joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003c640
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x48
movaps xmm0, xmmword [str..LZ_qMFOZqMKOZ]
xor edx, edx
push esi
push edi
mov edi, ecx
mov dword [esp + 0x1c], edi
movups xmmword [esp + 0x20], xmm0
nop
mov al, byte [esp + 0x20]
xor byte [esp + edx + 0x21], al
inc edx
cmp edx, 0xe
jb 0x1003c660
xorps xmm0, xmm0
mov byte [esp + 0x2f], 0
lea ecx, [esp + 0x21]
movaps xmmword [esp + 0x30], xmm0
mov dword [esp + 0x40], 0
lea edx, [ecx + 1]
mov dword [esp + 0x44], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1003c692
sub ecx, edx
lea eax, [esp + 0x21]
push ecx
push eax
lea ecx, [esp + 0x38]
call fcn.10002570
cmp dword [esp + 0x40], 0
mov edi, dword [edi]
mov dword [esp + 0x14], edi
je 0x1003c72a
test edi, edi
je 0x1003c72a
push 4
push edi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x1003c72a
mov eax, dword [edi + 0xc4]
mov dword [esp + 0x18], eax
mov esi, dword [eax]
cmp esi, eax
je 0x1003c72a
cmp esi, dword [edi + 0xc4]
jne 0x1003c6e5
call fcn.10084b0f
mov edi, dword [esi + 8]
test edi, edi
je 0x1003c711
cmp dword [edi + 0x78], 0x10
lea ecx, [edi + 0x64]
jb 0x1003c6f7
mov ecx, dword [ecx]
cmp dword [esp + 0x44], 0xf
lea eax, [esp + 0x30]
cmova eax, dword [esp + 0x30]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x1003c72c
mov edi, dword [esp + 0x14]
cmp esi, dword [edi + 0xc4]
jne 0x1003c722
call fcn.10084b0f
mov esi, dword [esi]
cmp esi, dword [esp + 0x18]
jne 0x1003c6d8
xor edi, edi
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x44]
mov dword [eax + 4], edi
cmp ecx, 0xf
jbe 0x1003c765
mov edx, dword [esp + 0x30]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1003c75b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1003c76b
push ecx
push edx
call fcn.1007fa16
add esp, 8
pop edi
pop esi
mov esp, ebp
pop ebp
ret
call fcn.10084b1f
int3
Function at 0x1003f7e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x48
movaps xmm0, xmmword [0x100b3f90]
xor edx, edx
push esi
push edi
mov edi, ecx
mov byte [esp + 0x2c], 0
mov dword [esp + 0x18], edi
movups xmmword [esp + 0x1c], xmm0
mov al, byte [esp + 0x1c]
xor byte [esp + edx + 0x1d], al
inc edx
cmp edx, 0xf
jb 0x1003f804
xorps xmm0, xmm0
mov byte [esp + 0x2c], 0
lea ecx, [esp + 0x1d]
movaps xmmword [esp + 0x30], xmm0
mov dword [esp + 0x40], 0
lea edx, [ecx + 1]
mov dword [esp + 0x44], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1003f836
sub ecx, edx
lea eax, [esp + 0x1d]
push ecx
push eax
lea ecx, [esp + 0x38]
call fcn.10002570
cmp dword [esp + 0x40], 0
mov edi, dword [edi + 4]
mov dword [esp + 0x10], edi
je 0x1003f8d2
test edi, edi
je 0x1003f8d2
push 4
push edi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x1003f8d2
mov eax, dword [edi + 0xc4]
mov dword [esp + 0x14], eax
mov esi, dword [eax]
cmp esi, eax
je 0x1003f8d2
nop dword [eax]
cmp esi, dword [edi + 0xc4]
jne 0x1003f88d
call fcn.10084b0f
mov edi, dword [esi + 8]
test edi, edi
je 0x1003f8b9
cmp dword [edi + 0x78], 0x10
lea ecx, [edi + 0x64]
jb 0x1003f89f
mov ecx, dword [ecx]
cmp dword [esp + 0x44], 0xf
lea eax, [esp + 0x30]
cmova eax, dword [esp + 0x30]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x1003f8d4
mov edi, dword [esp + 0x10]
cmp esi, dword [edi + 0xc4]
jne 0x1003f8ca
call fcn.10084b0f
mov esi, dword [esi]
cmp esi, dword [esp + 0x14]
jne 0x1003f880
xor edi, edi
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x44]
mov dword [eax], edi
cmp ecx, 0xf
jbe 0x1003f90c
mov edx, dword [esp + 0x30]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1003f902
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1003f912
push ecx
push edx
call fcn.1007fa16
add esp, 8
pop edi
pop esi
mov esp, ebp
pop ebp
ret
call fcn.10084b1f
int3
Function at 0x1007bbd0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100a421d
mov eax, dword fs:[0]
push eax
sub esp, 0x7c
mov eax, dword [0x100bd080]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 0
lea eax, [ebp + 8]
cmp dword [ebp + 0x1c], 0xf
lea ecx, [ebp - 0x84]
push dword [ebp + 0x18]
cmova eax, dword [ebp + 8]
push eax
mov byte [ebp - 0x84], 0
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0x67452301
mov dword [ebp - 0x34], 0xefcdab89
mov dword [ebp - 0x30], 0x98badcfe
mov dword [ebp - 0x2c], 0x10325476
call fcn.1007ba70
cmp byte [ebp - 0x84], 0
jne 0x1007bd21
xor ecx, ecx
lea edx, [ebp - 0x3f]
movzx eax, byte [edx - 1]
lea edx, [edx + 4]
mov byte [ebp + ecx - 0x18], al
movzx eax, byte [edx - 4]
mov byte [ebp + ecx - 0x17], al
movzx eax, byte [edx - 3]
mov byte [ebp + ecx - 0x16], al
movzx eax, byte [edx - 2]
mov byte [ebp + ecx - 0x15], al
add ecx, 4
cmp ecx, 8
jb 0x1007bc65
mov edx, dword [ebp - 0x40]
mov ecx, 0x78
shr edx, 3
mov eax, 0x38
and edx, 0x3f
sub ecx, edx
sub eax, edx
cmp edx, 0x38
cmovae eax, ecx
lea ecx, [ebp - 0x84]
push eax
push 0x100bf0d8
call fcn.1007ba70
push 8
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x84]
call fcn.1007ba70
xor ecx, ecx
lea edx, [ebp - 0x37]
movzx eax, byte [edx - 1]
lea edx, [edx + 4]
mov byte [ebp + ecx - 0x28], al
movzx eax, byte [edx - 4]
mov byte [ebp + ecx - 0x27], al
movzx eax, byte [edx - 3]
mov byte [ebp + ecx - 0x26], al
movzx eax, byte [edx - 2]
mov byte [ebp + ecx - 0x25], al
add ecx, 4
cmp ecx, 0x10
jb 0x1007bcd4
push 0x40
lea eax, [ebp - 0x83]
push 0
push eax
call fcn.10081a90
xorps xmm0, xmm0
mov byte [ebp - 0x84], 1
add esp, 0xc
movq qword [ebp - 0x40], xmm0
push esi
lea ecx, [ebp - 0x84]
call fcn.1007bb20
mov ecx, dword [ebp + 0x1c]
cmp ecx, 0xf
jbe 0x1007bd5d
mov edx, dword [ebp + 8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1007bd53
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1007bd79
push ecx
push edx
call fcn.1007fa16
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1007f9b5
mov esp, ebp
pop ebp
ret
call fcn.10084b1f
int3
Function at 0x1007bd80
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100bd080]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x10], edx
mov eax, 5
mov dword [ebp - 0xc], edi
add eax, eax
mov ecx, 0xffffffff
cmovo eax, ecx
push eax
call fcn.10088c86
add esp, 4
mov esi, eax
lea eax, [ebp - 8]
mov ebx, esi
push eax
push 0x40
push 5
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
call edi
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx]
mov dword [esi], eax
mov al, byte [ecx + 4]
mov byte [esi + 4], al
add esi, 5
mov eax, ecx
sub eax, esi
mov dword [esi + 1], eax
mov eax, dword [ebp - 0x10]
sub eax, ecx
mov byte [esi], 0xe9
sub eax, 5
mov byte [ecx], 0xe9
mov dword [ecx + 1], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 5
push ecx
call edi
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1007f9b5
mov esp, ebp
pop ebp
ret

Function at 0x1007cce0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
sub eax, 0x10000
push eax
call fcn.1007ceb0
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jbe 0x1007cdbd
mov edx, dword [ebp - 4]
cmp edx, dword [0x100bd060]
jb 0x1007cd2a
mov eax, dword [ebp - 4]
cmp eax, dword [0x100bd064]
ja 0x1007cd2a
mov ecx, dword [ebp - 4]
sub ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x1007ccfa
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call fcn.10081a90
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call sub.KERNEL32.dll_VirtualQuery
test eax, eax
jne 0x1007cd4f
jmp 0x1007cdbd
cmp dword [ebp - 0x14], 0x10000
jne 0x1007cda3
cmp dword [ebp - 0x18], 0x10000
jb 0x1007cda3
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call sub.KERNEL32.dll_VirtualAlloc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1007cd86
mov eax, dword [ebp - 8]
jmp 0x1007cdbf
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x677
jne 0x1007cd96
xor eax, eax
jmp 0x1007cdbf
mov eax, dword [ebp - 4]
sub eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x1007cdb8
mov ecx, dword [ebp - 0x20]
sub ecx, 0x10000
push ecx
call fcn.1007ceb0
add esp, 4
mov dword [ebp - 4], eax
jmp 0x1007ccfa
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x1007cdd0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push eax
call fcn.1007cee0
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x1007cea5
mov edx, dword [ebp - 4]
cmp edx, dword [0x100bd060]
jb 0x1007ce15
mov eax, dword [ebp - 4]
cmp eax, dword [0x100bd064]
ja 0x1007ce15
mov ecx, dword [ebp - 4]
add ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x1007cde5
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call fcn.10081a90
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call sub.KERNEL32.dll_VirtualQuery
test eax, eax
jne 0x1007ce3a
jmp 0x1007cea5
cmp dword [ebp - 0x14], 0x10000
jne 0x1007ce8e
cmp dword [ebp - 0x18], 0x10000
jb 0x1007ce8e
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call sub.KERNEL32.dll_VirtualAlloc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1007ce71
mov eax, dword [ebp - 8]
jmp 0x1007cea7
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x677
jne 0x1007ce81
xor eax, eax
jmp 0x1007cea7
mov eax, dword [ebp - 4]
add eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x1007cea0
mov ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 0x18]
push ecx
call fcn.1007cee0
add esp, 4
mov dword [ebp - 4], eax
jmp 0x1007cde5
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x1007cf10
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.1007d300
add esp, 0xc
mov dword [ebp - 4], 0
cmp dword [0x100bff40], 0
jne 0x1007cf4d
cmp dword [0x100bff3c], 0
je 0x1007cf4d
mov eax, dword [0x100bff3c]
mov dword [0x100bff40], eax
cmp dword [0x100bff40], 0
je 0x1007cfca
mov ecx, dword [0x100bff40]
cmp dword [ecx + 8], 0
je 0x1007cfca
mov edx, dword [0x100bff40]
mov eax, dword [edx + 8]
cmp eax, dword [ebp - 0x10]
jb 0x1007cfca
mov ecx, dword [0x100bff40]
mov edx, dword [ecx + 8]
cmp edx, dword [ebp - 0xc]
ja 0x1007cfca
mov eax, dword [0x100bff40]
mov ecx, dword [eax + 8]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
cmp edx, dword [ebp - 0x10]
jb 0x1007cf99
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0xc]
jbe 0x1007cfa0
xor eax, eax
jmp 0x1007d0e9
mov ecx, dword [0x100bff40]
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x40]
mov dword [ecx + 8], eax
push 0x48
push 0xcc
mov ecx, dword [ebp - 4]
push ecx
call fcn.10081a90
add esp, 0xc
mov eax, dword [ebp - 4]
jmp 0x1007d0e9
mov edx, dword [0x100bff3c]
mov dword [0x100bff40], edx
jmp 0x1007cfe6
mov eax, dword [0x100bff40]
mov ecx, dword [eax + 4]
mov dword [0x100bff40], ecx
cmp dword [0x100bff40], 0
je 0x1007d026
cmp dword [0x100bff40], 0
je 0x1007d024
mov edx, dword [0x100bff40]
cmp dword [edx + 8], 0
je 0x1007d024
mov eax, dword [0x100bff40]
mov ecx, dword [eax + 8]
cmp ecx, dword [ebp - 0x10]
jb 0x1007d024
mov edx, dword [0x100bff40]
mov eax, dword [edx + 8]
cmp eax, dword [ebp - 0xc]
ja 0x1007d024
jmp 0x1007cf7e
jmp 0x1007cfd8
mov ecx, dword [ebp + 8]
and ecx, 0xffff
mov edx, dword [ebp + 8]
sub edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.1007d0f0
add esp, 0xc
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x1007d0e7
mov eax, dword [ebp - 0x18]
mov dword [0x100bff40], eax
mov ecx, dword [0x100bff40]
mov dword [ecx], 0x52727464
mov edx, dword [0x100bff40]
mov dword [edx + 8], 0
mov eax, dword [0x100bff40]
mov ecx, dword [0x100bff3c]
mov dword [eax + 4], ecx
mov edx, dword [0x100bff40]
mov dword [0x100bff3c], edx
mov dword [ebp - 0x14], 0
mov eax, dword [0x100bff40]
add eax, 0x48
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0x38c
jmp 0x1007d0b7
mov ecx, dword [ebp - 8]
sub ecx, 1
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 1
jle 0x1007d0d7
imul edx, dword [ebp - 8], 0x48
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x14]
mov dword [eax + edx + 0x40], ecx
imul edx, dword [ebp - 8], 0x48
add edx, dword [ebp - 4]
mov dword [ebp - 0x14], edx
jmp 0x1007d0ae
mov eax, dword [0x100bff40]
mov ecx, dword [ebp - 0x14]
mov dword [eax + 8], ecx
jmp 0x1007cf7e
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x1007de30
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x100bff3c]
mov dword [ebp - 4], eax
jmp 0x1007de49
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
je 0x1007de70
lea eax, [ebp - 8]
push eax
push 0x40
push 0x10000
mov ecx, dword [ebp - 4]
push ecx
call sub.KERNEL32.dll_VirtualProtect
test eax, eax
jne 0x1007de6e
call sub.KERNEL32.dll_GetLastError
jmp 0x1007de72
jmp 0x1007de40
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x1007e310
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 8], 0
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [0x100bff4c], eax
je 0x1007e334
mov eax, 0x10dd
jmp 0x1007e4dc
cmp dword [0x100bff50], 0
je 0x1007e347
mov eax, dword [0x100bff50]
jmp 0x1007e4dc
cmp dword [ebp + 0xc], 0
jne 0x1007e357
mov eax, 0x57
jmp 0x1007e4dc
cmp dword [ebp + 8], 0
jne 0x1007e367
mov eax, 6
jmp 0x1007e4dc
mov eax, dword [ebp + 8]
cmp dword [eax], 0
jne 0x1007e390
mov dword [ebp - 8], 6
mov ecx, dword [ebp - 8]
mov dword [0x100bff50], ecx
mov edx, dword [ebp + 8]
mov dword [0x100bff54], edx
mov eax, dword [ebp - 8]
jmp 0x1007e4dc
push 0x18
call fcn.1007f9c3
add esp, 4
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1007e3eb
mov dword [ebp - 8], 8
mov ecx, dword [ebp - 8]
mov dword [0x100bff50], ecx
cmp dword [ebp - 4], 0
je 0x1007e3da
mov edx, dword [ebp - 4]
mov dword [ebp - 0x20], edx
push 0x18
mov eax, dword [ebp - 0x20]
push eax
call fcn.1007fa16
add esp, 8
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 8]
mov dword [0x100bff54], ecx
mov eax, dword [ebp - 8]
jmp 0x1007e4dc
push 0
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
call fcn.1007e2f0
mov dword [ebp - 0x10], eax
push 0
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.1007e2f0
mov dword [ebp + 0xc], eax
mov edx, dword [ebp - 0x10]
movzx eax, byte [edx + 0x36]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x40]
sub edx, dword [ebp - 0xc]
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0xc], 0
je 0x1007e42b
cmp dword [ebp - 0xc], 0x1e
jbe 0x1007e447
mov dword [ebp - 8], 9
cmp dword [0x100bff44], 0
je 0x1007e442
jmp 0x1007e3b9
jmp 0x1007e3b0
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x44]
cmp ecx, dword [ebp + 0xc]
je 0x1007e46e
mov dword [ebp - 8], 9
cmp dword [0x100bff44], 0
je 0x1007e469
jmp 0x1007e3b9
jmp 0x1007e3b0
mov dword [ebp - 0x18], 0
lea edx, [ebp - 0x18]
push edx
push 0x40
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call sub.KERNEL32.dll_VirtualProtect
test eax, eax
jne 0x1007e499
call sub.KERNEL32.dll_GetLastError
mov dword [ebp - 8], eax
jmp 0x1007e3b0
mov edx, dword [ebp - 4]
mov dword [edx + 4], 1
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov dword [eax + 8], ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
mov dword [edx + 0x10], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x14]
mov dword [ecx + 0xc], edx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x18]
mov dword [eax + 0x14], ecx
mov edx, dword [ebp - 4]
mov eax, dword [0x100bff5c]
mov dword [edx], eax
mov ecx, dword [ebp - 4]
mov dword [0x100bff5c], ecx
xor eax, eax
mov esp, ebp
pop ebp
ret 8
Function at 0x1007e4f0
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [0x100bff4c], eax
je 0x1007e50d
mov eax, 0x10dd
jmp 0x1007e5f0
mov eax, dword [0x100bff5c]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1007e58c
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x14]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
movzx eax, byte [edx + 0x36]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
push edx
call sub.KERNEL32.dll_VirtualProtect
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
jne 0x1007e568
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x10], 0
je 0x1007e568
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
push eax
call fcn.1007d390
add esp, 4
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 0xc], ecx
push 0x18
mov edx, dword [ebp - 0xc]
push edx
call fcn.1007fa16
add esp, 8
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
jmp 0x1007e515
mov dword [0x100bff5c], 0
call fcn.1007dc70
mov ecx, dword [0x100bff58]
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
je 0x1007e5da
mov edx, dword [ebp - 8]
mov eax, dword [edx + 4]
push eax
call sub.KERNEL32.dll_ResumeThread
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
push 8
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.1007fa16
add esp, 8
mov edx, dword [ebp - 0x18]
mov dword [ebp - 8], edx
jmp 0x1007e5a4
mov dword [0x100bff58], 0
mov dword [0x100bff4c], 0
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1007ead0
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x100bff50], 0
je 0x1007eae9
mov eax, dword [0x100bff50]
jmp 0x1007eb88
call sub.KERNEL32.dll_GetCurrentThread
cmp dword [ebp + 8], eax
jne 0x1007eafa
xor eax, eax
jmp 0x1007eb88
push 8
call fcn.1007f9c3
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1007eb52
mov dword [ebp - 8], 8
cmp dword [ebp - 4], 0
je 0x1007eb3b
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x10], ecx
push 8
mov edx, dword [ebp - 0x10]
push edx
call fcn.1007fa16
add esp, 8
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov dword [0x100bff50], eax
mov dword [0x100bff54], 0
mov eax, dword [ebp - 8]
jmp 0x1007eb88
mov ecx, dword [ebp + 8]
push ecx
call sub.KERNEL32.dll_SuspendThread
cmp eax, 0xffffffff
jne 0x1007eb6a
call sub.KERNEL32.dll_GetLastError
mov dword [ebp - 8], eax
jmp 0x1007eb1a
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov dword [edx + 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [0x100bff58]
mov dword [ecx], edx
mov eax, dword [ebp - 4]
mov dword [0x100bff58], eax
xor eax, eax
mov esp, ebp
pop ebp
ret 4
Function at 0x10084d88
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x10084dc7
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10084dc7
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10084dc7
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x10084dc7
cmp dword [ecx + 0x74], 0xe
jbe 0x10084dc7
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x1008e498
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100a92d0
push 0x100a92c8
push str.FlsAlloc
push 0x1f
call fcn.1008e360
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1008e4cc
push dword [ebp + 8]
mov ecx, esi
call dword [0x100a5290]
call esi
jmp 0x1008e4d2
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1008e516
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100a92e0
push 0x100a92d8
push str.FlsGetValue
push 0x21
call fcn.1008e360
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1008e54d
push dword [ebp + 8]
mov ecx, esi
call dword [0x100a5290]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1008e555
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100a92e8
push 0x100a92e0
push str.FlsSetValue
push 0x22
call fcn.1008e360
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1008e58f
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x100a5290]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x1008fd76
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.10080ad0
mov eax, dword [0x100bd080]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.1008ebea
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x1008fdb8
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x1008ff14
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.1009ee90
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x100c0720]
push dword [eax + edi + 0x24]
push dword [eax + edi + 0x20]
push ebx
call fcn.1008f8ff
mov ecx, dword [esi*4 + 0x100c0720]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [ecx + edi + 0x20]
jne 0x1008ff0d
cmp eax, dword [ecx + edi + 0x24]
jne 0x1008ff0d
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [ecx + edi + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1008ff0d
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.1008f8ff
add esp, 0x14
test edx, edx
jl 0x1008ff0d
jg 0x1008fe83
test eax, eax
jb 0x1008ff0d
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x1008ff0d
jl 0x1008fe9d
cmp dword [ebp - 0x1008], eax
ja 0x1008ff0d
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x1008febb
test ebx, ebx
je 0x1008fef4
cmp ecx, edi
jae 0x1008fef4
mov al, byte [ecx]
cmp al, 0xd
jne 0x1008fed5
lea eax, [edi - 1]
cmp ecx, eax
jae 0x1008fee1
cmp byte [ecx + 1], 0xa
jne 0x1008fee1
inc ecx
jmp 0x1008fee1
movzx eax, al
movsx eax, byte [eax + 0x100bd338]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x1008febb
cmp edx, ebx
jne 0x1008febb
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x1008ff12
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.1007f9b5
leave
ret