joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10018100
Capabilities:
Get session user name
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1d8
mov eax, dword [0x100d2948]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x100d2914
push 0x10ede5a8
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea eax, [ebp - 0x198]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10018154
mov eax, dword [ebp - 8]
push eax
push str.WSAStartup_failed_with_error:__d_n
call fcn.1000ed40
add esp, 8
jmp 0x100181bd
push 0x20
push 0
push 0x100d5f68
call fcn.10040a50
add esp, 0xc
mov dword [0x100d5f6c], 0
mov dword [0x100d5f70], 1
mov dword [0x100d5f74], 6
push 0x100d5f60
push 0x100d5f68
push str.9500
push str.178.32.113.62
call dword [sym.imp.WS2_32.dll_getaddrinfo]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x100181bd
mov eax, dword [ebp - 8]
push eax
push str.getaddrinfo_failed_with_error:__d_n
call fcn.1000ed40
add esp, 8
call dword [sym.imp.WS2_32.dll_WSACleanup]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002161d
mov esp, ebp
pop ebp
ret
Function at 0x10018660
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1314
call fcn.10021630
mov eax, dword [0x100d2948]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x1008], eax
cmp dword [ebp - 0x1008], 0
jne 0x100186a4
mov eax, 1
jmp 0x10018755
lea eax, [ebp - 0x100c]
push eax
push 0x1000
lea ecx, [ebp - 0x1004]
push ecx
mov edx, dword [ebp - 0x1008]
push edx
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x10018746
mov dword [ebp - 0x1010], 0
jmp 0x100186e2
mov eax, dword [ebp - 0x1010]
add eax, 1
mov dword [ebp - 0x1010], eax
mov eax, dword [ebp - 0x100c]
shr eax, 2
cmp dword [ebp - 0x1010], eax
jae 0x10018746
push 0x104
lea eax, [ebp - 0x1114]
push eax
mov ecx, dword [ebp - 0x1010]
mov edx, dword [ebp + ecx*4 - 0x1004]
push edx
mov eax, dword [ebp - 0x1008]
push eax
call sub.PSAPI.DLL_GetModuleFileNameExA
test eax, eax
je 0x10018744
push str.AutoItX3
lea eax, [ebp - 0x1114]
push eax
call fcn.100204e0
add esp, 8
test eax, eax
je 0x10018744
lea eax, [ebp - 0x1114]
push eax
call fcn.10017780
add esp, 4
jmp 0x100186d3
mov eax, dword [ebp - 0x1008]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002161d
mov esp, ebp
pop ebp
ret
Function at 0x10018850
Capabilities:
Acquire debug privileges
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100acf58
mov eax, dword fs:[0]
push eax
sub esp, 0x78
mov eax, dword [0x100d2948]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov dword [0x100d5ccc], eax
lea eax, [ebp + 0xc]
push eax
mov ecx, 0x10ede520
call fcn.10014e80
lea eax, [ebp - 0x14]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x100188cd
mov dword [ebp - 0x74], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.10003cd0
mov eax, dword [ebp - 0x74]
jmp 0x100189c2
lea eax, [ebp - 0x1c]
push eax
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
jne 0x10018900
mov dword [ebp - 0x78], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.10003cd0
mov eax, dword [ebp - 0x78]
jmp 0x100189c2
mov dword [ebp - 0x2c], 1
mov eax, 0xc
imul ecx, eax, 0
mov edx, dword [ebp - 0x1c]
mov dword [ebp + ecx - 0x28], edx
mov eax, dword [ebp - 0x18]
mov dword [ebp + ecx - 0x24], eax
mov eax, 0xc
imul ecx, eax, 0
mov dword [ebp + ecx - 0x20], 2
push 0
push 0
push 0x10
lea eax, [ebp - 0x2c]
push eax
push 0
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x10018962
mov dword [ebp - 0x7c], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.10003cd0
mov eax, dword [ebp - 0x7c]
jmp 0x100189c2
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x1001898b
mov dword [ebp - 0x80], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.10003cd0
mov eax, dword [ebp - 0x80]
jmp 0x100189c2
push 0
push 0
push 0
push 0x10018d20
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x84], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.10003cd0
mov eax, dword [ebp - 0x84]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1002161d
mov esp, ebp
pop ebp
ret
Function at 0x10018f30
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
push edi
push 0x100d5ce0
push str.Conquer.exe
call fcn.10017260
add esp, 8
push 0x100d5d04
push str...iniMagictype.dat
call fcn.10017260
add esp, 8
push 0x100d5d28
push str..._servers.dat
call fcn.10017260
add esp, 8
push 0x100d5d4c
push str...iniMagicEffect.ini
call fcn.10017260
add esp, 8
push 0x100d5d70
push str...iniStrRes.ini
call fcn.10017260
add esp, 8
push 0x100d5db8
push 0x100b2e98
call fcn.10017260
add esp, 8
push 0x100b2ea8
push 0x100d5d04
call fcn.1005e550
add esp, 8
test eax, eax
jne 0x10019075
push 0x100b2ea8
push 0x100d5d4c
call fcn.1005e550
add esp, 8
test eax, eax
jne 0x10019075
push 0x100b2ea8
push 0x100d5d70
call fcn.1005e550
add esp, 8
test eax, eax
jne 0x10019075
push 0x100b2ea8
push 0x100d5d94
call fcn.1005e550
add esp, 8
test eax, eax
jne 0x10019075
push 0x100d5ce0
push str.Env_DX8_Conquer.exe
call fcn.10017260
add esp, 8
push 0x100d5d04
push str.ini_Magictype.dat
call fcn.10017260
add esp, 8
push 0x100d5d28
push str.servers.dat
call fcn.10017260
add esp, 8
push 0x100d5d4c
push str.ini_MagicEffect.ini
call fcn.10017260
add esp, 8
push 0x100d5d70
push str.ini_StrRes.ini
call fcn.10017260
add esp, 8
push 0x100d5db8
push str.Env_DX8_CO2Helper.dll
call fcn.10017260
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [0x100d5e14], eax
push str.Connected_to_the_server..._Sending_the_welcome_hash.
call fcn.1000ed40
add esp, 4
push 0xcc
call fcn.1005e75f
add esp, 4
mov dword [ebp - 8], eax
push 0x100d5ce0
mov eax, dword [ebp - 8]
add eax, 0x25
push eax
call fcn.1004c220
add esp, 8
push 0x100d5d04
mov eax, dword [ebp - 8]
add eax, 4
push eax
call fcn.1004c220
add esp, 8
push 0x100d5d4c
mov eax, dword [ebp - 8]
add eax, 0x46
push eax
call fcn.1004c220
add esp, 8
push 0x100d5d28
mov eax, dword [ebp - 8]
add eax, 0x67
push eax
call fcn.1004c220
add esp, 8
push 0x100d5d70
mov eax, dword [ebp - 8]
add eax, 0x88
push eax
call fcn.1004c220
add esp, 8
push 0x100d5db8
mov eax, dword [ebp - 8]
add eax, 0xa9
push eax
call fcn.1004c220
add esp, 8
mov eax, dword [ebp - 8]
mov dword [eax], 1
push 0
push 0xcc
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [0x100d2910]
push ecx
call dword [sym.imp.WS2_32.dll_send]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
push eax
call fcn.1005dd3a
add esp, 4
cmp dword [ebp - 4], 0xffffffff
jne 0x10019181
mov eax, dword [0x100d2910]
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
call dword [sym.imp.WS2_32.dll_WSACleanup]
push str.Error_with_welcome_buff_n
call fcn.10018210
add esp, 4
push 2
mov eax, dword [0x100d2910]
push eax
call dword [sym.imp.WS2_32.dll_shutdown]
call fcn.1001e970
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10019190
Capabilities:
Create thread
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x294
mov eax, dword [0x100d2948]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
cmp dword [0x100d5f94], 0
jne 0x100192a1
push 0x100b2f54
push 0x100b2f58
call fcn.1005f7f0
add esp, 8
mov dword [ebp - 0x20c], eax
push 0x100b2f68
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
call fcn.1005f7f0
add esp, 8
mov dword [ebp - 0x210], eax
mov eax, dword [ebp - 0x20c]
push eax
push 0x200
push 1
lea ecx, [ebp - 0x208]
push ecx
call fcn.1005fbb0
add esp, 0x10
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10019228
mov eax, dword [ebp - 0x210]
push eax
mov ecx, dword [ebp - 8]
push ecx
push 1
lea edx, [ebp - 0x208]
push edx
call fcn.100602d8
add esp, 0x10
jmp 0x100191e4
mov dword [0x100d5f94], 1
mov eax, dword [ebp - 0x210]
push eax
call fcn.1005f03d
add esp, 4
mov eax, dword [ebp - 0x20c]
push eax
call fcn.1005f03d
add esp, 4
lea eax, [ebp - 0x208]
mov dword [ebp - 0x294], eax
mov ecx, dword [ebp - 0x294]
push ecx
call fcn.1002165d
add esp, 4
push 0
push 2
push 0x100d2918
mov eax, dword [0x100d291c]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call fcn.10017600
push 0
push 0
push 0
push 0x10016c60
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002161d
mov esp, ebp
pop ebp
ret

Function at 0x100194e0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
push esi
push edi
push 0
push 0
push 0
push 0x10015e10
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x1001fb90
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10019dd0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ad078
mov eax, dword fs:[0]
push eax
sub esp, 0x8c
mov eax, dword [0x100d2948]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0x38], 0
je 0x10019e15
mov eax, dword [ebp - 0x14]
movzx ecx, byte [eax + 0x3d]
test ecx, ecx
jne 0x10019e21
mov al, 1
jmp 0x10019ff7
mov dword [ebp - 0x18], 8
call fcn.1000ce60
push eax
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x14]
mov eax, dword [edx + 0xc]
call eax
mov dword [ebp - 0x7c], eax
call fcn.1000ce60
mov dword [ebp - 0x80], eax
lea ecx, [ebp - 0x7c]
push ecx
lea edx, [ebp - 0x80]
push edx
call fcn.1000cef0
add esp, 8
movzx eax, al
test eax, eax
je 0x10019e64
xor al, al
jmp 0x10019ff7
push 0
push 8
lea ecx, [ebp - 0x34]
call fcn.100140e0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x84]
push ecx
lea ecx, [ebp - 0x34]
call fcn.1001c970
mov ecx, eax
call fcn.100153d0
mov esi, eax
lea ecx, [ebp - 0x34]
call fcn.10007170
add esi, eax
push esi
lea edx, [ebp - 0x88]
push edx
lea ecx, [ebp - 0x34]
call fcn.1001c970
mov ecx, eax
call fcn.100153d0
push eax
mov eax, dword [ebp - 0x14]
add eax, 0x40
push eax
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ecx + 0x38]
call fcn.10020bc0
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0
je 0x10019ef1
cmp dword [ebp - 0x98], 1
je 0x10019ef8
cmp dword [ebp - 0x98], 3
je 0x10019fa7
jmp 0x10019fc5
mov eax, dword [ebp - 0x14]
mov byte [eax + 0x3d], 0
lea eax, [ebp - 0x8c]
push eax
lea ecx, [ebp - 0x34]
call fcn.1001c970
mov ecx, eax
call fcn.100153d0
mov ecx, dword [ebp - 0x1c]
sub ecx, eax
mov dword [ebp - 0x38], ecx
je 0x10019f6a
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp - 0x38]
push edx
push 1
lea eax, [ebp - 0x90]
push eax
lea ecx, [ebp - 0x34]
call fcn.1001c970
mov ecx, eax
call fcn.100153d0
push eax
call fcn.100602d8
add esp, 0x10
cmp dword [ebp - 0x38], eax
je 0x10019f6a
mov byte [ebp - 0x91], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.10003cd0
mov al, byte [ebp - 0x91]
jmp 0x10019ff7
mov eax, dword [ebp - 0x14]
movzx ecx, byte [eax + 0x3d]
test ecx, ecx
jne 0x10019f93
mov byte [ebp - 0x92], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.10003cd0
mov al, byte [ebp - 0x92]
jmp 0x10019ff7
cmp dword [ebp - 0x38], 0
jne 0x10019fa5
push 0
push 8
lea ecx, [ebp - 0x34]
call fcn.1001c760
jmp 0x10019fe3
mov byte [ebp - 0x93], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.10003cd0
mov al, byte [ebp - 0x93]
jmp 0x10019ff7
mov byte [ebp - 0x94], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.10003cd0
mov al, byte [ebp - 0x94]
jmp 0x10019ff7
jmp 0x10019e77
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1002161d
mov esp, ebp
pop ebp
ret
Function at 0x1001cfe0
Capabilities:
Connect socket
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
mov eax, dword [0x100d5eec]
add eax, 1
mov dword [0x100d5eec], eax
mov eax, dword [0x100d5f60]
mov dword [0x100d5f64], eax
jmp 0x1001d010
cmp dword [0x100d5f64], 0
je 0x1001d0fb
mov eax, dword [0x100d5f64]
mov ecx, dword [eax + 0xc]
push ecx
mov edx, dword [0x100d5f64]
mov eax, dword [edx + 8]
push eax
mov ecx, dword [0x100d5f64]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.WS2_32.dll_socket]
mov dword [0x100d2910], eax
cmp dword [0x100d2910], 0xffffffff
jne 0x1001d06d
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.socket_failed_with_error:__ld_n
call fcn.1000ed40
add esp, 8
call dword [sym.imp.WS2_32.dll_WSACleanup]
jmp 0x1001d123
mov eax, dword [0x100d5f64]
mov ecx, dword [eax + 0x10]
push ecx
mov edx, dword [0x100d5f64]
mov eax, dword [edx + 0x18]
push eax
mov ecx, dword [0x100d2910]
push ecx
call dword [sym.imp.WS2_32.dll_connect]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x1001d0e3
push 0
push 0
push 0
push 0x10016d10
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 8], eax
push 0
push 0x100b2b08
push str.Server_is_offline_right_now._nTry_again_later.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 2
mov eax, dword [0x100d2910]
push eax
call dword [sym.imp.WS2_32.dll_shutdown]
mov dword [0x100d2910], 0xffffffff
call fcn.1001e970
jmp 0x1001d123
mov dword [0x100d5eec], 0
mov byte [0x100d5cd1], 1
jmp 0x1001d0fb
mov eax, dword [0x100d5f60]
push eax
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
cmp dword [0x100d2910], 0xffffffff
jne 0x1001d123
push str.Unable_to_connect_to_server__n
call fcn.1000ed40
add esp, 4
call dword [sym.imp.WS2_32.dll_WSACleanup]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100256b4
Capabilities:
Write file on windows

Disassembly:
push 0x2c
mov eax, 0x100ad98a
call fcn.100a9106
mov edi, ecx
mov dword [ebp - 0x30], edi
xor ebx, ebx
cmp dword [edi + 0x38], ebx
je 0x100257e7
cmp byte [edi + 0x3e], bl
je 0x100257e7
mov eax, dword [edi]
mov ecx, 0xffff
push ecx
mov esi, dword [eax + 0xc]
mov ecx, esi
call fcn.1002265a
mov ecx, edi
call esi
mov ecx, 0xffff
cmp cx, ax
jne 0x10025700
xor al, al
jmp 0x100257e9
push ebx
push 8
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], bl
call fcn.1001c840
lea eax, [edi + 0x40]
mov dword [ebp - 4], ebx
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x14]
lea esi, [ebp - 0x28]
mov dword [ebp - 0x2c], esi
cmp ecx, 0x10
jb 0x10025735
mov dword [ebp - 0x2c], eax
lea edx, [ebp - 0x28]
cmp ecx, 0x10
jb 0x1002573f
mov edx, eax
mov edi, dword [edi + 0x38]
lea eax, [ebp - 0x38]
push eax
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x2c]
mov esi, dword [edi]
push eax
push edx
push dword [ebp - 0x34]
mov ecx, dword [esi + 0x20]
call fcn.1002265a
mov ecx, edi
call dword [esi + 0x20]
sub eax, ebx
je 0x1002576e
sub eax, 1
jne 0x100257cc
mov edi, dword [ebp - 0x30]
jmp 0x10025774
mov edi, dword [ebp - 0x30]
mov byte [edi + 0x3e], bl
mov ecx, dword [ebp - 0x14]
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0x28]
cmp ecx, 0x10
jb 0x10025784
mov edx, eax
mov esi, dword [ebp - 0x38]
sub esi, edx
je 0x100257ae
lea edx, [ebp - 0x28]
cmp ecx, 0x10
jb 0x10025795
mov edx, eax
push dword [edi + 0x4c]
push esi
push 1
push edx
call fcn.100602d8
add esp, 0x10
cmp esi, eax
jne 0x100257d7
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x28]
cmp byte [edi + 0x3e], 0
je 0x100257d5
test esi, esi
jne 0x10025727
push ebx
push 8
lea ecx, [ebp - 0x28]
call fcn.1001c760
jmp 0x10025721
dec eax
sub eax, 1
jne 0x100257db
inc eax
jmp 0x100257d9
mov bl, 1
mov al, bl
mov bl, al
lea ecx, [ebp - 0x28]
call fcn.10005f40
mov al, bl
jmp 0x100257e9
mov al, 1
call fcn.100a90b0
ret
Function at 0x10025e34
Capabilities:
Write file on windows

Disassembly:
push 0x34
mov eax, 0x100ad9df
call fcn.100a9106
mov esi, ecx
mov dword [ebp - 0x30], esi
mov edi, dword [ebp + 8]
mov ebx, 0xffff
cmp bx, di
jne 0x10025e59
xor eax, eax
jmp 0x10025fdd
mov eax, dword [esi + 0x20]
mov ecx, dword [eax]
test ecx, ecx
je 0x10025e85
mov edx, dword [esi + 0x30]
mov eax, dword [edx]
lea eax, [ecx + eax*2]
cmp ecx, eax
jae 0x10025e85
dec dword [edx]
mov ax, di
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 2]
mov dword [edx], ecx
mov word [esi], di
jmp 0x10025fdd
cmp dword [esi + 0x4c], 0
je 0x10025fda
mov ecx, esi
call fcn.1002599b
xor eax, eax
cmp dword [esi + 0x38], eax
jne 0x10025eb8
push dword [esi + 0x4c]
push edi
call fcn.10024f08
pop ecx
pop ecx
test al, al
je 0x10025fda
movzx ebx, di
jmp 0x10025fda
push eax
push 8
lea ecx, [ebp - 0x28]
mov word [ebp - 0x2c], di
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], al
call fcn.1001c840
and dword [ebp - 4], 0
lea eax, [esi + 0x40]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x14]
lea edi, [ebp - 0x28]
mov dword [ebp - 0x34], edi
cmp ecx, 0x10
jb 0x10025ef2
mov dword [ebp - 0x34], eax
lea edx, [ebp - 0x28]
cmp ecx, 0x10
jb 0x10025efc
mov edx, eax
mov edi, dword [esi + 0x38]
lea eax, [ebp - 0x3c]
push eax
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x34]
mov esi, dword [edi]
push eax
push edx
lea eax, [ebp - 0x40]
mov ecx, dword [esi + 0x1c]
push eax
lea eax, [ebp - 0x2a]
push eax
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0x38]
call fcn.1002265a
mov ecx, edi
call dword [esi + 0x1c]
test eax, eax
js 0x10025fd2
cmp eax, 1
jg 0x10025fad
mov ecx, dword [ebp - 0x14]
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0x28]
cmp ecx, 0x10
jb 0x10025f46
mov edx, eax
mov edi, dword [ebp - 0x3c]
sub edi, edx
je 0x10025f75
lea edx, [ebp - 0x28]
cmp ecx, 0x10
jb 0x10025f57
mov edx, eax
mov esi, dword [ebp - 0x30]
push dword [esi + 0x4c]
push edi
push 1
push edx
call fcn.100602d8
add esp, 0x10
cmp edi, eax
jne 0x10025fa8
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x28]
jmp 0x10025f78
mov esi, dword [ebp - 0x30]
lea edx, [ebp - 0x2c]
mov byte [esi + 0x3e], 1
cmp dword [ebp - 0x40], edx
jne 0x10025fa2
test edi, edi
jne 0x10025ee4
cmp dword [ebp - 0x18], 0x20
jae 0x10025fcc
push edi
push 8
lea ecx, [ebp - 0x28]
call fcn.1001c760
jmp 0x10025ede
mov eax, dword [ebp + 8]
movzx ebx, ax
movzx ebx, bx
jmp 0x10025fcc
cmp eax, 3
jne 0x10025fd2
mov eax, dword [ebp - 0x30]
push dword [eax + 0x4c]
push dword [ebp - 0x2c]
call fcn.10024f08
pop ecx
pop ecx
test al, al
je 0x10025fcc
mov eax, dword [ebp + 8]
movzx ebx, ax
movzx eax, bx
movzx ebx, ax
lea ecx, [ebp - 0x28]
call fcn.10005f40
mov ax, bx
call fcn.100a90b0
ret 4

Function at 0x10044663
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x100b792c
push 0x100b7924
push 0x100b48e8
push 0
call fcn.10044511
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10044695
push dword [ebp + 8]
mov ecx, esi
call fcn.1002265a
call esi
pop esi
pop ebp
ret
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsAlloc]
Function at 0x100446d7
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x100b793c
push 0x100b7934
push str.FlsGetValue
push 2
call fcn.10044511
add esp, 0x10
mov esi, eax
push dword [ebp + 8]
test esi, esi
je 0x10044708
mov ecx, esi
call fcn.1002265a
call esi
jmp 0x1004470e
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
pop esi
pop ebp
ret

Function at 0x10044711
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x100b7944
push 0x100b793c
push str.FlsSetValue
push 3
call fcn.10044511
add esp, 0x10
mov esi, eax
push dword [ebp + 0xc]
push dword [ebp + 8]
test esi, esi
je 0x10044745
mov ecx, esi
call fcn.1002265a
call esi
jmp 0x1004474b
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop esi
pop ebp
ret
Function at 0x100761c5
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10075dca

Function at 0x100761d0
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10075f4b

Function at 0x1007a18e
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10079968

Function at 0x1007a199
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10079ba3

Function at 0x1008866a
Capabilities:
Create thread
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100883f1

Function at 0x1008abbe
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret
Function at 0x100011a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x100011f8
cmp byte [esi + ebx - 1], 0xa
je 0x100011cc
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x1000e084], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0x10
pop ebx
pop esi
pop ebp
ret