joyce8/EMBER2024-capa huggingface dataset:
Function at 0x488c51
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
xor edi, edi
cmp dword [ebp + 0x10], edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], ebx
je 0x488c8e
cmp dword [ebp + 0x14], edi
je 0x488c8e
cmp ecx, edi
jne 0x488c95
call fcn.004908d0
push edi
push edi
push edi
push edi
mov dword [eax], 0x16
push edi
call fcn.00489350
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov esi, dword [ebp + 0x18]
cmp esi, edi
je 0x488ca9
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
jbe 0x488cca
cmp ebx, 0xffffffff
je 0x488cb9
push ebx
push edi
push ecx
call fcn.0048ae50
add esp, 0xc
cmp esi, edi
je 0x488c76
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
ja 0x488c76
mov edi, dword [ebp + 0x10]
imul edi, dword [ebp + 0x14]
test word [esi + 0xc], 0x10c
mov dword [ebp - 0x10], edi
mov ebx, edi
je 0x488ce6
mov eax, dword [esi + 0x18]
mov dword [ebp - 0xc], eax
jmp 0x488ced
mov dword [ebp - 0xc], 0x1000
test edi, edi
je 0x488dde
test word [esi + 0xc], 0x10c
je 0x488d41
mov eax, dword [esi + 4]
test eax, eax
je 0x488d41
jl 0x488e3f
cmp ebx, eax
mov edi, ebx
jb 0x488d12
mov edi, eax
cmp edi, dword [ebp - 4]
ja 0x488de6
push edi
push dword [esi]
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.0048aeca
sub dword [esi + 4], edi
add dword [esi], edi
add dword [ebp - 8], edi
sub ebx, edi
add esp, 0x10
sub dword [ebp - 4], edi
mov edi, dword [ebp - 0x10]
jmp 0x488dd6
cmp ebx, dword [ebp - 0xc]
jb 0x488dae
cmp dword [ebp - 0xc], 0
je 0x488d6b
mov ecx, SysReAllocString
xor edx, edx
cmp ebx, ecx
jbe 0x488d60
mov eax, ecx
div dword [ebp - 0xc]
mov eax, ecx
jmp 0x488d67
mov eax, ebx
div dword [ebp - 0xc]
mov eax, ebx
sub eax, edx
jmp 0x488d76
mov eax, SysReAllocString
cmp ebx, eax
ja 0x488d76
mov eax, ebx
cmp eax, dword [ebp - 4]
ja 0x488e12
push eax
push dword [ebp - 8]
push esi
call fcn.0048d010
pop ecx
push eax
call fcn.00495f96
add esp, 0xc
test eax, eax
je 0x488e51
cmp eax, 0xffffffff
je 0x488e3f
add dword [ebp - 8], eax
sub ebx, eax
sub dword [ebp - 4], eax
jmp 0x488dd6
push esi
call fcn.004958b5
cmp eax, 0xffffffff
pop ecx
je 0x488e43
cmp dword [ebp - 4], 0
je 0x488e12
mov ecx, dword [ebp - 8]
inc dword [ebp - 8]
mov byte [ecx], al
mov eax, dword [esi + 0x18]
dec ebx
dec dword [ebp - 4]
mov dword [ebp - 0xc], eax
test ebx, ebx
jne 0x488cf5
mov eax, dword [ebp + 0x14]
jmp 0x488c90
xor esi, esi
cmp dword [ebp + 0xc], 0xffffffff
je 0x488dfd
push dword [ebp + 0xc]
push esi
push dword [ebp + 8]
call fcn.0048ae50
add esp, 0xc
call fcn.004908d0
push esi
push esi
push esi
push esi
mov dword [eax], 0x22
push esi
jmp 0x488c86
cmp dword [ebp + 0xc], 0xffffffff
je 0x488e28
push dword [ebp + 0xc]
push 0
push dword [ebp + 8]
call fcn.0048ae50
add esp, 0xc
call fcn.004908d0
mov dword [eax], 0x22
xor eax, eax
push eax
push eax
push eax
push eax
push eax
jmp 0x488c86
or dword [esi + 0xc], 0x20
mov eax, edi
sub eax, ebx
xor edx, edx
div dword [ebp + 0x10]
jmp 0x488c90
or dword [esi + 0xc], 0x10
jmp 0x488e43
Function at 0x48e113
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 8], esi
jne 0x48e140
call fcn.004908e3
mov dword [eax], esi
call fcn.004908d0
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.00489350
add esp, 0x14
push 0x16
pop eax
pop esi
ret
test dword [esp + 0xc], 0xfffffff9
jne 0x48e11c
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x48e16f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004908f6
pop ecx
call fcn.004908d0
mov eax, dword [eax]
pop esi
ret
test al, 0x10
jne 0x48e196
test al, 1
je 0x48e196
test byte [esp + 0xc], 2
je 0x48e196
call fcn.004908e3
mov dword [eax], 5
call fcn.004908d0
mov dword [eax], 0xd
jmp 0x48e166
xor eax, eax
pop esi
ret

Function at 0x48f8b5
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4d215c]
jne 0x48f8bf
repz ret
jmp fcn.0049ea2d

Function at 0x499407
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x4d2ee8]
je 0x499422
inc edi
cmp edi, 0x17
jb 0x499413
cmp edi, 0x17
jae 0x4995a2
push ebp
push 3
call fcn.004a2c0f
cmp eax, 1
pop ecx
je 0x49956e
push 3
call fcn.004a2c0f
test eax, eax
pop ecx
jne 0x499456
cmp dword [0x4d2158], 1
je 0x49956e
cmp ebx, 0xfc
je 0x4995a1
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x4d72f0
push ebp
call fcn.0048e2e1
add esp, 0xc
test eax, eax
je 0x49948c
push esi
push esi
push esi
push esi
push esi
call fcn.00489254
add esp, 0x14
push 0x104
mov esi, 0x4d7309
push esi
push 0
mov byte [0x4d740d], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4994d0
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.0048e2e1
add esp, 0xc
test eax, eax
je 0x4994d0
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.00489254
add esp, 0x14
push esi
call fcn.00488410
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x499515
push esi
call fcn.00488410
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x4d7604
push 0x4b09a4
sub ecx, eax
push ecx
push eax
call fcn.0049ff3d
add esp, 0x14
test eax, eax
je 0x499515
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.00489254
add esp, 0x14
jmp 0x499517
xor esi, esi
push 0x4b09a0
push ebx
push ebp
call fcn.004a02a2
add esp, 0xc
test eax, eax
je 0x499537
push esi
push esi
push esi
push esi
push esi
call fcn.00489254
add esp, 0x14
push dword [edi*8 + 0x4d2eec]
push ebx
push ebp
call fcn.004a02a2
add esp, 0xc
test eax, eax
je 0x499559
push esi
push esi
push esi
push esi
push esi
call fcn.00489254
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.004a2a52
add esp, 0xc
jmp 0x4995a1
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x4995a1
cmp ebp, 0xffffffff
je 0x4995a1
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x4d2eec]
push dword [esi]
call fcn.00488410
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x4a2a52
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.004933dd
xor ebx, ebx
cmp dword [0x4d7c48], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x4a2b28
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x4a2c08
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x4a2c08
push eax
call fcn.0049336f
mov dword [esp], 0x4b0ccc
push edi
mov dword [0x4d7c48], eax
call esi
push eax
call fcn.0049336f
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4d7c4c], eax
call esi
push eax
call fcn.0049336f
mov dword [0x4d7c50], eax
lea eax, [ebp - 0xc]
push eax
call fcn.0048f3f4
test eax, eax
pop ecx
pop ecx
je 0x4a2af6
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00489254
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x4a2b28
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.0049336f
cmp eax, ebx
pop ecx
mov dword [0x4d7c58], eax
je 0x4a2b28
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0049336f
pop ecx
mov dword [0x4d7c54], eax
mov eax, dword [0x4d7c54]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x4a2bad
cmp dword [0x4d7c58], ecx
je 0x4a2bad
push eax
call fcn.004933e6
push dword [0x4d7c58]
mov esi, eax
call fcn.004933e6
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x4a2bad
cmp edi, ebx
je 0x4a2bad
call esi
cmp eax, ebx
je 0x4a2b7a
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4a2b7a
test byte [ebp - 0x18], 1
jne 0x4a2bad
lea eax, [ebp - 0x10]
push eax
call fcn.0048f42b
test eax, eax
pop ecx
je 0x4a2b95
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00489254
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x4a2ba4
or dword [ebp + 0x10], 0x200000
jmp 0x4a2be8
or dword [ebp + 0x10], 0x40000
jmp 0x4a2be8
mov eax, dword [0x4d7c4c]
cmp eax, dword [ebp - 8]
je 0x4a2be8
push eax
call fcn.004933e6
cmp eax, ebx
pop ecx
je 0x4a2be8
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x4a2be8
mov eax, dword [0x4d7c50]
cmp eax, dword [ebp - 8]
je 0x4a2be8
push eax
call fcn.004933e6
cmp eax, ebx
pop ecx
je 0x4a2be8
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4d7c48]
call fcn.004933e6
cmp eax, ebx
pop ecx
je 0x4a2c08
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4a2c0a
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1000b1f4
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
push ebx
mov dword [esp + 0x10], 0x3c1c
cmp dword [esp + 0x10], 0x3f1e
push esi
push edi
jle 0x1000b2ab
push 0xc9
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
xor esi, esi
mov dword [esp + 0x14], esi
xor edi, edi
mov dword [esp + 0x10], edi
xor ebx, ebx
mov dword [esp + 0xc], 0x1119
and dword [esp + 0x1c], 0
mov edi, esi
mov esi, dword [esp + 0x1c]
mov ecx, ebx
sar edi, cl
mov eax, edi
lea ecx, [esp + 0x20]
or eax, esi
cdq
push edx
push eax
call fcn.10009476
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1000b264
mov eax, dword [eax]
push eax
call fcn.10051846
pop ecx
push 0
push 1
lea ecx, [esp + 0x28]
call fcn.1000be5d
inc esi
cmp esi, 0x130b
jl 0x1000b24a
mov edi, dword [esp + 0x10]
add ebx, edi
dec dword [esp + 0xc]
mov esi, dword [esp + 0x14]
jne 0x1000b23b
inc edi
mov dword [esp + 0x10], edi
cmp edi, 0x5fb4
jl 0x1000b231
inc esi
mov dword [esp + 0x14], esi
cmp esi, 0x4946
jl 0x1000b22b
cmp dword [esp + 0x18], 0x3a5c
jge 0x1000b2c0
push 0x1000782c
call fcn.10051846
pop ecx
fldz
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10024292
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
xor edx, edx
mov dword [ebp - 0x10], 0x88a137b1
inc edx
mov ebx, ecx
push esi
mov dword [ebp - 0xc], edx
xor ecx, ecx
mov dword [ebp - 0x14], 0x3187110e
push 3
mov dword [ebp - 8], 6
mov dword [ebp - 8], ecx
pop esi
jmp 0x100242cf
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x28], 0xccb03629
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x100242c1
neg dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
je 0x100242e5
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x10], edx
ja 0x100242ed
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0xc], ecx
jmp 0x10024315
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 8], 0xfffffffb
inc dword [ebp - 0x10]
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xffffffef
je 0x10024301
push 4
lea ecx, [ebp - 0x34]
call fcn.1000b98b
mov dword [ebp - 8], 0x29000d4e
mov dword [ebp - 0xc], 0
jmp 0x10024345
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x34]
mov dword [eax + ecx*4], 0x207
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 4
jl 0x10024335
mov dword [ebp - 8], 0
cmp dword [ebp - 8], esi
jg 0x1002444c
push edi
mov dword [ebp - 0xc], 0
jmp 0x10024373
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x40], 0xed69376
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], esi
jl 0x10024365
mov dword [ebp - 0xc], 0
jmp 0x1002438f
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x1c], 0
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 2
jl 0x10024381
mov eax, dword [ebp - 8]
xor edx, edx
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x34]
cmp dword [eax + ecx*4], 2
setl dl
xor ecx, ecx
cmp edx, 0x23cc
setge cl
xor eax, eax
sub ecx, 0x47027eb9
cmp ecx, 0x71639956
setg al
xor edx, edx
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 8]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 8]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x34]
add eax, 0xfffb
cmp dword [ecx + esi*4], eax
mov eax, dword [ebp - 0x34]
sete dl
sub edx, dword [eax + edi*4]
je 0x1002440a
mov byte [ebp - 1], 0
cmp byte [ebp - 1], 0
je 0x1002441e
push 0x17b6
call dword [sym.imp.USER32.dll_IsWindow]
jmp 0x1002441e
mov dword [ebp - 0x14], 0xfffffffb
mov dword [ebp - 0x10], 0x9ff7503a
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
push 3
pop esi
mov dword [ebp - 0x1c], esi
cmp dword [ebp - 0x1c], 0
jl 0x1002443f
mov byte [ebp - 1], 0
cmp byte [ebp - 1], 0
je 0x1002443a
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
dec dword [ebp - 0x1c]
jns 0x1002442a
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jle 0x1002435c
pop edi
lea ecx, [ebp - 0x34]
call fcn.1000ba0d
pop esi
mov dword [ebx], 0xfffffffb
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10042ccb
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x10042d8d
lea eax, [ebp + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x20], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x10042d19
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x10042d17
push 0x26b7
push 0
push 0xb08
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x10042d8b
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
push 8
pop ecx
imul ecx, ecx, 5
lea eax, [eax + ecx + 0x78]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
cmp dword [eax + 4], 0
jbe 0x10042d8b
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
add ecx, dword [eax]
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x14]
cmp dword [eax], 0
jbe 0x10042d8b
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
push 0xef3
push 1
push 1
push 0x60a6
push 0
push 0x4383
push 0x1739
push dword [ebp - 0x28]
call fcn.1004218b
add esp, 0x28
jmp 0x10042d54
jmp 0x10042df9
lea eax, [ebp + 0x10]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x10042ddf
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0x10
jmp 0x10042dc5
mov eax, dword [ebp - 8]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 0xfffffffb
jne 0x10042ddd
mov dword [ebp - 0x38], 1
mov dword [ebp - 0x38], 8
jmp 0x10042dba
jmp 0x10042df9
push 0x1232
push 0xaae
push 0xc6
push 0x623
call dword [sym.imp.GDI32.dll_CreateRectRgn]
mov esp, ebp
pop ebp
ret
Function at 0x1004500c
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x1004508d
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x10045083
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x10045064
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 4
jge 0x10045081
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x1c]
call fcn.1000ba29
mov dword [eax], 4
jmp 0x10045059
jmp 0x1004508b
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
jmp 0x100450d2
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
push 1
push 0x6c60
push 0xc50
push 0x146b
push 0x3d25
push dword [ebp - 0x20]
push 0x7416
push 0x5758
push 0x79af
push 0x7b8e
push 0x5f41
push 0x7967
call fcn.10030ccb
add esp, 0x30
mov esp, ebp
pop ebp
ret
Function at 0x10047102
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1004721b
mov dword [ebp - 0x10], 0x1f2d
cmp dword [ebp - 0x10], 0x132d
jge 0x100471e8
lea eax, [ebp - 0xc]
push eax
push 0x10007a0c
call fcn.1005162b
pop ecx
pop ecx
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
dec eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0x14], 0
je 0x100471e8
lea eax, [ebp - 4]
push eax
push 0x10007a0c
call fcn.1005162b
pop ecx
pop ecx
cmp dword [ebp - 4], 1
jne 0x10047172
push 0x10007d18
call fcn.10051a06
pop ecx
jmp 0x100471e3
cmp dword [ebp - 4], 2
jne 0x10047185
push 0x10007a40
call fcn.10051a06
pop ecx
jmp 0x100471e3
cmp dword [ebp - 4], 3
jne 0x10047198
push 0x10007adc
call fcn.10051a06
pop ecx
jmp 0x100471e3
mov eax, dword [ebp - 4]
and eax, 0x80000001
jns 0x100471a7
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x100471b8
push 0x10007adc
call fcn.10051a06
pop ecx
jmp 0x100471e3
mov eax, dword [ebp - 4]
and eax, 0x80000001
jns 0x100471c7
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
je 0x100471d8
push 0x10007dac
call fcn.10051a06
pop ecx
jmp 0x100471e3
push 0x10007a44
call fcn.10051a06
pop ecx
jmp 0x10047138
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x18], eax
push 0x70c6
push 0x170
push 0x61bf
push 0x59f6
push 0x6aac
push 1
push 0x446d
push dword [ebp - 0x18]
call fcn.1004728e
add esp, 0x20
jmp 0x1004728a
lea eax, [ebp + 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x10047284
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x10047265
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 1
jge 0x10047282
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 0x30]
call fcn.1000ba29
mov dword [eax], 0xa42bbd4a
jmp 0x1004725a
jmp 0x1004728a
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov esp, ebp
pop ebp
ret
Function at 0x100658a5
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1006f750]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.10057328
mov dword [ebp - 0x14], eax
cmp dword [0x1065c4e0], esi
jne 0x10065998
push 0x800
push esi
push 0x10007688
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x10065925
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x10065a78
push esi
push esi
push 0x10007688
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x10065a78
push 0x100076a0
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10065a78
push eax
call ebx
push 0x100076ac
push edi
mov dword [0x1065c4e0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x100076bc
push edi
mov dword [0x1065c4e4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x100076d0
push edi
mov dword [0x1065c4e8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x1065c4f0], eax
test eax, eax
je 0x10065995
push 0x100076ec
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x1065c4ec], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x100659bd
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x100659b0
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x100659d2
push 4
pop eax
jmp 0x10065a7a
cmp dword [ebp - 0x14], esi
je 0x100659d2
push dword [0x1065c4e0]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x100659b7
mov eax, dword [0x1065c4ec]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x10065a30
cmp dword [0x1065c4f0], edi
je 0x10065a30
push eax
call ebx
push dword [0x1065c4f0]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x10065a30
test eax, eax
je 0x10065a30
call ecx
test eax, eax
je 0x10065a25
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x10065a25
test byte [ebp - 8], 1
jne 0x10065a30
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x10065a60
mov eax, dword [0x1065c4e4]
cmp eax, edi
je 0x10065a5d
push eax
call ebx
test eax, eax
je 0x10065a5d
call eax
mov esi, eax
test esi, esi
je 0x10065a5d
mov eax, dword [0x1065c4e8]
cmp eax, edi
je 0x10065a5d
push eax
call ebx
test eax, eax
je 0x10065a5d
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x1065c4e0]
call ebx
test eax, eax
je 0x10065a78
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x10065a7a
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100548b9
mov esp, ebp
pop ebp
ret
Function at 0x10192d41
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x10192d50
pop dword [ebp - 0x2c]
mov eax, 0x959bb7
sub eax, 0xf07c6e67
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0x732077a0
add dword [ebp - 0x3c], 0xdb31cdab
mov dword [ebp - 0x38], 0xe1fecd32
sub dword [ebp - 0x38], 0xafcb80ed
mov dword [ebp - 0x34], 0xe9615322
sub dword [ebp - 0x34], 0x9d150ef4
mov dword [ebp - 0x30], 0x70ffdc65
sub dword [ebp - 0x30], 0x70ffdc65
lea eax, [ebp - 0x3c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0x2a4813cc
add dword [ebp - 0x3c], 0x4a2a558a
mov dword [ebp - 0x38], 0xad8d1ca4
add dword [ebp - 0x38], 0x93df44d1
mov dword [ebp - 0x34], 0x1946067d
add dword [ebp - 0x34], 0x4a2965ef
mov dword [ebp - 0x30], 0xf054049e
add dword [ebp - 0x30], 0xfabfb62
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x3782e
push 0
call eax
mov ecx, 0x6d309d9a
sub ecx, 0x6d305177
mov ebx, eax
mov esi, 0x5e100b39
add esi, 0xb20e82c7
add esi, dword [ebp - 0x2c]
mov edi, 0x2e6a33d4
add edi, 0x8c1364e2
xor dword [ebp - 8], 0x4cb3fc3
mov edx, dword [esi]
sub dword [ebp - 0x28], 0x4abf9086
add edx, edi
sub dword [ebp - 0x10], esi
mov dword [ebx], edx
mov dword [ebp - 0xc], 0x142f1d53
add ebx, 4
add esi, 4
loop 0x10192e68
add eax, 0xcef088d4
sub eax, 0xceef6575
mov ebx, eax
add eax, 0xb33eb19
sub eax, 0xb33eb14
mov ecx, sym.nss3.dll_Ordinal_0
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret