joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5467b0
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x5467e3
push esi
call fcn.005498c0
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x5467dc
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x546869
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x546852
mov eax, dword [esi + 8]
test eax, eax
je 0x546807
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x54684e
cmp eax, 2
je 0x546852
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x5467fa
cmp eax, 3
je 0x54682d
cmp eax, 1
jne 0x5467fa
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x5467fa
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x5467fa
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.00546890
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x546878
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.00546890
add esp, 4
pop esi
ret

Function at 0x552f40
Capabilities:
Encrypt data using des

Disassembly:
sub esp, 0xf4
xor ecx, ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x104]
push edi
xor eax, eax
mov al, byte [ecx + str.80_]
mov edx, eax
and eax, 7
sar edx, 3
mov bl, byte [eax*2 + 0x727888]
mov dl, byte [edx + esi]
test bl, dl
setne al
mov byte [esp + ecx + 0x4c], al
inc ecx
cmp ecx, 0x38
jl 0x552f53
mov eax, 0x1e
xor edx, edx
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10c], 1
je 0x552f94
lea eax, [edx + edx]
lea edi, [esp + eax*4 + 0x88]
lea ebp, [esp + eax*4 + 0x84]
xor eax, eax
xor ecx, ecx
mov cl, byte [edx + 0x727930]
mov dword [edi], 0
mov dword [ebp], 0
mov esi, ecx
cmp ecx, 0x1c
jge 0x552fc6
mov bl, byte [esp + ecx + 0x4c]
jmp 0x552fca
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x1c
jl 0x552fbb
mov eax, 0x1c
lea ecx, [esi + 0x1c]
cmp ecx, 0x38
jge 0x552fe8
mov bl, byte [esp + ecx + 0x4c]
jmp 0x552fec
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x38
jl 0x552fdd
xor ecx, ecx
mov eax, 0x727898
xor ebx, ebx
mov bl, byte [ecx + 0x727940]
cmp byte [esp + ebx + 0x14], 0
je 0x553017
mov esi, dword [eax]
mov ebx, dword [ebp]
or ebx, esi
mov dword [ebp], ebx
xor ebx, ebx
mov bl, byte [ecx + 0x727958]
cmp byte [esp + ebx + 0x14], 0
je 0x55302e
mov esi, dword [eax]
mov ebx, dword [edi]
or ebx, esi
mov dword [edi], ebx
add eax, 4
inc ecx
cmp eax, str.80_
jl 0x552ffe
mov eax, dword [esp + 0x10]
inc edx
sub eax, 2
cmp eax, 0xfffffffe
mov dword [esp + 0x10], eax
jg 0x552f87
lea edx, [esp + 0x84]
push edx
call fcn.00553070
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xf4
ret
Function at 0x5685a7
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x5685df
push dword [esi + 0x1c]
call dword [sym.imp.user32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0056664e
push eax
push dword [esi + 0x1c]
call dword [sym.imp.user32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00566626
jmp 0x5685eb
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x569c98
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x569cda
call fcn.0056f634
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.kernel32.dll_FindResourceA]
cmp eax, edi
je 0x569cda
push eax
push esi
call dword [sym.imp.kernel32.dll_LoadResource]
cmp eax, edi
jne 0x569cd1
xor eax, eax
jmp 0x569ce2
push eax
call dword [sym.imp.kernel32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00569ce8
pop edi
pop esi
pop ebx
ret 4
Function at 0x58b8a2
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x58b8da
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA_1]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0058992f
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA_1]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00589907
jmp 0x58b8e6
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x58cf90
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x58cfd2
call fcn.00592a8a
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA_1]
cmp eax, edi
je 0x58cfd2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource_1]
cmp eax, edi
jne 0x58cfc9
xor eax, eax
jmp 0x58cfda
push eax
call dword [sym.imp.KERNEL32.dll_LockResource_1]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0058cfe0
pop edi
pop esi
pop ebx
ret 4

Function at 0x592fba
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection_1]
cmp dword [esp + 0x10], 0
jne 0x592fe8
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue_1]
test eax, eax
je 0x593006
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00592f20
jmp 0x593006
mov eax, dword [esi + 0x14]
test eax, eax
je 0x593006
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00592f20
test edi, edi
mov eax, edi
jne 0x592ff0
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection_1]
pop esi
pop ebx
ret 8
Function at 0x412402
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
cmp dword [0x4186e0], 0
push ebx
push esi
mov esi, 0x4186e8
jne 0x41242e
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
push esi
mov dword [0x418700], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x4186e0], 1
push dword [0x418700]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test ebx, ebx
jne 0x4124cb
push 0x14
push 8
push dword [0x418068]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x4124f5
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x4186e4]
test eax, eax
je 0x412470
mov dword [eax], ebx
push edi
push esi
mov dword [ebx + 4], eax
mov dword [0x4186e4], ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea edi, [ebx + 0x10]
push 0
push 0
push 0x100000
push edi
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push 8
push 0xffffffffffffffff
push ebx
push 0x4124fa
push dword [edi]
lea eax, [ebx + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
push ebx
push dword [0x418700]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop edi
push 0xc
push 0
push dword [0x418068]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x4124f5
mov ecx, dword [esp + 0xc]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x10]
mov dword [eax + 8], ecx
mov ecx, dword [ebx + 8]
mov dword [eax], ecx
mov dword [ebx + 8], eax
pop esi
pop ebx
ret 8

Function at 0x103b1d70
Capabilities:
Encode data using xor

Disassembly:
jmp 0x103b1d7a
pushal
call 0x103b1d80
pop ebp
sub ebp, 0x10
sub ebp, 0x3b1d70
mov al, byte [esp + 0x28]
cmp al, 1
je 0x103b1da4
popal
xor eax, eax
inc eax
ret 0xc
jmp 0x103b1dad
mov eax, 0x3b1d70
add eax, ebp
add eax, 0x63
mov ecx, 0x605
mov edx, 0xd1ecc661
xor byte [eax], dl
inc eax
dec ecx
jne 0x103b1dc4
jmp 0x103b1dd7
ljmp 0x6161:0x5de8eaac
Function at 0x9b6058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.009b61a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x9b607e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x9b606a
add dl, dl
jne 0x9b6089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x9b60dc
xor eax, eax
add dl, dl
jne 0x9b6096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x9b617d
add dl, dl
jne 0x9b60a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9b60b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9b60bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9b60c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x9b60d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x9b6075
mov eax, 1
add dl, dl
jne 0x9b60ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9b60f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x9b60e1
sub eax, ebx
mov ebx, 1
jne 0x9b6128
mov ecx, 1
add dl, dl
jne 0x9b610e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x9b6119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x9b6105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x9b6075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x9b613f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x9b614a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x9b6136
cmp eax, 0x7d00
jae 0x9b616d
cmp eax, 0x500
jb 0x9b6168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x9b6075
cmp eax, 0x7f
ja 0x9b6170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x9b6075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x9b619e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x9b6075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
nop
mov ecx, 0x5de451cb
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x43304e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x433024
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x50b96c3d
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43306c
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x402ca5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x402cb4
pop dword [ebp - 0x30]
mov eax, 0x5182d046
add eax, 0xaebd5c6e
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0x9da7bd0
add dword [ebp - 0x40], 0x4477c97b
mov dword [ebp - 0x3c], 0x95f7c247
add dword [ebp - 0x3c], 0x9c3b89fe
mov dword [ebp - 0x38], 0x8e9213da
add dword [ebp - 0x38], 0xbdba3054
mov dword [ebp - 0x34], 0xf0c70744
sub dword [ebp - 0x34], 0xf0c70744
lea eax, [ebp - 0x40]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0x549c524b
add dword [ebp - 0x40], 0x1fd6170b
mov dword [ebp - 0x3c], 0x7374a351
add dword [ebp - 0x3c], 0xcdf7be24
mov dword [ebp - 0x38], 0xa83a2268
sub dword [ebp - 0x38], 0x44cab5fc
mov dword [ebp - 0x34], 0x82e35b22
sub dword [ebp - 0x34], 0x82e35b22
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, 0xa4dc2fa1
sub eax, 0xa49bbe91
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x3866b
push 0
call eax
mov ecx, 0xb7f07c42
sub ecx, 0xb7f02e8b
xor edx, edx
add edx, eax
mov edi, 0x8bfb37da
sub edi, 0x8bb7d7da
add edi, dword [ebp - 0x30]
mov esi, 0x190aa331
add esi, 0xd9d92ac7
add dword [ebp - 8], 0x500ffde1
mov ebx, dword [edi]
xor ebx, esi
add dword [ebp - 0x18], eax
mov dword [edx], ebx
add dword [ebp - 0x14], eax
add edx, 0x80638c77
sub edx, 0x80638c73
add edi, 4
loop 0x402dd3
add eax, 0x129af
mov ebx, eax
add eax, 5
mov ecx, 0x21a2c514
sub ecx, 0x2162c514
add ecx, dword [ebp - 0x30]
call ebx
leave
ret
Function at 0x102c275
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
call fcn.0102a3d1
test al, al
je 0x102c2a4
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x102c398
cmp dword [ebp + 0xc], 0
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
jne 0x102c2b6
and dword [ebp - 4], 0
jmp 0x102c2e4
push dword [ebp + 0xc]
call esi
lea edi, [eax + eax + 2]
lea eax, [edi + 2]
add eax, 3
and eax, 0xfffffffc
call fcn.01016610
mov ebx, esp
push 0xffffffffffffffff
push edi
push dword [ebp + 0xc]
push ebx
call fcn.01028afc
neg eax
sbb eax, eax
and eax, ebx
mov dword [ebp - 4], eax
xor ebx, ebx
cmp dword [ebp + 0x10], ebx
je 0x102c318
push dword [ebp + 0x10]
call esi
lea ebx, [eax + eax + 2]
lea eax, [ebx + 2]
add eax, 3
and eax, 0xfffffffc
call fcn.01016610
mov edi, esp
push 0xffffffffffffffff
push ebx
push dword [ebp + 0x10]
push edi
call fcn.01028afc
mov ebx, eax
neg ebx
sbb ebx, ebx
and ebx, edi
xor edi, edi
cmp dword [ebp + 0x14], edi
je 0x102c350
push dword [ebp + 0x14]
call esi
lea edi, [eax + eax + 2]
lea eax, [edi + 2]
add eax, 3
and eax, 0xfffffffc
call fcn.01016610
mov dword [ebp + 0xc], esp
push 0xffffffffffffffff
push edi
push dword [ebp + 0x14]
push dword [ebp + 0xc]
call fcn.01028afc
mov edi, eax
neg edi
sbb edi, edi
and edi, dword [ebp + 0xc]
xor eax, eax
cmp dword [ebp + 0x18], eax
je 0x102c386
push dword [ebp + 0x18]
call esi
lea esi, [eax + eax + 2]
lea eax, [esi + 2]
add eax, 3
and eax, 0xfffffffc
call fcn.01016610
mov dword [ebp + 0xc], esp
push 0xffffffffffffffff
push esi
push dword [ebp + 0x18]
push dword [ebp + 0xc]
call fcn.01028afc
neg eax
sbb eax, eax
and eax, dword [ebp + 0xc]
push dword [ebp + 0x1c]
push eax
push edi
push ebx
push dword [ebp - 4]
push dword [ebp + 8]
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea esp, [ebp - 0x10]
pop edi
pop esi
pop ebx
leave
ret 0x18
Function at 0x10014630
Capabilities:
Enumerate process modules
Get common file path

Disassembly:
push esi
mov esi, ecx
call fcn.10018b90
call fcn.1000d420
call fcn.100190f0
call fcn.100092f0
call fcn.10021de0
mov ecx, eax
call fcn.10037430
call fcn.10021de0
mov ecx, eax
call fcn.10021de0
mov esi, dword [esi]
test esi, esi
je 0x10014675
mov ecx, esi
call fcn.10021de0
push esi
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
add esp, 4
call fcn.10013770
call fcn.1002d0f0
pop esi
jmp fcn.1001f4d0

Function at 0x10016a60
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003ef28
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x1006b894]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x40], eax
cmp dword [esi + 0x30], ebx
jne 0x10016ad9
movzx ecx, word [esi + 0x28]
mov eax, dword [esi + 4]
push ecx
lea edx, [esi + 0xc]
push edx
push eax
call fcn.1000d760
mov ecx, eax
call fcn.10021de0
mov dword [esi + 0x30], eax
cmp eax, ebx
jne 0x10016ad9
push str.Hyphenation_service_not_supported
push 0xffffff36
lea ecx, [ebp - 0x3c]
call fcn.10021de0
push 0x1005d268
lea ecx, [ebp - 0x3c]
push ecx
call sub.MSVCR100.dll__CxxThrowException
call fcn.10021de0
mov ecx, eax
call fcn.10037410
test al, al
je 0x10016b61
cmp byte [esi + 0x3d], bl
jne 0x10016b61
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x4c], esp
push 6
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], ebx
push 0x10046540
mov byte [ecx], bl
call fcn.10021de0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x44], esp
push 0xffffffffffffffff
push ebx
lea edx, [esi + 0xc]
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], ebx
push edx
mov dword [ebp - 4], ebx
mov byte [ecx], bl
call fcn.10021de0
mov ecx, dword [esi + 4]
mov eax, dword [ecx]
mov eax, dword [eax + 4]
push ecx
mov edx, esp
mov dword [ebp - 0x48], esp
mov bl, 1
push edx
mov byte [ebp - 4], bl
call eax
mov byte [ebp - 4], 2
call fcn.10021de0
mov ecx, eax
mov dword [ebp - 4], 0xffffffff
call fcn.10021de0
mov byte [esi + 0x3d], bl
mov ecx, dword [esi + 0x30]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x40]
mov edx, dword [edx + 0xc]
push eax
call edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1003c1ea
mov esp, ebp
pop ebp
ret 4
Function at 0x10021de0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x10021def
pop dword [ebp - 0x18]
mov eax, 0x1f20d101
sub eax, 0xf1eb312
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0xf7e1bd94
sub dword [ebp - 0x28], 0xa98f7849
mov dword [ebp - 0x24], 0xfa05c7eb
sub dword [ebp - 0x24], 0xc7d27ba6
mov dword [ebp - 0x20], 0x8e7b0629
sub dword [ebp - 0x20], 0x422ec1fb
mov dword [ebp - 0x1c], 0x64c87ab8
add dword [ebp - 0x1c], 0x9b378548
lea eax, [ebp - 0x28]
push eax
mov eax, 0x14f547c7
add eax, 0xfb0f0905
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0x2f2ea5d0
add dword [ebp - 0x28], 0x4543c386
mov dword [ebp - 0x24], 0x1ff64c62
sub dword [ebp - 0x24], 0xde89eaed
mov dword [ebp - 0x20], 0x77e4ae86
sub dword [ebp - 0x20], 0x1475421a
mov dword [ebp - 0x1c], 0x8e7fd8ff
sub dword [ebp - 0x1c], 0x8e7fd8ff
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, 0x7314efb8
add eax, 0x9cef6088
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x44b26
push 0
call eax
mov ecx, 0x885661af
add ecx, 0x77a9ea36
xor edx, edx
add edx, eax
mov ebx, 0xc86217ee
add ebx, 0x47a58412
add ebx, dword [ebp - 0x18]
mov esi, 0x8b2ad37d
add dword [ebp - 0x14], ebx
mov edi, dword [ebx]
add dword [ebp - 0x14], 0xb5ea4b56
xor edi, esi
add dword [ebp - 0x10], edi
mov dword [edx], edi
sub dword [ebp - 0xc], 0xe764ef8c
add edx, 0x74a824e6
sub edx, 0x74a824e2
add ebx, 0x838a74a3
sub ebx, 0x838a749f
loop 0x10021f0d
add eax, 0x6fc2fc2
add eax, 0xf904f2a5
mov ebx, eax
add eax, 0x8a6b907f
add eax, 0x75946f86
mov ecx, 0x151843f1
add ecx, 0xfae7bc0f
add ecx, dword [ebp - 0x18]
call ebx
leave
ret
Function at 0x10022c80
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1004081c
mov eax, dword fs:[0]
push eax
sub esp, 0x478
mov eax, dword [0x1006b894]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, dword [sym.imp.kernel32.dll_ReadFile]
xor ebx, ebx
mov esi, ecx
mov dword [ebp - 0x484], ebx
cmp byte [esi + 0x28], bl
je 0x10022de1
mov edx, dword [esi + 4]
push ebx
lea eax, [ebp - 0x480]
push eax
push 0x400
lea ecx, [ebp - 0x414]
push ecx
push edx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x480], ebx
call edi
cmp eax, ebx
jne 0x10022d19
call dword [sym.imp.kernel32.dll_GetLastError]
push str.MailSlotRead
push eax
lea ecx, [ebp - 0x47c]
call fcn.10021de0
push 0x1005d268
lea eax, [ebp - 0x47c]
push eax
call sub.MSVCR100.dll__CxxThrowException
cmp dword [ebp - 0x480], ebx
jne 0x10022d2a
mov dword [ebp - 4], 0xffffffff
jmp 0x10022cc1
mov dword [ebp - 0x420], 0xf
mov dword [ebp - 0x424], ebx
mov byte [ebp - 0x434], bl
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 1
call fcn.10021de0
lea ecx, [ebp - 0x450]
mov byte [ebp - 4], 2
call fcn.10036db0
mov edx, dword [esi]
mov edx, dword [edx + 8]
lea eax, [ebp - 0x450]
push eax
lea ecx, [ebp - 0x434]
push ecx
lea eax, [ebp - 0x414]
push eax
mov ecx, esi
mov byte [ebp - 4], 3
call edx
cmp al, bl
je 0x10022d99
lea eax, [ebp - 0x450]
push eax
lea ecx, [ebp - 0x434]
push ecx
mov ecx, esi
call fcn.10021de0
lea ecx, [ebp - 0x450]
mov byte [ebp - 4], 2
call fcn.10035170
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 4
call sym.AdobeLinguistic.dll_public:_void___thiscall_devtech::RCPtr_struct_devtech::LM_UniString::StringValue_::destructor_void_
cmp dword [ebp - 0x420], 0x10
jb 0x10022dcf
mov edx, dword [ebp - 0x434]
push edx
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [ebp - 4], 0xffffffff
jmp 0x10022cc1
mov eax, dword [ebp - 0x484]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1003c1ea
mov esp, ebp
pop ebp
ret

Function at 0x1003ba10
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x1006bd68]
test eax, eax
je 0x1003ba3b
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x1003ba3b
mov eax, dword [eax + 0x14]
test eax, eax
je 0x1003ba3b
mov ecx, dword [esp + 4]
nop
cmp dword [eax], ecx
je 0x1003ba3e
mov eax, dword [eax + 0x10]
test eax, eax
jne 0x1003ba30
xor eax, eax
ret
mov eax, dword [eax + 0xc]
ret

Function at 0x1003bc40
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov eax, dword [0x1006bd68]
push edi
mov edi, dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x1003bc57
push eax
call edi
test eax, eax
jne 0x1003bc8d
push esi
call fcn.10021de0
push 0x1003b950
push 0x1006bd64
mov esi, eax
call fcn.10021de0
mov eax, dword [0x1006bd68]
add esp, 8
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov eax, dword [0x1006bd68]
pop esi
test eax, eax
jne 0x1003bc8a
pop edi
ret
push eax
call edi
pop edi
ret
Function at 0x1003bd80
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push 0xffffffffffffffff
push 0x10043248
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x1006b894]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov eax, dword [0x1006bd68]
test eax, eax
jne 0x1003bdb2
xor esi, esi
jmp 0x1003bdbb
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov esi, eax
mov dword [esp + 0x14], esi
mov ebp, dword [sym.imp.kernel32.dll_HeapFree]
mov dword [esp + 0x20], 0
test esi, esi
je 0x1003bdfd
cmp dword [esi + 0x14], 0
jne 0x1003be3f
cmp dword [esi + 0x10], 0
jne 0x1003be45
push 0x1003b950
push 0x1006bd64
call fcn.10021de0
mov eax, dword [0x1006bd68]
add esp, 8
push 0
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov dword [esp + 0x20], 0xffffffff
test esi, esi
je 0x1003be2b
lea ecx, [esi + 4]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x1003be2b
mov eax, dword [esi]
mov edx, dword [eax]
push 0
mov ecx, esi
call edx
push esi
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call ebp
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
cmp dword [esi + 0x10], 0
je 0x1003be85
mov ebx, dword [esi + 0x10]
mov eax, dword [ebx + 4]
mov dword [esi + 0x10], eax
mov ecx, dword [ebx]
test ecx, ecx
je 0x1003be73
mov edx, dword [ecx]
mov eax, dword [edx + 4]
call eax
mov edi, dword [ebx]
mov edx, dword [edi]
mov eax, dword [edx]
push 0
mov ecx, edi
call eax
push edi
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call ebp
push ebx
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call ebp
cmp dword [esi + 0x10], 0
jne 0x1003be45
cmp dword [esi + 0x14], 0
je 0x1003bdd7
mov edi, dword [esi + 0x14]
mov ecx, dword [edi + 0x10]
mov dword [esi + 0x14], ecx
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x1003beaa
mov edx, dword [ecx]
mov eax, dword [edi + 0xc]
mov edx, dword [edx + 4]
push eax
call edx
mov ebx, dword [edi + 8]
test ebx, ebx
je 0x1003bedb
lea eax, [ebx + 4]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x1003bedb
mov edx, dword [ebx]
mov eax, dword [edx + 4]
mov ecx, ebx
call eax
lea ecx, [ebx + 8]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x1003bedb
mov eax, dword [ebx]
mov edx, dword [eax + 8]
mov ecx, ebx
call edx
push edi
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call ebp
cmp dword [esi + 0x14], 0
jne 0x1003be8f
jmp 0x1003bdd1
jmp 0x1003bd80