joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10003270
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10066423
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], 0x12
mov byte [ebp - 0x28], 0x5f
mov byte [ebp - 0x27], 3
mov byte [ebp - 0x26], 5
mov byte [ebp - 0x25], 7
mov byte [ebp - 0x24], 0x64
mov byte [ebp - 0x23], 0x66
mov byte [ebp - 0x22], 0x68
mov byte [ebp - 0x21], 0x72
mov byte [ebp - 0x20], 0x6f
mov byte [ebp - 0x1f], 0xa
mov byte [ebp - 0x1e], 0x1b
mov byte [ebp - 0x1d], 6
mov byte [ebp - 0x1c], 0x64
mov byte [ebp - 0x1b], 0x73
mov byte [ebp - 0x1a], 0x77
mov byte [ebp - 0x19], 0x64
mov byte [ebp - 0x18], 0x69
mov byte [ebp - 0x17], 0x6f
mov eax, dword [0x103d27ec]
and eax, 1
jne 0x1000331f
mov ecx, dword [0x103d27ec]
or ecx, 1
mov dword [0x103d27ec], ecx
mov dword [ebp - 4], 0
lea edx, [ebp - 0x28]
push edx
mov ecx, 0x103d27d8
call fcn.10001800
push 0x100667f0
call fcn.1005a196
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, 0x103d27d8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x100033e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10066463
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x38
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], 0x30
mov byte [ebp - 0x44], 0x83
mov byte [ebp - 0x43], 0x5d
mov byte [ebp - 0x42], 0x23
mov byte [ebp - 0x41], 0x25
mov byte [ebp - 0x40], 0x72
mov byte [ebp - 0x3f], 0x3b
mov byte [ebp - 0x3e], 0x2e
mov byte [ebp - 0x3d], 0x2e
mov byte [ebp - 0x3c], 0x89
mov byte [ebp - 0x3b], 0x45
mov byte [ebp - 0x3a], 0x22
mov byte [ebp - 0x39], 0x30
mov byte [ebp - 0x38], 0x75
mov byte [ebp - 0x37], 0x73
mov byte [ebp - 0x36], 0x64
mov byte [ebp - 0x35], 0x64
mov byte [ebp - 0x34], 0x9c
mov byte [ebp - 0x33], 0x48
mov byte [ebp - 0x32], 0x23
mov byte [ebp - 0x31], 0x30
mov byte [ebp - 0x30], 0x73
mov byte [ebp - 0x2f], 0x2f
mov byte [ebp - 0x2e], 0x62
mov byte [ebp - 0x2d], 0x6e
mov byte [ebp - 0x2c], 0x86
mov byte [ebp - 0x2b], 6
mov byte [ebp - 0x2a], 0x33
mov byte [ebp - 0x29], 0x34
mov byte [ebp - 0x28], 0x75
mov byte [ebp - 0x27], 0x60
mov byte [ebp - 0x26], 0x2e
mov byte [ebp - 0x25], 0x74
mov byte [ebp - 0x24], 0x98
mov byte [ebp - 0x23], 0x4c
mov byte [ebp - 0x22], 0x25
mov byte [ebp - 0x21], 0x34
mov byte [ebp - 0x20], 0x62
mov byte [ebp - 0x1f], 0x62
mov byte [ebp - 0x1e], 0x6e
mov byte [ebp - 0x1d], 0x74
mov byte [ebp - 0x1c], 0x85
mov byte [ebp - 0x1b], 0x5d
mov byte [ebp - 0x1a], 0x79
mov byte [ebp - 0x19], 0x34
mov byte [ebp - 0x18], 0x72
mov byte [ebp - 0x17], 0x71
mov byte [ebp - 0x16], 0x79
mov byte [ebp - 0x15], 1
mov eax, dword [0x103d2824]
and eax, 1
jne 0x10003507
mov ecx, dword [0x103d2824]
or ecx, 1
mov dword [0x103d2824], ecx
mov dword [ebp - 4], 0
lea edx, [ebp - 0x44]
push edx
mov ecx, 0x103d27f0
call fcn.10001980
push 0x10066810
call fcn.1005a196
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, 0x103d27f0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x100035d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100664a3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x38
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], 0x30
mov byte [ebp - 0x44], 0xfd
mov byte [ebp - 0x43], 0x89
mov byte [ebp - 0x42], 0x25
mov byte [ebp - 0x41], 0x25
mov byte [ebp - 0x40], 0x72
mov byte [ebp - 0x3f], 0x3b
mov byte [ebp - 0x3e], 0x2e
mov byte [ebp - 0x3d], 0x2e
mov byte [ebp - 0x3c], 0xf7
mov byte [ebp - 0x3b], 0x91
mov byte [ebp - 0x3a], 0x24
mov byte [ebp - 0x39], 0x30
mov byte [ebp - 0x38], 0x75
mov byte [ebp - 0x37], 0x73
mov byte [ebp - 0x36], 0x64
mov byte [ebp - 0x35], 0x64
mov byte [ebp - 0x34], 0xe2
mov byte [ebp - 0x33], 0x9c
mov byte [ebp - 0x32], 0x25
mov byte [ebp - 0x31], 0x30
mov byte [ebp - 0x30], 0x73
mov byte [ebp - 0x2f], 0x2f
mov byte [ebp - 0x2e], 0x62
mov byte [ebp - 0x2d], 0x6e
mov byte [ebp - 0x2c], 0xf8
mov byte [ebp - 0x2b], 0xd2
mov byte [ebp - 0x2a], 0x35
mov byte [ebp - 0x29], 0x34
mov byte [ebp - 0x28], 0x75
mov byte [ebp - 0x27], 0x60
mov byte [ebp - 0x26], 0x2e
mov byte [ebp - 0x25], 0x74
mov byte [ebp - 0x24], 0xe6
mov byte [ebp - 0x23], 0x98
mov byte [ebp - 0x22], 0x23
mov byte [ebp - 0x21], 0x34
mov byte [ebp - 0x20], 0x62
mov byte [ebp - 0x1f], 0x62
mov byte [ebp - 0x1e], 0x6e
mov byte [ebp - 0x1d], 0x74
mov byte [ebp - 0x1c], 0xfb
mov byte [ebp - 0x1b], 0x89
mov byte [ebp - 0x1a], 0x7f
mov byte [ebp - 0x19], 0x34
mov byte [ebp - 0x18], 0x72
mov byte [ebp - 0x17], 0x71
mov byte [ebp - 0x16], 0x79
mov byte [ebp - 0x15], 1
mov eax, dword [0x103d285c]
and eax, 1
jne 0x100036f7
mov ecx, dword [0x103d285c]
or ecx, 1
mov dword [0x103d285c], ecx
mov dword [ebp - 4], 0
lea edx, [ebp - 0x44]
push edx
mov ecx, 0x103d2828
call fcn.10001980
push 0x10066830
call fcn.1005a196
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, 0x103d2828
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x1000d7d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100664f0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x4fc
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x41c], 0xb5af19d4
mov eax, 0xffffde99
mov word [ebp - 0x24], ax
mov cx, word [0x1007f16c]
mov byte [ebp - 0x14], cl
mov edx, dword [0x1007f170]
xor eax, eax
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x34], eax
mov ecx, dword [0x1007f1c0]
mov dword [ebp - 0x64], ecx
movzx eax, byte [0x1007f026]
cdq
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x78], edx
mov edx, 0x4cbe
mov word [ebp - 0x70], dx
movzx eax, word [0x1007f14c]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x58], 0x66b7
xor ecx, ecx
mov dword [ebp - 0x6c], 0xac
mov dword [ebp - 0x68], ecx
mov dx, word [0x1007f1c8]
mov word [ebp - 0x1c], dx
mov eax, dword [0x1007f190]
mov ecx, dword [0x1007f194]
mov dword [ebp - 0x420], ecx
mov dword [ebp - 0x54], eax
xor edx, edx
mov dword [ebp - 0x84], 0x9bd4
mov dword [ebp - 0x80], edx
mov eax, 0xffffc26e
mov word [ebp - 0x28], ax
mov ecx, 0x3a4c
mov word [ebp - 0x20], cx
mov edx, dword [0x1007f180]
mov dword [ebp - 0x48], edx
xor eax, eax
mov dword [ebp - 0x40], 0x47b6
mov dword [ebp - 0x3c], eax
mov ecx, 0x490ac
mov dword [ebp - 0x60], 0xb072e606
mov dword [ebp - 0x5c], ecx
mov byte [ebp - 0x11], 0x54
mov dx, word [0x1007f16c]
mov byte [ebp - 0x15], dl
mov byte [ebp - 0x13], 0xbe
mov eax, dword [0x1007f120]
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x12], 0x7e
mov ecx, dword [0x1007f198]
mov edx, dword [0x1007f19c]
mov dword [ebp - 0x424], edx
mov dword [ebp - 0x50], ecx
movzx eax, word [0x1007f14c]
cdq
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edx
mov eax, dword [0x1007f190]
mov ecx, dword [0x1007f194]
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], eax
mov edx, dword [0x1007f1b0]
mov eax, dword [0x1007f1b4]
mov dword [ebp - 0x474], edx
mov dword [ebp - 0x470], eax
mov byte [ebp - 0x95], 0x77
mov ecx, 0xe4c7
mov word [ebp - 0x294], cx
mov byte [ebp - 0x99], 0x73
mov edx, dword [0x1007f160]
mov eax, dword [0x1007f164]
mov dword [ebp - 0x430], eax
mov byte [ebp - 0x96], dl
mov cl, byte [0x1007f158]
mov byte [ebp - 0x97], cl
xor edx, edx
mov dword [ebp - 0x47c], 0x1c
mov dword [ebp - 0x478], edx
mov dword [ebp - 0x434], 0xed
mov byte [ebp - 0x98], 0xbe
mov dword [ebp - 0x438], 0xd73fd41
movsx ax, byte [ebp - 0x12]
movzx ecx, ax
push ecx
push 0
push 0x3a
push 0x19
push 0xbe
push 0xce
push 0
call fcn.10035820
add esp, 0x1c
movsx edx, ax
mov dword [0x1007f170], edx
cmp dword [0x1007f170], 0
jae 0x1000d9dd
jmp fcn.1000d9db
xor eax, eax
mov dword [0x1007f120], 0xee013446
mov dword [0x1007f124], eax
mov ecx, 0x5b52
mov word [ebp - 0x20], cx
mov edx, dword [0x1007f160]
mov eax, dword [0x1007f164]
mov dword [ebp - 0x43c], eax
add edx, 0x189a
mov dword [ebp - 0x50], edx
Function at 0x100117e0
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
movzx edx, word [ecx]
cmp edx, 0x5a4d
je 0x10011801
xor eax, eax
jmp 0x1001191d
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x14]
cmp dword [edx], 0x4550
je 0x1001181f
xor eax, eax
jmp 0x1001191d
mov eax, dword [ebp - 0x14]
movzx ecx, word [eax + 0x14]
cmp ecx, 0x60
jl 0x10011834
mov edx, dword [ebp - 0x14]
cmp dword [edx + 0x74], 0
jne 0x1001183b
xor eax, eax
jmp 0x1001191d
mov eax, 8
imul ecx, eax, 0
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + ecx + 0x78]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x1001185a
xor eax, eax
jmp 0x1001191d
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x24]
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp + 8]
add edx, dword [ecx + 0x20]
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x1c]
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x10], 0
jmp 0x10011899
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [eax + 0x18]
jae 0x1001191b
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + edx*4]
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp + 8]
add edx, dword [ebp - 0x28]
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x2c]
push eax
call fcn.10030d40
add esp, 4
cmp eax, dword [ebp + 0xc]
je 0x100118cc
jmp 0x10011890
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x30]
movzx eax, word [edx + ecx*2]
mov ecx, dword [ebp - 0xc]
movzx edx, word [ecx + 0x10]
add eax, edx
mov word [ebp - 4], ax
movzx eax, word [ebp - 4]
mov ecx, dword [ebp - 0xc]
movzx edx, word [ecx + 0x10]
sub eax, edx
mov word [ebp - 8], ax
mov dword [ebp - 0x20], 0
movzx eax, word [ebp - 8]
mov ecx, dword [ebp - 0x34]
mov edx, dword [ecx + eax*4]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x20]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
jmp 0x1001191d
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10037860
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp + 8]
movsx eax, byte [edx + ecx]
test eax, eax
jne 0x1003787f
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
jmp 0x100378af
mov edx, 1
imul eax, edx, 0
mov ecx, dword [ebp + 8]
movsx edx, byte [ecx + eax]
xor edx, dword [ebp + 0xc]
imul eax, edx, 0x1000193
push eax
mov ecx, 1
shl ecx, 0
add ecx, dword [ebp + 8]
push ecx
call fcn.10037860
add esp, 8
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x10041500
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb0
mov eax, dword [0x1007f1bc]
mov dword [ebp - 0x48], eax
xor ecx, ecx
mov dword [ebp - 0x80], 0x490f9d0a
mov dword [ebp - 0x7c], ecx
mov dx, word [0x1007f168]
mov word [ebp - 0x44], dx
mov eax, dword [0x1007f130]
mov ecx, dword [0x1007f134]
mov dword [ebp - 0x4c], ecx
mov word [ebp - 0x10], ax
mov edx, dword [0x1007f160]
mov eax, dword [0x1007f164]
mov dword [ebp - 0x50], eax
mov word [ebp - 0x1c], dx
mov dword [ebp - 0x54], 0xc545
movsx ecx, word [0x1007f15c]
mov dword [ebp - 0x58], ecx
mov edx, 0x73f9
mov word [ebp - 0x20], dx
mov eax, dword [0x1007f190]
mov ecx, dword [0x1007f194]
mov dword [ebp - 0x5c], ecx
mov word [ebp - 0x24], ax
mov dl, byte [0x1007f1c0]
mov byte [ebp - 5], dl
mov eax, 0x1d08
mov word [ebp - 0x28], ax
mov ecx, dword [0x1007f160]
mov edx, dword [0x1007f164]
mov dword [ebp - 0x60], edx
mov byte [ebp - 2], cl
mov ax, word [0x1007f1b0]
mov word [ebp - 0x2c], ax
mov dword [ebp - 0x64], 0x207dc3ca
xor ecx, ecx
mov dword [ebp - 0x88], 0x59218866
mov dword [ebp - 0x84], ecx
mov dl, byte [0x1007f027]
mov byte [ebp - 1], dl
mov eax, 0x5c0c
mov word [ebp - 0x40], ax
mov dword [ebp - 0x68], 0xbc6e
mov byte [ebp - 6], 0xbc
mov byte [ebp - 7], 1
mov ecx, 0xae
mov word [ebp - 0x30], cx
mov edx, dword [0x1007f1bc]
xor eax, eax
mov dword [ebp - 0x90], edx
mov dword [ebp - 0x8c], eax
movzx ecx, word [0x1007f1b8]
mov dword [ebp - 0x6c], ecx
movsx edx, word [0x1007f148]
mov dword [ebp - 0x70], edx
mov byte [ebp - 8], 0x7d
mov eax, dword [0x1007f188]
mov ecx, dword [0x1007f18c]
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x94], ecx
mov eax, dword [0x1007f1a4]
cdq
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0x9c], edx
movzx eax, byte [0x1007f04e]
cdq
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0xa4], edx
mov edx, dword [0x1007f190]
mov eax, dword [0x1007f194]
mov dword [ebp - 0x74], eax
mov word [ebp - 0x34], dx
mov cx, word [0x1007f158]
mov word [ebp - 0x38], cx
mov byte [ebp - 9], 0xcc
movzx eax, word [0x1007f14c]
cdq
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0xac], edx
mov dx, word [0x1007f1b8]
mov byte [ebp - 0xa], dl
mov ax, word [0x1007f120]
mov word [ebp - 0x3c], ax
mov dword [ebp - 0x78], 0x30a5a5b3
mov byte [ebp - 0xb], 0xbb
push 0x61
mov ecx, dword [0x1007f178]
push ecx
call fcn.100364f0
add esp, 8
mov byte [ebp - 1], al
movsx edx, byte [ebp - 1]
test edx, edx
je 0x100416cb
mov dword [ebp - 0x14], 1
jmp 0x100416d2
mov dword [ebp - 0x14], 0
movsx eax, byte [ebp - 1]
cmp eax, 0x30
je 0x100416e4
mov dword [ebp - 0x18], 1
jmp 0x100416eb
mov dword [ebp - 0x18], 0
mov ecx, dword [ebp - 0x14]
cmp ecx, dword [ebp - 0x18]
jl 0x10041727
movsx edx, word [ebp - 0x10]
imul eax, edx, 0x47
mov byte [ebp - 2], al
mov ecx, dword [0x1007f1c0]
or ecx, dword [0x1007f1c4]
jne 0x10041716
mov edx, 1
mov word [ebp - 4], dx
jmp 0x1004171c
xor eax, eax
mov word [ebp - 4], ax
mov cx, word [ebp - 4]
mov word [0x1007f1a8], cx
push str.C:NonExistentPath
push str.TEMP
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov esp, ebp
pop ebp
ret
Function at 0x100607c7
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x10060864
push ebx
push esi
call fcn.10060790
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.100606d9
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x10060811
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10060863
push edi
push eax
call fcn.1006177e
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x10060831
call fcn.1005e91b
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10060862
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.100606d9
add esp, 0x20
test eax, eax
jne 0x10060850
push edi
call fcn.1005e91b
jmp 0x10060858
push ebx
call fcn.1005e91b
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x10060acf
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10069830
push 0x10069828
push str.FlsAlloc
push 0x1e
call fcn.100609ed
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10060b03
push dword [ebp + 8]
mov ecx, esi
call dword [0x10067218]
call esi
jmp 0x10060b09
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x10060b4d
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10069840
push 0x10069838
push str.FlsGetValue
push 0x20
call fcn.100609ed
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10060b84
push dword [ebp + 8]
mov ecx, esi
call dword [0x10067218]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x100660d0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x100660fd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x100660fd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x402019
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x2c
mov eax, dword [0x42e040]
xor eax, esp
mov dword [esp + 0x24], eax
push ebx
push ebp
push esi
mov esi, dword [0x4902c0]
xor ebx, ebx
push edi
mov dword [esp + 0x14], edx
mov eax, dword [esi + 0x3c]
mov ebp, dword [eax + esi + 0x78]
add ebp, esi
mov edi, dword [ebp + 0x20]
mov eax, dword [ebp + 0x18]
add edi, esi
mov dword [esp + 0x18], eax
test eax, eax
je 0x402080
mov eax, dword [edi]
lea ecx, [esp + 0x1c]
add eax, esi
push eax
call fcn.00402631
lea ecx, [esp + 0x1c]
call fcn.00401e49
cmp eax, dword [esp + 0x14]
je 0x402098
lea ecx, [esp + 0x1c]
add edi, 4
call fcn.004026be
inc ebx
cmp ebx, dword [esp + 0x18]
jb 0x402050
xor edi, edi
mov ecx, dword [esp + 0x34]
lea eax, [esi + edi]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00406d02
add esp, 0x2c
ret
mov edx, str.QwruxAA
call fcn.00402a1e
push eax
call fcn.00402c97
mov eax, dword [ebp + 0x24]
pop ecx
lea eax, [eax + ebx*2]
movzx ecx, word [eax + esi]
mov eax, dword [ebp + 0x1c]
lea eax, [eax + ecx*4]
mov edi, dword [eax + esi]
lea ecx, [esp + 0x1c]
call fcn.004026be
jmp 0x402082
Function at 0x416e62
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00416b04

Function at 0x416e6d
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00416c93

Function at 0x417267
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.00407c60
mov eax, dword [0x42e040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.00415596
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x4172a9
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x417405
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.004221f0
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x48ff80]
push dword [edi + eax + 0x24]
push dword [edi + eax + 0x20]
push ebx
call fcn.00418437
mov ecx, dword [esi*4 + 0x48ff80]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [edi + ecx + 0x20]
jne 0x4173fe
cmp eax, dword [edi + ecx + 0x24]
jne 0x4173fe
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [edi + ecx + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4173fe
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.00418437
add esp, 0x14
test edx, edx
jl 0x4173fe
jg 0x417374
test eax, eax
jb 0x4173fe
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x4173fe
jl 0x41738e
cmp dword [ebp - 0x1008], eax
ja 0x4173fe
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x4173ac
test ebx, ebx
je 0x4173e5
cmp ecx, edi
jae 0x4173e5
mov al, byte [ecx]
cmp al, 0xd
jne 0x4173c6
lea eax, [edi - 1]
cmp ecx, eax
jae 0x4173d2
cmp byte [ecx + 1], 0xa
jne 0x4173d2
inc ecx
jmp 0x4173d2
movzx eax, al
movsx eax, byte [eax + 0x42e308]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x4173ac
cmp edx, ebx
jne 0x4173ac
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x417403
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00406d02
leave
ret
Function at 0x4178d5
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x48ff80]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x417915
cmp byte [ebx], 0xa
jne 0x417915
or byte [eax + edi + 0x28], 4
jmp 0x41791a
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x417a18
mov al, byte [edx]
cmp al, 0x1a
je 0x4179fa
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0x417949
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0x41796e
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x417978
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0x41792b
jmp 0x417a18
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4179f5
cmp dword [ebp - 0xc], 0
je 0x4179f5
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0x48ff80]
test byte [eax + edi + 0x28], 0x48
je 0x4179cf
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x4179ba
mov byte [esi], dl
jmp 0x4179cb
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x48ff80]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x417a18
cmp byte [ebp - 1], 0xa
jne 0x4179de
cmp esi, ebx
jne 0x4179de
mov byte [esi], 0xa
jmp 0x417a17
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.00418455
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x417a18
mov byte [esi], 0xd
jmp 0x417a17
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x48ff80]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x417a14
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x417a18
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret