joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40cf00
Capabilities:
Print debug messages

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x18]
push edi
mov ebp, ecx
push esi
or ebx, 0xffffffff
xor edi, edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jle 0x40cf3f
mov eax, esi
jmp 0x40cf22
mov eax, dword [esp + 0x1c]
cmp word [eax], 9
je 0x40cf3d
add eax, 2
push esi
inc edi
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp edi, eax
jl 0x40cf1e
jmp 0x40cf3f
mov ebx, edi
mov eax, dword [esp + 0x20]
mov edi, dword [esp + 0x14]
push eax
push edi
call dword [sym.imp.GDI32.dll_SetTextColor]
mov eax, dword [ebp + 0x48]
test eax, eax
jne 0x40cf88
push str.NULL_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push 6
push edi
call dword [sym.imp.GDI32.dll_GetCurrentObject]
test eax, eax
je 0x40cf88
lea ecx, [ebp + 0x50]
push ecx
push 0x5c
push eax
call dword [sym.imp.GDI32.dll_GetObjectW]
lea eax, [ebp + 0x50]
push eax
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
mov dword [ebp + 0x48], eax
mov ecx, dword [ebp + 0x4cc]
mov edx, dword [esp + 0x18]
neg ecx
sbb ecx, ecx
and ecx, 0xfff00000
add ecx, 0x100000
or ecx, 0x24
push ecx
push edx
push ebx
push esi
push edi
call dword [sym.imp.USER32.dll_DrawTextW]
cmp ebx, 0xffffffff
je 0x40cfdf
mov eax, dword [ebp + 0x4cc]
mov ecx, dword [esp + 0x18]
neg eax
sbb eax, eax
lea edx, [esi + ebx*2 + 2]
and eax, 0xfff00000
add eax, 0x100000
or al, 0x26
push eax
push ecx
push 0xffffffffffffffff
push edx
push edi
call dword [sym.imp.USER32.dll_DrawTextW]
pop edi
pop esi
pop ebp
pop ebx
ret 0x10

Function at 0x40d520
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
mov edx, dword [esp + 0xc]
xor eax, eax
test edx, edx
setne al
lea ecx, [esp + 0xc]
push esi
add eax, 0x80000001
push ecx
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push eax
mov dword [esp + 0x1c], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov esi, eax
test esi, esi
jne 0x40d580
mov esi, dword [esp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edx, dword [esp + 8]
shl eax, 1
push eax
mov eax, dword [esp + 0x14]
push esi
push 1
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [esp + 0x10]
mov esi, eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
sete al
pop esi
ret

Function at 0x40d590
Capabilities:
Delete registry value
Persist via run registry key

Disassembly:
mov edx, dword [esp + 8]
xor eax, eax
test edx, edx
setne al
lea ecx, [esp + 8]
push esi
add eax, 0x80000001
push ecx
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push eax
mov dword [esp + 0x18], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov esi, eax
test esi, esi
jne 0x40d5dd
mov edx, dword [esp + 8]
mov eax, dword [esp + 0xc]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ecx, dword [esp + 0xc]
mov esi, eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
sete al
pop esi
ret
Function at 0x40d610
Capabilities:
Persist via run registry key
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0xc1c
push esi
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea ecx, [esp + 0x21c]
push 0x208
push ecx
push eax
call fcn.0040d5f0
mov edx, dword [0x427f18]
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x24]
mov dword [esp + 0x20], edx
push 0x4188e8
rep stosd dword es:[edi], eax
lea eax, [esp + 0x24]
push eax
call sub.MSVCRT.dll_wcscat
lea ecx, [esp + 0x230]
lea edx, [esp + 0x28]
push ecx
push edx
call sub.MSVCRT.dll_wcscat
lea eax, [esp + 0x30]
push str.___bg
push eax
call sub.MSVCRT.dll_wcscat
mov ecx, dword [0x427f18]
xor eax, eax
mov dword [esp + 0x448], ecx
mov ecx, 0x1ff
lea edi, [esp + 0x44c]
add esp, 0x24
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0xc2c]
lea edx, [esp + 8]
test ecx, ecx
setne al
add eax, 0x80000001
push edx
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push eax
mov dword [esp + 0x14], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov esi, dword [esp + 0xc28]
lea eax, [esp + 0x10]
lea ecx, [esp + 0x424]
push eax
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x10]
push ecx
push edx
push 0
push esi
push eax
mov dword [esp + 0x24], 1
mov dword [esp + 0x28], 0x400
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40d749
lea ecx, [esp + 0x424]
lea edx, [esp + 0x14]
push ecx
push edx
call sub.MSVCRT.dll_wcscmp
add esp, 8
test eax, eax
je 0x40d73b
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edx, dword [esp + 8]
lea ecx, [esp + 0x14]
shl eax, 1
push eax
push ecx
push 1
push 0
push esi
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
mov eax, 1
pop esi
add esp, 0xc1c
ret
pop edi
xor eax, eax
pop esi
add esp, 0xc1c
ret

Function at 0x40dc70
Capabilities:
Extract resource via kernel32 functions
Read file via mapping

Disassembly:
mov ecx, dword [esp + 8]
mov eax, dword [esp + 0x10]
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
and ecx, 0xffff
push eax
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push ebx
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, dword [esp + 0x1c]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push edx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push 0
push edi
push 0
mov ebx, eax
push 4
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push 0
push 0
mov ebp, eax
push 0
push 2
push ebp
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, edi
mov edi, eax
mov edx, ecx
push eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
call esi
push ebx
call esi
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret
Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43300c
nop
nop
nop
nop
nop
pop eax
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x433030
nop
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43301e
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x1000e680
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x1000e802
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x1000e802
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
mov edi, dword [edi]
push eax
push edi
push esi
mov esi, dword [esi]
mov edi, dword [edi]
test eax, 0x1f
je 0x1000e6b8
mov dl, byte [esi + eax - 1]
mov byte [esi + eax], dl
vpxor ymm0, ymm0, ymm0
vpcmpeqb xmm7, xmm7, xmm7
vpsrldq xmm7, xmm7, 0xf
vpand ymm7, ymm7, ymmword [esi]
add eax, 0x1f
and eax, 0xffffffe0
cmp eax, 0x20
ja 0x1000e6f0
vpcmpeqb xmm6, xmm6, xmm6
vpslldq xmm6, xmm6, 0xf
vperm2i128 ymm6, ymm6, ymm6, 1
vpand ymm6, ymm6, ymmword [esi]
jmp 0x1000e700
vmovdqu ymm6, ymmword [esi + 0x20]
vperm2i128 ymm6, ymm0, ymm6, 0x20
vpslldq ymm6, ymm6, 0xf
vmovdqu ymm1, ymmword [esi]
vperm2i128 ymm2, ymm0, ymm1, 0x20
vpalignr ymm2, ymm1, ymm2, 0xf
vperm2i128 ymm4, ymm0, ymm1, 3
vpalignr ymm3, ymm4, ymm1, 1
vpor ymm2, ymm2, ymm7
vpor ymm3, ymm3, ymm6
vpsrldq ymm7, ymm4, 0xf
vpunpckhbw ymm4, ymm1, ymm0
vpunpcklbw ymm5, ymm1, ymm0
vperm2i128 ymm1, ymm5, ymm4, 0x20
vperm2i128 ymm4, ymm5, ymm4, 0x31
vpunpckhbw ymm5, ymm2, ymm0
vpunpcklbw ymm6, ymm2, ymm0
vperm2i128 ymm2, ymm6, ymm5, 0x20
vperm2i128 ymm5, ymm6, ymm5, 0x31
vpunpckhbw ymm6, ymm3, ymm0
vpunpcklbw ymm0, ymm3, ymm0
vperm2i128 ymm3, ymm0, ymm6, 0x20
vperm2i128 ymm6, ymm0, ymm6, 0x31
vpxor ymm0, ymm0, ymm0
vpmullw ymm1, ymm1, ymmword [0x10190a00]
vpmullw ymm4, ymm4, ymmword [0x10190a00]
vpaddw ymm2, ymm2, ymmword [0x101909c0]
vpaddw ymm5, ymm5, ymmword [0x101909c0]
vpaddw ymm3, ymm3, ymmword [0x101909e0]
vpaddw ymm6, ymm6, ymmword [0x101909e0]
vpaddw ymm2, ymm2, ymm1
vpaddw ymm5, ymm5, ymm4
vpsrlw ymm2, ymm2, 2
vpsrlw ymm5, ymm5, 2
vpaddw ymm3, ymm3, ymm1
vpaddw ymm6, ymm6, ymm4
vpsrlw ymm3, ymm3, 2
vpsrlw ymm6, ymm6, 2
vpsllw ymm3, ymm3, 8
vpsllw ymm6, ymm6, 8
vpor ymm2, ymm2, ymm3
vpor ymm5, ymm5, ymm6
vmovdqu ymmword [edi], ymm2
vmovdqu ymmword [edi + 0x20], ymm5
sub eax, 0x20
add esi, 0x20
add edi, 0x40
cmp eax, 0x20
ja 0x1000e6f0
test eax, eax
jne 0x1000e6d4
pop esi
pop edi
pop eax
add esi, 4
add edi, 4
dec ecx
jg 0x1000e6a3
vzeroupper
pop edi
pop esi
pop ebp
ret
Function at 0x100268b0
Capabilities:
Encode data using xor

Disassembly:
mov dl, byte [ecx]
push esi
mov esi, 0x811b
test dl, dl
je 0x100268d5
nop dword [eax]
mov eax, esi
lea ecx, [ecx + 1]
shl esi, 5
add esi, eax
movzx eax, dl
mov dl, byte [ecx]
xor esi, eax
test dl, dl
jne 0x100268c0
mov eax, 0x2f684bdb
mul esi
mov eax, esi
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 4
imul eax, eax, 0x1b
sub esi, eax
mov eax, esi
pop esi
ret

Function at 0x100268f0
Capabilities:
Terminate process

Disassembly:
push ebx
push ebp
push esi
push edi
mov esi, ecx
call fcn.100268b0
mov ebp, eax
lea edx, [ebp*2]
add edx, ebp
mov ebx, dword [edx*4 + 0x101ee500]
lea edi, [edx*4 + 0x101ee500]
test ebx, ebx
je 0x1002696d
mov ecx, esi
mov eax, ebx
nop dword [eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10026940
test dl, dl
je 0x1002693c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10026940
add eax, 2
add ecx, 2
test dl, dl
jne 0x10026920
xor eax, eax
jmp 0x10026945
sbb eax, eax
or eax, 1
test eax, eax
je 0x1002696d
push ebx
push esi
push ebp
push str.AccessInit:_hash_collision:__d_for_both__s_and__s_n
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
call fcn.10026880
add esp, 0x14
push 1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [edi], esi
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x100598c0
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov eax, dword [esi + 0x14]
cmp eax, 0xca
jne 0x100598f4
push esi
call fcn.1005e0c0
add esp, 4
cmp byte [esi + 0x40], 0
je 0x100598eb
pop edi
mov dword [esi + 0x14], 0xcf
mov al, 1
pop esi
ret
mov dword [esi + 0x14], 0xcb
jmp 0x100598fb
cmp eax, 0xcb
jne 0x10059973
mov eax, dword [esi + 0x1a0]
cmp byte [eax + 0x10], 0
je 0x1005995e
mov eax, dword [esi + 8]
test eax, eax
je 0x10059916
mov eax, dword [eax]
push esi
call eax
add esp, 4
mov eax, dword [esi + 0x1a0]
push esi
mov eax, dword [eax]
call eax
add esp, 4
test eax, eax
je 0x10059959
cmp eax, 2
je 0x1005995e
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x10059907
cmp eax, 3
je 0x1005993e
cmp eax, 1
jne 0x10059907
inc dword [ecx + 4]
mov edx, dword [esi + 8]
mov edi, dword [edx + 8]
cmp dword [ecx + 4], edi
jl 0x10059907
mov eax, dword [esi + 0x120]
add eax, edi
mov dword [edx + 8], eax
jmp 0x10059907
pop edi
xor al, al
pop esi
ret
mov eax, dword [esi + 0x7c]
push esi
mov dword [esi + 0x84], eax
call fcn.100599b0
add esp, 4
pop edi
pop esi
ret
cmp eax, 0xcc
je 0x10059995
mov eax, dword [esi]
push esi
mov dword [eax + 0x14], 0x15
mov ecx, dword [esi]
mov eax, dword [esi + 0x14]
mov dword [ecx + 0x18], eax
mov eax, dword [esi]
mov eax, dword [eax]
call eax
add esp, 4
push esi
call fcn.100599b0
add esp, 4
pop edi
pop esi
ret

Function at 0x100599b0
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
push edi
cmp dword [esi + 0x14], 0xcc
lea ebx, [esi + 0x78]
je 0x100599df
mov eax, dword [esi + 0x190]
push esi
mov eax, dword [eax]
call eax
add esp, 4
mov dword [ebx], 0
mov dword [esi + 0x14], 0xcc
mov eax, dword [esi + 0x190]
cmp byte [eax + 8], 0
je 0x10059a62
nop dword [eax + eax]
mov eax, dword [ebx]
cmp eax, dword [esi + 0x60]
jae 0x10059a36
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x10059a15
mov dword [ecx + 4], eax
mov ecx, dword [esi + 8]
mov eax, dword [esi + 0x60]
push esi
mov dword [ecx + 8], eax
mov eax, dword [esi + 8]
mov eax, dword [eax]
call eax
add esp, 4
mov eax, dword [esi + 0x194]
mov edi, dword [ebx]
push 0
push ebx
mov eax, dword [eax + 4]
push 0
push esi
call eax
mov eax, dword [ebx]
add esp, 0x10
cmp eax, edi
je 0x10059a79
cmp eax, dword [esi + 0x60]
jb 0x100599f7
mov eax, dword [esi + 0x190]
push esi
mov eax, dword [eax + 4]
call eax
mov eax, dword [esi + 0x190]
push esi
mov eax, dword [eax]
call eax
mov dword [ebx], 0
add esp, 8
mov eax, dword [esi + 0x190]
cmp byte [eax + 8], 0
jne 0x100599f0
xor eax, eax
cmp byte [esi + 0x41], al
pop edi
setne al
add eax, 0xcd
mov dword [esi + 0x14], eax
mov al, 1
pop esi
pop ebp
pop ebx
ret
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret
Function at 0x10068db0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x28]
mov edx, 0x100
mov ebp, dword [edi + 0x4c]
cmp ebp, 1
mov esi, dword [edi + 0x1b8]
sete al
mov dword [esp + 0x20], esi
mov dword [esp + 0x18], ebp
mov byte [esi + 0x1c], al
mov eax, 0x2fe
push dword [edi + 0x64]
mov ecx, dword [edi + 4]
cmovne eax, edx
push eax
push 1
push edi
mov eax, dword [ecx + 8]
call eax
xor ebx, ebx
mov dword [esi + 0x18], eax
mov eax, dword [esi + 0x14]
add esp, 0x10
mov dword [esp + 0x10], ebx
cmp dword [edi + 0x64], ebx
jle 0x10068ee3
nop dword [eax]
mov ecx, dword [esi + ebx*4 + 0x20]
cdq
idiv ecx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
cmp ebp, 1
jne 0x10068e2e
mov eax, dword [esi + 0x18]
add dword [eax + ebx*4], 0xff
mov eax, dword [esi + 0x18]
lea edi, [ecx*2 - 2]
mov ebp, dword [eax + ebx*4]
lea eax, [ecx + 0xfe]
cdq
xor ebx, ebx
idiv edi
xor esi, esi
mov edx, eax
nop word [eax + eax]
cmp esi, edx
jle 0x10068e74
imul eax, ebx, 0x1fe
add ecx, 0xfe
add ecx, eax
add ecx, 0x1fe
inc ebx
mov eax, ecx
cdq
idiv edi
mov edx, eax
cmp esi, edx
jg 0x10068e62
mov ecx, dword [esp + 0x14]
movzx ecx, cl
movzx eax, bl
imul ecx, eax
mov byte [esi + ebp], cl
inc esi
mov ecx, dword [esp + 0x1c]
cmp esi, 0xff
jle 0x10068e50
cmp dword [esp + 0x18], 1
jne 0x10068ec1
mov ecx, 1
lea edx, [ebp - 1]
movzx eax, byte [ebp]
lea edx, [edx - 1]
mov byte [edx + 1], al
movzx eax, byte [ebp + 0xff]
mov byte [ecx + ebp + 0xff], al
inc ecx
cmp ecx, 0xff
jle 0x10068ea0
mov eax, dword [esp + 0x28]
mov ebx, dword [esp + 0x10]
mov ebp, dword [esp + 0x18]
inc ebx
mov esi, dword [esp + 0x20]
cmp ebx, dword [eax + 0x64]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x10], ebx
jl 0x10068e10
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x1008fab0
Capabilities:
Query environment variable

Disassembly:
push edi
push str.OPJ_NUM_THREADS
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov edi, eax
add esp, 4
test edi, edi
je 0x1008fb37
call fcn.1008b2d0
test eax, eax
je 0x1008fb37
push esi
call fcn.1009ae50
mov esi, eax
mov edx, str.ALL_CPUS
mov ecx, edi
push ebx
nop
mov bl, byte [ecx]
cmp bl, byte [edx]
jne 0x1008fb00
test bl, bl
je 0x1008fafc
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x1008fb00
add ecx, 2
add edx, 2
test al, al
jne 0x1008fae0
xor eax, eax
jmp 0x1008fb05
sbb eax, eax
or eax, 1
pop ebx
test eax, eax
jne 0x1008fb0f
mov eax, esi
pop esi
pop edi
ret
mov eax, 0x20
test esi, esi
push edi
cmove esi, eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
add esp, 4
test eax, eax
jns 0x1008fb2c
pop esi
xor eax, eax
pop edi
ret
lea ecx, [esi + esi]
cmp eax, ecx
pop esi
cmovg eax, ecx
pop edi
ret
xor eax, eax
pop edi
ret
Function at 0x1009acf0
Capabilities:
Allocate thread local storage

Disassembly:
push esi
push 8
call fcn.1008aa70
mov esi, eax
add esp, 4
test esi, esi
jne 0x1009ad03
pop esi
ret
push edi
mov edi, 0x101ec1a4
nop dword [eax]
mov ecx, 1
xor eax, eax
lock cmpxchg dword [edi], ecx
test eax, eax
jne 0x1009ad10
cmp dword [0x101ec1a8], eax
jne 0x1009ad3c
call dword [sym.imp.kernel32.dll_TlsAlloc]
mov dword [0x101ec1a0], eax
mov dword [0x101ec1a8], 1
xor ecx, ecx
mov eax, 1
lock cmpxchg dword [edi], ecx
cmp dword [0x101ec1a0], 0xffffffff
je 0x1009ad62
push 0x18
call fcn.1008aa70
mov edi, eax
add esp, 4
test edi, edi
jne 0x1009ad70
mov dword [esi], eax
push esi
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
add esp, 4
xor eax, eax
pop edi
pop esi
ret
push 0xfa0
push edi
call dword [sym.imp.kernel32.dll_InitializeCriticalSectionAndSpinCount]
mov dword [esi], edi
mov eax, esi
pop edi
mov dword [esi + 4], 0
pop esi
ret

Function at 0x1009add0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
push esi
push dword [0x101ec1a0]
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov ebp, eax
test ebp, ebp
jne 0x1009adfd
push eax
push eax
push eax
push eax
call dword [sym.imp.kernel32.dll_CreateEventA]
mov ebp, eax
push ebp
push dword [0x101ec1a0]
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov esi, dword [esp + 0xc]
push dword [esi]
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
push 8
call fcn.1008aa70
add esp, 4
mov dword [eax], ebp
mov ecx, dword [esi + 4]
mov dword [eax + 4], ecx
push dword [esi]
mov dword [esi + 4], eax
mov esi, dword [sym.imp.kernel32.dll_LeaveCriticalSection]
call esi
push dword [esp + 0x10]
call esi
push 0xffffffffffffffff
push ebp
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
push dword [esp + 0x10]
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
pop esi
pop ebp
ret

Function at 0x1009ae50
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x24
lea eax, [esp]
push eax
call dword [sym.imp.kernel32.dll_GetSystemInfo]
mov eax, dword [esp + 0x14]
mov ecx, 1
cmp eax, ecx
cmovb eax, ecx
add esp, 0x24
ret
Function at 0x1009b720
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov ecx, dword [esp + 8]
push edi
mov edi, dword [esp + 8]
mov eax, dword [edi + 0xc]
test eax, eax
je 0x1009b7d7
push ebp
xor ebp, ebp
test ecx, ecx
push eax
cmovns ebp, ecx
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
mov dword [edi + 0x28], ebp
cmp dword [edi + 0x18], ebp
jle 0x1009b7cd
push ebx
push esi
mov eax, dword [edi + 0xc]
push dword [0x101ec1a0]
mov ebx, dword [edi + 8]
mov dword [esp + 0x18], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x1009b786
push eax
push eax
push eax
push eax
call dword [sym.imp.kernel32.dll_CreateEventA]
mov esi, eax
push esi
push dword [0x101ec1a0]
call dword [sym.imp.kernel32.dll_TlsSetValue]
push dword [ebx]
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
push 8
call fcn.1008aa70
add esp, 4
mov dword [eax], esi
mov ecx, dword [ebx + 4]
mov dword [eax + 4], ecx
push dword [ebx]
mov dword [ebx + 4], eax
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
mov ebx, dword [esp + 0x14]
push ebx
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
push 0xffffffffffffffff
push esi
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
push ebx
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
cmp dword [edi + 0x18], ebp
jg 0x1009b751
pop esi
pop ebx
push dword [edi + 0xc]
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
pop ebp
pop edi
ret
Function at 0x100d0920
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
mov esi, dword [esp + 0x18]
push edi
movzx eax, word [esi + 0x20]
cmp eax, 6
ja case.0x100d0938.12
jmp dword [eax*4 + 0x100d0b08]
cmp word [esi + 0x18], 8
je case.0x100d0938.12
movzx eax, word [esi + 0x18]
mov edi, 1
mov cl, al
shl edi, cl
mov ecx, 0xff
dec edi
cmp eax, 0x10
cmove edi, ecx
lea eax, [edi + 1]
push eax
push dword [esi]
call fcn.100cf420
add esp, 8
mov dword [esi + 0x38], eax
test eax, eax
jne 0x100d099c
push str.No_space_for_photometric_conversion_table
push dword [esi]
call fcn.1009ba70
add esp, 4
push eax
push dword [esi]
call fcn.100dd770
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
xor ebx, ebx
cmp word [esi + 0x20], bx
jne 0x100d09c8
test edi, edi
js 0x100d09e6
imul ebp, edi, 0xff
nop
mov eax, ebp
mov ecx, dword [esi + 0x38]
cdq
sub ebp, 0xff
idiv edi
mov byte [ebx + ecx], al
inc ebx
cmp ebx, edi
jle 0x100d09b0
jmp 0x100d09e6
test edi, edi
js 0x100d09e6
xor ebp, ebp
nop
mov eax, ebp
mov ecx, dword [esi + 0x38]
cdq
add ebp, 0xff
idiv edi
mov byte [ebx + ecx], al
inc ebx
cmp ebx, edi
jle 0x100d09d0
cmp word [esi + 0x18], 0x10
ja case.0x100d0938.12
movzx eax, word [esi + 0x20]
cmp eax, 1
je 0x100d09fb
test ax, ax
jne case.0x100d0938.12
push esi
call fcn.100d1ba0
add esp, 4
test eax, eax
jne 0x100d0a10
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
push dword [esi + 0x38]
push dword [esi]
call fcn.100cf410
add esp, 8
mov dword [esi + 0x38], 0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 8
ret
mov cl, byte [esi + 0x18]
mov eax, 1
mov ebp, dword [esi + 0x24]
mov edx, ebp
mov ebx, dword [esi + 0x2c]
mov edi, dword [esi + 0x28]
shl eax, cl
mov ecx, eax
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
test ecx, ecx
jle 0x100d0a8c
mov dword [esp + 0x1c], 0x100
nop dword [eax]
mov ax, word [edx]
lea edx, [edx + 2]
dec ecx
cmp ax, word [esp + 0x1c]
jae 0x100d0ac8
mov ax, word [edi]
add edi, 2
cmp ax, word [esp + 0x1c]
jae 0x100d0ac8
mov ax, word [ebx]
add ebx, 2
cmp ax, word [esp + 0x1c]
jae 0x100d0ac8
test ecx, ecx
jg 0x100d0a60
push str.Assuming_8_bit_colormap
push dword [esi]
call fcn.1009ba70
add esp, 4
push eax
push dword [esi]
call fcn.100dd4c0
add esp, 0xc
cmp word [esi + 0x18], 8
ja case.0x100d0938.12
push esi
call fcn.100d1e40
add esp, 4
neg eax
sbb eax, eax
neg eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov edx, dword [esp + 0x10]
add edx, 0xffffffff
js 0x100d0aa6
mov eax, dword [esi + 0x28]
sub ebp, eax
mov ebx, dword [esp + 0x14]
sub ebx, eax
lea ecx, [eax + edx*2]
nop
sub edx, 1
movzx eax, byte [ecx + ebp + 1]
mov word [ecx + ebp], ax
lea ecx, [ecx - 2]
movzx eax, byte [ecx + 3]
mov word [ecx + 2], ax
movzx eax, byte [ebx + ecx + 3]
mov word [ebx + ecx + 2], ax
jns 0x100d0ae0
jmp 0x100d0aa6
Function at 0x100d7e10
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push esi
mov esi, dword [esp + 0xc]
push edi
lea edi, [esi + 0x38]
call fcn.100dabf0
push eax
push esi
call fcn.100db040
push 0x108
push 0
push edi
call fcn.100d6a70
mov ebp, 1
mov dword [edi + 0x34], 0x10001
mov dword [edi + 0x2c], 0x10001
mov eax, 2
mov word [edi + 0x54], ax
add esp, 0x14
mov dword [edi + 0x38], 0x10001
xor eax, eax
mov dword [edi + 0x3c], 0xffffffff
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], ebp
mov dword [edi + 0x18], ebp
mov dword [edi + 0xd8], 0x20002
mov word [edi + 0xdc], bp
mov dword [esi + 0x334], fcn.1003f810
mov dword [esi + 0x340], 0
mov dword [esi + 0x344], 0x100d8d70
mov dword [esi + 0x348], 0x100d84d0
mov dword [esi + 0x34c], 0
mov word [edi + 0x56], bp
mov word [edi + 0x30], bp
mov dword [edi + 0x28], 0
mov dword [edi + 0x40], 0x10000
mov word [edi + 0x74], ax
mov dword [edi + 0x78], eax
cmp dword [esi + 0x358], eax
jbe 0x100d7f2d
push ebx
xor edi, edi
xor ebx, ebx
mov eax, dword [esi + 0x354]
cmp dword [ebx + eax + 4], 0
je 0x100d7efd
push dword [ebx + eax + 0xc]
push esi
call fcn.100cf410
add esp, 8
inc edi
add ebx, 0x10
cmp edi, dword [esi + 0x358]
jb 0x100d7ee3
push dword [esi + 0x354]
push esi
call fcn.100cf410
add esp, 8
mov dword [esi + 0x358], 0
mov dword [esi + 0x354], 0
pop ebx
mov eax, dword [0x101ec1b0]
test eax, eax
je 0x100d7f3c
push esi
call eax
add esp, 4
push 1
push 0x103
push esi
call fcn.100d8270
and dword [esi + 0xc], 0xfffffbf7
add esp, 0xc
mov eax, ebp
pop edi
pop esi
pop ebp
ret