joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10003047
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x1005062a
call fcn.1004f2f8
push ecx
push ecx
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
mov dword [ebp - 0x14], edi
push 0x48
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
call fcn.1001ec9c
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [edi + 4], eax
lea ecx, [edi + 0x10]
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], ecx
and dword [ebp - 0x10], ebx
push eax
call fcn.10005662
mov byte [ebp - 4], 1
lea esi, [edi + 0x30]
mov dword [ebp - 0x10], esi
and dword [esi], ebx
push 0x1c
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
call fcn.1001ec9c
pop ecx
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [esi + 4], eax
lea ecx, [esi + 0xc]
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
mov byte [ebp - 4], 3
mov dword [esi + 0x18], 7
mov dword [esi + 0x1c], 8
mov dword [esi], 0x3f800000
push dword [esi + 4]
push 0x10
call fcn.100057bb
lea ecx, [edi + 0x50]
mov byte [ebp - 4], 4
push ecx
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], ecx
and dword [ebp - 0x10], ebx
push eax
call fcn.1000535e
mov ecx, edi
mov byte [ebp - 4], 5
call fcn.1000314a
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret

Function at 0x10003260
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 4]
test edx, edx
jne 0x1000327e
mov edx, dword [edi + 0xc]
lea eax, [edx + 1]
mov dword [edi + 0xc], eax
mov dword [ecx + 4], edx
xor ecx, ecx
mov dword [ebp + 0xc], edx
mov ebx, 0x811c9dc5
mov esi, ecx
movzx eax, byte [ebp + esi + 0xc]
xor eax, ebx
imul ebx, eax, 0x1000193
inc esi
cmp esi, 4
jb 0x1000328a
mov esi, dword [edi + 0x28]
and esi, ebx
mov ebx, dword [edi + 0x1c]
mov eax, dword [ebx + esi*8 + 4]
cmp eax, dword [edi + 0x14]
je 0x100032c1
mov esi, dword [ebx + esi*8]
jmp 0x100032ba
cmp eax, esi
je 0x100032c1
mov eax, dword [eax + 4]
cmp edx, dword [eax + 8]
jne 0x100032b3
jmp 0x100032c3
mov eax, ecx
test eax, eax
cmove eax, dword [edi + 0x14]
cmp eax, dword [edi + 0x14]
pop edi
pop esi
pop ebx
je 0x100032db
mov ecx, dword [eax + 0xc]
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov cl, 1
mov al, cl
pop ebp
ret 8

Function at 0x10006898
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x10]
mov ebx, ecx
push eax
push 0x40
push 5
mov ebp, dword [ebx]
push ebp
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [esp + 0x10]
call fcn.100080a0
mov esi, dword [ebx + 0xc]
mov edi, eax
sub esi, dword [ebx + 8]
push esi
push dword [ebx + 8]
push dword [ebx]
call fcn.10020470
push edi
push 5
pop edx
mov ecx, ebp
call fcn.10007a3a
add esp, 0x10
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x100068e1
Capabilities:
Allocate or change rwx memory

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x10]
mov esi, ecx
push eax
push 0x40
push 5
mov edi, dword [esi]
pop ebp
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [esp + 0x10]
call fcn.100080a0
mov ecx, dword [esi + 0x14]
mov ebx, eax
mov byte [esp + 0x14], 0xe9
lea eax, [esp + 0x14]
push ebp
push eax
mov ecx, dword [ecx + 0x1c]
sub ecx, dword [esi]
push dword [esi]
sub ecx, ebp
mov dword [esp + 0x21], ecx
call fcn.10020470
mov ecx, dword [esi + 0xc]
add esp, 0xc
sub ecx, dword [esi + 8]
cmp ecx, ebp
jbe 0x1000694e
mov eax, dword [esi]
lea esi, [eax + 5]
sub eax, esi
add eax, ecx
push eax
push 0x90
push esi
call fcn.10020a00
add esp, 0xc
push ebx
mov edx, ebp
mov ecx, edi
call fcn.10007a3a
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret

Function at 0x1000982b
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1a4
lea eax, [esp + 0x14]
push esi
mov esi, ecx
push eax
push 0x202
mov byte [esi], 0
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov ecx, eax
test ecx, ecx
jne 0x1000988b
mov eax, dword [esp + 0x18]
cmp al, 2
jne 0x1000986c
shr eax, 8
cmp al, 2
jne 0x1000986c
mov byte [esi], 1
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
call dword [sym.imp.WS2_32.dll_WSACleanup]
push str.Invalid_WinSock_version
lea ecx, [esp + 8]
call fcn.100096ec
push 0x1006a3a0
lea eax, [esp + 8]
jmp 0x100098a9
push str.WSAStartup_failed
call fcn.1000980f
push eax
push ecx
lea ecx, [esp + 0x10]
call fcn.10002176
push 0x1006a34c
lea eax, [esp + 8]
push eax
call fcn.10020402
int3

Function at 0x1000993e
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push esi
mov esi, ecx
mov cl, byte [ebp + 8]
push 6
push 1
call fcn.100098c2
push eax
call dword [sym.imp.WS2_32.dll_socket]
mov dword [esi], eax
cmp eax, 0xffffffff
je 0x100099b9
lea ecx, [esp + 8]
mov dword [esp + 8], 1
push ecx
push 0x8004667e
push eax
call dword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
je 0x100099b0
mov ecx, esi
call fcn.10009cf2
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push str.Failed_to_get_socket_flags
mov ecx, eax
call fcn.1000980f
push eax
push ecx
lea ecx, [esp + 0x18]
call fcn.10002176
push 0x1006a34c
lea eax, [esp + 0x10]
jmp 0x100099de
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4
call sub.WS2_32.dll_WSAGetLastError
push str.Failed_to_create_socket
mov ecx, eax
call fcn.1000980f
push eax
push ecx
lea ecx, [esp + 0x18]
call fcn.10002176
push 0x1006a34c
lea eax, [esp + 0x10]
push eax
call fcn.10020402
int3
Function at 0x100099f3
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x20
push esi
push edi
push dword [ebp + 0xc]
mov edi, ecx
push dword [ebp + 8]
push dword [edi]
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x10009a35
mov esi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call esi
cmp eax, 0x2714
jne 0x10009a3d
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi]
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x10009a19
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
call esi
cmp eax, 0x2733
jne 0x10009aa8
push dword [ebp + 0x14]
mov ecx, edi
push dword [ebp + 0x10]
push 1
call fcn.10009bd7
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 4
push eax
lea eax, [esp + 0x10]
push eax
push 0x1007
push 0xffff
push dword [edi]
call dword [sym.imp.WS2_32.dll_getsockopt]
cmp eax, 0xffffffff
je 0x10009acc
cmp dword [esp + 0xc], 0
je 0x10009a35
push str.Failed_to_connect
call fcn.1000980f
push eax
push dword [esp + 0x14]
lea ecx, [esp + 0x20]
call fcn.10002176
push 0x1006a34c
lea eax, [esp + 0x18]
jmp 0x10009aee
call esi
push str.Failed_to_connect
mov ecx, eax
call fcn.1000980f
push eax
push ecx
lea ecx, [esp + 0x20]
call fcn.10002176
push 0x1006a34c
lea eax, [esp + 0x18]
jmp 0x10009aee
call esi
push str.Failed_to_get_socket_option
mov ecx, eax
call fcn.1000980f
push eax
push ecx
lea ecx, [esp + 0x20]
call fcn.10002176
push 0x1006a34c
lea eax, [esp + 0x18]
push eax
call fcn.10020402
int3

Function at 0x10009bd7
Capabilities:
Get socket status

Disassembly:
sub esp, 0x128
mov eax, dword [ecx]
push ebx
push ebp
mov ebp, dword [esp + 0x13c]
push esi
push edi
mov edi, dword [esp + 0x140]
xor esi, esi
push esi
push 0x3e8
push ebp
push edi
mov dword [esp + 0x44], eax
mov dword [esp + 0x40], 1
call fcn.1004ee60
mov dword [esp + 0x10], eax
imul eax, ecx, 0x3e8
mov dword [esp + 0x14], ebx
mov dword [esp + 0x14], edx
mov dword [esp + 0x14], eax
cmp ebp, esi
jl 0x10009c32
jg 0x10009c2c
cmp edi, esi
jb 0x10009c32
lea eax, [esp + 0x10]
jmp 0x10009c34
mov eax, esi
xor ecx, ecx
lea ebx, [esp + 0x30]
cmp dword [esp + 0x13c], 1
push eax
cmovne ebx, ecx
lea ecx, [esp + 0x34]
xor edx, edx
cmp dword [esp + 0x140], edx
push esi
cmovne ecx, edx
push ebx
push ecx
push esi
mov dword [esp + 0x2c], ecx
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
jne 0x10009c9f
mov esi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call esi
cmp eax, 0x2714
jne 0x10009cc9
test ebp, ebp
jl 0x10009c88
jg 0x10009c82
test edi, edi
jb 0x10009c88
lea eax, [esp + 0x10]
jmp 0x10009c8a
xor eax, eax
push eax
push 0
push ebx
push dword [esp + 0x24]
push 0
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
je 0x10009c6f
test eax, eax
je 0x10009cb0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x128
ret 0xc
push str.Request_timed_out
lea ecx, [esp + 0x20]
call fcn.10009cfb
push 0x1006a4c4
lea eax, [esp + 0x20]
jmp 0x10009ceb
call esi
push str.Failed_to_select_socket
mov ecx, eax
call fcn.1000980f
push eax
push ecx
lea ecx, [esp + 0x28]
call fcn.10002176
push 0x1006a34c
lea eax, [esp + 0x20]
push eax
call fcn.10020402
int3
Function at 0x10010172
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
mov dword [esp + 0x10], ecx
push edi
test esi, esi
jg 0x1001019b
jl 0x10010192
test ebx, ebx
jne 0x1001019b
xor eax, eax
xor edx, edx
jmp 0x10010265
cmp dword [ecx + 0x38], 0
je 0x100101b0
push esi
push ebx
push dword [ebp + 8]
call fcn.10010d13
jmp 0x10010265
mov eax, dword [ecx + 0x1c]
mov edi, ebx
mov edx, dword [eax]
test edx, edx
je 0x100101f5
mov eax, dword [ecx + 0x2c]
cmp dword [eax], 0
jbe 0x100101f5
cmp dword [eax], ebx
mov esi, ebx
mov edi, dword [ebp + 8]
cmovb esi, dword [eax]
push esi
push edx
push edi
call fcn.10020470
mov ecx, dword [esp + 0x20]
add edi, esi
mov dword [esp + 0x1c], edi
add esp, 0xc
mov edi, ebx
sub edi, esi
mov eax, dword [ecx + 0x2c]
sub dword [eax], esi
mov eax, dword [ecx + 0x1c]
add dword [eax], esi
mov esi, dword [ebp + 0x10]
jmp 0x100101fc
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], eax
cmp dword [ecx + 0x4c], 0
je 0x1001025c
call fcn.100115f2
mov ecx, dword [esp + 0x10]
mov edx, edi
cmp edi, 0xfff
jbe 0x10010243
mov eax, dword [esp + 0x14]
push dword [eax + 0x4c]
push 0xfff
push 1
push ecx
call fcn.10034925
mov ecx, dword [esp + 0x20]
sub edi, eax
add ecx, eax
add esp, 0x10
mov dword [esp + 0x10], ecx
mov edx, edi
cmp eax, 0xfff
jne 0x1001025c
jmp 0x1001020d
test edx, edx
je 0x1001025c
mov eax, dword [esp + 0x14]
push dword [eax + 0x4c]
push edi
push 1
push ecx
call fcn.10034925
add esp, 0x10
sub edi, eax
sub ebx, edi
mov eax, ebx
sbb esi, 0
mov edx, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10011f2a
Capabilities:
Encode data using base64

Disassembly:
mov eax, 0x100514ba
call fcn.1004f2f8
sub esp, 0x54
mov edx, ecx
xor eax, eax
mov dword [ebp - 0x18], edx
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
movaps xmm0, xmmword [0x10064190]
push ebx
push esi
push edi
mov edi, edx
movups xmmword [ebp - 0x60], xmm0
movaps xmm0, xmmword [0x100641a0]
stosd dword es:[edi], eax
movups xmmword [ebp - 0x50], xmm0
movaps xmm0, xmmword [0x100641b0]
stosd dword es:[edi], eax
movups xmmword [ebp - 0x40], xmm0
movaps xmm0, xmmword [str.wxyz0123456789_]
stosd dword es:[edi], eax
movups xmmword [ebp - 0x30], xmm0
stosd dword es:[edi], eax
mov dword [edx + 0x10], ecx
mov dword [edx + 0x14], 0xf
mov byte [edx], cl
mov dword [ebp - 4], ecx
mov edi, ecx
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], 1
cmp esi, eax
je 0x100120b0
mov cl, byte [esi]
mov byte [ebp + edi - 0x14], cl
inc edi
mov bl, byte [ebp - 0x13]
mov bh, byte [ebp - 0x14]
mov byte [ebp - 0xd], bl
cmp edi, 3
jne 0x10012024
movzx eax, bh
mov ecx, edx
shr eax, 2
movzx eax, byte [ebp + eax - 0x60]
push eax
call fcn.10011b1b
mov edi, dword [ebp - 0x18]
mov cl, bh
and cl, 3
mov al, bl
shr al, 4
shl cl, 4
add cl, al
movzx eax, cl
mov ecx, edi
movzx eax, byte [ebp + eax - 0x60]
push eax
call fcn.10011b1b
mov al, byte [ebp - 0x12]
mov cl, bl
and cl, 0xf
shr al, 6
shl cl, 2
add cl, al
movzx eax, cl
mov ecx, edi
movzx eax, byte [ebp + eax - 0x60]
push eax
call fcn.10011b1b
movzx eax, byte [ebp - 0x12]
mov ecx, edi
and eax, 0x3f
movzx eax, byte [ebp + eax - 0x60]
push eax
call fcn.10011b1b
mov eax, dword [ebp + 0xc]
xor edi, edi
mov edx, dword [ebp - 0x18]
inc esi
cmp esi, eax
jne 0x10011f9e
test edi, edi
je 0x100120b0
movzx eax, bh
mov ecx, edx
shr eax, 2
movzx eax, byte [ebp + eax - 0x60]
push eax
call fcn.10011b1b
mov esi, dword [ebp - 0x18]
and bh, 3
mov ecx, esi
cmp edi, 1
jne 0x10012068
shl bh, 4
movzx eax, bh
movzx eax, byte [ebp + eax - 0x60]
push eax
call fcn.10011b1b
push 4
inc edi
pop ebx
jmp 0x1001209e
mov al, bl
shl bh, 4
shr al, 4
add bh, al
movzx eax, bh
movzx eax, byte [ebp + eax - 0x60]
push eax
call fcn.10011b1b
and bl, 0xf
mov ecx, esi
shl bl, 2
movzx eax, bl
movzx eax, byte [ebp + eax - 0x60]
push eax
call fcn.10011b1b
push 4
inc edi
pop ebx
cmp edi, ebx
jae 0x100120b3
sub ebx, edi
push 0x3d
mov ecx, esi
call fcn.10011b1b
sub ebx, 1
jne 0x100120a0
jmp 0x100120b3
mov esi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x1001d0b8
Capabilities:
Enumerate threads

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x1006c048]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0
push 4
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
je 0x1001d198
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x1001d191
push ebx
cmp dword [ebp - 0x20], 0x10
jb 0x1001d176
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [ebp - 0x14], eax
jne 0x1001d176
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp - 0x18], eax
je 0x1001d176
mov edx, dword [esi]
test edx, edx
jne 0x1001d144
push 0x200
push edx
push dword [0x1006f434]
mov dword [esi + 4], 0x80
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
mov dword [esi], edx
test edx, edx
je 0x1001d190
lea ebx, [esi + 8]
jmp 0x1001d16c
mov eax, dword [esi + 4]
lea ebx, [esi + 8]
cmp dword [ebx], eax
jb 0x1001d16c
shl eax, 3
push eax
push edx
push 0
push dword [0x1006f434]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov edx, eax
test edx, edx
je 0x1001d190
shl dword [esi + 4], 1
mov dword [esi], edx
mov ecx, dword [ebx]
mov eax, dword [ebp - 0x18]
mov dword [edx + ecx*4], eax
inc dword [ebx]
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x1001d0fc
pop ebx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1001f4be
leave
ret

Function at 0x1001d1a6
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], edx
xor ebx, ebx
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
call fcn.1001d0b8
cmp dword [esi], ebx
je 0x1001d206
push edi
mov edi, ebx
cmp dword [esi + 8], ebx
jbe 0x1001d205
mov eax, dword [esi]
push dword [eax + edi*4]
push ebx
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov ebx, eax
test ebx, ebx
je 0x1001d1fc
push ebx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push dword [ebp + 8]
mov edx, dword [ebp - 4]
mov ecx, ebx
call fcn.1001cf65
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
push 0
pop ebx
cmp edi, dword [esi + 8]
jb 0x1001d1cc
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1001d20a
Capabilities:
Resume thread

Disassembly:
push esi
mov esi, ecx
cmp dword [esi], 0
je 0x1001d256
push edi
xor edi, edi
cmp dword [esi + 8], edi
jbe 0x1001d245
push ebx
mov eax, dword [esi]
push dword [eax + edi*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov ebx, eax
test ebx, ebx
je 0x1001d23e
push ebx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, dword [esi + 8]
jb 0x1001d21b
pop ebx
push dword [esi]
push 0
push dword [0x1006f434]
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
ret
Function at 0x1001d258
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
imul edi, ecx, 0x2c
add edi, dword [0x10085f90]
mov al, byte [edi + 0x14]
mov esi, dword [edi]
and al, 1
je 0x1001d274
sub esi, 5
movzx eax, al
lea ebx, [eax*2 + 5]
lea eax, [ebp - 4]
push eax
push 0x40
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1001d295
push 0xa
pop eax
jmp 0x1001d2d4
mov byte [esi], 0xe9
mov eax, dword [edi + 4]
sub eax, esi
sub eax, 5
mov dword [esi + 1], eax
test byte [edi + 0x14], 1
je 0x1001d2b0
mov eax, dword [edi]
mov word [eax], 0xf9eb
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
or byte [edi + 0x14], 6
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1001d77d
Capabilities:
Allocate or change rwx memory

Disassembly:
mov edx, dword [0x10085f80]
push esi
xor esi, esi
jmp 0x1001d78f
cmp dword [edx + 4], esi
jne 0x1001d7e3
mov edx, dword [edx]
test edx, edx
jne 0x1001d788
push 0x40
push 0x3000
push 0x1000
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edx, eax
test edx, edx
je 0x1001d7df
push edi
push 0x20
lea ecx, [edx + 0x20]
mov dword [edx + 8], esi
pop edi
mov dword [ecx], esi
mov eax, ecx
mov dword [edx + 4], ecx
add edi, 0x20
add ecx, 0x20
mov esi, eax
cmp edi, 0xfe0
jbe 0x1001d7b6
mov eax, dword [0x10085f80]
mov dword [edx], eax
mov dword [0x10085f80], edx
pop edi
test edx, edx
jne 0x1001d7e3
xor eax, eax
pop esi
ret
mov eax, dword [edx + 4]
pop esi
mov ecx, dword [eax]
inc dword [edx + 8]
mov dword [edx + 4], ecx
ret

Function at 0x1001e313
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 2
lea eax, [ebp - 4]
push eax
push 0x20000001
push str._x_sys_default_locale
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov esi, dword [ebp + 0xc]
neg eax
sbb eax, eax
xor ecx, ecx
and eax, dword [ebp - 4]
push ecx
push ecx
push esi
push eax
push dword [ebp + 8]
mov dword [ebp - 4], eax
push ecx
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push eax
push dword [esi]
call fcn.1001e2ef
pop esi
leave
ret 8

Function at 0x1003f2c8
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1003f24a

Function at 0x1003fac1
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10058200
push 0x100581f8
push str.FlsAlloc
push 0x1e
call fcn.1003f8ae
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1003faf5
push dword [ebp + 8]
mov ecx, esi
call dword [0x100531f0]
call esi
jmp 0x1003fafb
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4
Function at 0x1003fb3f
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10058210
push 0x10058208
push str.FlsGetValue
push 0x20
call fcn.1003f8ae
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1003fb76
push dword [ebp + 8]
mov ecx, esi
call dword [0x100531f0]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x100417de
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1004164f

Function at 0x10041d0b
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.1001fc90
mov eax, dword [0x1006c048]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.1003c133
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x10041d4d
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x10041ea9
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.1004edb0
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x1006efa0]
push dword [edi + eax + 0x24]
push dword [edi + eax + 0x20]
push ebx
call fcn.1004392a
mov ecx, dword [esi*4 + 0x1006efa0]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [edi + ecx + 0x20]
jne 0x10041ea2
cmp eax, dword [edi + ecx + 0x24]
jne 0x10041ea2
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [edi + ecx + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10041ea2
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.1004392a
add esp, 0x14
test edx, edx
jl 0x10041ea2
jg 0x10041e18
test eax, eax
jb 0x10041ea2
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x10041ea2
jl 0x10041e32
cmp dword [ebp - 0x1008], eax
ja 0x10041ea2
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x10041e50
test ebx, ebx
je 0x10041e89
cmp ecx, edi
jae 0x10041e89
mov al, byte [ecx]
cmp al, 0xd
jne 0x10041e6a
lea eax, [edi - 1]
cmp ecx, eax
jae 0x10041e76
cmp byte [ecx + 1], 0xa
jne 0x10041e76
inc ecx
jmp 0x10041e76
movzx eax, al
movsx eax, byte [eax + 0x1006c480]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x10041e50
cmp edx, ebx
jne 0x10041e50
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x10041ea7
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.1001f4be
leave
ret
Function at 0x10042d35
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x1006efa0]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x10042d75
cmp byte [ebx], 0xa
jne 0x10042d75
or byte [eax + edi + 0x28], 4
jmp 0x10042d7a
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x10042e78
mov al, byte [edx]
cmp al, 0x1a
je 0x10042e5a
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0x10042da9
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0x10042dce
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x10042dd8
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0x10042d8b
jmp 0x10042e78
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10042e55
cmp dword [ebp - 0xc], 0
je 0x10042e55
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0x1006efa0]
test byte [eax + edi + 0x28], 0x48
je 0x10042e2f
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x10042e1a
mov byte [esi], dl
jmp 0x10042e2b
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x1006efa0]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x10042e78
cmp byte [ebp - 1], 0xa
jne 0x10042e3e
cmp esi, ebx
jne 0x10042e3e
mov byte [esi], 0xa
jmp 0x10042e77
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.10043948
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x10042e78
mov byte [esi], 0xd
jmp 0x10042e77
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x1006efa0]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x10042e74
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x10042e78
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret