joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10002d97
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
cmp dword [0x10166457], 0
jne 0x10002e42
mov eax, str._dbg.g_threadCallStack_tls
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.10002ec4
mov dword [ebp - 0xc], eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x10002dd8
push ebx
call fcn.10072734
add esp, 4
mov eax, dword [ebp - 0xc]
mov dword [0x10166457], eax
cmp dword [0x10166457], 0
jne 0x10002e42
mov dword [ebp - 8], esp
xor eax, eax
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
nop
nop
cmp dword [ebp - 8], esp
je 0x10002e16
push 0xd2
push 0x4018758
push 6
call fcn.10072740
add esp, 0xc
mov dword [0x10166457], eax
push dword [0x10166457]
mov eax, str._dbg.g_threadCallStack_tls
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.1000330a
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x10002e42
push ebx
call fcn.10072734
add esp, 4
mov dword [ebp - 8], esp
push dword [0x10166457]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
nop
nop
cmp dword [ebp - 8], esp
je 0x10002e71
push 0x163
push 0x4018758
push 6
call fcn.10072740
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10002eb8
call fcn.10003405
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push dword [ebp - 4]
push dword [0x10166457]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
nop
cmp dword [ebp - 8], esp
je 0x10002eb8
push 0x1e1
push 0x4018758
push 6
call fcn.10072740
add esp, 0xc
mov eax, dword [ebp - 4]
jmp 0x10002ec0
mov esp, ebp
pop ebp
ret
Function at 0x10002ef2
Capabilities:
Query environment variable
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 4], 0
cmp dword [0x1016645b], 0
jne 0x10003129
push 0x80000301
push 0
push 0x40
push 1
mov ebx, 0x184
call fcn.100732c0
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x10002f44
push ebx
call fcn.10072734
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
nop
nop
cmp dword [ebp - 8], esp
je 0x10002f71
push 0xb8
push 0x4018775
push 6
call fcn.10072740
add esp, 0xc
push 0x80000301
push 0
push eax
push 1
mov ebx, 0x168
call fcn.10073010
add esp, 0x10
mov dword [ebp - 0x10], eax
push dword [ebp - 0x10]
push str.__processStrMap_
mov ecx, 2
call fcn.10001960
add esp, 8
mov dword [ebp - 0x14], eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x10002fb6
push ebx
call fcn.10072734
add esp, 4
mov dword [ebp - 0x18], esp
push 0x40
push dword [ebp - 4]
push dword [ebp - 0x14]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
nop
nop
cmp dword [ebp - 0x18], esp
je 0x10002fea
push 0xb8
push 0x4018775
push 6
call fcn.10072740
add esp, 0xc
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x10002ffa
push ebx
call fcn.10072734
add esp, 4
push VariantClear
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x1000300d
mov eax, 0x1015e258
push eax
push 1
mov ebx, 0x164
call fcn.10073300
add esp, 0x10
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], edx
fld qword [ebp - 0x14]
call fcn.1000101d
mov dword [0x1016645b], eax
cmp dword [0x1016645b], 0
jne 0x10003129
call fcn.10003149
mov dword [0x1016645b], eax
mov dword [ebp - 8], esp
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
nop
nop
cmp dword [ebp - 8], esp
je 0x10003073
push 0x1c1
push 0x4018775
push 6
call fcn.10072740
add esp, 0xc
push 0x80000301
push 0
push eax
push 1
mov ebx, 0x168
call fcn.10073010
add esp, 0x10
mov dword [ebp - 0x10], eax
push dword [ebp - 0x10]
push str.__processStrMap_
mov ecx, 2
call fcn.10001960
add esp, 8
mov dword [ebp - 0x14], eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x100030b8
push ebx
call fcn.10072734
add esp, 4
push 0x80000301
push 0
push dword [0x1016645b]
push 1
mov ebx, 0x168
call fcn.10073010
add esp, 0x10
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], esp
push dword [ebp - 0x18]
push dword [ebp - 0x14]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
nop
nop
cmp dword [ebp - 0x1c], esp
je 0x10003109
push 0x1d6
push 0x4018775
push 6
call fcn.10072740
add esp, 0xc
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x10003119
push ebx
call fcn.10072734
add esp, 4
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x10003129
push ebx
call fcn.10072734
add esp, 4
mov eax, dword [0x1016645b]
jmp 0x10003133
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x10003144
push ebx
call fcn.10072734
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret
Function at 0x100037f7
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], esp
push 0x40
push 0x1000
push dword [ebp + 8]
push 0
xor eax, eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
nop
nop
cmp dword [ebp - 4], esp
je 0x1000383b
push 0x12
push 0x4018768
push 6
call fcn.10072740
add esp, 0xc
jmp 0x10003840
mov esp, ebp
pop ebp
ret 4

Function at 0x10003ff6
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], esp
push 0x40
push 0x1000
push dword [ebp + 8]
push 0
xor eax, eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
nop
nop
cmp dword [ebp - 4], esp
je 0x1000403a
push 0x12
push 0x40186ca
push 6
call fcn.10072740
add esp, 0xc
jmp 0x1000403f
mov esp, ebp
pop ebp
ret 4
Function at 0x1000839f
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
cmp dword [0x1016646b], 0
jne 0x1000844a
mov eax, str.__threadStrMap
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.10001d43
mov dword [ebp - 0xc], eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x100083e0
push ebx
call fcn.10072734
add esp, 4
mov eax, dword [ebp - 0xc]
mov dword [0x1016646b], eax
cmp dword [0x1016646b], 0
jne 0x1000844a
mov dword [ebp - 8], esp
xor eax, eax
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
nop
nop
cmp dword [ebp - 8], esp
je 0x1000841e
push 0xc6
push 0x40186e5
push 6
call fcn.10072740
add esp, 0xc
mov dword [0x1016646b], eax
push dword [0x1016646b]
mov eax, str.__threadStrMap
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.100021f9
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x1000844a
push ebx
call fcn.10072734
add esp, 4
mov dword [ebp - 8], esp
push dword [0x1016646b]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
nop
nop
cmp dword [ebp - 8], esp
je 0x10008479
push 0x138
push 0x40186e5
push 6
call fcn.10072740
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x100084c0
call fcn.10001fc8
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push dword [ebp - 4]
push dword [0x1016646b]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
nop
cmp dword [ebp - 8], esp
je 0x100084c0
push 0x1b6
push 0x40186e5
push 6
call fcn.10072740
add esp, 0xc
mov eax, dword [ebp - 4]
jmp 0x100084c8
mov esp, ebp
pop ebp
ret
Function at 0x1000885c
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
cmp dword [0x1016646f], 0
jne 0x10008907
mov eax, str.__threadStrMap
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.10008989
mov dword [ebp - 0xc], eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x1000889d
push ebx
call fcn.10072734
add esp, 4
mov eax, dword [ebp - 0xc]
mov dword [0x1016646f], eax
cmp dword [0x1016646f], 0
jne 0x10008907
mov dword [ebp - 8], esp
xor eax, eax
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
nop
nop
cmp dword [ebp - 8], esp
je 0x100088db
push 0xc6
push 0x4018749
push 6
call fcn.10072740
add esp, 0xc
mov dword [0x1016646f], eax
push dword [0x1016646f]
mov eax, str.__threadStrMap
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.10008dcf
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x10008907
push ebx
call fcn.10072734
add esp, 4
mov dword [ebp - 8], esp
push dword [0x1016646f]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
nop
nop
cmp dword [ebp - 8], esp
je 0x10008936
push 0x138
push 0x4018749
push 6
call fcn.10072740
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1000897d
call fcn.10008c0e
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push dword [ebp - 4]
push dword [0x1016646f]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
nop
cmp dword [ebp - 8], esp
je 0x1000897d
push 0x1b6
push 0x4018749
push 6
call fcn.10072740
add esp, 0xc
mov eax, dword [ebp - 4]
jmp 0x10008985
mov esp, ebp
pop ebp
ret
Function at 0x100089b7
Capabilities:
Query environment variable
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 4], 0
cmp dword [0x10166473], 0
jne 0x10008bee
push 0x80000301
push 0
push 0x40
push 1
mov ebx, 0x184
call fcn.100732c0
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x10008a09
push ebx
call fcn.10072734
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
nop
nop
cmp dword [ebp - 8], esp
je 0x10008a36
push 0xb8
push 0x401874d
push 6
call fcn.10072740
add esp, 0xc
push 0x80000301
push 0
push eax
push 1
mov ebx, 0x168
call fcn.10073010
add esp, 0x10
mov dword [ebp - 0x10], eax
push dword [ebp - 0x10]
push str.__processStrMap_
mov ecx, 2
call fcn.10001960
add esp, 8
mov dword [ebp - 0x14], eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x10008a7b
push ebx
call fcn.10072734
add esp, 4
mov dword [ebp - 0x18], esp
push 0x40
push dword [ebp - 4]
push dword [ebp - 0x14]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
nop
nop
cmp dword [ebp - 0x18], esp
je 0x10008aaf
push 0xb8
push 0x401874d
push 6
call fcn.10072740
add esp, 0xc
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x10008abf
push ebx
call fcn.10072734
add esp, 4
push VariantClear
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x10008ad2
mov eax, 0x1015e258
push eax
push 1
mov ebx, 0x164
call fcn.10073300
add esp, 0x10
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], edx
fld qword [ebp - 0x14]
call fcn.1000101d
mov dword [0x10166473], eax
cmp dword [0x10166473], 0
jne 0x10008bee
call fcn.10008c0e
mov dword [0x10166473], eax
mov dword [ebp - 8], esp
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
nop
nop
cmp dword [ebp - 8], esp
je 0x10008b38
push 0x1c1
push 0x401874d
push 6
call fcn.10072740
add esp, 0xc
push 0x80000301
push 0
push eax
push 1
mov ebx, 0x168
call fcn.10073010
add esp, 0x10
mov dword [ebp - 0x10], eax
push dword [ebp - 0x10]
push str.__processStrMap_
mov ecx, 2
call fcn.10001960
add esp, 8
mov dword [ebp - 0x14], eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x10008b7d
push ebx
call fcn.10072734
add esp, 4
push 0x80000301
push 0
push dword [0x10166473]
push 1
mov ebx, 0x168
call fcn.10073010
add esp, 0x10
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], esp
push dword [ebp - 0x18]
push dword [ebp - 0x14]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
nop
nop
cmp dword [ebp - 0x1c], esp
je 0x10008bce
push 0x1d6
push 0x401874d
push 6
call fcn.10072740
add esp, 0xc
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x10008bde
push ebx
call fcn.10072734
add esp, 4
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x10008bee
push ebx
call fcn.10072734
add esp, 4
mov eax, dword [0x10166473]
jmp 0x10008bf8
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x10008c09
push ebx
call fcn.10072734
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret
Function at 0x100098ce
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 4], 0
mov dword [ebp - 8], esp
push str.ntdll.dll
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
nop
nop
cmp dword [ebp - 8], esp
je 0x1000990c
push 0x36
push 0x401867b
push 6
call fcn.10072740
add esp, 0xc
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], esp
push str.NtQueryInformationThread
push dword [ebp - 0xc]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x10009940
push 0x36
push 0x401867b
push 6
call fcn.10072740
add esp, 0xc
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x10009a3a
mov dword [ebp - 8], esp
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
nop
nop
cmp dword [ebp - 8], esp
je 0x10009976
push 0x94
push 0x401867b
push 6
call fcn.10072740
add esp, 0xc
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], esp
mov eax, 0
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 4
lea eax, [ebp - 4]
push eax
push 9
push dword [ebp - 0xc]
xor eax, eax
call dword [0x101664fb]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x100099bf
push 0x94
push 0x401867b
push 6
call fcn.10072740
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x10009a3a
mov dword [ebp - 8], esp
push 0
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
nop
nop
cmp dword [ebp - 8], esp
je 0x100099f7
push 0x132
push 0x401867b
push 6
call fcn.10072740
add esp, 0xc
push eax
call fcn.10009a6e
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
cmp dword [ebp - 0x14], eax
jne 0x10009a3a
mov dword [ebp - 8], esp
push 0
xor eax, eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov dword [ebp - 8], esp
push 0
xor eax, eax
call dword [sym.imp.KERNEL32.dll_ExitThread]
Function at 0x1000a40b
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.100092bb
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 1
jne 0x1000a463
mov dword [ebp - 4], esp
push 0x10
push 0x1015e258
push 0x1015e792
push 0
xor eax, eax
call dword [sym.imp.USER32.dll_MessageBoxA]
nop
nop
cmp dword [ebp - 4], esp
je 0x1000a463
push 0x3c
push 0x4018696
push 6
call fcn.10072740
add esp, 0xc
call fcn.1000983b
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 1
jne 0x1000a47f
push 0
call fcn.100098ce
mov dword [ebp - 4], esp
push 0
xor eax, eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x1000b97e
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], esp
push dword [ebp + 0x10]
push dword [ebp + 0xc]
xor eax, eax
call dword [0x101664ff]
nop
nop
cmp dword [ebp - 4], esp
je 0x1000b9b6
push 0x24
push 0x4017968
push 6
call fcn.10072740
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x1000b9d4
pushal
mov ecx, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
rep movsb byte es:[edi], byte [esi]
popal
leave
ret 0xc
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10011123
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], esp
push 0x40
push 0x1000
push dword [ebp + 8]
push 0
xor eax, eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
nop
nop
cmp dword [ebp - 4], esp
je 0x10011167
push 0x12
push 0x40187aa
push 6
call fcn.10072740
add esp, 0xc
jmp 0x1001116c
mov esp, ebp
pop ebp
ret 4

Function at 0x1001278e
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push VariantClear
push 0
push dword [ebp + 8]
push 1
mov ebx, 0x9dc
call fcn.100741e0
add esp, 0x10
mov dword [ebp - 4], eax
push dword [ebp + 0x14]
call fcn.1001280d
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push dword [ebp - 8]
push 0
push dword [ebp + 0xc]
push dword [ebp - 4]
push 0
push 0
xor eax, eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x10012802
push 0x60
push 0x4010209
push 6
call fcn.10072740
add esp, 0xc
jmp 0x10012807
mov esp, ebp
pop ebp
ret 0x14
Function at 0x1001dc68
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push VariantClear
push 0
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebx]
test eax, eax
jne 0x1001dc94
mov eax, 0x1015e240
push eax
push 1
mov ebx, 0x194
call fcn.10072e40
add esp, 0x10
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], esp
lea eax, [ebp - 8]
push eax
push 0x40
push dword [ebp - 4]
push dword [ebp + 8]
push dword [0x101664d3]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x1001dce8
push 0x58
push 0x401782b
push 6
call fcn.10072740
add esp, 0xc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x1001dcff
mov eax, 0
jmp 0x1001dda4
push dword [ebp + 0xc]
call fcn.1001ddaa
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], esp
push 0
push dword [ebp - 4]
push dword [ebp - 0xc]
push dword [ebp + 8]
push dword [0x101664d3]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x1001dd47
push 0xf3
push 0x401782b
push 6
call fcn.10072740
add esp, 0xc
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x1001dd5e
mov eax, 0
jmp 0x1001dda4
mov dword [ebp - 0xc], esp
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
push dword [ebp + 8]
push dword [0x101664d3]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x1001dd9a
push 0x141
push 0x401782b
push 6
call fcn.10072740
add esp, 0xc
mov eax, 1
jmp 0x1001dda4
mov esp, ebp
pop ebp
ret 8

Function at 0x1002263c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push VariantClear
push 0
push dword [ebp + 8]
push 1
mov ebx, 0x9dc
call fcn.100741e0
add esp, 0x10
mov dword [ebp - 4], eax
push dword [ebp + 0x1c]
call fcn.1001280d
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push dword [ebp - 8]
push 0
push dword [ebp + 0xc]
push dword [ebp - 4]
push 0
push 0
xor eax, eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x100226b0
push 0x67
push 0x401020b
push 6
call fcn.10072740
add esp, 0xc
mov ebx, dword [ebp + 0x14]
mov dword [ebx], eax
cmp dword [ebp + 0x18], 0
jne 0x100226ed
mov dword [ebp - 4], esp
mov ebx, dword [ebp + 0x14]
push dword [ebx]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
nop
cmp dword [ebp - 4], esp
je 0x100226ed
push 0xb0
push 0x401020b
push 6
call fcn.10072740
add esp, 0xc
mov ebx, dword [ebp + 0x14]
cmp dword [ebx], 0
je 0x10022708
mov eax, 1
jmp 0x10022712
mov eax, 0
jmp 0x10022712
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x100698b2
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
add ebx, 0x14
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 4]
mov dword [ebx], 0xffffff
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
add ebx, 4
mov dword [ebp - 4], ebx
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
add ebx, 0x14
mov dword [ebp - 8], ebx
push 0x80000301
push 0
push 0x2000
push 0x80000301
push 0
push 0x1000
push 2
mov ebx, 0xc8
call fcn.100737a0
add esp, 0x1c
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], esp
push 0x40
push dword [ebp - 0xc]
mov ebx, dword [ebp - 8]
push dword [ebx]
push 0
xor eax, eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x1006994d
push 0x5e
push 0x4012a94
push 6
call fcn.10072740
add esp, 0xc
mov ebx, dword [ebp - 4]
mov dword [ebx], eax
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
add ebx, 8
mov dword [ebp - 4], ebx
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
add ebx, 0x14
mov dword [ebp - 8], ebx
push 0x80000301
push 0
push 0x2000
push 0x80000301
push 0
push 0x1000
push 2
mov ebx, 0xc8
call fcn.100737a0
add esp, 0x1c
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], esp
push 0x40
push dword [ebp - 0xc]
mov ebx, dword [ebp - 8]
push dword [ebx]
push 0
xor eax, eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x100699d0
push 0xc9
push 0x4012a94
push 6
call fcn.10072740
add esp, 0xc
mov ebx, dword [ebp - 4]
mov dword [ebx], eax
mov esp, ebp
pop ebp
ret 4
Function at 0x10074680
Capabilities:
Get file size

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
jne 0x1007468e
or eax, 0xffffffff
pop esi
ret
push esi
call fcn.1007ae50
add esp, 4
test eax, eax
jne 0x100746a0
or eax, 0xffffffff
pop esi
ret
mov ecx, dword [esi]
or eax, 0xffffffff
cmp ecx, 1
je 0x100746be
cmp ecx, 3
je 0x100746be
cmp ecx, 2
jne 0x100746cd
mov ecx, dword [esi + 4]
call fcn.1007b380
pop esi
ret
mov esi, dword [esi + 4]
lea eax, [esp + 0xc]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
pop esi
ret
Function at 0x10076310
Capabilities:
Create directory

Disassembly:
sub esp, 0xc
mov ecx, dword [esp + 0x14]
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp + 8], eax
lea eax, [esp]
mov dword [esp], 0xc
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
add esp, 0xc
ret

Function at 0x10076340
Capabilities:
Read .ini file

Disassembly:
push ebx
push ebp
push esi
push edi
push 0x400
call fcn.1008a0b8
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x40]
mov ecx, dword [esp + 0x28]
add esp, 4
mov esi, eax
mov eax, dword [esp + 0x30]
push ebx
push 0x400
push esi
push ebp
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp eax, 0x3ff
jl 0x100763aa
push esi
lea edi, [eax + 0x400]
call fcn.1008a067
push edi
call fcn.1008a0b8
mov edx, dword [esp + 0x38]
add esp, 8
mov esi, eax
mov eax, dword [esp + 0x24]
push ebx
push edi
push esi
push ebp
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
dec edi
cmp eax, edi
jge 0x1007637a
push esi
xor edi, edi
call dword [0x10166ae8]
add esp, 4
test eax, eax
je 0x100763c6
push eax
push esi
call fcn.1007b400
add esp, 8
mov edi, eax
push esi
call fcn.1008a067
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret