecx, 0xd1d
cmp ax, cx
jne 0x1000d1e0
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push 0x49b50a
mov dword [ebp - 8], 0x40
call esi
lea eax, [ebp - 8]
mov dword [0x49b50b], 0xffffaaaa
push eax
push dword [ebp - 8]
push 4
push 0x49b50a
call esi
jmp 0x1000d189
mov ecx, 0x5000
cmp ax, cx
jne 0x1000d248
mov esi, dword [ebx + 0x6c]
lea eax, [ebx + 0xc]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push 0x49b50a
mov dword [ebp - 8], 0x40
call edi
mov dword [0x49b50b], esi
mov eax, dword [0x6bdaf0]
mov dword [ebp - 0x10], eax
push dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
call dword [0x1004ae7c]
lea eax, [ebp - 8]
mov dword [0x49b50b], 0xffffaaaa
push eax
push dword [ebp - 8]
push 4
push 0x49b50a
call edi
jmp 0x1000d189
mov ecx, 0xd1e
cmp ax, cx
jne 0x1000d299
mov edi, dword [ebx + 0x68]
test edi, edi
je 0x1000d28b
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push 0x4a571c
mov dword [ebp - 8], 0x40
call esi
lea eax, [ebp - 8]
mov dword [0x4a571c], edi
push eax
push dword [ebp - 8]
push 4
push 0x4a571c
call esi
mov eax, 0xd1d
mov word [ebx + 4], ax
jmp 0x1000d189
mov ecx, 0xaf1
cmp ax, cx
jne 0x1000d2e7
mov esi, dword [ebx + 0x68]
lea eax, [ebx + 0xc]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push 0x49b50a
mov dword [ebp - 8], 0x40
call edi
mov dword [0x49b50b], esi
mov eax, dword [0x6bdaf0]
mov dword [ebp - 0xc], eax
push dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
call dword [0x1004ae7c]
jmp 0x1000d229
mov ecx, 0x666
cmp ax, cx
jne 0x1000d32c
movups xmm0, xmmword [ebx + 0x10]
movups xmmword [0x100832e0], xmm0
movups xmm0, xmmword [ebx + 0x20]
movups xmmword [0x100832f0], xmm0
movups xmm0, xmmword [ebx + 0x30]
movups xmmword [0x10083300], xmm0
movq xmm0, qword [ebx + 0x40]
movq qword [0x10083310], xmm0
mov eax, dword [ebx + 0x48]
mov dword [0x10083318], eax
jmp 0x1000d189
mov ecx, 0xafa
cmp ax, cx
jne 0x1000d189
movzx eax, word [ebx + 0xc]
cmp ax, 1
jne 0x1000d34c
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp ax, 2
je 0x1000d362
cmp ax, 3
je 0x1000d362
cmp ax, 4
jne 0x1000d189
call fcn.1000cf70
int3
Function at 0x1000d7e0
Capabilities:
Terminate process

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x1004a434]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebx + 8]
push esi
push edi
mov dword [ebp - 0x44], eax
jmp 0x1000d81d
cmp dword [ebx + 0x10], 0
jne 0x1000d8d0
mov esi, dword [ebp - 0x44]
mov eax, 0x20d
cmp word [esi + 4], ax
jne 0x1000d8d0
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.RPCRT4.dll_UuidCreateSequential]
movzx eax, byte [ebp - 0x31]
xorps xmm0, xmm0
push eax
movzx eax, byte [ebp - 0x32]
push eax
movzx eax, byte [ebp - 0x33]
push eax
movzx eax, byte [ebp - 0x34]
push eax
movzx eax, byte [ebp - 0x35]
push eax
movzx eax, byte [ebp - 0x36]
push eax
lea eax, [ebp - 0x30]
movaps xmmword [ebp - 0x30], xmm0
push str._02X:_02X:_02X:_02X:_02X:_02X
push eax
mov word [ebp - 0x20], 0
call fcn.10006100
lea ecx, [ebp - 0x30]
add esp, 0x20
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1000d885
sub ecx, edx
cmp ecx, 0xc
jge 0x1000d89b
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea edx, [esi + 0x42]
xorps xmm0, xmm0
lea eax, [ebp - 0x30]
movups xmmword [edx], xmm0
mov ecx, eax
mov word [edx + 0x10], 0
sub edx, ecx
mov cl, byte [eax]
lea eax, [eax + 1]
mov byte [edx + eax - 1], cl
test cl, cl
jne 0x1000d8b1
mov eax, 0x60b
mov word [esi + 0x54], ax
mov eax, 0x1221
mov word [esi + 0x5c], ax
jmp 0x1000d8e2
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
pop esi
call fcn.100148fc
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x1000fba0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push 0x10037f02
push 0x64
call fcn.10015314
mov esi, eax
add esp, 8
test esi, esi
je 0x1000fd3c
push 0x64
push 0
push esi
call fcn.10016c20
lea eax, [esi + 4]
mov byte [esi], 1
mov dword [eax + 4], 0
xorps xmm0, xmm0
mov dword [eax + 8], 0
movups xmmword [eax + 0xc], xmm0
push 2
movq qword [eax + 0x1c], xmm0
mov dword [eax + 0x24], 0
push eax
mov dword [eax + 0x28], 0
mov dword [eax + 0x2c], 0
call fcn.10013f7d
lea eax, [esi + 0x34]
push eax
call fcn.1001410c
xorps xmm0, xmm0
mov dword [0x10070e3c], esi
add esp, 0x18
movq qword [esi + 0x5c], xmm0
cmp dword [ebp + 0x10], 0
mov esi, dword [ebp + 8]
je 0x1000fc4a
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x1000fc3f
cmp byte [eax], 0
je 0x1000fc3f
push eax
push esi
call fcn.10010150
jmp 0x1000fc47
push 0
push esi
call fcn.100100d0
add esp, 8
call sub.KERNEL32.dll_GetCurrentProcessId
push 0x1004b740
mov dword [0x10070e38], eax
call fcn.10013f9e
add esp, 4
test eax, eax
jne 0x1000fd4b
cmp dword [0x1004b76c], 0x7fffffff
je 0x1000fd52
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x1000fc91
movups xmm0, xmmword [eax]
movups xmmword [0x1006c7e8], xmm0
movq xmm0, qword [eax + 0x10]
jmp 0x1000fc9b
xorps xmm0, xmm0
movups xmmword [0x1006c7e8], xmm0
movq qword [0x1006c7f8], xmm0
xorps xmm0, xmm0
push 0x1004b740
movups xmmword [0x1006c800], xmm0
movq qword [0x1006c810], xmm0
call fcn.10013fc3
add esp, 4
cmp dword [0x1006c7e4], 0
jne 0x1000fd46
push esi
call fcn.100125e0
mov dword [0x1006c7e4], eax
mov dword [eax + 8], 0x1000e500
mov eax, dword [0x1006c7e4]
mov dword [eax + 0xc], 0x1000e510
mov al, 1
mov esi, dword [0x10070e3c]
xchg byte [esi], al
push 4
call fcn.1001490a
add esp, 8
test eax, eax
je 0x1000fd05
mov dword [eax], esi
jmp 0x1000fd07
xor eax, eax
lea ecx, [ebp - 4]
push ecx
push 0
push eax
push 0x1000e560
push 0
push 0
call fcn.1002011b
mov ecx, eax
add esp, 0x18
mov dword [ebp - 8], ecx
test ecx, ecx
je 0x1000fd68
cmp dword [esi + 0x60], 0
jne 0x1000fd63
mov eax, dword [ebp - 4]
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], eax
pop esi
mov esp, ebp
pop ebp
ret
mov dword [0x10070e3c], 0
pop esi
mov esp, ebp
pop ebp
ret
push 5
call fcn.100142cc
push 6
mov dword [0x1004b76c], 0x7ffffffe
call fcn.100142cc
call fcn.1001ff1b
push 6
mov dword [ebp - 4], 0
call fcn.100142cc
int3
Function at 0x10010150
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa94
mov eax, dword [0x1004a434]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x84]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push edi
mov edi, dword [ebp + 0xc]
push 0x20
push ecx
push 0xffffffffffffffff
push eax
push 0
push 0xfde9
call esi
push 0x20
lea eax, [ebp - 0x44]
push eax
push 0xffffffffffffffff
push edi
push 0
push 0xfde9
call esi
lea eax, [ebp - 0xa90]
push eax
push 0x20019
push 0
push str.SoftwareValveSteam
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x100101c4
push str.Error_opening_Steam_key_n
jmp 0x10010284
lea eax, [ebp - 0xa94]
mov dword [ebp - 0xa94], 0x208
push eax
lea eax, [ebp - 0x28c]
push eax
push 0
push 0
push str.SteamExe
push dword [ebp - 0xa90]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0xa90]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x1001027f
mov ecx, dword [ebp - 0xa94]
cmp ecx, 1
jb 0x1001027f
shr ecx, 1
mov eax, esi
je 0x10010238
lea edx, [esi + 0x5c]
nop word [eax + eax]
cmp word [ebp + eax*2 - 0x28c], 0x2f
jne 0x10010233
mov word [ebp + eax*2 - 0x28c], dx
inc eax
cmp eax, ecx
jb 0x10010220
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x28c]
push eax
push str.__s__steam:__rungameid__s
lea eax, [ebp - 0xa8c]
push 0x800
push eax
call fcn.10010060
lea eax, [ebp - 0xa8c]
push eax
lea eax, [ebp - 0x84]
push eax
call fcn.1000fd80
add esp, 0x1c
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100148fc
mov esp, ebp
pop ebp
ret
push str.Error_reading_SteamExe_key_n
push 2
call fcn.10019838
add esp, 4
push eax
call fcn.100102b0
mov ecx, dword [ebp - 4]
add esp, 8
xor ecx, ebp
pop edi
pop esi
call fcn.100148fc
mov esp, ebp
pop ebp
ret
Function at 0x10010320
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x1004a434]
xor eax, ebp
mov dword [ebp - 4], eax
movups xmm0, xmmword [str._pipediscord_ipc_0]
mov eax, dword [0x100365b8]
push ebx
push esi
push edi
push 0
push 0
mov dword [ebp - 0xc], eax
mov esi, ecx
mov ax, word [0x100365bc]
push 3
movups xmmword [ebp - 0x34], xmm0
push 0
movups xmm0, xmmword [0x100365a0]
mov word [ebp - 8], ax
mov eax, 0x30
push 0
mov word [ebp - 0xa], ax
lea eax, [ebp - 0x34]
movups xmmword [ebp - 0x24], xmm0
push 0xc0000000
movq xmm0, qword [0x100365b0]
push eax
movq qword [ebp - 0x14], xmm0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi + 4], eax
cmp eax, 0xffffffff
jne 0x100103f0
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, dword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
call edi
cmp eax, 2
jne 0x100103b9
mov ax, word [ebp - 0xa]
cmp ax, 0x39
jae 0x10010406
inc ax
mov word [ebp - 0xa], ax
jmp 0x100103cf
cmp eax, 0xe7
jne 0x10010406
push 0x2710
lea eax, [ebp - 0x34]
push eax
call ebx
test eax, eax
je 0x10010406
push 0
push 0
push 3
push 0
push 0
push 0xc0000000
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi + 4], eax
cmp eax, 0xffffffff
je 0x100103a0
pop edi
mov byte [esi], 1
mov al, 1
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100148fc
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100148fc
mov esp, ebp
pop ebp
ret

Function at 0x1001f83c
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x1001f87b
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1001f87b
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1001f87b
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x1001f87b
cmp dword [ecx + 0x74], 0xe
jbe 0x1001f87b
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x10026087
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1003b5cc
push 0x1003b5c4
push str.FlsAlloc
push 0x1f
call fcn.10025f0f
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100260bb
push dword [ebp + 8]
mov ecx, esi
call dword [0x10036258]
call esi
jmp 0x100260c1
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x10026105
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1003b5dc
push 0x1003b5d4
push str.FlsGetValue
push 0x21
call fcn.10025f0f
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1002613c
push dword [ebp + 8]
mov ecx, esi
call dword [0x10036258]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x10026144
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1003b5e4
push 0x1003b5dc
push str.FlsSetValue
push 0x22
call fcn.10025f0f
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1002617e
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x10036258]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x1002886f
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.10015460
mov eax, dword [0x1004a434]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.10025762
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x100288b1
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x10028a0d
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.10015370
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x10081ad8]
push dword [eax + edi + 0x24]
push dword [eax + edi + 0x20]
push ebx
call fcn.10029670
mov ecx, dword [esi*4 + 0x10081ad8]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [ecx + edi + 0x20]
jne 0x10028a06
cmp eax, dword [ecx + edi + 0x24]
jne 0x10028a06
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [ecx + edi + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10028a06
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.10029670
add esp, 0x14
test edx, edx
jl 0x10028a06
jg 0x1002897c
test eax, eax
jb 0x10028a06
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x10028a06
jl 0x10028996
cmp dword [ebp - 0x1008], eax
ja 0x10028a06
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x100289b4
test ebx, ebx
je 0x100289ed
cmp ecx, edi
jae 0x100289ed
mov al, byte [ecx]
cmp al, 0xd
jne 0x100289ce
lea eax, [edi - 1]
cmp ecx, eax
jae 0x100289da
cmp byte [ecx + 1], 0xa
jne 0x100289da
inc ecx
jmp 0x100289da
movzx eax, al
movsx eax, byte [eax + 0x1004a6a8]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x100289b4
cmp edx, ebx
jne 0x100289b4
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x10028a0b
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.100148fc
leave
ret
Function at 0x10028b08
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x10081ad8]
mov dword [ebp - 0xc], ecx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x10028b48
cmp byte [ebx], 0xa
jne 0x10028b48
or byte [edi + eax + 0x28], 4
jmp 0x10028b4d
and byte [edi + eax + 0x28], 0xfb
add ecx, ebx
mov eax, ebx
mov dword [ebp - 0x10], ecx
mov esi, ebx
mov dword [ebp - 8], eax
cmp ebx, ecx
jae 0x10028c4c
mov dl, byte [eax]
cmp dl, 0x1a
je 0x10028c2f
inc eax
cmp dl, 0xd
je 0x10028b79
mov dword [ebp - 8], eax
mov byte [esi], dl
jmp 0x10028b9f
cmp eax, ecx
jae 0x10028bad
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add dword [ebp - 8], eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
xor edx, edx
inc edx
add esi, edx
cmp eax, ecx
jb 0x10028b61
jmp 0x10028c4c
push 0
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10028c2a
cmp dword [ebp - 0x10], 0
je 0x10028c2a
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx*4 + 0x10081ad8]
test byte [eax + edi + 0x28], 0x48
je 0x10028c04
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x10028bef
mov byte [esi], dl
jmp 0x10028c00
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x10081ad8]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x10028c4c
cmp byte [ebp - 1], 0xa
jne 0x10028c13
cmp esi, ebx
jne 0x10028c13
mov byte [esi], 0xa
jmp 0x10028c4b
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.1002968e
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x10028c4c
mov byte [esi], 0xd
jmp 0x10028c4b
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx*4 + 0x10081ad8]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x10028c49
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x10028c4c
mov byte [esi], dl
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret