joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100c46f9
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
cmp byte [0x10140552], 0
je 0x100c470e
mov eax, dword [0x10140554]
leave
ret
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push esi
push edi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push 0x100c4818
push SysReAllocStringLen
mov dword [ebp - 4], esi
call ebx
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100c4785
lea eax, [ebp - 8]
push eax
push 0x10140554
push esi
push esi
push dword [0x1013c6dc]
mov dword [ebp - 8], 4
push dword [ebp - 4]
call edi
test eax, eax
jne 0x100c4785
cmp dword [ebp - 8], 4
jne 0x100c4785
mov esi, dword [0x10140554]
mov byte [0x10140552], 1
cmp dword [ebp - 4], eax
je 0x100c477e
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x100c4810
mov eax, dword [ebp - 4]
mov dword [ebp - 4], esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x100c4798
push eax
call esi
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push 0x100c4864
push SysReAllocStringLen
call ebx
test eax, eax
jne 0x100c47f5
push 4
pop ebx
lea eax, [ebp - 8]
push eax
push 0x10140554
push 0
push 0
push dword [0x1013c6dc]
mov dword [ebp - 8], ebx
push dword [ebp - 4]
call edi
test eax, eax
jne 0x100c47f5
cmp dword [ebp - 8], ebx
jne 0x100c47f5
mov edi, dword [0x10140554]
mov byte [0x10140552], 1
cmp dword [ebp - 4], eax
je 0x100c47f1
push dword [ebp - 4]
call esi
mov eax, edi
jmp 0x100c4810
and dword [0x10140554], 0
cmp dword [ebp - 4], 0
mov byte [0x10140552], 1
je 0x100c480e
push dword [ebp - 4]
call esi
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x100c49b4
Capabilities:
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x10140660], eax
mov dword [0x1014065c], ecx
mov dword [0x10140658], edx
mov dword [0x10140654], ebx
mov dword [0x10140650], esi
mov dword [0x1014064c], edi
mov word [0x10140678], ss
mov word [0x1014066c], cs
mov word [0x10140648], ds
mov word [0x10140644], es
mov word [0x10140640], fs
mov word [0x1014063c], gs
pushfd
pop dword [0x10140670]
mov eax, dword [ebp]
mov dword [0x10140664], eax
mov eax, dword [ebp + 4]
mov dword [0x10140668], eax
lea eax, [ebp + 8]
mov dword [0x10140674], eax
mov eax, dword [ebp - 0x320]
mov dword [0x101405b0], 0x10001
mov eax, dword [0x10140668]
mov dword [0x10140564], eax
mov dword [0x10140558], 0xc0000409
mov dword [0x1014055c], 1
mov eax, dword [0x1000f6d4]
mov dword [ebp - 0x328], eax
mov eax, dword [0x1013c6d8]
mov dword [ebp - 0x324], eax
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x101405a8], eax
push 1
call sub.MSVCR100.dll__crt_debugger_hook
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
push 0x100c4ab4
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x101405a8], 0
jne 0x100c4aa0
push 1
call sub.MSVCR100.dll__crt_debugger_hook
pop ecx
push 0xc0000409
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
leave
ret
Function at 0x100c61b3
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x1000f6d4]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x20c]
push eax
push 0
push 2
push 0x100c62ac
push 0x100c6258
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x210], 0x208
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x100c6245
mov ecx, dword [ebp - 0x210]
cmp ecx, 4
jb 0x100c6245
shr ecx, 1
cmp word [ebp + ecx*2 - 0x210], 0x5c
push 0xffffffffffffffff
sete al
lea eax, [eax*2 + 0x100c62cc]
push eax
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.MSVCR100.dll_wcsncat_s]
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call fcn.100c63da
jmp 0x100c6247
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.10002069
leave
ret 4

Function at 0x100c6304
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x1000f6d4]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x20c]
push eax
push 0
push 2
push 0x10029070
push 0x100c6378
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x210], 0x208
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x100c6367
cmp dword [ebp - 0x210], 4
jb 0x100c6367
lea eax, [ebp - 0x20c]
push eax
call fcn.100c63da
jmp 0x100c6369
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.10002069
leave
ret 4

Function at 0x100c97b9
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x904
mov eax, dword [0x1000f6d4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
push 0x100
lea eax, [ebp - 0x904]
push 0
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0x400
lea eax, [ebp - 0x804]
push eax
push esi
xor edi, edi
call fcn.100c896b
push 0x5c
pop esi
lea eax, [ebp - 0x804]
push esi
push eax
call dword [sym.imp.MSVCR100.dll_wcsrchr]
pop ecx
pop ecx
test eax, eax
je 0x100c981f
xor ecx, ecx
mov dword [ebp + edi*4 - 0x904], eax
mov word [eax], cx
inc edi
cmp edi, 0x40
jge 0x100c9862
test eax, eax
je 0x100c9858
lea eax, [ebp - 0x804]
push eax
call fcn.100ce3bc
test eax, eax
jns 0x100c9858
jmp 0x100c97fe
mov eax, dword [ebp + edi*4 - 0x908]
dec edi
mov word [eax], si
push 0
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x100c9862
cmp edi, 1
jg 0x100c983a
xor eax, eax
inc eax
jmp 0x100c9864
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.10002069
leave
ret 4
Function at 0x100c987a
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x10
push 1
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x100c98c2
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
test eax, eax
je 0x100c98c2
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x100c98c2
cmp word [eax + 2], 0
je 0x100c98c2
cmp dword [eax + 0x28], 0xfeef04bd
jne 0x100c98c2
add eax, 0x30
jmp 0x100c98c7
mov eax, 0x100c98cc
pop esi
pop ebp
ret
Function at 0x100cc646
Capabilities:
Query or enumerate registry value

Disassembly:
push 4
mov eax, 0x100f063c
call fcn.10001e61
mov esi, dword [ebp + 8]
cmp esi, dword [0x10140d28]
jne 0x100cc664
xor al, al
jmp 0x100cc73d
mov bl, byte [ebp + 0xc]
test bl, bl
je 0x100cc675
xor ecx, ecx
cmp dword [0x10107738], ecx
jmp 0x100cc680
mov eax, esi
call fcn.100cc816
xor ecx, ecx
test al, al
sete cl
test ecx, ecx
jne 0x100cc65d
xor edi, edi
lea ecx, [ebp + 0xf]
mov dword [ebp + 8], edi
mov dword [ebp - 0x10], edi
call fcn.1002c0e2
mov dword [ebp - 4], edi
movzx edi, bl
neg edi
sbb edi, edi
and edi, 2
xor ebx, ebx
jmp 0x100cc6fe
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x100cc6b4
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push dword [esi]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
call fcn.100cc745
test eax, eax
je 0x100cc723
push 0x1c04c2
xor ebx, ebx
push ebx
call fcn.100bbd72
mov eax, dword [esi + 8]
movzx eax, word [eax + 6]
push dword [ebp + 8]
and eax, 0xf
imul eax, eax, 0xc
mov ecx, 0x10107740
mov dword [eax + 0x10106608], ebx
call fcn.100cc0c3
mov dword [ebp + 8], ebx
movzx eax, word [esi + 0xc]
shr eax, 1
and eax, 0x10
push ebx
or eax, edi
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp + 8]
push eax
push dword [esi + 8]
call fcn.1002c103
mov ebx, eax
test ebx, ebx
jne 0x100cc730
jmp 0x100cc6a8
push dword [ebp + 8]
mov ecx, 0x10107740
call fcn.100038fb
lea ecx, [ebp + 0xf]
call fcn.1002c8d7
test ebx, ebx
sete al
call fcn.10001ea0
ret 8

Function at 0x100cc76a
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov dword [ebp - 4], eax
test ecx, ecx
jne 0x100cc77c
mov ecx, dword [edi]
lea eax, [ebp - 4]
push eax
push ebx
lea eax, [ebp + 0xc]
push eax
push 0xffff
push dword [ebp + 8]
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
cmp dword [ebp - 4], 2
mov esi, eax
jae 0x100cc7ad
cmp dword [ebp + 0xc], 1
je 0x100cc7aa
cmp dword [ebp + 0xc], 2
jne 0x100cc7ad
push 2
pop esi
mov eax, esi
call fcn.100cc745
test eax, eax
je 0x100cc7d1
push 0x1c0491
push 0
call fcn.100bbd72
push edi
mov ecx, 0x10107740
call fcn.100cc0c3
jmp 0x100cc80e
test esi, esi
jne 0x100cc803
mov ecx, dword [ebp + 0xc]
cmp ecx, 2
je 0x100cc7e2
cmp ecx, 1
jne 0x100cc7f1
mov eax, dword [ebp - 4]
shr eax, 1
xor ecx, ecx
mov word [ebx + eax*2 - 2], cx
mov ecx, dword [ebp + 0xc]
movzx eax, byte [ebp + 0x10]
push eax
push ecx
call fcn.100cc61c
test eax, eax
jne 0x100cc803
push 2
pop esi
push edi
mov ecx, 0x10107740
call fcn.100038fb
mov eax, esi
pop esi
pop ebx
leave
ret 0xc
Function at 0x100cc838
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x14
mov eax, 0x100f06ec
call fcn.10001e61
mov esi, dword [ebp + 8]
cmp esi, dword [0x10140d28]
jne 0x100cc856
xor eax, eax
jmp 0x100cc9b9
and dword [ebp - 0x1c], 0
xor ecx, ecx
mov dword [ebp - 0x18], ecx
xor ebx, ebx
or edi, 0xffffffff
test ebx, ebx
jne 0x100cc879
cmp dword [0x10107738], ebx
je 0x100cc97a
push 2
pop edi
jmp 0x100cc893
cmp ebx, 1
jne 0x100cc97a
mov eax, esi
call fcn.100cc816
test al, al
je 0x100cc97a
xor edi, edi
and dword [ebp - 0x10], 0
lea ecx, [ebp + 0xb]
mov dword [ebp - 0x20], edi
call fcn.1002c0e2
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], eax
push eax
movzx eax, word [esi + 0xc]
shr eax, 1
and eax, 0x10
or eax, edi
jmp 0x100cc93e
mov eax, dword [ebp - 0x14]
test eax, eax
jne 0x100cc8c7
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
lea ecx, [ebp - 0x18]
push ecx
push 0
lea ecx, [ebp - 0x1c]
push ecx
push 0
push dword [esi]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [ebp - 0x18], 2
mov edi, eax
jae 0x100cc8f3
cmp dword [ebp - 0x1c], 1
je 0x100cc8f0
cmp dword [ebp - 0x1c], 2
jne 0x100cc8f3
push 2
pop edi
mov eax, edi
call fcn.100cc745
test eax, eax
je 0x100cc95a
push 0x1c0496
xor edi, edi
push edi
call fcn.100bbd72
mov eax, dword [esi + 8]
movzx eax, word [eax + 6]
push dword [ebp - 0x10]
and eax, 0xf
imul eax, eax, 0xc
mov ecx, 0x10107740
mov dword [eax + 0x10106608], edi
call fcn.100cc0c3
movzx eax, word [esi + 0xc]
shr eax, 1
and eax, 0x10
or eax, dword [ebp - 0x20]
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], edi
push edi
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push dword [esi + 8]
call fcn.1002c103
mov edi, eax
test edi, edi
jne 0x100cc96b
jmp 0x100cc8bb
push dword [ebp - 0x10]
mov ecx, 0x10107740
call fcn.100038fb
test edi, edi
je 0x100cc985
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xb]
call fcn.1002c8d7
mov ecx, dword [ebp - 0x18]
inc ebx
cmp ebx, 2
jge 0x100cc994
jmp 0x100cc861
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xb]
call fcn.1002c8d7
mov ecx, dword [ebp - 0x18]
test edi, edi
jne 0x100cc9af
cmp dword [ebp - 0x1c], 2
je 0x100cc9a7
mov al, byte [esi + 0xc]
and al, 0xf
cmp al, 2
jne 0x100cc9b7
push ecx
call fcn.100cbaaf
jmp 0x100cc9b5
push esi
call fcn.100cb288
mov ecx, eax
mov eax, ecx
call fcn.10001ea0
ret 4
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
nop
pop eax
nop
add eax, 0x40a063
nop
nop
sub eax, 0x40a009
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
popal
nop
nop
jmp fcn.00431219

Function at 0x41f034
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
pushal
mov dword [ebp - 4], 0
call fcn.0041f047

Function at 0x41f0ae
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
pushal
mov dword [ebp - 4], 0
call fcn.0041f0c1
Function at 0x1002f470
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x1002f47f
pop dword [ebp - 0x48]
mov eax, 0x9b9059f0
add eax, 0x74729a8f
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0xd8c90809
sub dword [ebp - 0x58], 0x8a76c2be
mov dword [ebp - 0x54], 0x3210ab09
add dword [ebp - 0x54], 0x22a13c
mov dword [ebp - 0x50], 0x4aea0f54
sub dword [ebp - 0x50], 0xfe9dcb26
mov dword [ebp - 0x4c], 0xe826b882
sub dword [ebp - 0x4c], 0xe826b882
lea eax, [ebp - 0x58]
push eax
mov eax, 0x497e7af1
sub eax, 0x397a7ab5
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0x645a2a15
add dword [ebp - 0x58], 0x10183f41
mov dword [ebp - 0x54], 0xc2bafb4a
add dword [ebp - 0x54], 0x7eb1662b
mov dword [ebp - 0x50], 0x7114b0bf
sub dword [ebp - 0x50], 0xda54453
mov dword [ebp - 0x4c], 0xd71bcfa4
add dword [ebp - 0x4c], 0x28e4305c
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x47e18
push 0
call eax
mov ecx, 0x9f6baffa
add ecx, 0x60949c94
mov esi, eax
mov edi, 0x10056e00
add edi, dword [ebp - 0x48]
mov ebx, 0x86e32862
add ebx, 0xf7dd8927
sub dword [ebp - 0x38], 0x3c493d12
mov edx, dword [edi]
mov dword [ebp - 0x38], 0x9a9000c2
xor edx, ebx
sub dword [ebp - 0x1c], 0xf909762
mov dword [esi], edx
add esi, 0xd299bab8
sub esi, 0xd299bab4
add edi, 0xb38c3947
sub edi, 0xb38c3943
loop 0x1002f596
add eax, 0x4097ae88
add eax, 0xbf697683
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x9a745920
add ecx, 0x758ba6e0
add ecx, dword [ebp - 0x48]
call ebx
leave
ret
Function at 0x10031820
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x1004f37c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x10031850
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10038620
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
mov eax, dword [eax]
test eax, eax
je 0x10031880
mov edx, dword [esi + 0x30]
mov edx, dword [edx]
add edx, eax
cmp eax, edx
jae 0x10031880
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void_]
pop esi
mov byte [eax], bl
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10038620
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
push edi
je 0x1003197a
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x100318a9
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x100318dd
push dword [esi + 0x4c]
movsx eax, bl
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10038620
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x28], bl
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x27]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
test eax, eax
js 0x1003197a
cmp eax, 1
jle 0x1003193b
cmp eax, 3
jne 0x1003197a
push dword [esi + 0x4c]
push dword [ebp - 0x28]
call fcn.1002f470
add esp, 8
or ecx, 0xffffffff
test al, al
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10038620
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x10031959
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x1003197a
lea eax, [ebp - 0x28]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
je 0x1003197a
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10038620
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10038620
mov esp, ebp
pop ebp
ret 4
Function at 0x10036f80
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003ecf8
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x1004f37c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x1004f338]
cmp eax, 0xffffffff
jne 0x10036fb6
xor ebx, ebx
jmp 0x10036fbf
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov ebx, eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], 0
test ebx, ebx
je 0x10036fff
mov eax, dword [ebx + 0x18]
mov esi, dword [ebx + 0xc]
test eax, eax
jne 0x1003703e
test esi, esi
jne 0x10037042
push 0x10035760
push 0x10050e58
call fcn.1002f470
mov eax, dword [0x1004f338]
add esp, 8
cmp eax, 0xffffffff
je 0x10036fff
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov dword [ebp - 4], 1
test ebx, ebx
je 0x1003702c
or eax, 0xffffffff
lock xadd dword [ebx + 4], eax
jne 0x1003702c
mov eax, dword [ebx]
mov ecx, ebx
push 0
call dword [eax]
push ebx
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x10037084
mov eax, dword [esi + 4]
mov dword [ebx + 0xc], eax
mov ecx, dword [esi]
test ecx, ecx
je 0x1003706d
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [esi]
mov ecx, edi
push 0
mov eax, dword [edi]
call dword [eax]
push edi
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapFree]
push esi
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov esi, dword [ebx + 0xc]
test esi, esi
jne 0x10037042
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x10036fd0
nop
mov esi, dword [ebx + 0x14]
mov esi, dword [esi]
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x100370a9
mov edx, dword [esi + 0x1c]
test edx, edx
je 0x100370a9
mov eax, dword [ecx]
push edx
call dword [eax + 4]
push esi
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebx + 0x14]
call fcn.1002f470
mov eax, dword [ebx + 0x18]
test eax, eax
jne 0x10037090
jmp 0x10036fd0

Function at 0x100370d0
Capabilities:
Create thread
Resume thread

Disassembly:
push ebx
push esi
mov esi, ecx
mov edx, dword [esi]
lea eax, [edx + 0x10]
push eax
push 4
push edx
push 0x10037130
push 0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov ebx, eax
add esp, 0x18
test ebx, ebx
jne 0x100370fa
pop esi
xor al, al
pop ebx
ret
mov eax, dword [esi]
push edi
add eax, 4
lock inc dword [eax]
mov edi, dword [esi]
mov eax, dword [edi + 8]
test eax, eax
je 0x10037118
cmp eax, 0xffffffff
je 0x10037118
push eax
call dword [sym.imp.kernel32.dll_CloseHandle]
mov dword [edi + 8], ebx
mov eax, dword [esi]
push dword [eax + 8]
call dword [sym.imp.kernel32.dll_ResumeThread]
pop edi
pop esi
mov al, 1
pop ebx
ret
Function at 0x4014d0
Capabilities:
Create directory
Write file on windows

Disassembly:
sub esp, 0x44
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push edi
push 0
push str.data
mov edi, ecx
call esi
push 0
push str.data_aiconfig
call esi
mov eax, dword [0x6b419c]
movzx ecx, word [eax + 0x129]
push ecx
lea edx, [esp + 0x10]
push 0x57f64c
push edx
call fcn.00561680
push 0x57f664
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x1c]
push ecx
call fcn.00561639
mov eax, dword [esp + 0x20]
add esp, 0x18
test eax, eax
je 0x40154b
push eax
push 1
push 0x1c64
add edi, 0xec
push edi
call fcn.005614ec
mov edx, dword [esp + 0x18]
push edx
call fcn.00561321
add esp, 0x14
pop edi
pop esi
add esp, 0x44
ret
Function at 0x404490
Capabilities:
Create directory
Write file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
xor edi, edi
mov dword [esp + 0x10], ecx
xor ebp, ebp
mov esi, 0x1d4
lea ebx, [edi + 1]
call fcn.004040a0
mov dword [eax + esi + 0xbc], ebx
call fcn.004040a0
mov dword [eax + esi], edi
cmp ebp, 5
jge 0x4044df
call fcn.004040a0
mov dword [eax + esi - 0x88], edi
call fcn.004040a0
mov dword [eax + esi - 0x34], edi
call fcn.004040a0
mov dword [eax + esi + 0x88], ebx
cmp ebp, 4
jge 0x404506
call fcn.004040a0
mov dword [eax + esi - 0x74], edi
call fcn.004040a0
mov dword [eax + esi - 0x20], edi
call fcn.004040a0
mov dword [eax + esi + 0x9c], 5
cmp ebp, 2
jge 0x40454f
call fcn.004040a0
mov dword [eax + esi - 0x64], edi
call fcn.004040a0
mov dword [eax + esi - 0x5c], edi
call fcn.004040a0
mov dword [eax + esi - 0x10], edi
call fcn.004040a0
mov dword [eax + esi + 0xac], 5
call fcn.004040a0
mov dword [eax + esi - 8], edi
call fcn.004040a0
mov dword [eax + esi + 0xb4], 5
add esi, 4
add ebp, ebx
cmp esi, 0x1ec
jl 0x4044a5
call fcn.004040a0
mov dword [eax + 0x240], 0x1e
call fcn.004040a0
mov dword [eax + 0x180], ebx
call fcn.004040a0
mov dword [eax + 0x184], ebx
call fcn.004040a0
mov esi, 0xfa
mov dword [eax + 0x228], esi
call fcn.004040a0
mov dword [eax + 0x22c], esi
call fcn.004040a0
mov dword [eax + 0x188], ebx
call fcn.004040a0
mov dword [eax + 0x18c], ebx
call fcn.004040a0
mov dword [eax + 0x250], ebx
call fcn.004040a0
mov ebp, 3
mov dword [eax + 0x254], ebp
call fcn.004040a0
mov dword [eax + 0x190], ebx
call fcn.004040a0
mov dword [eax + 0x12c], ebx
call fcn.004040a0
mov dword [eax + 0xf0], edi
call fcn.004040a0
mov dword [eax + 0xf4], edi
call fcn.004040a0
mov dword [eax + 0xf8], edi
call fcn.004040a0
mov dword [eax + 0x194], edi
call fcn.004040a0
mov dword [eax + 0x198], edi
call fcn.004040a0
mov esi, 5
mov dword [eax + 0x218], esi
call fcn.004040a0
mov dword [eax + 0x220], esi
call fcn.004040a0
mov dword [eax + 0x21c], esi
call fcn.004040a0
mov dword [eax + 0x258], ebp
call fcn.004040a0
mov dword [eax + 0x204], esi
call fcn.004040a0
mov dword [eax + 0x19c], edi
call fcn.004040a0
mov dword [eax + 0xfc], edi
call fcn.004040a0
mov dword [eax + 0x10c], ebx
call fcn.004040a0
mov dword [eax + 0x110], ebx
call fcn.004040a0
mov dword [eax + 0x118], ebx
call fcn.004040a0
mov dword [eax + 0x120], ebx
call fcn.004040a0
mov ecx, dword [esp + 0x10]
mov dword [eax + 0x2a8], edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 4
jmp fcn.004014d0