joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2a88034f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x2a88035e
pop dword [ebp - 0x48]
mov eax, 0xe0e40d2e
add eax, 0x49a3f630
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0xc31b4626
sub dword [ebp - 0x58], 0x74c900db
mov dword [ebp - 0x54], 0x9759bd86
add dword [ebp - 0x54], 0x9ad98ebf
mov dword [ebp - 0x50], 0x1c7da70a
add dword [ebp - 0x50], 0x2fce9d24
mov dword [ebp - 0x4c], 0x34219f4a
sub dword [ebp - 0x4c], 0x34219f4a
lea eax, [ebp - 0x58]
push eax
mov eax, 0xaacd05ba
add eax, 0x7fcb6b96
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0x8c0d1c2d
add dword [ebp - 0x58], 0xe8654d29
mov dword [ebp - 0x54], 0x41329ed0
add dword [ebp - 0x54], 0x39c2a5
mov dword [ebp - 0x50], 0x3b1e2ee5
sub dword [ebp - 0x50], 0xd7aec279
mov dword [ebp - 0x4c], 0xdf0d6ac3
sub dword [ebp - 0x4c], 0xdf0d6ac3
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x4c20a
push 0
call eax
mov ecx, 0xada5afea
sub ecx, 0xada55ef9
xor edi, edi
add edi, eax
mov edx, 0x2aa25c00
add edx, dword [ebp - 0x48]
mov esi, 0x67dd7150
xor dword [ebp - 0x10], edx
mov ebx, dword [edx]
xor dword [ebp - 0x2c], 0x249b7277
xor ebx, esi
sub dword [ebp - 4], 0x1fcb5b6e
mov dword [edi], ebx
xor dword [ebp - 4], 0x91492fb2
add edi, 0x912ece40
add edi, 0x6ed131c4
add edx, 0x613cfb67
sub edx, 0x613cfb63
loop 0x2a880471
add eax, 0x53dcfa65
sub eax, 0x53dbc3ce
mov ebx, eax
add eax, 0x82075ce4
sub eax, 0x82075cdf
mov ecx, 0xf173dd4a
add ecx, 0x390c22b6
add ecx, dword [ebp - 0x48]
call ebx
leave
ret
Function at 0x2a8bbca0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xc
call fcn.2a8ca120
push ebp
mov ebp, dword [esp + 0x20]
push esi
mov esi, dword [esp + 0x18]
inc ebp
push edi
mov edi, dword [esp + 0x20]
mov eax, dword [esi + 4]
mov ecx, dword [edi + 8]
mov eax, dword [eax + 0x64]
test byte [eax + 0x30], 1
je 0x2a8bbd2a
mov edx, dword [esp + 0x24]
lea eax, [edx + ebp]
cmp eax, ecx
ja 0x2a8bbd2e
add dword [edi + 0x14], edx
sub ecx, edx
add dword [edi + 0x18], edx
sub dword [edi + 0xc], edx
mov dword [edi + 8], ecx
mov eax, dword [edi + 0x14]
push ebx
push dword [esi + 0x3c8]
mov al, byte [eax + ecx - 1]
movzx ebx, al
mov byte [esp + 0x30], al
mov dword [esp + 0x24], ebx
call fcn.2a893790
push eax
call fcn.2a8cccb0
mov esi, dword [edi + 8]
add esp, 8
mov dword [esp + 0x18], esi
and eax, 0x200000
je 0x2a8bbd37
sub esi, ebx
mov eax, 1
dec esi
pop ebx
mov dword [edi + 8], esi
pop edi
pop esi
pop ebp
add esp, 0xc
ret
cmp ebp, ecx
jbe 0x2a8bbce2
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0xc
ret
lea ecx, [ebx + ebp]
mov eax, esi
mov ebx, esi
xor eax, ecx
sub ebx, ecx
xor ebx, ecx
or ebx, eax
mov eax, 0x100
xor ebx, esi
shr ebx, 0x1f
dec ebx
cmp esi, eax
cmovb eax, esi
xor ebp, ebp
mov dword [esp + 0x14], eax
test eax, eax
je 0x2a8bbdb4
mov eax, dword [esp + 0x20]
dec esi
mov edi, dword [edi + 0x14]
shr eax, 0x1f
add edi, esi
mov esi, dword [esp + 0x20]
mov dword [esp + 0x10], eax
movzx eax, byte [esp + 0x10]
lea edi, [edi - 1]
mov edx, esi
mov ecx, ebp
sub edx, ebp
shr ecx, 0x1f
shr edx, 0x1f
xor al, cl
xor dl, cl
inc ebp
movzx ecx, byte [esp + 0x2c]
or dl, al
movzx eax, byte [edi + 1]
dec dl
movzx edx, dl
xor ecx, eax
and edx, ecx
not edx
and ebx, edx
cmp ebp, dword [esp + 0x14]
jb 0x2a8bbd75
mov esi, dword [esp + 0x18]
mov edi, dword [esp + 0x24]
mov eax, dword [esp + 0x20]
not ebx
movzx ecx, bl
inc eax
dec ecx
shr ecx, 0x1f
neg ecx
and eax, ecx
sub esi, eax
mov eax, ecx
pop ebx
mov dword [edi + 8], esi
and eax, 1
pop edi
not ecx
pop esi
or eax, ecx
pop ebp
add esp, 0xc
ret

Function at 0x2a8c94f1
Capabilities:
Create process on windows

Disassembly:
push 0x48
mov eax, 0x2a9867e9
call fcn.2a84a756
mov edi, ecx
push 0x44
pop esi
push esi
xor ebx, ebx
lea eax, [ebp - 0x54]
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
push 0x10
mov dword [ebp - 0x54], esi
call fcn.2a88034f
mov esi, eax
add esp, 0x10
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], ebx
test esi, esi
je 0x2a8c9536
push 0x10
push ebx
push esi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
jmp 0x2a8c9538
mov esi, ebx
or dword [ebp - 4], 0xffffffff
mov ecx, edi
mov dword [edi + 0x24], esi
call fcn.2a8c88a9
push dword [edi + 0x24]
lea ecx, [ebp - 0x54]
push ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push eax
push ebx
call dword [sym.imp.kernel32.dll_CreateProcessW]
call fcn.2a84a9ee
ret
Function at 0x2a8e8ad0
Capabilities:
Check if file exists

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
push esi
push dword [esp + 0x14]
call fcn.2a88034f
push 0x62
push esi
mov edi, eax
mov ebx, 1
call sub.VCRUNTIME140.dll_strchr
add esp, 0x10
mov ecx, 0x11
test eax, eax
cmove ebx, ecx
test edi, edi
jne 0x2a8e8b75
push 0x48
push str.crypto_bio_bss_file.c
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
push 1
push 2
call fcn.2a8cf650
push 0x2a9905c4
push esi
push 0x2a9b2914
push dword [esp + 0x30]
push str.fopen_
push 5
call fcn.2a8ced60
add esp, 0x2c
call sub.api_ms_win_crt_runtime_l1_1_0.dll__errno
cmp dword [eax], 2
je 0x2a8e8b52
call sub.api_ms_win_crt_runtime_l1_1_0.dll__errno
cmp dword [eax], 6
je 0x2a8e8b52
lea eax, [edi + 2]
lea ecx, [edi + 0x51]
jmp 0x2a8e8b5c
mov eax, 0x80
mov ecx, 0x4f
push ecx
push str.crypto_bio_bss_file.c
push eax
push 0x6d
push 0x20
call fcn.2a8cf650
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
ret
push 0x2a9b28bc
call fcn.2a8cd060
mov esi, eax
add esp, 4
test esi, esi
jne 0x2a8e8b97
push edi
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fclose
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
ret
push 0
push esi
call fcn.2a8cca00
push edi
push ebx
push 0x6a
push esi
call fcn.2a8cca30
add esp, 0x18
mov eax, esi
pop edi
pop esi
pop ebx
ret
Function at 0x2a8f0480
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov eax, 0x9c
call fcn.2a8ca120
mov eax, dword [0x2a9fd098]
xor eax, esp
mov dword [esp + 0x98], eax
mov eax, dword [esp + 0xb0]
push ebx
mov ebx, dword [esp + 0xac]
push ebp
mov ebp, dword [esp + 0xac]
push esi
mov esi, dword [esp + 0xac]
push edi
mov edi, dword [esp + 0xbc]
mov dword [esp + 0x14], eax
mov eax, dword [esi]
mov dword [esp + 0x10], 0
test edi, edi
je 0x2a8f04ed
cmp edi, eax
je 0x2a8f04e1
test ebp, ebp
je 0x2a8f0560
test ebx, ebx
js 0x2a8f0560
mov dword [esp + 0x10], 1
mov dword [esi], edi
jmp 0x2a8f04f3
test eax, eax
je 0x2a8f0560
mov edi, eax
push edi
call fcn.2a8988b0
add esp, 4
test al, 2
jne 0x2a8f0560
test ebp, ebp
je 0x2a8f066b
push edi
mov dword [esp + 0x14], 1
call fcn.2a8ccca0
add esp, 4
cmp eax, 0x90
jg 0x2a8f0560
cmp eax, ebx
jge 0x2a8f057b
push dword [esp + 0x14]
push edi
push dword [esi + 4]
call fcn.2a8d1680
add esp, 0xc
test eax, eax
je 0x2a8f0560
push ebx
push ebp
push dword [esi + 4]
call fcn.2a8d1820
add esp, 0xc
test eax, eax
je 0x2a8f0560
lea ebp, [esi + 0x10]
push ebp
lea eax, [esi + 0x14]
push eax
push dword [esi + 4]
call fcn.2a8d15e0
add esp, 0xc
test eax, eax
jne 0x2a8f0597
xor eax, eax
mov ecx, dword [esp + 0xa8]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.2a84b0a0
add esp, 0x9c
ret
cmp ebx, 0x90
ja 0x2a8f0560
push ebx
lea eax, [esi + 0x14]
push ebp
push eax
call sub.VCRUNTIME140.dll_memcpy
lea ebp, [esi + 0x10]
add esp, 0xc
mov dword [ebp], ebx
mov ecx, dword [ebp]
cmp ecx, 0x90
je 0x2a8f05ba
mov eax, 0x90
sub eax, ecx
push eax
lea eax, [esi + 0x14]
add eax, ecx
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov ebx, dword [esp + 0x10]
xor ecx, ecx
mov al, byte [esi + ecx + 0x14]
xor al, 0x36
mov byte [esp + ecx + 0x18], al
inc ecx
cmp ecx, 0x90
jl 0x2a8f05c0
mov ebp, dword [esp + 0x14]
push ebp
push edi
push dword [esi + 8]
call fcn.2a8d1680
add esp, 0xc
test eax, eax
je 0x2a8f0678
push edi
call fcn.2a8ccca0
push eax
lea eax, [esp + 0x20]
push eax
push dword [esi + 8]
call fcn.2a8d1820
add esp, 0x10
test eax, eax
je 0x2a8f0678
xor ecx, ecx
nop dword [eax]
mov al, byte [esi + ecx + 0x14]
xor al, 0x5c
mov byte [esp + ecx + 0x18], al
inc ecx
cmp ecx, 0x90
jl 0x2a8f0610
push ebp
push edi
push dword [esi + 0xc]
call fcn.2a8d1680
add esp, 0xc
test eax, eax
je 0x2a8f0678
push edi
call fcn.2a8ccca0
push eax
lea eax, [esp + 0x20]
push eax
push dword [esi + 0xc]
call fcn.2a8d1820
add esp, 0x10
test eax, eax
je 0x2a8f0678
push dword [esi + 8]
push dword [esi + 4]
call fcn.2a8d19b0
xor ebp, ebp
add esp, 8
test eax, eax
mov ecx, 1
cmovne ebp, ecx
jmp 0x2a8f067a
mov ebx, dword [esp + 0x10]
test ebx, ebx
je 0x2a8f064f
jmp 0x2a8f05be
xor ebp, ebp
test ebx, ebx
je 0x2a8f0690
lea eax, [esp + 0x18]
push 0x90
push eax
call fcn.2a801320
add esp, 8
mov eax, ebp
jmp 0x2a8f0562
Function at 0x2a911230
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x14
call fcn.2a8ca120
push ebx
mov ebx, dword [esp + 0x24]
push esi
mov esi, dword [esp + 0x20]
push edi
mov edx, dword [esi + 0x160]
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
mov dword [esp + 0xc], edx
mov dword [esi + 0x16c], 0
mov dword [esi + 0x168], 0
cmp ebx, 0xc
jne 0x2a9112a5
mov eax, dword [esp + 0x28]
lea edi, [ebx - 0xb]
movq xmm0, qword [eax]
movq qword [esi], xmm0
mov eax, dword [eax + 8]
mov dword [esi + 8], eax
mov dword [esi + 0xc], 0x1000000
jmp 0x2a9113b5
mov dword [esi + 0x40], 0
lea edi, [esi + 0x40]
mov dword [edi + 4], 0
lea eax, [esi + 0x60]
mov dword [esi + 0x48], 0
mov dword [esp + 0x1c], ebx
mov dword [esi + 0x4c], 0
mov dword [esp + 0x14], eax
push ebp
mov ebp, dword [esp + 0x2c]
cmp ebx, 0x10
jb 0x2a91134f
mov eax, ebx
lea ecx, [esi + 0x41]
shr eax, 4
mov esi, edi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x30], eax
nop dword [eax + eax]
mov eax, ecx
lea edx, [ebp + 1]
mov edi, 4
nop word [eax + eax]
movzx ecx, byte [edx - 1]
lea edx, [edx + 4]
xor byte [eax - 1], cl
lea eax, [eax + 4]
movzx ecx, byte [edx - 4]
xor byte [eax - 4], cl
movzx ecx, byte [edx - 3]
xor byte [eax - 3], cl
movzx ecx, byte [edx - 2]
xor byte [eax - 2], cl
sub edi, 1
jne 0x2a911300
push dword [esp + 0x18]
push esi
call dword [esp + 0x18]
mov ecx, dword [esp + 0x24]
add esp, 8
add ebp, 0x10
sub ebx, 0x10
sub dword [esp + 0x30], 1
jne 0x2a9112f0
mov esi, dword [esp + 0x28]
mov edx, dword [esp + 0x10]
lea edi, [esi + 0x40]
test ebx, ebx
je 0x2a911375
xor ecx, ecx
test ebx, ebx
je 0x2a91136b
nop dword [eax]
mov al, byte [ecx + ebp]
xor byte [edi + ecx], al
inc ecx
cmp ecx, ebx
jb 0x2a911360
lea eax, [esi + 0x60]
push eax
push edi
call edx
add esp, 8
mov eax, dword [esp + 0x20]
xor ecx, ecx
shld ecx, eax, 3
shl eax, 3
bswap eax
xor dword [esi + 0x4c], eax
lea eax, [esi + 0x60]
push eax
bswap ecx
xor dword [esi + 0x48], ecx
push edi
call dword [esp + 0x18]
mov edi, dword [esi + 0x4c]
add esp, 8
mov eax, dword [esi + 0x40]
mov dword [esi], eax
mov eax, dword [esi + 0x44]
mov dword [esi + 4], eax
mov eax, dword [esi + 0x48]
mov dword [esi + 8], eax
mov eax, dword [esi + 0x4c]
bswap edi
mov dword [esi + 0xc], eax
pop ebp
mov dword [esi + 0x40], 0
lea eax, [esi + 0x20]
mov dword [esi + 0x44], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
push dword [esi + 0x174]
push eax
mov eax, dword [esi + 0x170]
push esi
call eax
add esp, 0xc
inc edi
bswap edi
mov dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
add esp, 0x14
ret

Function at 0x2a917ae0
Capabilities:
Encode data using xor

Disassembly:
cmp dword [esp + 0x18], 0
je 0x2a917af4
mov dword [esp + 0x18], fcn.2a9162c0
jmp fcn.2a90f890
mov dword [esp + 0x18], fcn.2a915560
jmp fcn.2a90f5c0
Function at 0x2a93e450
Capabilities:
Encode data using xor

Disassembly:
mov eax, 4
call fcn.2a8ca120
mov edx, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0x10]
mov dword [esp + 4], 0x10
lea eax, [edx + 0xf]
lea ecx, [esi + 0xf]
cmp esi, eax
ja 0x2a93e494
cmp ecx, edx
jb 0x2a93e494
push edi
mov ecx, esi
sub edx, esi
mov edi, 0x10
mov al, byte [edx + ecx]
lea ecx, [ecx + 1]
xor byte [ecx - 1], al
sub edi, 1
jne 0x2a93e483
pop edi
jmp 0x2a93e4a1
movups xmm1, xmmword [esi]
movups xmm0, xmmword [edx]
pxor xmm1, xmm0
movups xmmword [esi], xmm1
push 0x10
push esi
lea eax, [esp + 0xc]
push eax
mov eax, dword [esp + 0x18]
push esi
push dword [eax + 4]
call fcn.2a8d2280
add esp, 0x14
pop esi
test eax, eax
je 0x2a93e4cb
cmp dword [esp], 0x10
jne 0x2a93e4cb
mov eax, 1
pop ecx
ret
xor eax, eax
pop ecx
ret

Function at 0x2a93e610
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x2a93e673
mov edx, dword [esp + 0x10]
test edx, edx
je 0x2a93e673
push ebx
push edi
mov edi, dword [esp + 0x10]
mov eax, dword [edi + 0xc]
cmp edx, eax
mov ebx, eax
cmovb ebx, edx
xor ecx, ecx
test ebx, ebx
je 0x2a93e646
mov al, byte [ecx + esi]
xor byte [edi + ecx + 0x10], al
inc ecx
cmp ecx, ebx
jb 0x2a93e637
mov eax, dword [edi + 0xc]
cmp edx, eax
jbe 0x2a93e671
sub edx, eax
mov eax, 0x10
cmp edx, eax
cmova edx, eax
xor ecx, ecx
test edx, edx
je 0x2a93e671
nop dword [eax]
mov eax, dword [edi + 0xc]
add eax, ecx
mov al, byte [eax + esi]
xor byte [edi + ecx + 0x30], al
inc ecx
cmp ecx, edx
jb 0x2a93e660
pop edi
pop ebx
pop esi
ret
Function at 0x8f21b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.008f2140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.008f2140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.008f2140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.008f2140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x8f2bfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x8f2c50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x90487c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x8f2c43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x8f2c52
xor eax, eax
pop esi
leave
ret 4
Function at 0x4063d0
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40640f
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40640f
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40640f
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x40640f
cmp dword [ecx + 0x74], 0xe
jbe 0x40640f
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x40bf63
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x40c000
push ebx
push esi
call fcn.0040bf2c
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0040bec0
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x40bfad
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40bfff
push edi
push eax
call fcn.0040cb80
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x40bfcd
call fcn.0040aa21
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40bffe
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0040bec0
add esp, 0x20
test eax, eax
jne 0x40bfec
push edi
call fcn.0040aa21
jmp 0x40bff4
push ebx
call fcn.0040aa21
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x40d2fd
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x497008
push 0x497000
push str.FlsAlloc
push 0x1f
call fcn.0040d1bc
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40d331
push dword [ebp + 8]
mov ecx, esi
call dword [0x416174]
call esi
jmp 0x40d337
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x40d37b
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x497018
push 0x497010
push str.FlsGetValue
push 0x21
call fcn.0040d1bc
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40d3b2
push dword [ebp + 8]
mov ecx, esi
call dword [0x416174]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x40d3ba
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x497020
push 0x497018
push str.FlsSetValue
push 0x22
call fcn.0040d1bc
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40d3f4
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x416174]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x412860
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41288d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41288d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x1005d090
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, ecx
mov ebx, edx
push edi
push esi
mov dword [ebp - 8], esi
call fcn.101f2b98
add esp, 4
test eax, eax
jne 0x1005d139
push 2
push eax
push esi
call fcn.101f38cf
push esi
call fcn.101ef264
push 0
push 0
push esi
mov edi, eax
call fcn.101f38cf
mov eax, dword [ebx + 4]
add esp, 0x1c
mov edx, dword [ebx]
mov ecx, eax
sub ecx, edx
mov dword [ebp - 4], eax
cmp edi, ecx
jae 0x1005d0e4
lea eax, [edx + edi]
jmp 0x1005d114
jbe 0x1005d117
mov eax, dword [ebx + 8]
sub eax, edx
cmp edi, eax
jbe 0x1005d0fa
push ecx
push edi
mov ecx, ebx
call fcn.100788c0
jmp 0x1005d117
mov esi, edi
sub esi, ecx
push esi
push 0
push dword [ebp - 4]
call fcn.101eb6c0
mov eax, dword [ebp - 4]
add esp, 0xc
add eax, esi
mov esi, dword [ebp - 8]
mov dword [ebx + 4], eax
push esi
push edi
push 1
push dword [ebx]
call fcn.101fd97a
add esp, 0x10
cmp eax, edi
jne 0x1005d139
push esi
call fcn.101f3384
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.error_reading_from_file
lea ecx, [ebp - 0x14]
call fcn.1004c170
push 0x102ddf54
lea eax, [ebp - 0x14]
push eax
call fcn.101ebd9d
int3
Function at 0x10063740
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x102e2740]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xorps xmm0, xmm0
mov dword [ebp - 8], 0
mov edx, ecx
movq qword [ebp - 0x10], xmm0
push esi
lea ecx, [ebp - 0x10]
xor bl, bl
call fcn.10063620
mov eax, dword [ebp - 0xc]
mov esi, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
cmp esi, eax
je 0x100637a0
push edi
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [esi]
call edi
test eax, eax
movzx ebx, bl
mov eax, 1
cmovne ebx, eax
add esi, 4
cmp esi, dword [ebp - 0x14]
jne 0x10063781
mov esi, dword [ebp - 0x10]
pop edi
test esi, esi
je 0x100637d0
mov ecx, dword [ebp - 8]
mov eax, esi
sub ecx, esi
and ecx, 0xfffffffc
cmp ecx, 0x1000
jb 0x100637c6
mov esi, dword [eax - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100637e2
push ecx
push esi
call fcn.101e9982
add esp, 8
mov ecx, dword [ebp - 4]
mov al, bl
pop esi
xor ecx, ebp
pop ebx
call fcn.101e9427
mov esp, ebp
pop ebp
ret
call fcn.101fdc69
int3
Function at 0x100644c0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub dword [ebp + 0xc], 1
jne 0x100644de
push 0
push 0
push 0
push 0x100644b0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
pop ebp
ret 0xc

Function at 0x100656e0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [esp + 0xc], edi
test eax, eax
jg 0x10065712
jl 0x10065705
test ecx, ecx
jne 0x10065712
xor eax, eax
xor edx, edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x100657d2
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], eax
mov ecx, ebx
call fcn.10069fd0
mov esi, eax
mov eax, edx
mov dword [esp + 0x14], eax
test eax, eax
jl 0x1006577e
jg 0x1006573d
test esi, esi
je 0x1006577e
mov ecx, dword [esp + 0xc]
cmp ecx, eax
jg 0x10065755
mov eax, dword [esp + 0x10]
jl 0x1006574f
cmp eax, esi
jae 0x10065755
mov esi, eax
mov dword [esp + 0x14], ecx
mov eax, dword [ebx + 0x1c]
push esi
push dword [eax]
push edi
call fcn.101eb140
mov eax, dword [ebx + 0x2c]
add esp, 0xc
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
sub ecx, esi
sbb edx, dword [esp + 0x14]
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
jmp 0x1006579f
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x1c]
mov edx, dword [esp + 0xc]
cmp eax, 0xffffffff
je 0x100657bb
mov ecx, dword [esp + 0x10]
mov esi, 1
add ecx, 0xffffffff
mov byte [edi], al
adc edx, 0xffffffff
add edi, esi
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], ecx
test edx, edx
jg 0x10065724
jl 0x100657bb
test ecx, ecx
jne 0x10065724
mov eax, dword [ebp + 0xc]
sub eax, dword [esp + 0x10]
mov esi, dword [ebp + 0x10]
sbb esi, edx
mov edx, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
lea esi, [ebx + 0x2c]
mov edi, ecx
mov edx, dword [eax]
test edx, edx
je 0x10065810
mov eax, dword [esi]
mov eax, dword [eax]
test eax, eax
je 0x10065810
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push edx
push dword [esp + 0x14]
call fcn.101eb140
mov eax, dword [ebx + 0x2c]
sub edi, esi
add dword [esp + 0x18], esi
add esp, 0xc
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
lea esi, [ebx + 0x2c]
cmp dword [ebx + 0x4c], 0
je 0x10065879
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x10065836
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi]
mov dword [eax], edx
mov esi, dword [esp + 0xc]
cmp edi, 0xfff
jbe 0x10065864
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call fcn.101fd97a
add esp, 0x10
add esi, eax
sub edi, eax
cmp eax, 0xfff
jne 0x10065879
cmp edi, eax
ja 0x10065842
test edi, edi
je 0x10065879
push dword [ebx + 0x4c]
push edi
push 1
push esi
call fcn.101fd97a
add esp, 0x10
sub edi, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc