joyce8/EMBER2024-capa huggingface dataset:
Function at 0xa40f90
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x208
lea eax, [esp]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
push ebp
push esi
push edi
xor edi, edi
push 0x104
push eax
push edi
push SysStringLen
call ebx
mov esi, dword [esp + 0x21c]
mov ebp, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0xa40ffb
mov ecx, dword [esi + 8]
push 0
push ecx
call ebp
test eax, eax
je 0xa41035
lea edx, [esp + 0x10]
push esi
push edx
push SysStringLen
call fcn.00a40e00
add esp, 0xc
lea eax, [esp + 0x10]
inc edi
push 0x104
push eax
push edi
push SysStringLen
call ebx
test eax, eax
je 0xa40fc5
mov edi, 0xa5b8b0
mov ecx, dword [esi + 8]
push 0
push ecx
call ebp
test eax, eax
je 0xa41035
mov edx, dword [edi]
push esi
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00a40e00
add edi, 4
add esp, 0xc
cmp edi, 0xa5b8c0
jb 0xa41000
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x208
ret
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x208
ret

Function at 0xa41070
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x250
push esi
push edi
mov edi, dword [esp + 0x25c]
push 0x5c
push edi
call fcn.00a47082
mov esi, eax
add esp, 8
test esi, esi
je 0xa41107
lea eax, [esp + 8]
mov word [esi], 0
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0xa41102
push ebx
lea ebx, [esi + 2]
push ebp
lea ecx, [esp + 0x3c]
push ebx
push ecx
call fcn.00a46946
add esp, 8
test eax, eax
je 0xa410e3
mov ebp, dword [sym.imp.KERNEL32.dll_FindNextFileW]
lea edx, [esp + 0x10]
push edx
push edi
call ebp
test eax, eax
je 0xa410e8
lea eax, [esp + 0x3c]
push ebx
push eax
call fcn.00a46946
add esp, 8
test eax, eax
jne 0xa410c5
mov word [esi], 0x5c
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp word [esi], 0
pop ebp
pop ebx
je 0xa41102
pop edi
mov al, 1
pop esi
add esp, 0x250
ret
mov word [esi], 0x5c
pop edi
xor al, al
pop esi
add esp, 0x250
ret
Function at 0xa41f10
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0xa569fb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov esi, dword [esp + 0x2c]
xor ebp, ebp
mov dword [esp + 0x10], eax
xor ebx, ebx
mov eax, 1
mov ecx, ebx
shl eax, cl
mov ecx, dword [esp + 0x10]
test ecx, eax
je 0xa42002
lea edx, [ebx + 0x41]
lea eax, [esp + 0x14]
push edx
push str._c:_
push eax
call fcn.00a45dff
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0xa42002
lea edx, [esp + 0x14]
push edx
push str.Mounting__s_n
call fcn.00a3d6e0
lea eax, [esp + 0x1c]
lea edi, [esi + 0x1048]
push eax
push edi
mov word [esp + 0x28], bp
call fcn.00a4620b
push 0x10
call fcn.00a461d3
add esp, 0x14
mov dword [esp + 0x2c], eax
cmp eax, ebp
mov dword [esp + 0x24], ebp
je 0xa41fc5
mov cx, word [edi]
push ecx
mov ecx, eax
call fcn.00a321c0
jmp 0xa41fc7
xor eax, eax
push esi
mov dword [esp + 0x28], 0xffffffff
mov dword [esi], eax
call fcn.00a41b80
mov edi, dword [esi]
add esp, 4
cmp edi, ebp
je 0xa41ff0
mov ecx, edi
call fcn.00a322c0
push edi
call fcn.00a461c8
add esp, 4
mov edx, dword [esi + 0x1024]
push ebp
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0xa42021
inc ebx
cmp ebx, 0x20
jb 0xa41f3e
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0xa43250
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xa57808
push 0xa47288
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x28], ebx
xor esi, esi
mov dword [ebp - 0x20], esi
mov byte [ebp - 0x24], bl
mov dword [ebp - 4], ebx
mov byte [ebp - 0x34], bl
mov byte [ebp - 0x33], bl
mov byte [ebp - 0x32], bl
mov byte [ebp - 0x31], bl
mov byte [ebp - 0x30], bl
mov byte [ebp - 0x2f], 5
lea eax, [ebp - 0x1c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x12
push 1
lea ecx, [ebp - 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0xa43329
lea edx, [ebp - 0x28]
push edx
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0xa43329
mov dword [ebp - 0x2c], ebx
lea eax, [ebp - 0x2c]
push eax
push ebx
push ebx
push 1
mov ecx, dword [ebp - 0x28]
push ecx
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
call edi
mov edx, dword [ebp - 0x2c]
push edx
call fcn.00a461d3
add esp, 4
mov esi, eax
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x20], esi
cmp esi, ebx
je 0xa43329
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
push esi
push 1
mov edx, dword [ebp - 0x28]
push edx
call edi
test eax, eax
je 0xa43329
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [esi]
push ecx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 0x24], al
jmp 0xa4332c
mov al, byte [ebp - 0x24]
mov dword [ebp - 4], 0xffffffff
call fcn.00a43351
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0xa43d20
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 4]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
mov dword [esp + 0x1c], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0xa43d58
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esi], ecx
mov dword [esi + 4], edx
pop esi
pop ecx
ret 0x10

Function at 0xa43d60
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0xa43d94
mov eax, dword [esp + 0x14]
test eax, eax
je 0xa43d94
push eax
push esi
call fcn.00a4620b
add esp, 8
pop esi
ret 0x10

Function at 0xa43da0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x24
lea eax, [esp + 0x28]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0xa43e22
push ebx
mov ebx, dword [esp + 0x30]
push esi
xor esi, esi
test ebx, ebx
jbe 0xa43e15
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov edi, dword [esp + 0x40]
push esi
lea ecx, [esp + 0x18]
push 0xa5c320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00a45dff
mov ecx, dword [esp + 0x44]
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push edi
push 0
push 0
push eax
push ecx
call ebp
inc esi
add edi, 4
cmp esi, ebx
jb 0xa43dda
pop edi
pop ebp
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
add esp, 0x24
ret 0xc

Function at 0xa43e30
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x28
lea eax, [esp + 0x2c]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0xa43ec2
push ebp
mov ebp, dword [esp + 0x34]
push esi
xor esi, esi
test ebp, ebp
jbe 0xa43eb5
push ebx
mov ebx, dword [esp + 0x40]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
lea ecx, [esp + 0x1c]
push 0xa5c320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00a45dff
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x40]
push eax
push 0
push 0
push ecx
push edx
call edi
test eax, eax
jne 0xa43eab
mov ax, word [esp + 0x14]
mov word [ebx], ax
inc esi
add ebx, 2
cmp esi, ebp
jb 0xa43e6a
pop edi
pop ebx
mov ecx, dword [esp + 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
add esp, 0x28
ret 0xc
Function at 0xa44000
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0xa44131
push esi
call fcn.00a47145
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.00a36080
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
je 0xa44131
push 0
push ebp
call fcn.00a363a0
push 0
push 0
push 0
push 4
push 0
push ebp
mov ebx, eax
call fcn.00a36260
add esp, 0x20
mov dword [esp + 0x18], eax
test eax, eax
jne 0xa4408b
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push eax
call fcn.00a362f0
mov esi, eax
add esp, 0x14
test esi, esi
je 0xa44121
push 0xa5c918
push edi
call fcn.00a453f0
push eax
push ebx
push esi
call fcn.00a43f60
push 0xa5c8f8
push edi
call fcn.00a453f0
push eax
push ebx
push esi
call fcn.00a43f60
push 0xa5c8d8
push edi
call fcn.00a453f0
push eax
push ebx
push esi
call fcn.00a43f60
push 0xa5c8c0
push edi
call fcn.00a453f0
add esp, 0x44
push eax
push ebx
push esi
call fcn.00a43f60
push 0xa5c8a0
push edi
call fcn.00a453f0
push eax
push ebx
push esi
call fcn.00a43f60
push 0xa5c888
push edi
call fcn.00a453f0
push eax
push ebx
push esi
call fcn.00a43f60
add esp, 0x34
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0xa451b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.00a45140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.00a45140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.00a45140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.00a45140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0xa45bfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0xa45c50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0xa5787c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0xa45c43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0xa45c52
xor eax, eax
pop esi
leave
ret 4
Function at 0x100012f0
Capabilities:
Connect to http server
Create http request
Send data
Send http request

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xf4
mov eax, dword [0x1002f080]
xor eax, ebp
mov dword [ebp - 4], eax
push 0
push 0
push 0
push 1
push str.BFS_Detector
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 0
je 0x100014f6
push 0
push 0
push 3
push 0
push 0
push 0x50
push str.89.203.250.203
mov eax, dword [ebp - 0x58]
push eax
call dword [sym.imp.WININET.dll_InternetConnectA]
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0
je 0x100014ca
push 0
push 0x80000000
push 0
push 0
push 0
push str._BFS_BFS_AC_BFS_DETECT_bfsactest.php
push str.POST
mov ecx, dword [ebp - 0x54]
push ecx
call dword [sym.imp.WININET.dll_HttpOpenRequestA]
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0
je 0x1000149e
push str.Content_Type:_application_x_www_form_urlencoded
lea ecx, [ebp - 0x34]
call fcn.10003ad0
lea edx, [ebp - 0x4c]
push edx
call fcn.100011c0
add esp, 4
push 1
lea ecx, [ebp - 0xf4]
call fcn.10003840
mov eax, dword [ebp + 8]
push eax
push 0x100252c0
lea ecx, [ebp - 0x4c]
push ecx
push 0x100252c4
lea edx, [ebp - 0xf4]
push edx
call fcn.10002220
add esp, 8
push eax
call fcn.100021f0
add esp, 8
push eax
call fcn.10002220
add esp, 8
push eax
call fcn.100021f0
add esp, 8
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0xf4]
call fcn.10008660
lea ecx, [ebp - 0x1c]
call fcn.100072f0
push eax
lea ecx, [ebp - 0x1c]
call fcn.10006800
push eax
lea ecx, [ebp - 0x34]
call fcn.100072f0
push eax
lea ecx, [ebp - 0x34]
call fcn.10006800
push eax
mov ecx, dword [ebp - 0x50]
push ecx
call dword [sym.imp.WININET.dll_HttpSendRequestA]
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0
je 0x1000144f
push 0x10003250
lea edx, [ebp - 0x1c]
push edx
push str.Data_sent_to_VPS_successfully:
push 0x10030168
call fcn.10002220
add esp, 8
push eax
call fcn.100021f0
add esp, 8
mov ecx, eax
call fcn.10004af0
nop
jmp 0x1000146e
push 0x10003250
push str.Failed_to_send_data_to_VPS.
push 0x10030168
call fcn.10002220
add esp, 8
mov ecx, eax
call fcn.10004af0
nop
mov eax, dword [ebp - 0x50]
push eax
call dword [sym.imp.WININET.dll_InternetCloseHandle]
lea ecx, [ebp - 0x1c]
call fcn.10004760
lea ecx, [ebp - 0xf4]
call fcn.10004e00
lea ecx, [ebp - 0x4c]
call fcn.10004760
lea ecx, [ebp - 0x34]
call fcn.10004760
nop
jmp 0x100014bd
push 0x10003250
push str.Failed_to_open_HTTP_request.
push 0x10030168
call fcn.10002220
add esp, 8
mov ecx, eax
call fcn.10004af0
nop
mov ecx, dword [ebp - 0x54]
push ecx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
nop
jmp 0x100014e9
push 0x10003250
push str.Failed_to_connect_to_server.
push 0x10030168
call fcn.10002220
add esp, 8
mov ecx, eax
call fcn.10004af0
nop
mov edx, dword [ebp - 0x58]
push edx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
nop
jmp 0x10001515
push 0x10003250
push str.Failed_to_initialize_WinINet.
push 0x10030168
call fcn.10002220
add esp, 8
mov ecx, eax
call fcn.10004af0
nop
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10009f17
mov esp, ebp
pop ebp
ret
Function at 0x10001ec0
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1ac
mov eax, dword [0x1002f080]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x1a4]
push eax
push 0x100255f4
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x34]
push edx
call fcn.10002530
add esp, 0xc
mov ecx, eax
call fcn.10006800
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x1ac], eax
lea ecx, [ebp - 0x34]
call fcn.10004760
nop
cmp dword [ebp - 0x1ac], 0xffffffff
jne 0x10001f46
push 0x10003250
mov eax, dword [ebp + 8]
push eax
push str.Directory_does_not_exist:
push 0x10030168
call fcn.10002220
add esp, 8
push eax
call fcn.100021f0
add esp, 8
mov ecx, eax
call fcn.10004af0
nop
jmp 0x10002048
mov byte [ebp - 0x1a5], 0
lea ecx, [ebp - 0x178]
push ecx
lea ecx, [ebp - 0x1c]
call fcn.10003ad0
push str.cleo
lea edx, [ebp - 0x1c]
push edx
lea eax, [ebp - 0x4c]
push eax
call fcn.10001140
add esp, 8
push eax
call fcn.10002510
add esp, 8
mov byte [ebp - 0x1a6], al
lea ecx, [ebp - 0x4c]
call fcn.10004760
lea ecx, [ebp - 0x1c]
call fcn.10004760
movzx ecx, byte [ebp - 0x1a6]
test ecx, ecx
je 0x10001fe8
mov byte [ebp - 0x1a5], 1
push 0x10003250
push str.CLEO_folder_found_in_GTA_directory.
push 0x10030168
call fcn.10002220
add esp, 8
mov ecx, eax
call fcn.10004af0
nop
push str.CLEO
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x64]
push eax
call fcn.10002530
add esp, 0xc
push eax
call fcn.10001880
add esp, 4
lea ecx, [ebp - 0x64]
call fcn.10004760
nop
lea ecx, [ebp - 0x1a4]
push ecx
mov edx, dword [ebp - 0x1ac]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x10001f4d
mov eax, dword [ebp - 0x1ac]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
nop
movzx ecx, byte [ebp - 0x1a5]
test ecx, ecx
jne 0x1000203c
push 0x10003250
push str.CLEO_folder_not_found_in_GTA_directory.
push 0x10030168
call fcn.10002220
add esp, 8
mov ecx, eax
call fcn.10004af0
nop
mov edx, dword [ebp + 8]
push edx
call fcn.10001b80
add esp, 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10009f17
mov esp, ebp
pop ebp
ret
Function at 0x10008d10
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 8], ecx
cmp dword [ebp + 0x10], 0
jg 0x10008d30
jl 0x10008d27
cmp dword [ebp + 0xc], 0
ja 0x10008d30
xor eax, eax
xor edx, edx
jmp 0x10008e68
mov eax, dword [ebp - 8]
cmp dword [eax + 0x38], 0
je 0x10008d52
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
call fcn.10008e70
jmp 0x10008e68
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 8]
call fcn.10005a80
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jbe 0x10008dc2
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 4]
push edx
call fcn.10003300
add esp, 8
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
push ecx
mov ecx, dword [ebp - 8]
call fcn.10007170
push eax
mov edx, dword [ebp + 8]
push edx
call fcn.10006a10
add esp, 0xc
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0xc]
mov dword [ebp + 8], eax
mov ecx, dword [ebp - 4]
sub ecx, dword [ebp - 0xc]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0xc]
push edx
mov ecx, dword [ebp - 8]
call fcn.100070c0
nop
mov eax, dword [ebp - 8]
cmp dword [eax + 0x4c], 0
je 0x10008e59
mov ecx, dword [ebp - 8]
call fcn.100060e0
mov dword [ebp - 0x18], 0xfff
cmp dword [ebp - 4], 0xfff
jbe 0x10008e32
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x4c]
push edx
push 0xfff
push 1
mov eax, dword [ebp + 8]
push eax
call fcn.1000fc25
add esp, 0x10
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x10]
mov dword [ebp + 8], ecx
mov edx, dword [ebp - 4]
sub edx, dword [ebp - 0x10]
mov dword [ebp - 4], edx
cmp dword [ebp - 0x10], 0xfff
je 0x10008e30
xor eax, eax
mov ecx, dword [ebp - 0x20]
sub ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x1c]
sbb edx, eax
mov eax, ecx
jmp 0x10008e68
jmp 0x10008dde
cmp dword [ebp - 4], 0
jbe 0x10008e59
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x4c]
push eax
mov ecx, dword [ebp - 4]
push ecx
push 1
mov edx, dword [ebp + 8]
push edx
call fcn.1000fc25
add esp, 0x10
mov ecx, dword [ebp - 4]
sub ecx, eax
mov dword [ebp - 4], ecx
xor edx, edx
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x1c]
sbb ecx, edx
mov edx, ecx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x10013542
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x10013581
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10013581
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10013581
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x10013581
cmp dword [ecx + 0x74], 0xe
jbe 0x10013581
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x10016bd0
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10028a20
push 0x10028a18
push str.FlsAlloc
push 0x1f
call fcn.10016a3b
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10016c04
push dword [ebp + 8]
mov ecx, esi
call dword [0x10025174]
call esi
jmp 0x10016c0a
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x10016c4e
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10028a30
push 0x10028a28
push str.FlsGetValue
push 0x21
call fcn.10016a3b
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10016c85
push dword [ebp + 8]
mov ecx, esi
call dword [0x10025174]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x10016c8d
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10028a38
push 0x10028a30
push str.FlsSetValue
push 0x22
call fcn.10016a3b
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10016cc7
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x10025174]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x100187ea
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.10009f30
mov eax, dword [0x1002f080]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.1001729f
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x1001882c
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x10018988
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.100242c0
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x10030aa0]
push dword [eax + edi + 0x24]
push dword [eax + edi + 0x20]
push ebx
call fcn.100197e7
mov ecx, dword [esi*4 + 0x10030aa0]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [ecx + edi + 0x20]
jne 0x10018981
cmp eax, dword [ecx + edi + 0x24]
jne 0x10018981
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [ecx + edi + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10018981
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.100197e7
add esp, 0x14
test edx, edx
jl 0x10018981
jg 0x100188f7
test eax, eax
jb 0x10018981
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x10018981
jl 0x10018911
cmp dword [ebp - 0x1008], eax
ja 0x10018981
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x1001892f
test ebx, ebx
je 0x10018968
cmp ecx, edi
jae 0x10018968
mov al, byte [ecx]
cmp al, 0xd
jne 0x10018949
lea eax, [edi - 1]
cmp ecx, eax
jae 0x10018955
cmp byte [ecx + 1], 0xa
jne 0x10018955
inc ecx
jmp 0x10018955
movzx eax, al
movsx eax, byte [eax + 0x1002f328]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x1001892f
cmp edx, ebx
jne 0x1001892f
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x10018986
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.10009f17
leave
ret