joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403afb
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x9c]
sub esp, 0x11c
mov eax, dword [0x422108]
xor eax, ebp
mov dword [ebp + 0x98], eax
mov eax, dword [ebp + 0xa8]
push ebx
mov ebx, dword [ebp + 0xac]
push esi
mov esi, dword [ebp + 0xa4]
imul esi, esi, 0xc
mov ecx, dword [esi + 0x422054]
push edi
mov dword [ebp - 0x78], eax
mov eax, dword [esi + 0x422050]
movzx eax, ax
push ecx
mov edi, ebx
shr edi, 8
push eax
not edi
push 0
and edi, 1
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push 0
mov dword [ebp - 0x70], eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push dword [ebp - 0x70]
mov dword [ebp - 0x74], eax
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push dword [esi + 0x422058]
mov dword [ebp - 0x7c], eax
push dword [ebp - 0x78]
lea eax, [ebp - 0x6c]
push 0x41a3e0
push eax
call fcn.0040b11c
add esp, 0x10
and ebx, 0xffff00ff
mov dword [ebp - 0x70], ebx
xor ebx, ebx
push ebx
push 0x80
push dword [ebp - 0x70]
lea eax, [ebp - 0x6c]
push ebx
push ebx
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x403bda
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x20
je 0x403bd5
cmp eax, 0x21
je 0x403bd5
mov eax, 0x80004005
jmp 0x403c1a
push 0xfffffffffffffffd
pop eax
jmp 0x403c1a
cmp dword [ebp - 0x70], 3
jne 0x403be9
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x403c18
push ebx
lea eax, [ebp - 0x80]
push eax
push dword [ebp - 0x74]
push dword [ebp - 0x7c]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x403bce
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp edi, ebx
je 0x403c18
lea eax, [ebp - 0x6c]
push eax
call fcn.0040358d
test eax, eax
pop ecx
jl 0x403bce
xor eax, eax
mov ecx, dword [ebp + 0x98]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040b00e
add ebp, 0x9c
leave
ret
Function at 0x403c32
Capabilities:
Create directory
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x518
mov eax, dword [0x422108]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x310]
push eax
call fcn.00402b82
test eax, eax
pop ecx
jge 0x403c60
mov eax, 0x80004005
jmp 0x403e1f
lea eax, [ebp - 0x310]
push eax
call fcn.00403872
pop ecx
push 0
lea eax, [ebp - 0x310]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jl 0x403c56
push ebx
push esi
push edi
mov edi, 0x42395e
push edi
lea eax, [ebp - 0x414]
push 0x41a390
push eax
call fcn.0040b11c
push 0x41a75c
push edi
mov esi, 0x41a3e0
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.0040b11c
push 0x41a840
lea eax, [ebp - 0x310]
push eax
lea eax, [ebp - 0x108]
push esi
push eax
call fcn.0040b11c
lea eax, [ebp - 0x414]
push eax
mov ebx, 0x41a81c
push ebx
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x20c]
push 0x41a378
push eax
call fcn.00403777
add esp, 0x40
lea eax, [ebp - 0x518]
push eax
xor eax, eax
push eax
push eax
push 0x18
push eax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
jl 0x403d47
push 0x41a7fc
lea eax, [ebp - 0x518]
push eax
lea eax, [ebp - 0x108]
push esi
push eax
call fcn.0040b11c
lea eax, [ebp - 0x414]
push eax
push ebx
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x20c]
push 0x41a7f4
push eax
call fcn.00403777
add esp, 0x24
mov ebx, dword [sym.imp.USER32.dll_SendDlgItemMessageA]
push 0
push 0
push 0x405
push 0x3fb
push dword [0x4238e4]
call ebx
push 0x41a6b8
push edi
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.0040b11c
push 0x41a7dc
lea eax, [ebp - 0x310]
push eax
lea eax, [ebp - 0x108]
push esi
push eax
call fcn.0040b11c
lea eax, [ebp - 0x414]
push eax
push 0x41a7c4
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x20c]
push 0x41a378
push eax
call fcn.00403777
add esp, 0x34
push 0
push 0
push 0x405
push 0x3fb
push dword [0x4238e4]
call ebx
push 0x41a774
push edi
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.0040b11c
push 0x41a7a8
lea eax, [ebp - 0x310]
push eax
lea eax, [ebp - 0x108]
push esi
push eax
call fcn.0040b11c
push 0
push 0x41a790
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x20c]
push 0x41a788
push eax
call fcn.00403777
add esp, 0x34
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040b00e
leave
ret
Function at 0x403e7c
Capabilities:
Delete registry value

Disassembly:
sub esp, 0x10c
mov eax, dword [0x422108]
xor eax, esp
mov dword [esp + 0x108], eax
push ebx
push ebp
push esi
push edi
call fcn.00401ec0
mov esi, dword [sym.imp.USER32.dll_SendDlgItemMessageA]
xor eax, eax
push eax
push eax
mov ebx, 0x405
push ebx
mov ebp, 0x3fb
push ebp
push dword [0x4238e4]
mov dword [esp + 0x24], eax
call esi
xor eax, eax
mov edi, 0x423c84
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor edi, edi
push 0x4238f8
mov dword [0x423c94], edi
call fcn.004036a7
test eax, eax
pop ecx
jge 0x403eee
push 0x10
push 0x41a734
push 0x41ab88
jmp 0x404027
push edi
push edi
push ebx
push ebp
push dword [0x4238e4]
call esi
call fcn.00403ad9
test eax, eax
jge 0x403f14
push 0x10
push 0x41a734
push 0x41ab28
jmp 0x404027
cmp dword [0x422050], edi
je 0x403fae
mov eax, 0x422050
mov eax, dword [eax]
sub eax, 0xb7
je 0x403f65
sub eax, 0x1f
je 0x403f65
dec eax
jne 0x403f6d
cmp dword [0x4237b8], 0
je 0x403f8b
lea eax, [esp + 0x14]
push eax
mov byte [esp + 0x18], 0
call fcn.00402b64
test eax, eax
pop ecx
jl 0x403f8b
push 1
lea eax, [esp + 0x18]
push eax
push edi
call fcn.00403afb
add esp, 0xc
jmp 0x403f8b
mov dword [esp + 0x10], 0x100
mov eax, dword [esp + 0x10]
or eax, 2
push eax
push 0x42395e
push edi
call fcn.00403afb
add esp, 0xc
test eax, eax
jl 0x40400f
push 0
push 0
push ebx
push ebp
push dword [0x4238e4]
call esi
inc edi
mov eax, edi
imul eax, eax, 0xc
lea eax, [eax + 0x422050]
cmp dword [eax], 0
jne 0x403f25
call fcn.00403769
test eax, eax
jne 0x403fcf
push 0x30
push 0x41a318
push 0x41aa00
push dword [0x4238e4]
call dword [sym.imp.USER32.dll_MessageBoxA]
call fcn.00403c32
mov ecx, dword [0x4238ec]
call fcn.004023c3
push 0x41a328
push 0x41a330
push 0x80000001
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueA]
xor eax, eax
mov ecx, dword [esp + 0x118]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0040b00e
add esp, 0x10c
ret
cmp eax, 0xfffffffd
push 0x10
push 0x41a734
je 0x404022
push 0x41a910
jmp 0x404027
push 0x41a850
push dword [0x4238e4]
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, 0x80004005
jmp 0x403ff6

Function at 0x404c80
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push esi
push edi
mov edi, dword [esp + 0xc]
push eax
push ecx
push edx
push edi
call fcn.0040c203
add esp, 0x10
cmp dword [0x423ca0], 0
mov esi, eax
je 0x404cb5
push esi
push edi
call fcn.00404c50
add esp, 8
mov eax, esi
pop edi
pop esi
ret

Function at 0x404cc0
Capabilities:
Write file on windows

Disassembly:
cmp dword [0x423ca0], 0
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0xc]
je 0x404cdd
push esi
push edi
call fcn.00404c20
add esp, 8
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
push eax
push esi
push ecx
push edi
call fcn.0040b895
add esp, 0x10
pop edi
pop esi
ret
Function at 0x40b00e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x422108]
jne 0x40b018
repz ret
jmp fcn.0040cc45

Function at 0x417c3f
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.0040d83b
xor ebx, ebx
cmp dword [0x424678], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x417d14
push 0x41fb08
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x417c7f
xor eax, eax
jmp 0x417dd8
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x41fafc
push edi
call esi
cmp eax, ebx
je 0x417c78
push eax
call fcn.0040d7d8
mov dword [esp], 0x41faec
push edi
mov dword [0x424678], eax
call esi
push eax
call fcn.0040d7d8
mov dword [esp], 0x41fad8
push edi
mov dword [0x42467c], eax
call esi
push eax
call fcn.0040d7d8
mov dword [0x424680], eax
lea eax, [ebp - 8]
push eax
call fcn.00411968
test eax, eax
pop ecx
pop ecx
je 0x417ce2
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0040dda2
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x417d14
push 0x41fabc
push edi
call esi
push eax
call fcn.0040d7d8
cmp eax, ebx
pop ecx
mov dword [0x424688], eax
je 0x417d14
push 0x41faa4
push edi
call esi
push eax
call fcn.0040d7d8
pop ecx
mov dword [0x424684], eax
mov eax, dword [0x424684]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x417d8d
cmp dword [0x424688], esi
je 0x417d8d
push eax
call fcn.0040d844
pop ecx
call eax
cmp eax, ebx
je 0x417d5a
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x424688]
call fcn.0040d844
pop ecx
call eax
test eax, eax
je 0x417d5a
test byte [ebp - 0x18], 1
jne 0x417d8d
lea eax, [ebp - 0xc]
push eax
call fcn.0041199f
test eax, eax
pop ecx
je 0x417d75
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0040dda2
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x417d84
or dword [ebp + 0x10], 0x200000
jmp 0x417dbe
or dword [ebp + 0x10], 0x40000
jmp 0x417dbe
mov eax, dword [0x42467c]
cmp eax, esi
je 0x417dbe
push eax
call fcn.0040d844
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x417dbe
mov eax, dword [0x424680]
cmp eax, esi
je 0x417dbe
push dword [ebp - 4]
push eax
call fcn.0040d844
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x424678]
call fcn.0040d844
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x5d8aba
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0x5d87dc
or esi, esi
call fcn.005d8ae9
mov esi, ecx
xor dword [edi], edx
sub ecx, esi
add edi, 2
mov esi, ecx
add ecx, 0xe9d56c59
cmp edi, ebx
jl fcn.005d8aba
sub esi, esi
sub ecx, 0xc50f2497
ret
Function at 0x40110b
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x410284]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
jne 0x401158
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x404]
push 0x3ff
push 0x400
push eax
call fcn.004011a6
lea eax, [ebp - 0x404]
push eax
call fcn.004011a6
add esp, 0x18
push 1
call dword [sym.imp.kernel32.dll_ExitProcess]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401ea2
leave
ret

Function at 0x4011a6
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x4011b5
pop dword [ebp - 0x24]
mov eax, 0x70533b6f
sub eax, 0x701329ba
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0x4b04752d
add dword [ebp - 0x34], 0x34dd01e
mov dword [ebp - 0x30], 0xb5d37841
add dword [ebp - 0x30], 0x7c5fd404
mov dword [ebp - 0x2c], 0x9792f7ff
sub dword [ebp - 0x2c], 0x4b46b3d1
mov dword [ebp - 0x28], 0x40d718dd
sub dword [ebp - 0x28], 0x40d718dd
lea eax, [ebp - 0x34]
push eax
mov eax, 0x13abf349
sub eax, 0x136b22f5
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0x97c426b9
add dword [ebp - 0x34], 0xdcae429d
mov dword [ebp - 0x30], 0x70b9057e
add dword [ebp - 0x30], 0xd0b35bf7
mov dword [ebp - 0x2c], 0x7149df2c
sub dword [ebp - 0x2c], 0xdda72c0
mov dword [ebp - 0x28], 0x41a7ff9c
sub dword [ebp - 0x28], 0x41a7ff9c
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, 0x1b4ba5e4
add eax, 0xe4f52a68
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x39723
push 0
call eax
mov ecx, 0x9c5c915f
add ecx, 0x63a3b63f
mov edi, eax
mov ebx, 0x17b0bacb
add ebx, 0xe890f535
add ebx, dword [ebp - 0x24]
mov esi, 0xf8eefac3
add esi, 0xaa4f94c2
xor dword [ebp - 0x14], 0xa5f609c3
mov edx, dword [ebx]
xor dword [ebp - 0x10], 0xc59284a9
xor edx, esi
add dword [ebp - 0x10], eax
mov dword [edi], edx
add dword [ebp - 8], eax
add edi, 4
add ebx, 0x2d93e3e2
sub ebx, 0x2d93e3de
loop 0x4012d7
add eax, 0xcce7699f
sub eax, 0xcce65854
xor ebx, ebx
add ebx, eax
add eax, 0xf789dc84
add eax, 0x8762381
mov ecx, 0x7c8ebebc
sub ecx, 0x7c4ebebc
add ecx, dword [ebp - 0x24]
call ebx
leave
ret

Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53
Function at 0x100032be
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
xor eax, eax
push eax
push eax
push eax
push 0xffffffffffffffff
push dword [esp + 0x28]
call fcn.1001a811
mov esi, eax
add esp, 0x14
test esi, esi
je 0x10003426
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
push esi
mov ebx, eax
call sym.glib_lite.dll_Ordinal_109
pop ecx
cmp ebx, 0xffffffff
je 0x10003426
mov ecx, dword [esp + 0x1c]
test cl, 0x10
jne 0x10003413
test cl, 1
je 0x10003314
test bl, 0x50
je 0x10003413
test cl, 4
je 0x10003322
test bl, 0x10
jne 0x10003413
test cl, 8
je 0x10003426
push 0x2e
push dword [esp + 0x1c]
call sub.vcruntime140.dll_strrchr
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x10003426
mov edi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
push 0x100357e4
push esi
call edi
pop ecx
pop ecx
test eax, eax
je 0x10003413
push 0x100357ec
push esi
call edi
pop ecx
pop ecx
test eax, eax
je 0x10003413
push 0x100357f4
push esi
call edi
pop ecx
pop ecx
test eax, eax
je 0x10003413
push 0x100357fc
push esi
call edi
pop ecx
pop ecx
test eax, eax
je 0x10003413
push str.PATHEXT
call sym.glib_lite.dll_Ordinal_117
pop ecx
test eax, eax
je 0x10003426
push 0xffffffffffffffff
push eax
call fcn.1001b60a
push 0xffffffffffffffff
push esi
mov ebp, eax
call fcn.1001b60a
mov ebx, eax
push ebx
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add esp, 0x14
mov dword [esp + 0x10], eax
mov edi, ebp
push 0x3b
push edi
call sub.vcruntime140.dll_strchr
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x100033e0
push edi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
pop ecx
lea esi, [edi + eax]
mov ecx, dword [esp + 0x10]
mov eax, esi
sub eax, edi
cmp ecx, eax
jne 0x100033fb
push ecx
push edi
push ebx
call sub.vcruntime140.dll_memcmp
add esp, 0xc
test eax, eax
je 0x10003405
cmp byte [esi], 0
je 0x10003418
lea edi, [esi + 1]
jmp 0x100033c6
push ebp
call sym.glib_lite.dll_Ordinal_109
push ebx
call sym.glib_lite.dll_Ordinal_109
pop ecx
pop ecx
xor eax, eax
inc eax
jmp 0x10003428
push ebp
call sym.glib_lite.dll_Ordinal_109
push ebx
call sym.glib_lite.dll_Ordinal_109
pop ecx
pop ecx
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x1000342e
Capabilities:
Get common file path

Disassembly:
push ecx
push ebx
push ebp
push esi
lea eax, [esp + 0xc]
xor ebx, ebx
push eax
push 2
call dword [sym.imp.kernel32.dll_GetCurrentDirectoryW]
mov esi, eax
push 2
push esi
call sym.glib_lite.dll_Ordinal_201
pop ecx
pop ecx
mov ebp, eax
push ebp
push esi
call dword [sym.imp.kernel32.dll_GetCurrentDirectoryW]
lea ecx, [esi - 1]
cmp eax, ecx
jne 0x1000346e
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push ebp
call sym.glib_lite.dll_Ordinal_446
add esp, 0x14
mov ebx, eax
push ebp
call sym.glib_lite.dll_Ordinal_109
pop ecx
test ebx, ebx
jne 0x10003486
push 0x10035908
call sym.glib_lite.dll_Ordinal_359
pop ecx
mov ebx, eax
pop esi
pop ebp
mov eax, ebx
pop ebx
pop ecx
ret
Function at 0x10003d8d
Capabilities:
Hash data using sha1

Disassembly:
push esi
mov esi, dword [esp + 8]
push dword [esi + 4]
call sym.glib_lite.dll_Ordinal_109
mov eax, dword [esi]
pop ecx
xor ecx, ecx
mov dword [esi + 4], ecx
sub eax, ecx
je 0x10003deb
sub eax, 1
je 0x10003ddf
sub eax, 1
je 0x10003dd1
sub eax, 1
je 0x10003dc6
sub eax, 1
jne 0x10003e0d
lea eax, [esi + 8]
push eax
call fcn.1000831c
pop ecx
pop esi
ret
lea eax, [esi + 8]
push eax
call fcn.1000857a
jmp 0x10003dc3
lea eax, [esi + 8]
push eax
call fcn.10005a23
add esp, 4
pop esi
ret
mov dword [esi + 0x18], 0xc3d2e1f0
mov dword [esi + 0x20], ecx
jmp 0x10003dee
mov dword [esi + 0x18], ecx
mov dword [esi + 0x1c], ecx
mov dword [esi + 0x14], 0x10325476
mov dword [esi + 0x10], 0x98badcfe
mov dword [esi + 0xc], 0xefcdab89
mov dword [esi + 8], 0x67452301
pop esi
ret
Function at 0x10005a23
Capabilities:
Hash data using sha256

Disassembly:
mov eax, dword [esp + 4]
and dword [eax + 0x24], 0
and dword [eax + 0x20], 0
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
ret
Function at 0x1000831c
Capabilities:
Hash data using sha224

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0xc1059ed8
mov dword [eax + 4], 0xcbbb9d5d
mov dword [eax + 8], 0x367cd507
mov dword [eax + 0xc], 0x629a292a
mov dword [eax + 0x10], 0x3070dd17
mov dword [eax + 0x14], 0x9159015a
mov dword [eax + 0x18], 0xf70e5939
mov dword [eax + 0x1c], 0x152fecd8
mov dword [eax + 0x20], 0xffc00b31
mov dword [eax + 0x24], 0x67332667
mov dword [eax + 0x28], 0x68581511
mov dword [eax + 0x2c], 0x8eb44a87
mov dword [eax + 0x30], 0x64f98fa7
mov dword [eax + 0x34], 0xdb0c2e0d
mov dword [eax + 0x38], 0xbefa4fa4
mov dword [eax + 0x3c], 0x47b5481d
mov byte [eax + 0xc0], cl
mov dword [eax + 0xc8], ecx
mov dword [eax + 0xcc], ecx
mov dword [eax + 0xd0], ecx
mov dword [eax + 0xd4], ecx
ret

Function at 0x1000857a
Capabilities:
Hash data using sha256

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0xf3bcc908
mov dword [eax + 4], 0x6a09e667
mov dword [eax + 8], 0x84caa73b
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0xfe94f82b
mov dword [eax + 0x14], 0x3c6ef372
mov dword [eax + 0x18], 0x5f1d36f1
mov dword [eax + 0x1c], 0xa54ff53a
mov dword [eax + 0x20], 0xade682d1
mov dword [eax + 0x24], 0x510e527f
mov dword [eax + 0x28], 0x2b3e6c1f
mov dword [eax + 0x2c], 0x9b05688c
mov dword [eax + 0x30], 0xfb41bd6b
mov dword [eax + 0x34], 0x1f83d9ab
mov dword [eax + 0x38], 0x137e2179
mov dword [eax + 0x3c], 0x5be0cd19
mov byte [eax + 0xc0], cl
mov dword [eax + 0xc8], ecx
mov dword [eax + 0xcc], ecx
mov dword [eax + 0xd0], ecx
mov dword [eax + 0xd4], ecx
ret
Function at 0x1000909c
Capabilities:
Allocate thread local storage

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, dword [edi]
test esi, esi
jne 0x10009159
push 0x1008337c
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
mov esi, dword [edi]
test esi, esi
jne 0x1000914e
push ebp
call dword [sym.imp.kernel32.dll_TlsAlloc]
mov esi, eax
xor ebp, ebp
cmp esi, 0xffffffff
jne 0x100090de
push 0x10035da0
push ebp
call fcn.1000939c
pop ecx
pop ecx
cmp dword [edi + 4], ebp
je 0x10009134
push ebx
push 0xc
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov ebx, eax
pop ecx
test ebx, ebx
jne 0x10009107
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
push 0x10035dac
push dword [eax]
call fcn.1000939c
pop ecx
pop ecx
mov dword [ebx], esi
lea ecx, [ebx + 8]
mov eax, dword [edi + 4]
mov edx, 0x10083378
mov dword [ebx + 4], eax
mov eax, dword [0x10083378]
mov dword [ecx], eax
lock cmpxchg dword [edx], ebx
pop ebx
cmp eax, dword [ecx]
je 0x10009134
push str.g_private_get_impl_1_
push ebp
call fcn.1000939c
pop ecx
pop ecx
mov ecx, esi
xor eax, eax
lock cmpxchg dword [edi], ecx
test eax, eax
je 0x1000914d
push str.g_private_get_impl_2_
push ebp
call fcn.1000939c
pop ecx
pop ecx
pop ebp
push 0x1008337c
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
pop edi
mov eax, esi
pop esi
ret

Function at 0x1000915e
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
push edi
call fcn.1000909c
pop ecx
mov esi, eax
push esi
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x10009183
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x10009183
push eax
call ecx
pop ecx
push dword [esp + 0x10]
push esi
call dword [sym.imp.kernel32.dll_TlsSetValue]
pop edi
pop esi
ret
Function at 0x1000c715
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x20c
mov eax, dword [0x10083304]
xor eax, esp
mov dword [esp + 0x208], eax
push ebp
push esi
mov esi, dword [esp + 0x218]
push edi
mov edi, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
call edi
xor ebp, ebp
mov dword [eax], ebp
test esi, esi
jne 0x1000c752
call edi
mov dword [eax], 0xe
xor eax, eax
jmp 0x1000c858
cmp word [esi], bp
jne 0x1000c761
call edi
mov dword [eax], 0x14
jmp 0x1000c74b
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1000c777
call edi
mov dword [eax], 2
jmp 0x1000c74b
test al, 0x10
je 0x1000c757
push ebx
push 0x104
lea eax, [esp + 0x14]
push esi
push eax
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wfullpath]
mov ebx, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
push 0x1003727c
call ebx
push 0x10037278
mov esi, eax
call ebx
add esi, eax
lea eax, [esp + 0x24]
push eax
call ebx
add eax, esi
lea eax, [eax*2 + 0x452]
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov esi, eax
add esp, 0x1c
test esi, esi
jne 0x1000c7d4
call edi
mov dword [eax], 0xc
xor eax, eax
jmp 0x1000c857
lea eax, [esp + 0x10]
push eax
lea edi, [esi + 0x448]
push edi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy]
cmp word [edi], bp
mov ebp, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat]
pop ecx
pop ecx
je 0x1000c81b
push edi
call ebx
pop ecx
cmp word [esi + eax*2 + 0x446], 0x2f
je 0x1000c81b
push edi
call ebx
pop ecx
cmp word [esi + eax*2 + 0x446], 0x5c
je 0x1000c81b
push 0x10037278
push edi
call ebp
pop ecx
pop ecx
push 0x1003727c
push edi
call ebp
or dword [esi + 0x440], 0xffffffff
xor ecx, ecx
xor eax, eax
mov dword [esi + 0x444], ecx
push 0x104
mov dword [esi + 0x234], eax
lea eax, [esi + 0x238]
push ecx
push eax
mov dword [esi + 0x230], ecx
call sub.vcruntime140.dll_memset
add esp, 0x14
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.100319bd
add esp, 0x20c
ret