joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10129390
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov ebp, dword [esi + 4]
cmp ebp, ebx
je 0x1012951b
cmp dword [esi + 8], ebx
je 0x1012951b
cmp dword [esi + 0x10], ebx
je 0x10129422
lea eax, [esp + 0x14]
lea edi, [esi + 0x1c]
push ebx
push eax
push edi
push ebp
mov dword [esp + 0x24], ebx
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
cmp eax, ebx
jne 0x10129407
mov ecx, dword [esi + 0x2c]
push 0x7530
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x101293f6
mov dword [esi + 0x14], 0xf0000003
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x20
ret 0xc
mov eax, dword [esi + 4]
lea edx, [esp + 0x14]
push ebx
push edx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
xor ecx, ecx
mov dword [esi + 0x10], ebx
mov dword [edi], ecx
cmp eax, ebx
mov dword [edi + 4], ecx
mov dword [edi + 8], ecx
mov dword [edi + 0xc], ecx
mov dword [edi + 0x10], ecx
je 0x1012951b
mov eax, dword [esi + 8]
xor edx, edx
mov dword [esp + 0x20], edx
push eax
mov dword [esp + 0x28], edx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x2c], edx
mov dword [esp + 0x30], edx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov ecx, dword [esi + 8]
lea edx, [esp + 0x1c]
mov dword [esp + 0x2c], ecx
mov ecx, dword [esp + 0x38]
lea eax, [esp + 0x10]
push edx
mov edx, dword [esp + 0x38]
push eax
push ecx
push edx
push ebp
mov dword [esp + 0x24], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edi, eax
cmp edi, ebx
je 0x1012948c
cmp dword [esp + 0x10], ebx
je 0x1012948c
mov eax, dword [esi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp edi, ebx
jne 0x101294a8
cmp eax, ebx
je 0x101294a8
cmp eax, 0x3e5
je 0x101294a8
cmp eax, 0x217
jne 0x1012951b
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x2c]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edi, eax
cmp edi, ebx
je 0x101294e0
push ebp
call dword [sym.imp.KERNEL32.dll_CancelIo]
cmp edi, 0x102
jne 0x1012951b
mov dword [esi + 0x14], 0xf0000003
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x20
ret 0xc
lea eax, [esp + 0x18]
push ebx
lea ecx, [esp + 0x20]
push eax
push ecx
push ebp
mov dword [esp + 0x28], ebx
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
mov edx, dword [esi + 8]
mov edi, eax
push edx
mov dword [esi + 0x14], ebx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov ecx, dword [esp + 0x18]
mov eax, edi
neg eax
pop edi
pop esi
sbb eax, eax
pop ebp
and eax, ecx
pop ebx
add esp, 0x20
ret 0xc
mov dword [esi + 0x14], 0xf0000001
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x20
ret 0xc
Function at 0x10129530
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov ebp, dword [esi + 4]
cmp ebp, ebx
je 0x101296bb
cmp dword [esi + 0xc], ebx
je 0x101296bb
cmp dword [esi + 0x10], ebx
je 0x101295c2
lea eax, [esp + 0x14]
lea edi, [esi + 0x1c]
push ebx
push eax
push edi
push ebp
mov dword [esp + 0x24], ebx
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
cmp eax, ebx
jne 0x101295a7
mov ecx, dword [esi + 0x2c]
push 0x7530
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x10129596
mov dword [esi + 0x14], 0xf0000003
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x20
ret 0xc
mov eax, dword [esi + 4]
lea edx, [esp + 0x14]
push ebx
push edx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
xor ecx, ecx
mov dword [esi + 0x10], ebx
mov dword [edi], ecx
cmp eax, ebx
mov dword [edi + 4], ecx
mov dword [edi + 8], ecx
mov dword [edi + 0xc], ecx
mov dword [edi + 0x10], ecx
je 0x101296bb
mov eax, dword [esi + 0xc]
xor edx, edx
mov dword [esp + 0x20], edx
push eax
mov dword [esp + 0x28], edx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x2c], edx
mov dword [esp + 0x30], edx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov ecx, dword [esi + 0xc]
lea edx, [esp + 0x1c]
mov dword [esp + 0x2c], ecx
mov ecx, dword [esp + 0x38]
lea eax, [esp + 0x10]
push edx
mov edx, dword [esp + 0x38]
push eax
push ecx
push edx
push ebp
mov dword [esp + 0x24], ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, eax
cmp edi, ebx
je 0x1012962c
cmp dword [esp + 0x10], ebx
jbe 0x1012962c
mov eax, dword [esi + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp edi, ebx
jne 0x10129648
cmp eax, ebx
je 0x10129648
cmp eax, 0x3e5
je 0x10129648
cmp eax, 0x217
jne 0x101296bb
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x2c]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edi, eax
cmp edi, ebx
je 0x10129680
push ebp
call dword [sym.imp.KERNEL32.dll_CancelIo]
cmp edi, 0x102
jne 0x101296bb
mov dword [esi + 0x14], 0xf0000003
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x20
ret 0xc
lea eax, [esp + 0x18]
push ebx
lea ecx, [esp + 0x20]
push eax
push ecx
push ebp
mov dword [esp + 0x28], ebx
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
mov edx, dword [esi + 0xc]
mov edi, eax
push edx
mov dword [esi + 0x14], ebx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov ecx, dword [esp + 0x18]
mov eax, edi
neg eax
pop edi
pop esi
sbb eax, eax
pop ebp
and eax, ecx
pop ebx
add esp, 0x20
ret 0xc
mov dword [esi + 0x14], 0xf0000001
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x20
ret 0xc
Function at 0x1012a860
Capabilities:
Write file on windows

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x10256fe8
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push ebp
mov ebp, dword [esp + 0x34]
push esi
cmp ebp, 0x640
push edi
mov esi, ecx
ja 0x1012a949
xor edi, edi
cmp ebp, edi
jbe 0x1012a949
lea eax, [esi + 0x74]
push 1
push eax
lea ecx, [esp + 0x20]
call fcn.10091800
mov eax, dword [esp + 0x34]
mov ebx, dword [esi + 0x64]
mov dword [esp + 0x2c], edi
lea ecx, [eax + eax*2]
shl ecx, 4
add ebx, ecx
cmp dword [ebx + 0x28], edi
jne 0x1012a960
mov esi, dword [esp + 0x38]
mov edi, dword [ebx + 0x1c]
mov ecx, ebp
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebx + 0x24]
mov edx, dword [ebx + 0x1c]
lea ecx, [esp + 0x38]
push eax
mov eax, dword [ebx]
push ecx
push ebp
xor esi, esi
push edx
push eax
mov dword [ebx + 0x28], 1
mov dword [esp + 0x4c], esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, esi
je 0x1012a927
cmp dword [esp + 0x38], ebp
jne 0x1012a9ee
lea ecx, [esp + 0x18]
mov dword [ebx + 0x28], esi
mov dword [esp + 0x2c], 0xffffffff
call fcn.10091860
mov eax, 1
jmp 0x1012a94b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x1012a9ee
lea ecx, [esp + 0x18]
mov dword [esp + 0x2c], 0xffffffff
call fcn.10091860
xor eax, eax
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret 0xc
push ebp
mov dword [esp + 0x18], edi
call fcn.1023d8fc
mov edx, eax
add esp, 4
cmp edx, edi
mov dword [esp + 0x3c], edx
je 0x1012a938
mov esi, dword [esp + 0x38]
mov ecx, ebp
mov eax, ecx
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ebx, dword [ebx + 0x2c]
mov eax, dword [ebx + 8]
mov esi, dword [ebx + 4]
test eax, eax
jne 0x1012a9ae
push 0x10
call fcn.1023d8fc
add esp, 4
test eax, eax
jne 0x1012a9bc
mov edx, dword [esp + 0x3c]
jmp 0x1012a9d8
mov ecx, dword [eax]
mov dword [ebx + 8], ecx
mov ecx, dword [ebx + 0x10]
dec ecx
mov dword [ebx + 0x10], ecx
jmp 0x1012a9c0
mov edx, dword [esp + 0x3c]
mov dword [eax + 4], esi
mov dword [eax], 0
mov ecx, dword [ebx + 0xc]
inc ecx
mov dword [ebx + 0xc], ecx
xor ecx, ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov dword [eax + 8], ebp
mov dword [eax + 0xc], edx
mov ecx, dword [ebx + 4]
test ecx, ecx
je 0x1012a9e9
mov dword [ecx], eax
jmp 0x1012a9eb
mov dword [ebx], eax
mov dword [ebx + 4], eax
lea ecx, [esp + 0x18]
mov dword [esp + 0x2c], 0xffffffff
call fcn.10091860
mov eax, 1
jmp 0x1012a94b
Function at 0x1012aa10
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x10257008
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push esi
mov esi, ecx
push edi
push 1
lea eax, [esi + 0x74]
lea ecx, [esp + 0x10]
push eax
call fcn.10091800
mov eax, dword [esp + 0x28]
xor edi, edi
lea ecx, [eax + eax*2]
mov eax, dword [esi + 0x64]
shl ecx, 4
add eax, ecx
mov edx, dword [eax + 0x20]
mov dword [edx], edi
mov ecx, dword [eax + 0x20]
mov dword [ecx + 4], edi
mov edx, dword [eax + 0x20]
mov dword [edx + 8], edi
mov ecx, dword [eax + 0x20]
mov dword [ecx + 0xc], edi
mov dword [esp + 8], edi
mov edx, dword [eax + 0x20]
lea ecx, [esp + 8]
push edx
mov edx, dword [eax + 0x18]
mov eax, dword [eax]
push ecx
push 0x640
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, edi
pop edi
pop esi
jne 0x1012aac2
cmp eax, 0x3e5
je 0x1012aac2
cmp eax, 0x218
je 0x1012aac2
lea ecx, [esp + 4]
mov dword [esp + 0x18], 0xffffffff
call fcn.10091860
xor eax, eax
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x1c
ret 4
lea ecx, [esp + 4]
mov dword [esp + 0x18], 0xffffffff
call fcn.10091860
mov ecx, dword [esp + 0x10]
mov eax, 1
mov dword fs:[0], ecx
add esp, 0x1c
ret 4

Function at 0x1012aaf0
Capabilities:
Access peb ldr_data
Connect pipe
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x10257028
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
mov ebx, ecx
push esi
push edi
lea eax, [ebx + 0x74]
push 1
push eax
lea ecx, [esp + 0x14]
call fcn.10091800
mov eax, dword [esp + 0x38]
mov esi, dword [ebx + 0x64]
xor edi, edi
lea ecx, [eax + eax*2]
mov dword [esp + 0x30], edi
shl ecx, 4
add esi, ecx
mov edx, dword [esi + 0x20]
mov dword [edx + 8], edi
mov eax, dword [esi + 0x20]
mov dword [eax + 0xc], edi
mov ecx, dword [esi + 0x20]
mov dword [ecx], edi
mov edx, dword [esi + 0x20]
mov dword [edx + 4], edi
mov eax, dword [esi + 0x24]
mov dword [eax + 8], edi
mov ecx, dword [esi + 0x24]
mov dword [ecx + 0xc], edi
mov edx, dword [esi + 0x24]
mov dword [edx], edi
mov eax, dword [esi + 0x24]
mov dword [eax + 4], edi
mov ecx, dword [esi + 0x20]
mov edx, dword [esi]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x217
jne 0x1012abd3
mov ecx, dword [esi + 0x20]
xor eax, eax
mov dword [esp + 0x1c], eax
lea edx, [esp + 0x18]
mov dword [esp + 0x20], eax
push edx
mov dword [esp + 0x28], eax
mov eax, dword [esi]
mov dword [esp + 0x28], ecx
push eax
mov ecx, ebx
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], 0x217
call fcn.1012a0e0
lea ecx, [esp + 0xc]
mov dword [esp + 0x30], 0xffffffff
call fcn.10091860
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
add esp, 0x28
ret 4
cmp eax, edi
je 0x1012abde
cmp eax, 0x3e5
jne 0x1012abe3
mov edi, 1
lea ecx, [esp + 0xc]
mov dword [esp + 0x30], 0xffffffff
call fcn.10091860
mov ecx, dword [esp + 0x28]
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x28
ret 4
Function at 0x1012c2e0
Capabilities:
Check os version

Disassembly:
push 0xffffffffffffffff
push 0x10257295
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x91c
push esi
push edi
mov esi, dword [esp + 0x938]
mov ecx, 0x1ff
xor eax, eax
lea edi, [esp + 0x126]
mov word [esp + 0x124], 0
mov dword [esp + 0xc], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [0x102f8cc4]
test esi, esi
je 0x1012c3cc
test eax, eax
jne 0x1012c38b
mov ecx, 0x44
xor eax, eax
lea edi, [esp + 0x14]
mov dword [0x102f8cc4], 1
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x114
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 0x20], 2
jne 0x1012c37f
cmp dword [esp + 0x14], 5
jb 0x1012c37f
mov ecx, dword [str.GlobalOCULAR_]
mov dword [0x102f8cc8], ecx
jmp 0x1012c38b
mov edx, dword [0x102d66e8]
mov dword [0x102f8cc8], edx
mov eax, dword [esp + 0x93c]
test eax, eax
mov eax, dword [0x102d66e8]
jne 0x1012c3a0
mov eax, dword [0x102f8cc8]
mov ecx, dword [esp + 0x944]
mov edx, dword [esp + 0x940]
push ecx
push edx
push esi
push eax
lea eax, [esp + 0x134]
push str._s__s__08x__08x
push eax
call fcn.1006ca01
add esp, 0x18
jmp 0x1012c45b
test eax, eax
jne 0x1012c420
mov ecx, 0x44
xor eax, eax
lea edi, [esp + 0x14]
mov dword [0x102f8cc4], 1
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], 0x114
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 0x20], 2
jne 0x1012c416
cmp dword [esp + 0x14], 5
jb 0x1012c416
mov edx, dword [str.GlobalOCULAR_]
mov dword [0x102f8cc8], edx
jmp 0x1012c420
mov eax, dword [0x102d66e8]
mov dword [0x102f8cc8], eax
mov eax, dword [esp + 0x93c]
test eax, eax
mov eax, dword [0x102d66e8]
jne 0x1012c435
mov eax, dword [0x102f8cc8]
mov ecx, dword [esp + 0x944]
mov edx, dword [esp + 0x940]
push ecx
push edx
push eax
lea eax, [esp + 0x130]
push str._s___08x__08x
push eax
call fcn.1006ca01
add esp, 0x14
lea ecx, [esp + 0x124]
push ecx
lea ecx, [esp + 0xc]
call fcn.10082dc0
mov esi, dword [esp + 0x934]
lea edx, [esp + 8]
push edx
mov ecx, esi
mov dword [esp + 0x930], 1
call fcn.10082b60
mov dword [esp + 0xc], 1
lea ecx, [esp + 8]
mov byte [esp + 0x92c], 0
call fcn.10083560
mov ecx, dword [esp + 0x924]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x928
ret
Function at 0x1012ec00
Capabilities:
Set socket configuration

Disassembly:
sub esp, 8
push ebx
push esi
mov esi, ecx
cmp dword [esi + 0xc], 0xffffffff
je 0x1012ec88
mov eax, dword [esi + 0x14]
xor ebx, ebx
cmp eax, ebx
je 0x1012ec62
mov ecx, dword [esi + 0x18]
xor eax, eax
mov dword [esp + 9], eax
push edi
mov edi, dword [sym.imp.WS2_32.dll_htonl]
mov word [esp + 0x11], ax
push ecx
mov byte [esp + 0x10], bl
mov byte [esp + 0x17], al
call edi
push ebx
mov dword [esp + 0x10], eax
call edi
lea edx, [esp + 0xc]
push 8
mov dword [esp + 0x14], eax
mov eax, dword [esi + 0xc]
push edx
push 0xd
push ebx
push eax
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
pop edi
jge 0x1012ec62
pop esi
xor eax, eax
pop ebx
add esp, 8
ret
mov ecx, dword [esi + 0xc]
push 1
push ecx
call dword [sym.imp.WS2_32.dll_shutdown]
mov edx, dword [esi + 0xc]
push edx
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [esi + 0xc], 0xffffffff
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
pop esi
mov eax, 1
pop ebx
add esp, 8
ret

Function at 0x1012f4c0
Capabilities:
Get user security identifier

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, dword [esp + 0x14]
lea eax, [esp + 0x18]
push edi
mov edi, dword [esp + 0x1c]
lea ecx, [esp + 0xc]
xor ebx, ebx
push eax
push ecx
lea edx, [esp + 0x18]
push ebx
push edx
push ebx
push ebp
push ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x28], ebx
mov dword [edi], ebx
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
jne 0x1012f50b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x1012f50b
pop edi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret
mov eax, dword [esp + 0x10]
push esi
push eax
call fcn.1023d8fc
mov ecx, dword [esp + 0x14]
mov dword [edi], eax
lea edx, [ecx + ecx]
push edx
call fcn.1023d8fc
mov esi, eax
mov eax, dword [edi]
add esp, 8
test eax, eax
je 0x1012f550
test esi, esi
je 0x1012f561
lea ecx, [esp + 0x20]
lea edx, [esp + 0x10]
push ecx
push edx
lea ecx, [esp + 0x1c]
push esi
push ecx
push eax
push ebp
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
mov ebx, eax
test esi, esi
je 0x1012f55d
push esi
call fcn.1023d925
add esp, 4
test ebx, ebx
jne 0x1012f570
mov edi, dword [edi]
test edi, edi
je 0x1012f570
push edi
call fcn.1023d925
add esp, 4
pop esi
pop edi
mov eax, ebx
pop ebp
pop ebx
add esp, 8
ret
Function at 0x10132190
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
sub esp, 0x664
push ebx
mov ebx, dword [esp + 0x670]
push ebp
mov ebp, dword [esp + 0x670]
push esi
push edi
push ebx
push 4
push ebp
call dword [sym.imp.ADVAPI32.dll_SetFileSecurityW]
mov esi, eax
test esi, esi
je 0x101322d4
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x46e]
mov word [esp + 0x46c], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push ebp
lea eax, [esp + 0x470]
push 0x102a8c58
push eax
call fcn.1006ca01
mov ecx, 0x93
xor eax, eax
lea edi, [esp + 0x24]
mov dword [esp + 0x20], 0
rep stosd dword es:[edi], eax
add esp, 0xc
lea ecx, [esp + 0x14]
lea edx, [esp + 0x46c]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [esp + 0x10], eax
je 0x101322d4
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpW]
lea eax, [esp + 0x40]
push 0x102ab560
push eax
call edi
test eax, eax
je 0x101322ad
lea ecx, [esp + 0x40]
push 0x102ab568
push ecx
call edi
test eax, eax
je 0x101322ad
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x266]
mov word [esp + 0x264], 0
rep stosd dword es:[edi], eax
lea edx, [esp + 0x40]
stosw word es:[edi], ax
push edx
push ebp
lea eax, [esp + 0x26c]
push 0x102a8c4c
push eax
call fcn.1006ca01
mov al, byte [esp + 0x24]
add esp, 0x10
test al, 0x10
push ebx
je 0x1013229b
lea ecx, [esp + 0x268]
push ecx
call fcn.10132190
add esp, 8
jmp 0x101322ab
lea edx, [esp + 0x268]
push 4
push edx
call dword [sym.imp.ADVAPI32.dll_SetFileSecurityW]
mov esi, eax
test esi, esi
je 0x101322c9
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x10132223
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x664
ret
Function at 0x1013dda0
Capabilities:
Allocate thread local storage
Set thread local storage value

Disassembly:
mov eax, dword [0x102f8eb4]
push ebx
mov ebx, dword [esp + 0x10]
push esi
test eax, eax
push edi
jne 0x1013ddc2
mov eax, dword [0x102f963c]
test eax, eax
jne 0x1013ddc2
mov eax, dword [0x102f9c4c]
test eax, eax
je 0x1013ddc6
test ebx, ebx
je 0x1013de00
mov eax, dword [0x102d71cc]
or esi, 0xffffffff
cmp eax, esi
jne 0x1013de00
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, esi
mov dword [0x102d71cc], eax
je 0x1013de00
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x1013de00
mov eax, dword [0x102d71cc]
push eax
call dword [sym.imp.KERNEL32.dll_TlsFree]
mov dword [0x102d71cc], esi
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x10]
push ebx
push esi
push edi
call fcn.1014fbf0
add esp, 0xc
test eax, eax
je 0x1013de43
mov ecx, dword [esp + 0x1c]
push ecx
push ebx
push esi
push edi
call fcn.1016c4a0
add esp, 0x10
test eax, eax
je 0x1013de43
push ebx
push esi
push edi
call fcn.1017b7d0
add esp, 0xc
test eax, eax
je 0x1013de43
pop edi
pop esi
mov eax, 1
pop ebx
ret
pop edi
pop esi
xor eax, eax
pop ebx
ret
Function at 0x101501f0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x3ec
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
push ebp
push esi
xor ebp, ebp
push edi
mov dword [0x102f8ea8], ebp
call ebx
mov dword [0x102f8eb0], eax
mov ecx, 0xf7
xor eax, eax
lea edi, [esp + 0x1d]
mov byte [esp + 0x1c], 0
mov esi, dword [esp + 0x41c]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
cmp esi, ebp
stosb byte es:[edi], al
je 0x1015032c
mov ecx, 0xf8
lea edi, [esp + 0x1c]
rep movsd dword es:[edi], dword [esi]
lea eax, [esp + 0x1c]
push eax
call fcn.101570e0
mov esi, dword [esp + 0x408]
mov ebx, dword [esp + 0x414]
mov ebp, dword [esp + 0x410]
mov edi, dword [esp + 0x40c]
add esp, 4
mov dword [esp + 0x10], eax
test esi, esi
jne 0x10150295
test edi, edi
jne 0x10150295
test ebp, ebp
jne 0x10150295
test ebx, ebx
jne 0x10150295
mov ecx, dword [esp + 0x414]
test ecx, ecx
jne 0x10150295
mov ecx, dword [esp + 0x418]
test ecx, ecx
je 0x10150321
cmp eax, 3
jne 0x10150321
mov ecx, dword [esp + 0x4c]
lea edx, [esp + 0x1c]
push ecx
push 0x30
push edx
call fcn.1018a440
add esp, 0xc
test eax, eax
je 0x1015031d
mov eax, dword [esp + 0x40]
test esi, esi
je 0x101502c5
mov ecx, eax
and ecx, 1
mov dword [esi], ecx
test edi, edi
je 0x101502d0
mov edx, eax
and edx, 2
mov dword [edi], edx
test ebp, ebp
je 0x101502dc
mov ecx, eax
and ecx, 4
mov dword [ebp], ecx
test ebx, ebx
je 0x101502fb
mov edx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x30]
mov dword [ebx], edx
mov edx, dword [esp + 0x34]
mov dword [ebx + 4], ecx
mov ecx, dword [esp + 0x38]
mov dword [ebx + 8], edx
mov dword [ebx + 0xc], ecx
mov ecx, dword [esp + 0x414]
test ecx, ecx
je 0x1015030d
mov edx, eax
and edx, 8
mov dword [ecx], edx
mov ecx, dword [esp + 0x418]
test ecx, ecx
je 0x1015031d
and eax, 0x10
mov dword [ecx], eax
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3ec
ret
mov esi, dword [esp + 0x400]
lea eax, [esp + 0x10]
push 1
push eax
mov dword [esp + 0x18], ebp
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push esi
call ebp
push 0
push 0
push 0
push esi
mov dword [esp + 0x28], eax
call ebp
cmp esi, 0xffffffff
je 0x101503bd
lea ecx, [esp + 0x1c]
test ecx, ecx
je 0x101503bd
push esi
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 1
jne 0x101503d8
mov ecx, 0xd
xor eax, eax
lea edi, [esp + 0x1c]
lea edx, [esp + 0x14]
rep stosd dword es:[edi], eax
xor edi, edi
lea eax, [esp + 0x1c]
push edi
push edx
push 0x34
push eax
push esi
mov dword [esp + 0x28], edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x101503b6
mov dword [0x102f8ea8], 0xd
mov dword [0x102f8eac], 0x29f7
call ebx
mov dword [0x102f8eb0], eax
jmp 0x101503da
mov edi, 1
jmp 0x101503da
mov dword [0x102f8ea8], 1
mov dword [0x102f8eac], 0x29ea
call ebx
mov dword [0x102f8eb0], eax
xor edi, edi
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x10]
push 0
push ecx
push edx
push esi
call ebp
test edi, edi
jne 0x1015023e
mov dword [0x102f8ea8], 0xf
mov dword [0x102f8eac], 0x1b63
call ebx
pop edi
pop esi
mov dword [0x102f8eb0], eax
pop ebp
xor eax, eax
pop ebx
add esp, 0x3ec
ret