joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10025730
Capabilities:
Query environment variable
Resume thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x274
mov eax, dword [0x1005a014]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x210], 0
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0x100488c8
call sub.KERNEL32.dll_GetEnvironmentVariableA
mov dword [ebp - 0x218], eax
cmp dword [ebp + 0xc], 1
jb 0x10025782
cmp dword [ebp + 0xc], 0x1000
jbe 0x10025793
push 0x57
call sub.KERNEL32.dll_SetLastError
jmp 0x10025964
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x210]
push ecx
call fcn.100238b0
test eax, eax
jne 0x100257b9
jmp 0x10025964
cmp dword [ebp - 0x218], 0
je 0x100257ce
cmp dword [ebp - 0x218], 0x104
jb 0x100257d8
jmp 0x10025964
push 0x100488d0
push 0x104
lea edx, [ebp - 0x108]
push edx
call fcn.10024160
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0
jge 0x10025807
jmp 0x10025964
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp - 0x210]
lea eax, [edx + ecx + 0xc]
push eax
push 0x100488e8
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
call fcn.100242c0
add esp, 0x10
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0
jge 0x1002584c
jmp 0x10025964
push 0x10
push 0
lea edx, [ebp - 0x230]
push edx
call fcn.1002ea90
add esp, 0xc
push 0x44
push 0
lea eax, [ebp - 0x274]
push eax
call fcn.1002ea90
add esp, 0xc
mov dword [ebp - 0x274], 0x44
lea ecx, [ebp - 0x230]
push ecx
lea edx, [ebp - 0x274]
push edx
push 0
push 0
push 4
push 0
push 0
push 0
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x108]
push ecx
call dword [ebp + 0x14]
test eax, eax
je 0x10025964
mov edx, dword [ebp - 0x210]
mov eax, dword [edx]
push eax
mov ecx, dword [ebp - 0x210]
push ecx
push 0x10048970
mov edx, dword [ebp - 0x230]
push edx
call fcn.10024fa0
test eax, eax
jne 0x100258fe
push 0xffffffffffffffff
mov eax, dword [ebp - 0x230]
push eax
call sub.KERNEL32.dll_TerminateProcess
mov ecx, dword [ebp - 0x230]
push ecx
call sub.KERNEL32.dll_CloseHandle
mov edx, dword [ebp - 0x22c]
push edx
call sub.KERNEL32.dll_CloseHandle
jmp 0x10025964
mov eax, dword [ebp - 0x22c]
push eax
call sub.KERNEL32.dll_ResumeThread
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x230]
push ecx
call sub.KERNEL32.dll_WaitForSingleObject
mov dword [ebp - 0x21c], 0x1f4
lea edx, [ebp - 0x21c]
push edx
mov eax, dword [ebp - 0x230]
push eax
call sub.KERNEL32.dll_GetExitCodeProcess
mov ecx, dword [ebp - 0x230]
push ecx
call sub.KERNEL32.dll_CloseHandle
mov edx, dword [ebp - 0x22c]
push edx
call sub.KERNEL32.dll_CloseHandle
cmp dword [ebp - 0x21c], 0
je 0x1002595a
jmp 0x10025964
mov dword [ebp - 0x220], 1
lea eax, [ebp - 0x210]
push eax
call fcn.10023cf0
mov eax, dword [ebp - 0x220]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002bcfe
mov esp, ebp
pop ebp
ret 0x10
Function at 0x10025990
Capabilities:
Query environment variable
Resume thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x688
mov eax, dword [0x1005a014]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x634], 0
mov dword [ebp - 0x620], 0
push 0x104
lea eax, [ebp - 0x20c]
push eax
push str.WINDIR
call sub.KERNEL32.dll_GetEnvironmentVariableW
mov dword [ebp - 0x628], eax
cmp dword [ebp + 0xc], 1
jb 0x100259e2
cmp dword [ebp + 0xc], 0x1000
jbe 0x100259f3
push 0x57
call sub.KERNEL32.dll_SetLastError
jmp 0x10025c07
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x620]
push ecx
call fcn.100238b0
test eax, eax
jne 0x10025a19
jmp 0x10025c07
cmp dword [ebp - 0x628], 0
je 0x10025a2e
cmp dword [ebp - 0x628], 0x104
jb 0x10025a38
jmp 0x10025c07
push str._sysnative_rundll32.exe
push 0x104
lea edx, [ebp - 0x20c]
push edx
call fcn.100241b0
mov dword [ebp - 0x624], eax
cmp dword [ebp - 0x624], 0
jge 0x10025a67
jmp 0x10025c07
push 0x104
lea eax, [ebp - 0x414]
push eax
push 0xffffffffffffffff
mov ecx, 1
imul edx, ecx, 0
mov eax, dword [ebp - 0x620]
lea ecx, [eax + edx + 0xc]
push ecx
push 0
push 0
call sub.KERNEL32.dll_MultiByteToWideChar
mov dword [ebp - 0x62c], eax
cmp dword [ebp - 0x62c], 0x104
jae 0x10025aac
cmp dword [ebp - 0x62c], 0
jg 0x10025ab6
jmp 0x10025c07
lea edx, [ebp - 0x414]
push edx
push str.rundll32.exe___s__1
push 0x104
lea eax, [ebp - 0x61c]
push eax
call fcn.10024320
add esp, 0x10
mov dword [ebp - 0x624], eax
cmp dword [ebp - 0x624], 0
jge 0x10025aef
jmp 0x10025c07
push 0x10
push 0
lea ecx, [ebp - 0x644]
push ecx
call fcn.1002ea90
add esp, 0xc
push 0x44
push 0
lea edx, [ebp - 0x688]
push edx
call fcn.1002ea90
add esp, 0xc
mov dword [ebp - 0x688], 0x44
lea eax, [ebp - 0x644]
push eax
lea ecx, [ebp - 0x688]
push ecx
push 0
push 0
push 4
push 0
push 0
push 0
lea edx, [ebp - 0x61c]
push edx
lea eax, [ebp - 0x20c]
push eax
call dword [ebp + 0x14]
test eax, eax
je 0x10025c07
mov ecx, dword [ebp - 0x620]
mov edx, dword [ecx]
push edx
mov eax, dword [ebp - 0x620]
push eax
push 0x10048970
mov ecx, dword [ebp - 0x644]
push ecx
call fcn.10024fa0
test eax, eax
jne 0x10025ba1
push 0xffffffffffffffff
mov edx, dword [ebp - 0x644]
push edx
call sub.KERNEL32.dll_TerminateProcess
mov eax, dword [ebp - 0x644]
push eax
call sub.KERNEL32.dll_CloseHandle
mov ecx, dword [ebp - 0x640]
push ecx
call sub.KERNEL32.dll_CloseHandle
jmp 0x10025c07
mov edx, dword [ebp - 0x640]
push edx
call sub.KERNEL32.dll_ResumeThread
push 0xffffffffffffffff
mov eax, dword [ebp - 0x644]
push eax
call sub.KERNEL32.dll_WaitForSingleObject
mov dword [ebp - 0x630], 0x1f4
lea ecx, [ebp - 0x630]
push ecx
mov edx, dword [ebp - 0x644]
push edx
call sub.KERNEL32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x644]
push eax
call sub.KERNEL32.dll_CloseHandle
mov ecx, dword [ebp - 0x640]
push ecx
call sub.KERNEL32.dll_CloseHandle
cmp dword [ebp - 0x630], 0
je 0x10025bfd
jmp 0x10025c07
mov dword [ebp - 0x634], 1
lea edx, [ebp - 0x620]
push edx
call fcn.10023cf0
mov eax, dword [ebp - 0x634]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002bcfe
mov esp, ebp
pop ebp
ret 0x10
Function at 0x10026140
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
sub eax, 0x10000
push eax
call fcn.10026310
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jbe 0x1002621d
mov edx, dword [ebp - 4]
cmp edx, dword [section..data]
jb 0x1002618a
mov eax, dword [ebp - 4]
cmp eax, dword [0x1005a004]
ja 0x1002618a
mov ecx, dword [ebp - 4]
sub ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x1002615a
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call fcn.1002ea90
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call sub.KERNEL32.dll_VirtualQuery
test eax, eax
jne 0x100261af
jmp 0x1002621d
cmp dword [ebp - 0x14], 0x10000
jne 0x10026203
cmp dword [ebp - 0x18], 0x10000
jb 0x10026203
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call sub.KERNEL32.dll_VirtualAlloc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x100261e6
mov eax, dword [ebp - 8]
jmp 0x1002621f
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x677
jne 0x100261f6
xor eax, eax
jmp 0x1002621f
mov eax, dword [ebp - 4]
sub eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x10026218
mov ecx, dword [ebp - 0x20]
sub ecx, 0x10000
push ecx
call fcn.10026310
add esp, 4
mov dword [ebp - 4], eax
jmp 0x1002615a
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x10026230
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push eax
call fcn.10026340
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x10026305
mov edx, dword [ebp - 4]
cmp edx, dword [section..data]
jb 0x10026275
mov eax, dword [ebp - 4]
cmp eax, dword [0x1005a004]
ja 0x10026275
mov ecx, dword [ebp - 4]
add ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x10026245
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call fcn.1002ea90
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call sub.KERNEL32.dll_VirtualQuery
test eax, eax
jne 0x1002629a
jmp 0x10026305
cmp dword [ebp - 0x14], 0x10000
jne 0x100262ee
cmp dword [ebp - 0x18], 0x10000
jb 0x100262ee
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call sub.KERNEL32.dll_VirtualAlloc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x100262d1
mov eax, dword [ebp - 8]
jmp 0x10026307
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x677
jne 0x100262e1
xor eax, eax
jmp 0x10026307
mov eax, dword [ebp - 4]
add eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x10026300
mov ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 0x18]
push ecx
call fcn.10026340
add esp, 4
mov dword [ebp - 4], eax
jmp 0x10026245
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10026370
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.10026760
add esp, 0xc
mov dword [ebp - 4], 0
cmp dword [0x1005ab9c], 0
jne 0x100263ad
cmp dword [0x1005ab98], 0
je 0x100263ad
mov eax, dword [0x1005ab98]
mov dword [0x1005ab9c], eax
cmp dword [0x1005ab9c], 0
je 0x1002642a
mov ecx, dword [0x1005ab9c]
cmp dword [ecx + 8], 0
je 0x1002642a
mov edx, dword [0x1005ab9c]
mov eax, dword [edx + 8]
cmp eax, dword [ebp - 0x10]
jb 0x1002642a
mov ecx, dword [0x1005ab9c]
mov edx, dword [ecx + 8]
cmp edx, dword [ebp - 0xc]
ja 0x1002642a
mov eax, dword [0x1005ab9c]
mov ecx, dword [eax + 8]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
cmp edx, dword [ebp - 0x10]
jb 0x100263f9
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0xc]
jbe 0x10026400
xor eax, eax
jmp 0x10026549
mov ecx, dword [0x1005ab9c]
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x40]
mov dword [ecx + 8], eax
push 0x48
push 0xcc
mov ecx, dword [ebp - 4]
push ecx
call fcn.1002ea90
add esp, 0xc
mov eax, dword [ebp - 4]
jmp 0x10026549
mov edx, dword [0x1005ab98]
mov dword [0x1005ab9c], edx
jmp 0x10026446
mov eax, dword [0x1005ab9c]
mov ecx, dword [eax + 4]
mov dword [0x1005ab9c], ecx
cmp dword [0x1005ab9c], 0
je 0x10026486
cmp dword [0x1005ab9c], 0
je 0x10026484
mov edx, dword [0x1005ab9c]
cmp dword [edx + 8], 0
je 0x10026484
mov eax, dword [0x1005ab9c]
mov ecx, dword [eax + 8]
cmp ecx, dword [ebp - 0x10]
jb 0x10026484
mov edx, dword [0x1005ab9c]
mov eax, dword [edx + 8]
cmp eax, dword [ebp - 0xc]
ja 0x10026484
jmp 0x100263de
jmp 0x10026438
mov ecx, dword [ebp + 8]
and ecx, 0xffff
mov edx, dword [ebp + 8]
sub edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.10026550
add esp, 0xc
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x10026547
mov eax, dword [ebp - 0x18]
mov dword [0x1005ab9c], eax
mov ecx, dword [0x1005ab9c]
mov dword [ecx], 0x52727464
mov edx, dword [0x1005ab9c]
mov dword [edx + 8], 0
mov eax, dword [0x1005ab9c]
mov ecx, dword [0x1005ab98]
mov dword [eax + 4], ecx
mov edx, dword [0x1005ab9c]
mov dword [0x1005ab98], edx
mov dword [ebp - 0x14], 0
mov eax, dword [0x1005ab9c]
add eax, 0x48
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0x38c
jmp 0x10026517
mov ecx, dword [ebp - 8]
sub ecx, 1
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 1
jle 0x10026537
imul edx, dword [ebp - 8], 0x48
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x14]
mov dword [eax + edx + 0x40], ecx
imul edx, dword [ebp - 8], 0x48
add edx, dword [ebp - 4]
mov dword [ebp - 0x14], edx
jmp 0x1002650e
mov eax, dword [0x1005ab9c]
mov ecx, dword [ebp - 0x14]
mov dword [eax + 8], ecx
jmp 0x100263de
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10027290
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1005ab98]
mov dword [ebp - 4], eax
jmp 0x100272a9
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
je 0x100272d0
lea eax, [ebp - 8]
push eax
push 0x40
push 0x10000
mov ecx, dword [ebp - 4]
push ecx
call sub.KERNEL32.dll_VirtualProtect
test eax, eax
jne 0x100272ce
call sub.KERNEL32.dll_GetLastError
jmp 0x100272d2
jmp 0x100272a0
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10027740
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 8], 0
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [0x1005aba8], eax
je 0x10027764
mov eax, 0x10dd
jmp 0x1002790c
cmp dword [0x1005abac], 0
je 0x10027777
mov eax, dword [0x1005abac]
jmp 0x1002790c
cmp dword [ebp + 0xc], 0
jne 0x10027787
mov eax, 0x57
jmp 0x1002790c
cmp dword [ebp + 8], 0
jne 0x10027797
mov eax, 6
jmp 0x1002790c
mov eax, dword [ebp + 8]
cmp dword [eax], 0
jne 0x100277c0
mov dword [ebp - 8], 6
mov ecx, dword [ebp - 8]
mov dword [0x1005abac], ecx
mov edx, dword [ebp + 8]
mov dword [0x1005abb0], edx
mov eax, dword [ebp - 8]
jmp 0x1002790c
push 0x18
call fcn.1002c27a
add esp, 4
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1002781b
mov dword [ebp - 8], 8
mov ecx, dword [ebp - 8]
mov dword [0x1005abac], ecx
cmp dword [ebp - 4], 0
je 0x1002780a
mov edx, dword [ebp - 4]
mov dword [ebp - 0x20], edx
push 0x18
mov eax, dword [ebp - 0x20]
push eax
call fcn.1002c2aa
add esp, 8
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 8]
mov dword [0x1005abb0], ecx
mov eax, dword [ebp - 8]
jmp 0x1002790c
push 0
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
call fcn.10027720
mov dword [ebp - 0x10], eax
push 0
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.10027720
mov dword [ebp + 0xc], eax
mov edx, dword [ebp - 0x10]
movzx eax, byte [edx + 0x36]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x40]
sub edx, dword [ebp - 0xc]
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0xc], 0
je 0x1002785b
cmp dword [ebp - 0xc], 0x1e
jbe 0x10027877
mov dword [ebp - 8], 9
cmp dword [0x1005aba0], 0
je 0x10027872
jmp 0x100277e9
jmp 0x100277e0
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x44]
cmp ecx, dword [ebp + 0xc]
je 0x1002789e
mov dword [ebp - 8], 9
cmp dword [0x1005aba0], 0
je 0x10027899
jmp 0x100277e9
jmp 0x100277e0
mov dword [ebp - 0x18], 0
lea edx, [ebp - 0x18]
push edx
push 0x40
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call sub.KERNEL32.dll_VirtualProtect
test eax, eax
jne 0x100278c9
call sub.KERNEL32.dll_GetLastError
mov dword [ebp - 8], eax
jmp 0x100277e0
mov edx, dword [ebp - 4]
mov dword [edx + 4], 1
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov dword [eax + 8], ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
mov dword [edx + 0x10], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x14]
mov dword [ecx + 0xc], edx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x18]
mov dword [eax + 0x14], ecx
mov edx, dword [ebp - 4]
mov eax, dword [0x1005abb8]
mov dword [edx], eax
mov ecx, dword [ebp - 4]
mov dword [0x1005abb8], ecx
xor eax, eax
mov esp, ebp
pop ebp
ret 8
Function at 0x10027920
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [0x1005aba8], eax
je 0x1002793d
mov eax, 0x10dd
jmp 0x10027a20
mov eax, dword [0x1005abb8]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x100279bc
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x14]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
movzx eax, byte [edx + 0x36]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
push edx
call sub.KERNEL32.dll_VirtualProtect
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
jne 0x10027998
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x10], 0
je 0x10027998
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
push eax
call fcn.100267f0
add esp, 4
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 0xc], ecx
push 0x18
mov edx, dword [ebp - 0xc]
push edx
call fcn.1002c2aa
add esp, 8
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
jmp 0x10027945
mov dword [0x1005abb8], 0
call fcn.100270d0
mov ecx, dword [0x1005abb4]
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
je 0x10027a0a
mov edx, dword [ebp - 8]
mov eax, dword [edx + 4]
push eax
call sub.KERNEL32.dll_ResumeThread
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
push 8
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.1002c2aa
add esp, 8
mov edx, dword [ebp - 0x18]
mov dword [ebp - 8], edx
jmp 0x100279d4
mov dword [0x1005abb4], 0
mov dword [0x1005aba8], 0
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x10027f00
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x1005abac], 0
je 0x10027f19
mov eax, dword [0x1005abac]
jmp 0x10027fb8
call sub.KERNEL32.dll_GetCurrentThread
cmp dword [ebp + 8], eax
jne 0x10027f2a
xor eax, eax
jmp 0x10027fb8
push 8
call fcn.1002c27a
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10027f82
mov dword [ebp - 8], 8
cmp dword [ebp - 4], 0
je 0x10027f6b
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x10], ecx
push 8
mov edx, dword [ebp - 0x10]
push edx
call fcn.1002c2aa
add esp, 8
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov dword [0x1005abac], eax
mov dword [0x1005abb0], 0
mov eax, dword [ebp - 8]
jmp 0x10027fb8
mov ecx, dword [ebp + 8]
push ecx
call sub.KERNEL32.dll_SuspendThread
cmp eax, 0xffffffff
jne 0x10027f9a
call sub.KERNEL32.dll_GetLastError
mov dword [ebp - 8], eax
jmp 0x10027f4a
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov dword [edx + 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [0x1005abb4]
mov dword [ecx], edx
mov eax, dword [ebp - 4]
mov dword [0x1005abb4], eax
xor eax, eax
mov esp, ebp
pop ebp
ret 4
Function at 0x100380e5
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x10038124
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10038124
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10038124
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x10038124
cmp dword [ecx + 0x74], 0xe
jbe 0x10038124
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x1003b391
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1004b4f8
push 0x1004b4f0
push str.FlsAlloc
push 0x1f
call fcn.1003b250
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1003b3c5
push dword [ebp + 8]
mov ecx, esi
call dword [0x10048578]
call esi
jmp 0x1003b3cb
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1003b40f
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1004b508
push 0x1004b500
push str.FlsGetValue
push 0x21
call fcn.1003b250
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1003b446
push dword [ebp + 8]
mov ecx, esi
call dword [0x10048578]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1003b44e
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1004b510
push 0x1004b508
push str.FlsSetValue
push 0x22
call fcn.1003b250
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1003b488
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x10048578]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x1003ea83
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1003eb20
push ebx
push esi
call fcn.1003ea4c
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1003e9e0
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x1003eacd
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1003eb1f
push edi
push eax
call fcn.100394d3
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x1003eaed
call fcn.10039499
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1003eb1e
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1003e9e0
add esp, 0x20
test eax, eax
jne 0x1003eb0c
push edi
call fcn.10039499
jmp 0x1003eb14
push ebx
call fcn.10039499
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x1003eb23
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x1003eb34
pop esi
ret
push ebx
push edi
push esi
call fcn.1003ea4c
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.100394d3
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x1003eb5c
push ebx
push esi
push edi
call fcn.1002e510
add esp, 0xc
push 0
call fcn.10039499
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x1003ef2c
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1003eb71
Function at 0x1004301f
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x1005b278]
mov dword [ebp - 0xc], ecx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x1004305f
cmp byte [ebx], 0xa
jne 0x1004305f
or byte [edi + eax + 0x28], 4
jmp 0x10043064
and byte [edi + eax + 0x28], 0xfb
add ecx, ebx
mov eax, ebx
mov dword [ebp - 0x10], ecx
mov esi, ebx
mov dword [ebp - 8], eax
cmp ebx, ecx
jae 0x10043163
mov dl, byte [eax]
cmp dl, 0x1a
je 0x10043146
inc eax
cmp dl, 0xd
je 0x10043090
mov dword [ebp - 8], eax
mov byte [esi], dl
jmp 0x100430b6
cmp eax, ecx
jae 0x100430c4
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add dword [ebp - 8], eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
xor edx, edx
inc edx
add esi, edx
cmp eax, ecx
jb 0x10043078
jmp 0x10043163
push 0
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10043141
cmp dword [ebp - 0x10], 0
je 0x10043141
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx*4 + 0x1005b278]
test byte [eax + edi + 0x28], 0x48
je 0x1004311b
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x10043106
mov byte [esi], dl
jmp 0x10043117
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x1005b278]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x10043163
cmp byte [ebp - 1], 0xa
jne 0x1004312a
cmp esi, ebx
jne 0x1004312a
mov byte [esi], 0xa
jmp 0x10043162
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.10042f8f
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x10043163
mov byte [esi], 0xd
jmp 0x10043162
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx*4 + 0x1005b278]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x10043160
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x10043163
mov byte [esi], dl
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret