joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1c70f90
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0xa34], 0x8000
jne 0x1c71077
cmp dword [esi + 0x434], 0x200
jne 0x1c7107a
push 0x1cf53f0
call dword [sym.imp.progwrp.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x1c71080
cmp byte [0x1d04bf4], 0
jne 0x1c7100a
cmp dword [0x1d04c4c], 0
jne 0x1c7108f
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x1c71092
mov dword [0x1d04ba0], eax
mov dword [0x1d04c50], eax
mov dword [0x1d04c4c], 0x1c70eb0
mov byte [0x1d04bf4], 1
push 0x1cf53f0
call dword [sym.imp.progwrp.dll_ReleaseSRWLockExclusive]
xor eax, eax
lock cmpxchg dword [0x1d04bf8], esi
jne 0x1c7107d
mov dword [0x1d04c54], 0x1c71190
add esi, 0x48
mov eax, 0xffffffb0
jmp 0x1c71047
mov cl, 0x40
jmp 0x1c7103b
mov cl, 0x80
mov byte [eax + 0x1d04bf4], cl
add esi, 0x20
inc eax
je 0x1c71070
cmp dword [esi], 0
je 0x1c71073
mov ecx, dword [esi + 0xc]
cmp ecx, 0x81
jb 0x1c71039
cmp ecx, 0x101
jb 0x1c71035
cmp ecx, 0x201
setb cl
shl cl, 4
add cl, 0x10
jmp 0x1c7103b
pop esi
pop ebp
ret
xor ecx, ecx
jmp 0x1c7103b
int3
int3
int3
mov ecx, 0x1cf53f0
call fcn.01c7e190
jmp 0x1c70fca
int3
int3

Function at 0x1c710a0
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x20
mov edi, dword [ebp + 8]
mov eax, dword [0x1cf3040]
xor eax, ebp
mov dword [ebp - 0xc], eax
test edi, edi
je 0x1c71186
mov eax, dword [0x1d060c0]
mov ecx, dword [0x1cf656c]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x1c7112a
mov ecx, 0x1d04c80
push 0
push 0x340
call fcn.01c2f330
mov esi, eax
mov ecx, eax
push edi
call fcn.01c2f110
push esi
push dword [0x1d04ba0]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [0x1cf656c]
mov ecx, dword fs:[0x2c]
mov eax, dword [ecx + eax*4]
mov dword [eax + 0xa0], esi
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.01c98173
mov eax, esi
add esp, 0x20
pop esi
pop edi
pop ebp
ret
push 0x1d060c0
call fcn.01c9518a
add esp, 4
cmp dword [0x1d060c0], 0xffffffff
jne 0x1c710da
pcmpeqd xmm0, xmm0
lea eax, [ebp - 0x28]
movdqu xmmword [eax + 4], xmm0
mov dword [eax + 0x14], 0xffffffff
xor ecx, ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov byte [eax + 0x10], cl
mov byte [eax + 0x14], cl
mov dword [eax + 0x18], ecx
mov dword [eax], ecx
mov byte [eax + 4], cl
mov ecx, 0x1d04c80
push eax
call fcn.01c744b0
push 0x1d060c0
call fcn.01c951d9
add esp, 4
jmp 0x1c710da
int3
Function at 0x1c725c0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [ebp + 0x10]
mov ecx, dword [0x1cf3040]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
mov esi, 0x7fffffff
cmp eax, 0x7fffffff
cmovb esi, eax
lea edi, [ebp - 0x14]
mov dword [edi], 0xffffffff
push 0
push edi
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1c72659
mov eax, dword [sym.imp.KERNEL32.dll_GetFileType]
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x1c72626
cmp ebx, 0xffffffff
je 0x1c72638
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c98173
mov eax, ebx
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
mov ebx, dword [ebp + 8]
push ebx
mov ebx, eax
call eax
cmp eax, 3
je 0x1c7263b
mov ebx, dword [ebp - 0x14]
jmp 0x1c72612
int3
mov dword [ebp - 0x14], 0xffffffff
push 0
push edi
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
mov eax, dword [sym.imp.KERNEL32.dll_ReadFile]
call eax
test eax, eax
mov eax, ebx
jne 0x1c72606
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ebx, ebx
cmp eax, 0x6d
setne bl
neg ebx
jmp 0x1c72612

Function at 0x1c74430
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov eax, dword [ebp + 0xc]
cmp eax, 3
je 0x1c74447
test eax, eax
je 0x1c74447
pop esi
pop edi
pop ebp
ret 0xc
test eax, eax
jne 0x1c74455
mov ecx, dword [0x1d04c54]
test ecx, ecx
jne 0x1c74491
cmp dword [0x1d04c4c], 0
je 0x1c74441
mov esi, dword [0x1d04c50]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test edi, edi
jne 0x1c7449b
test esi, esi
je 0x1c74441
mov ecx, dword [0x1d04c4c]
call dword [0x1cef298]
push esi
call ecx
add esp, 4
jmp 0x1c74441
call dword [0x1cef298]
call ecx
jmp 0x1c74455
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1c74479
Function at 0x1c7aa30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
cmp dword [ecx + 0x30], 0xffffffff
je 0x1c7aa3b
pop ebp
ret
mov eax, dword [ecx + 0x14]
mov dword [ecx + 0x28], eax
lea edx, [ecx + 0x18]
pop ebp
jmp fcn.01cd6330
Function at 0x1c857b0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x10
mov eax, dword [0x1cf3040]
xor eax, ebp
mov dword [esp + 8], eax
push 0x1d07158
call dword [sym.imp.progwrp.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x1c85906
cmp byte [0x1d0715c], 0
je 0x1c858a3
mov edi, dword [0x1d07160]
mov edx, dword [0x1d07164]
mov esi, edx
shld esi, edi, 0x17
mov eax, dword [0x1d0716c]
mov ecx, edi
shl ecx, 0x17
xor ecx, edi
xor esi, edx
mov edx, esi
mov edi, eax
shr edi, 0x1a
xor edi, eax
xor edi, esi
shr esi, 0x11
xor esi, edi
mov edi, dword [0x1d07168]
shld edx, ecx, 0xf
mov ebx, eax
shld ebx, edi, 6
xor ebx, edi
xor ebx, ecx
xor ebx, edx
mov dword [0x1d07160], edi
mov dword [0x1d07164], eax
mov dword [0x1d07168], ebx
add ebx, edi
mov dword [0x1d0716c], esi
adc esi, eax
push 0x1d07158
call dword [sym.imp.progwrp.dll_ReleaseSRWLockExclusive]
mov eax, dword [0x1cf6454]
cmp eax, 0xffffffff
je 0x1c85886
test eax, eax
je 0x1c8586f
and esi, 0x3fff0000
add esi, 0x20000000
jmp 0x1c85871
xor esi, esi
mov ecx, dword [esp + 8]
xor ecx, ebp
call fcn.01c98173
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0x1cf6454
push eax
call dword [sym.imp.progwrp.dll_IsWow64Process]
test eax, eax
je 0x1c85915
mov eax, dword [0x1cf6454]
jmp 0x1c8585d
xorps xmm0, xmm0
movups xmmword [0x1d07160], xmm0
xor edi, edi
dec edi
mov esi, esp
mov dword [esi + 4], edi
mov dword [esi], edi
push 8
push esi
call sub.progwrp.dll_SystemFunction036
test al, al
je 0x1c85924
mov eax, dword [esp]
mov ecx, dword [esp + 4]
mov dword [0x1d07164], ecx
mov dword [0x1d07160], eax
mov dword [esp + 4], edi
mov dword [esp], edi
push 8
push esi
call sub.progwrp.dll_SystemFunction036
test al, al
je 0x1c85927
mov eax, dword [esp]
mov ecx, dword [esp + 4]
mov dword [0x1d0716c], ecx
mov dword [0x1d07168], eax
mov byte [0x1d0715c], 1
jmp 0x1c857e7
mov ecx, 0x1d07158
call fcn.01c7e190
jmp 0x1c857da
mov dword [0x1cf6454], 0
jmp 0x1c8586f
int3
int3
Function at 0x1c8c890
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov edi, dword [ecx + 4]
mov edx, dword [edi + 0x3c]
xor eax, eax
cmp dword [edi + edx + 0x74], 0
je 0x1c8c9c4
add edx, edi
cmp word [edx + 0x14], 0x68
jb 0x1c8c9c4
mov ecx, edx
add ecx, 0x78
je 0x1c8c9c4
mov esi, dword [ecx]
test esi, esi
je 0x1c8c9c4
add esi, edi
je 0x1c8c9c4
cmp dword [ebp + 8], 0xffff
mov dword [ebp - 0x14], edx
jbe 0x1c8c9d2
mov eax, dword [esi + 0x20]
lea ebx, [edi + eax]
test eax, eax
cmove ebx, eax
mov dword [ebp - 0x18], esi
mov eax, dword [esi + 0x18]
lea eax, [ebx + eax*4]
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x1c], edi
jmp 0x1c8c91d
movzx ecx, dl
movzx edi, dh
cmp ecx, edi
lea ecx, [ebx + esi*2]
lea esi, [ecx + 4]
cmovg ebx, esi
cmovs eax, ecx
cmp dl, dh
mov edi, dword [ebp - 0x1c]
je 0x1c8c967
cmp ebx, eax
je 0x1c8c9ce
mov esi, eax
sub esi, ebx
mov ecx, esi
sar ecx, 2
shr esi, 0x1f
add esi, ecx
and esi, 0xfffffffe
mov edx, dword [ebx + esi*2]
lea ecx, [edi + edx]
test edx, edx
cmove ecx, edx
mov edx, dword [ebp + 8]
mov dl, byte [edx]
mov dh, byte [ecx]
test dl, dl
je 0x1c8c902
cmp dl, dh
jne 0x1c8c902
xor edi, edi
inc edi
mov edx, dword [ebp + 8]
mov dl, byte [edx + edi]
mov dh, byte [ecx + edi]
test dl, dl
je 0x1c8c902
inc edi
cmp dl, dh
je 0x1c8c953
jmp 0x1c8c902
mov esi, dword [ebp - 0x18]
mov eax, dword [esi + 0x24]
lea edx, [edi + eax]
test eax, eax
cmove edx, eax
sub ecx, dword [ebp - 0x10]
sar ecx, 1
movzx edx, word [edx + ecx]
add dx, word [esi + 0x10]
mov eax, dword [esi + 0x1c]
lea ecx, [edi + eax]
test eax, eax
cmove ecx, eax
movzx eax, dx
lea ecx, [ecx + eax*4]
mov eax, dword [esi + 0x10]
shl eax, 2
sub ecx, eax
mov eax, 0
mov edx, dword [ebp - 0x14]
je 0x1c8c9c4
mov edx, dword [edx + 0x7c]
test edx, edx
je 0x1c8c9c4
mov ecx, dword [ecx]
add edi, ecx
test ecx, ecx
cmove edi, ecx
add edx, esi
xor eax, eax
dec eax
cmp edx, edi
cmovbe eax, edi
cmp esi, edi
cmova eax, edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 4
xor eax, eax
jmp 0x1c8c9c4
mov edx, dword [ebp + 8]
jmp 0x1c8c982
Function at 0x1c8db80
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov esi, ecx
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x18]
mov dword [ecx - 4], esp
mov dword [ecx + 8], 0xffffffff
mov dword [ecx + 4], 0x1c5e630
mov edx, dword fs:[0]
mov dword [ecx], edx
mov dword fs:[0], ecx
mov dword [esi + 0x18], eax
xor ecx, ecx
test eax, eax
sete cl
mov dword [esi + 0x10], ecx
xor eax, eax
mov dword [esi + 0x14], eax
mov dword [esi + 4], 0x1002
mov dword [esi + 0xc], eax
mov dword [esi + 8], 6
xorps xmm0, xmm0
movups xmmword [esi + 0x20], xmm0
movups xmmword [esi + 0x30], xmm0
xorps xmm0, xmm0
movsd qword [esi + 0x40], xmm0
mov eax, dword [0x1cf77cc]
mov ecx, dword [0x1cf656c]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x1c8dc2b
mov eax, dword [0x1cf77c8]
mov dword [esi + 0x1c], eax
cmp eax, 0x1cf7724
jne 0x1c8dcea
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 4
push 0x1cf77cc
call fcn.01c9518a
add esp, 4
cmp dword [0x1cf77cc], 0xffffffff
jne 0x1c8dc05
mov eax, dword [0x1cf77c4]
mov ecx, dword [0x1cf656c]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x1c8dc92
mov eax, dword [0x1cf77c0]
mov dword [0x1cf77c8], eax
cmp eax, 0x1cf7724
jne 0x1c8dcf3
push fcn.01cbf890
call fcn.01c96dd3
add esp, 4
push 0x1cf77cc
call fcn.01c951d9
add esp, 4
jmp 0x1c8dc05
push 0x1cf77c4
call fcn.01c9518a
add esp, 4
cmp dword [0x1cf77c4], 0xffffffff
jne 0x1c8dc5e
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x10], 0
mov ecx, 0x1cf7724
push 1
call fcn.01c46eb0
mov dword [0x1cf77c0], 0x1cf7724
push fcn.01cbf890
call fcn.01c96dd3
add esp, 4
push 0x1cf77c4
call fcn.01c951d9
add esp, 4
mov esi, dword [ebp - 0x20]
jmp 0x1c8dc5e
lock inc dword [eax + 4]
jmp 0x1c8dc18
lock inc dword [eax + 4]
jmp 0x1c8dc73
Function at 0x1c8e770
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x124
mov eax, dword [0x1cf3040]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x1cf8bfc]
mov ecx, dword [0x1cf656c]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x1c8e7c0
mov esi, dword [0x1cf8bf8]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c98173
mov eax, esi
add esp, 0x124
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x1cf8bfc
call fcn.01c9518a
add esp, 4
cmp dword [0x1cf8bfc], 0xffffffff
jne 0x1c8e7a3
lea edi, [ebp - 0x128]
xor esi, esi
push 0x118
push esi
push edi
call fcn.01c99a20
add esp, 0xc
mov dword [edi - 4], 0x11c
lea ebx, [ebp - 0x12c]
push ebx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
lea edi, [ebp - 0x130]
mov dword [edi], esi
push edi
push esi
push esi
push dword [ebx + 8]
push dword [ebx + 4]
call dword [sym.imp.progwrp.dll_GetProductInfo]
push 0x54
call fcn.01c9515a
add esp, 4
mov esi, eax
mov edi, dword [edi]
mov eax, dword [0x1cf8c2c]
mov ecx, dword [0x1cf656c]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x1c8e86c
lea edx, [ebp - 0x12c]
mov ecx, esi
push edi
call fcn.01c38f80
add esp, 4
mov dword [0x1cf8bf8], esi
push 0x1cf8bfc
call fcn.01c951d9
add esp, 4
jmp 0x1c8e7a3
push 0x1cf8c2c
call fcn.01c9518a
add esp, 4
cmp dword [0x1cf8c2c], 0xffffffff
jne 0x1c8e843
xorps xmm0, xmm0
movups xmmword [0x1cf8c18], xmm0
movups xmmword [0x1cf8c08], xmm0
mov dword [0x1cf8c28], 0
push 0x1cf8c08
call dword [sym.imp.progwrp.dll_GetNativeSystemInfo]
push 0x1cf8c2c
call fcn.01c951d9
add esp, 4
jmp 0x1c8e843
Function at 0x1c932a0
Capabilities:
Parse pe header

Disassembly:
mov eax, dword [ecx + 8]
test eax, eax
jne 0x1c932af
xor eax, eax
cmp dword [ecx + 0x14], 0
je 0x1c932b0
ret
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov ebx, dword [ecx + 0xc]
mov edi, dword [ecx + 0x10]
test edi, edi
jne 0x1c93315
test ebx, ebx
jne 0x1c933b7
mov ebx, dword [ecx]
test ebx, ebx
je 0x1c93375
mov dword [ecx + 0xc], ebx
mov edx, dword [ecx + 4]
cmp edx, 0x40
jb 0x1c933ae
movzx esi, word [ebx]
cmp esi, 0x5a4d
jne 0x1c933ae
mov esi, dword [ebx + 0x3c]
lea edi, [esi + 0x18]
cmp edi, edx
ja 0x1c93375
add esi, ebx
cmp dword [esi], 0x4550
jne 0x1c93375
mov edi, esi
add edi, 4
mov dword [ecx + 0x10], edi
mov esi, edx
jne 0x1c93318
jmp 0x1c93375
mov esi, dword [ecx + 4]
mov dword [ebp - 0x1c], edi
lea edx, [edi + 0x14]
mov edi, edx
sub edi, ebx
lea ebx, [edi + 2]
mov dword [ebp - 0x10], esi
cmp ebx, esi
ja 0x1c93375
mov dword [ebp - 0x18], edx
movzx ebx, word [edx]
cmp ebx, 0x20b
jne 0x1c93381
mov al, 1
mov dword [ebp - 0x14], eax
mov eax, 2
mov edx, dword [ebp - 0x10]
lea ebx, [edi + 0xf0]
cmp ebx, edx
seta bh
and bh, byte [ebp - 0x14]
add edi, 0xe0
cmp edi, edx
seta bl
or bl, bh
mov dword [ecx + 8], eax
cmp edx, 0xffffffff
je 0x1c93398
test bl, 1
jne 0x1c93398
mov edx, dword [ebp - 0x18]
mov dword [ecx + 0x14], edx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
jmp 0x1c932af
cmp ebx, 0x10b
mov edx, dword [ebp - 0x10]
jne 0x1c933bf
xor eax, eax
inc eax
mov dword [ebp - 0x14], 0
jmp 0x1c93347
test bl, 1
jne 0x1c93375
cmp dword [ebp - 0x10], 0xffffffff
jne 0x1c9336f
mov edx, dword [ebp - 0x1c]
mov edx, dword [edx + 0x4c]
mov dword [ecx + 4], edx
jmp 0x1c9336f
mov dword [ecx + 0xc], 0
jmp 0x1c93375
mov edx, dword [ecx + 4]
jmp 0x1c932f3
mov dword [ecx + 8], 0
jmp 0x1c93375
Function at 0x1ca43ef
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x1ca442e
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1ca442e
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1ca442e
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x1ca442e
cmp dword [ecx + 0x74], 0xe
jbe 0x1ca442e
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x1ca6e31
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x1cf3040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push 0x1ced4b0
push esi
call fcn.01cb40d6
pop ecx
pop ecx
test eax, eax
jne 0x1ca6e5f
xor al, al
jmp 0x1ca6edc
push ebx
lea eax, [ebp - 0x210]
xor ebx, ebx
push eax
push 0x104
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x210], ebx
push esi
push eax
call fcn.01ca6bc0
mov edx, eax
add esp, 0x10
test edx, edx
jne 0x1ca6e99
push dword [ebp - 0x210]
call fcn.01c93ce0
xor al, al
jmp 0x1ca6eda
mov ecx, edx
push edi
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x1ca6e9f
sub ecx, edi
sar ecx, 1
pop edi
cmp ecx, 3
je 0x1ca6ebf
push edx
call fcn.01ca6d83
pop ecx
test al, al
je 0x1ca6e8a
push esi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x1ca6ecd
mov bl, 1
push dword [ebp - 0x210]
call fcn.01c93ce0
mov al, bl
pop ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.01c98173
leave
ret
Function at 0x1ca8358
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x1cf6e60]
mov dword [ebp - 0xc], ecx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x1ca8398
cmp byte [ebx], 0xa
jne 0x1ca8398
or byte [edi + eax + 0x28], 4
jmp 0x1ca839d
and byte [edi + eax + 0x28], 0xfb
add ecx, ebx
mov eax, ebx
mov dword [ebp - 0x10], ecx
mov esi, ebx
mov dword [ebp - 8], eax
cmp ebx, ecx
jae 0x1ca849c
mov dl, byte [eax]
cmp dl, 0x1a
je 0x1ca847f
inc eax
cmp dl, 0xd
je 0x1ca83c9
mov dword [ebp - 8], eax
mov byte [esi], dl
jmp 0x1ca83ef
cmp eax, ecx
jae 0x1ca83fd
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add dword [ebp - 8], eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
xor edx, edx
inc edx
add esi, edx
cmp eax, ecx
jb 0x1ca83b1
jmp 0x1ca849c
push 0
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1ca847a
cmp dword [ebp - 0x10], 0
je 0x1ca847a
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx*4 + 0x1cf6e60]
test byte [eax + edi + 0x28], 0x48
je 0x1ca8454
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x1ca843f
mov byte [esi], dl
jmp 0x1ca8450
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x1cf6e60]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x1ca849c
cmp byte [ebp - 1], 0xa
jne 0x1ca8463
cmp esi, ebx
jne 0x1ca8463
mov byte [esi], 0xa
jmp 0x1ca849b
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.01cb320d
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x1ca849c
mov byte [esi], 0xd
jmp 0x1ca849b
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx*4 + 0x1cf6e60]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x1ca8499
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x1ca849c
mov byte [esi], dl
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x1ca84a5
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
push esi
sar ecx, 6
push edi
imul edi, eax, 0x38
mov dword [ebp - 8], ecx
mov eax, dword [ecx*4 + 0x1cf6e60]
push 0xa
pop edx
mov dword [ebp - 0x18], edx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x1ca84eb
cmp word [ebx], dx
jne 0x1ca84eb
or byte [eax + edi + 0x28], 4
jmp 0x1ca84f0
and byte [eax + edi + 0x28], 0xfb
lea edx, [ebx + ecx*2]
mov eax, ebx
mov dword [ebp - 0xc], edx
mov esi, ebx
mov dword [ebp - 4], eax
cmp ebx, edx
jae 0x1ca8653
mov dword [ebp - 0x10], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0xc]
cmp ecx, 0x1a
je 0x1ca8633
add eax, 2
cmp cx, word [ebp - 0x10]
je 0x1ca8531
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x1ca8567
cmp eax, edx
jae 0x1ca8575
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x18]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 0xc]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
push 2
pop ecx
add esi, ecx
cmp eax, edx
jb 0x1ca850c
jmp 0x1ca8653
push 0
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1ca862e
cmp dword [ebp - 0x18], 0
je 0x1ca862e
mov edx, dword [ebp - 8]
push 0xa
mov eax, dword [edx*4 + 0x1cf6e60]
test byte [eax + edi + 0x28], 0x48
je 0x1ca8604
lea eax, [esi + 2]
mov dword [ebp - 0x1c], eax
mov ax, word [ebp - 4]
pop ecx
mov word [ebp - 2], ax
cmp ax, cx
jne 0x1ca85c8
mov word [esi], cx
jmp 0x1ca85ff
push 0xd
pop ecx
mov word [esi], cx
movzx ecx, ax
mov eax, dword [edx*4 + 0x1cf6e60]
mov dx, word [ebp - 2]
shr ecx, 8
push 0xa
mov byte [eax + edi + 0x2a], dl
mov edx, dword [ebp - 8]
mov eax, dword [edx*4 + 0x1cf6e60]
mov byte [eax + edi + 0x2b], cl
mov eax, dword [edx*4 + 0x1cf6e60]
pop ecx
mov byte [eax + edi + 0x2c], cl
mov esi, dword [ebp - 0x1c]
jmp 0x1ca8653
pop eax
cmp word [ebp - 4], ax
jne 0x1ca8614
cmp esi, ebx
jne 0x1ca8614
mov word [esi], ax
jmp 0x1ca8650
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.01cb320d
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x1ca8653
push 0xd
pop eax
jmp 0x1ca860f
mov edx, dword [ebp - 8]
mov edx, dword [edx*4 + 0x1cf6e60]
mov al, byte [edx + edi + 0x28]
test al, 0x40
jne 0x1ca864d
or al, 2
mov byte [edx + edi + 0x28], al
jmp 0x1ca8653
mov word [esi], cx
add esi, 2
sub esi, ebx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x1caf970
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1caf99d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1caf99d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x1cb0a56
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1cdbf58
push 0x1cdbf50
push str.FlsAlloc
push 0x1f
call fcn.01cb0f09
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1cb0a8a
push dword [ebp + 8]
mov ecx, esi
call dword [0x1cef298]
call esi
jmp 0x1cb0a90
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1cb0ad4
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1cdbf68
push 0x1cdbf60
push str.FlsGetValue
push 0x21
call fcn.01cb0f09
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1cb0b0b
push dword [ebp + 8]
mov ecx, esi
call dword [0x1cef298]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1cb0b13
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1cdbf70
push 0x1cdbf68
push str.FlsSetValue
push 0x22
call fcn.01cb0f09
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1cb0b4d
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x1cef298]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]