joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1005aa70
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 0x38
mov eax, dword [0x1007eed0]
push ebx
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, dword [esp + 0x4c]
xor ecx, ecx
xor edi, edi
xor ebx, ebx
cmp esi, ecx
mov dword [esp + 0x18], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], ecx
je 0x1005ac00
mov eax, dword [esi + 0x10]
push ebp
cdq
mov ebp, 0x25
idiv ebp
cmp dword [edx*4 + 0x100746d0], ecx
mov ebp, dword [edx*4 + 0x10076508]
jne 0x1005aac3
lea ebx, [esi + 0x3a]
mov eax, dword [esi + 0x1c]
cmp eax, ecx
jne 0x1005aae5
push 0x11
push esi
call fcn.10055ad0
xor ecx, ecx
cmp eax, ecx
jne 0x1005aae5
pop ebp
pop edi
pop esi
lea eax, [ecx + 0x33]
pop ebx
add esp, 0x38
ret 0x10
mov eax, dword [eax + 0x80]
lea ecx, [esp + 0x50]
push ecx
mov ecx, dword [esp + 0x5c]
lea edx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x5c]
push ebx
push ebp
push ecx
push edx
push eax
push esi
call fcn.1005a830
cmp eax, 7
mov ebx, dword [esp + 0x14]
mov ebp, dword [esp + 0x1c]
mov dword [esp + 0x10], eax
je 0x1005ab32
push 0x400
push ebp
call fcn.10069dc0
mov edi, eax
test edi, edi
jne 0x1005ab56
mov dword [esp + 0x10], 7
test ebx, ebx
je 0x1005ab3d
push ebx
push ebp
call fcn.1006a020
test edi, edi
je 0x1005ab48
push edi
push ebp
call fcn.1006a020
mov eax, dword [esp + 0x10]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x38
ret 0x10
xor eax, eax
mov word [edi], 0
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x3c], eax
push esi
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x2c], 0x20
mov dword [esp + 0x30], 0xfffff82f
mov dword [esp + 0x40], ebx
call fcn.10058c20
test eax, eax
mov dword [esp + 0x10], eax
je 0x1005abab
push esi
call fcn.10019ae0
mov dword [esp + 0x10], eax
jmp 0x1005ab32
lea ecx, [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x54]
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x2c]
push eax
add ecx, 0x200
push ecx
push edi
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x40]
push eax
push 0xfffff82f
call dword [0x1007eee8]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
push 0xfffff82f
push ecx
push edx
push edi
push str.ODBC
push eax
push esi
call fcn.1005a040
jmp 0x1005ab32
pop edi
pop esi
mov eax, 0x33
pop ebx
add esp, 0x38
ret 0x10
Function at 0x1005ac30
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x1007eed0]
sub esp, 0x28
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
push eax
call esi
xor ebp, ebp
test eax, eax
jne 0x1005acdc
mov eax, dword [esp + 0x3c]
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov dword [esp + 0xc], ecx
mov ecx, dword [eax + 8]
mov dword [esp + 0x10], edx
mov edx, dword [eax + 0xc]
push 0x70
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], ebp
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x34], ebp
mov dword [esp + 0x30], 8
call fcn.10069dc0
mov ebx, eax
cmp ebx, ebp
jne 0x1005aca3
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x28
ret 8
push edi
push 0x70
push ebp
push ebx
call sub.msvcrt.dll_memset
mov ecx, 0xa
lea esi, [esp + 0x1c]
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
add esp, 0xc
mov dword [ebx + 0x2c], 1
mov dword [ebx + 0x50], ebp
mov dword [ebx + 0x54], ebp
mov dword [ebx + 0x58], ebp
mov dword [ebx + 0x60], ebp
mov dword [ebx + 0x64], ebp
mov dword [ebx + 0x68], ebp
mov dword [ebx + 0x6c], ebp
pop edi
jmp 0x1005aceb
mov ecx, dword [0x1007eed0]
push ecx
call esi
mov ebx, eax
add dword [ebx + 0x2c], 1
mov eax, dword [esp + 0x38]
cmp eax, ebp
je 0x1005acf5
mov dword [eax], ebx
mov eax, dword [ebx + 0x2c]
pop esi
pop ebp
pop ebx
add esp, 0x28
ret 8

Function at 0x1005ad10
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov eax, dword [0x1007eed0]
sub esp, 0x28
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
add dword [ebx + 0x2c], 0xffffffff
jne 0x1005ad97
mov eax, dword [esp + 0x30]
test eax, eax
je 0x1005ad36
mov ecx, dword [ebx + 0x30]
push ecx
call eax
call fcn.10058080
call fcn.10058120
call fcn.10058180
mov eax, dword [ebx + 0x38]
test eax, eax
je 0x1005ad53
push eax
push ebx
call fcn.1006a020
push esi
push edi
push ebx
lea edx, [esp + 0x10]
mov ecx, 0xa
mov esi, ebx
lea edi, [esp + 0x10]
push edx
rep movsd dword es:[edi], dword [esi]
call fcn.1006a020
lea eax, [esp + 0xc]
push eax
call fcn.1006a0d0
mov eax, dword [esp + 0x14]
test eax, eax
pop edi
pop esi
je 0x1005ad88
mov ecx, dword [esp + 0x10]
push ecx
call eax
mov edx, dword [0x1007eed0]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop ebx
add esp, 0x28
ret 4
Function at 0x1005d810
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push ebp
push edi
mov edi, dword [esp + 0x14]
mov ebp, dword [edi + 0x18]
call fcn.10057e50
cmp dword [edi + 0x10], 0x25
mov ebx, 1
jge 0x1005d8e5
cmp dword [edi + 0x498], 0
je 0x1005d841
cmp word [edi + 8], bx
je 0x1005d8e5
cmp word [esp + 0x34], bx
jb 0x1005d8d1
mov eax, dword [esp + 0x18]
and eax, 0x7fff
cmp eax, 8
jne 0x1005d8d1
mov ecx, dword [esp + 0x1c]
push esi
push ecx
call fcn.10020570
mov esi, eax
add esi, ebx
lea edx, [esi + esi]
push edx
push edi
push ebp
call fcn.1004af50
mov ebx, eax
test ebx, ebx
je 0x1005d88e
mov eax, dword [esp + 0x20]
push eax
push ebp
call fcn.1004ae90
pop esi
pop edi
pop ebp
mov eax, ebx
pop ebx
ret 0x28
mov ecx, dword [0x1007eed0]
push ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, dword [eax + 0x38]
mov edx, dword [esp + 0x20]
push esi
push ebx
push edx
call fcn.100205a0
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x30]
add eax, 0xffffffff
push eax
mov eax, dword [esp + 0x18]
push ecx
push edx
push 0
push ebx
push edi
push eax
call fcn.100539d0
pop esi
pop edi
pop ebp
pop ebx
ret 0x28
push ebx
push 0
push edi
push 0xfffffc15
call fcn.1005a550
pop edi
pop ebp
pop ebx
ret 0x28
lea ecx, [esp + 0x18]
push ecx
push ebp
call fcn.1004aeb0
push ebx
push 0
push edi
push 0xffff8abf
call fcn.1005a550
pop edi
pop ebp
pop ebx
ret 0x28
Function at 0x1005ee30
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
mov eax, dword [esi + 0x18]
push edi
push esi
mov dword [esp + 0x18], eax
call fcn.1005e5f0
mov ebp, dword [esp + 0x18]
mov ebx, eax
test ebx, ebx
jne 0x1005ef58
push ebp
call fcn.10020570
mov edx, dword [esp + 0x14]
mov edi, eax
add edi, 1
lea ecx, [edi + edi]
push ecx
push esi
push edx
call fcn.1004af50
mov ebx, eax
test ebx, ebx
jne 0x1005ef58
mov eax, dword [0x1007eed0]
mov ebx, dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push eax
call ebx
mov ecx, dword [eax + 0x38]
push ecx
push ebp
call fcn.100205a0
mov edx, dword [esp + 0x1c]
mov eax, dword [0x1007eed0]
push 0
or edx, 0x200000
push edx
push 0
push 0
push eax
call ebx
mov ecx, dword [eax + 0x38]
mov edx, dword [esi + 0x494]
mov eax, dword [esi + 0x4a0]
push ecx
push edx
push eax
call dword [0x1007eff0]
mov edi, eax
test edi, edi
jge 0x1005ef43
cmp edi, 0xfffffbf7
je 0x1005ef1f
cmp edi, 0xfffffc0d
je 0x1005ef1f
cmp edi, 0xfffffc0a
je 0x1005ef1f
cmp edi, 0xfffff8ec
je 0x1005ef1f
cmp edi, 0xfffff8f0
je 0x1005ef1f
mov ecx, dword [0x1007eed0]
push ecx
call ebx
mov edx, dword [eax + 0x38]
mov eax, dword [esi + 0x4a0]
push edx
push eax
push esi
push edi
call fcn.1005a1e0
mov ecx, dword [esp + 0x14]
push ecx
mov esi, eax
call fcn.1004b060
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret 0xc
push 1
push 0
push esi
push 0xfffffc0a
call fcn.1005a550
mov ecx, dword [esp + 0x14]
push ecx
mov esi, eax
call fcn.1004b060
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret 0xc
mov ecx, dword [esp + 0x14]
push ecx
xor esi, esi
call fcn.1004b060
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret 0xc
push 0
push 0
push ebp
call fcn.100205a0
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
ret 0xc
Function at 0x10065b90
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
mov ebx, dword [esi + 0x18]
push edi
mov edi, dword [esi + 0x15c]
push 0
push edi
call fcn.10062100
test eax, eax
jne 0x10065c3d
lea eax, [esp + 0x10]
push eax
push esi
call fcn.10065a30
movzx ecx, word [esp + 0x10]
add ecx, ecx
push ecx
push edi
push ebx
call fcn.1004af50
test eax, eax
jne 0x10065c3d
mov edi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
push eax
mov eax, dword [0x1007eed0]
lea edx, [esp + 0x14]
push edx
push eax
call edi
mov ecx, dword [eax + 0x38]
push ecx
push esi
call fcn.100658f0
test eax, eax
jne 0x10065c3d
mov esi, dword [esp + 0x14]
mov edx, dword [esi]
and edx, 0xffff8005
or edx, 5
mov dword [esi], edx
mov eax, dword [0x1007eed0]
push eax
call edi
cmp dword [eax + 0x38], 0
je 0x10065c24
mov ecx, dword [0x1007eed0]
push ecx
call edi
mov edx, dword [eax + 0x38]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
jmp 0x10065c26
xor eax, eax
push eax
mov eax, dword [0x1007eed0]
push eax
call edi
mov ecx, dword [eax + 0x38]
push ecx
call fcn.10020460
mov dword [esi + 8], eax
xor eax, eax
pop edi
pop esi
pop ebx
ret 8
Function at 0x100660f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x168
mov eax, dword [0x1007e5f0]
xor eax, esp
mov dword [esp + 0x164], eax
mov eax, dword [esp + 0x174]
push ebp
mov ebp, dword [esp + 0x180]
push esi
mov esi, dword [esp + 0x174]
mov dword [esp + 0x18], eax
mov eax, dword [esi + 0x1c]
push edi
xor edi, edi
test eax, eax
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], edx
jne 0x10066139
push 0x11
push esi
call fcn.10055ad0
mov dword [esp + 0xc], eax
mov eax, dword [esi + 0x1c]
test eax, eax
jne 0x1006614c
push 0x11
push esi
call fcn.10055ad0
xor esi, esi
cmp eax, esi
jne 0x1006615c
mov eax, 0xfffffbfb
jmp 0x100662dd
test byte [esp + 0x184], 2
je 0x100661aa
mov eax, dword [ebx]
cmp eax, 0xffffffff
je 0x10066182
push eax
mov eax, dword [esp + 0x180]
push eax
call dword [0x1007ef1c]
mov dword [ebx], 0xffffffff
mov ecx, dword [0x1007e5dc]
mov edx, dword [esp + 0x17c]
push 0
push ecx
push edx
call dword [0x1007ef18]
mov dword [0x1007e5dc], 0xffffffff
xor eax, eax
jmp 0x100662dd
cmp word [ebp], si
je 0x10066203
push ebp
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
cmp eax, 0x28
jbe 0x100661c8
mov eax, 0xfffffc16
jmp 0x100662dd
lea esi, [esp + 0x40]
mov dword [esp + 0x38], 0xa
mov dword [esp + 0x3c], eax
mov ecx, ebp
sub esi, ebp
lea esp, [esp]
movzx edx, word [ecx]
mov word [esi + ecx], dx
add ecx, 2
test dx, dx
jne 0x100661e0
lea esi, [eax + 0xb]
shr esi, 2
add esi, esi
lea eax, [esp + 0x38]
add esi, esi
mov dword [esp + 0x10], eax
jmp 0x10066207
mov dword [esp + 0x10], esi
test byte [esp + 0x184], 1
mov ebp, dword [esp + 0x17c]
je 0x100662c1
mov edx, dword [esp + 0xc]
mov eax, dword [edx + 0x6c]
push 0x102
lea ecx, [esp + 0x70]
push ecx
push 0
push 0
push ebp
push eax
call dword [0x1007efb4]
mov edi, eax
test edi, edi
jl 0x100662db
push 0
push 0x1007e5dc
push 0
lea ecx, [esp + 0x78]
push ecx
push ebp
call dword [0x1007efe8]
test eax, eax
jge 0x10066277
push 1
push 0x1007e5dc
push 0
lea edx, [esp + 0x78]
push edx
push ebp
call dword [0x1007efe8]
mov edi, eax
test edi, edi
jl 0x100662db
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
mov edx, dword [0x1007e5dc]
push ebx
push 0x20
push esi
push eax
push ecx
push edx
push ebp
call dword [0x1007eff0]
mov edi, eax
test edi, edi
jl 0x100662db
mov ecx, dword [esp + 0x14]
mov edx, dword [ebx]
push 0
push 0x18
lea eax, [esp + 0x28]
push eax
push ecx
push edx
push ebp
call dword [0x1007efb8]
mov edi, eax
test edi, edi
jl 0x100662db
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x1c]
mov dword [ecx], eax
test byte [esp + 0x184], 4
je 0x100662db
mov edx, dword [ebx]
push 0
push 0
push edx
push ebp
call dword [0x1007f018]
mov edi, eax
mov eax, edi
mov ecx, dword [esp + 0x170]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.1006ac47
add esp, 0x168
ret 0x14
Function at 0x10068c80
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [esi + 0x1c]
push ebx
push ebp
xor ebx, ebx
test eax, eax
push edi
jne 0x10068cae
push 0x11
push esi
call fcn.10055ad0
test eax, eax
jne 0x10068cae
push 1
push eax
push esi
push 0xfffffbfb
call fcn.1005a550
pop edi
pop ebp
mov ebx, eax
pop ebx
ret 8
cmp dword [esi + 0x10], 0x25
jge 0x10068ddb
mov ebp, dword [esi + 0xec]
cmp ebp, 0xffffffff
jne 0x10068cda
push 1
push 0
push esi
push 0xffff8ac6
call fcn.1005a550
pop edi
pop ebp
mov ebx, eax
pop ebx
ret 8
cmp dword [esp + 0x10], ebx
je 0x10068d4d
cmp ebp, 0xfffffffe
je 0x10068d09
push 1
push ebp
call dword [0x1007f02c]
test eax, eax
jge 0x10068d09
cmp eax, 0xfffffbe2
je 0x10068d09
push 0
push ebp
push esi
push eax
call fcn.1005a1e0
pop edi
pop ebp
pop ebx
ret 8
mov eax, dword [esi + 0x100]
test eax, eax
je 0x10068d4d
cmp word [eax + 0x2c], bx
je 0x10068d4d
cmp dword [esp + 0x14], ebx
mov eax, dword [eax + 0x38]
jne 0x10068d25
mov eax, dword [eax + 0x2c]
test eax, eax
je 0x10068d4d
lea esp, [esp]
mov edi, dword [eax + 0x2c]
push 0
push 1
push eax
call fcn.1005e0b0
mov ebx, eax
test ebx, ebx
jne 0x10068dec
test edi, edi
mov eax, edi
jne 0x10068d30
mov eax, dword [esi + 0x1c]
test eax, eax
jne 0x10068d60
push 0x11
push esi
call fcn.10055ad0
test eax, eax
je 0x10068d74
mov eax, dword [esi + 0x1c]
test eax, eax
jne 0x10068d6f
push 0x11
push esi
call fcn.10055ad0
mov eax, dword [eax + 0x70]
jmp 0x10068d86
mov eax, dword [0x1007eed0]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [eax + 0x28]
mov eax, dword [ecx + 0x70]
cmp ebp, eax
jne 0x10068d92
pop edi
pop ebp
xor eax, eax
pop ebx
ret 8
cmp ebp, 0xfffffffe
je 0x10068db1
cmp dword [esi + 0xf4], 0
jne 0x10068db1
push 0
push ebp
call dword [0x1007ef68]
test eax, eax
jl 0x10068cf9
mov eax, dword [esi + 0x10]
cmp eax, 0x25
mov dword [esi + 0xec], 0xffffffff
mov dword [esi + 0xf0], 1
jge 0x10068dec
add eax, 0x25
pop edi
mov dword [esi + 0x10], eax
pop ebp
mov eax, ebx
pop ebx
ret 8
push 1
push 0
push esi
push 0xffff8abf
call fcn.1005a550
mov ebx, eax
pop edi
pop ebp
mov eax, ebx
pop ebx
ret 8
Function at 0x10069920
Capabilities:
Get thread local storage value

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
jne 0x1006993b
cmp word [esi + 0x2c], di
je 0x10069945
pop edi
xor eax, eax
pop esi
ret 8
cmp word [esi + 0x2c], di
jne 0x10069b1e
cmp dword [esi + 0x34], edi
jne 0x10069960
push 1
push 0
push esi
push 0xffff8ac6
call fcn.1005a550
mov edi, eax
pop edi
pop esi
ret 8
push 0x12
lea eax, [esp + 0x14]
push eax
push esi
call fcn.10057aa0
mov edi, eax
test edi, edi
jne 0x10069b1e
mov ecx, dword [esp + 0x10]
push 0x82
push str.Default_Workspace
push ecx
call fcn.10057040
mov edx, dword [esp + 0x10]
push edx
push esi
call fcn.10056e80
mov ecx, dword [esp + 0x10]
test ecx, ecx
mov esi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
je 0x100699dd
cmp dword [ecx + 0x1c], edi
je 0x100699ae
mov eax, dword [ecx + 0x1c]
jmp 0x100699ba
push 0x11
push ecx
call fcn.10055ad0
mov ecx, dword [esp + 0x10]
test eax, eax
je 0x100699dd
cmp dword [ecx + 0x1c], 0
je 0x100699cc
mov eax, dword [ecx + 0x1c]
mov eax, dword [eax + 0x74]
jmp 0x100699ef
push 0x11
push ecx
call fcn.10055ad0
mov ecx, dword [esp + 0x10]
mov eax, dword [eax + 0x74]
jmp 0x100699ef
mov eax, dword [0x1007eed0]
push eax
call esi
mov ecx, dword [eax + 0x28]
mov eax, dword [ecx + 0x74]
mov ecx, dword [esp + 0x10]
cmp eax, 1
jne 0x10069a65
mov dword [ecx + 0xec], 0xfffffffe
mov eax, dword [esp + 0x10]
mov edx, str.Default_Workspace
mov esi, 0x15
add eax, 0xbc
lea ecx, [esi + 0x7fffffe9]
test ecx, ecx
je 0x10069a48
movzx ecx, word [edx]
test cx, cx
je 0x10069a48
mov word [eax], cx
add eax, 2
add edx, 2
sub esi, 1
jne 0x10069a11
sub eax, 2
mov word [eax], si
mov edx, dword [esp + 0x10]
push edx
call fcn.100555e0
mov eax, edi
pop edi
pop esi
ret 8
test esi, esi
jne 0x10069a4f
sub eax, 2
mov word [eax], 0
mov edx, dword [esp + 0x10]
push edx
call fcn.100555e0
mov eax, edi
pop edi
pop esi
ret 8
test ecx, ecx
je 0x10069a99
cmp dword [ecx + 0x1c], 0
je 0x10069a74
mov eax, dword [ecx + 0x1c]
jmp 0x10069a80
push 0x11
push ecx
call fcn.10055ad0
mov ecx, dword [esp + 0x10]
test eax, eax
je 0x10069a99
cmp dword [ecx + 0x1c], 0
je 0x10069a8f
mov eax, dword [ecx + 0x1c]
jmp 0x10069aa9
push 0x11
push ecx
call fcn.10055ad0
jmp 0x10069aa5
mov edx, dword [0x1007eed0]
push edx
call esi
mov eax, dword [eax + 0x28]
mov ecx, dword [esp + 0x10]
mov eax, dword [eax + 0x70]
push 0
mov dword [ecx + 0xec], eax
mov eax, dword [esp + 0x14]
mov edx, dword [eax + 0xec]
push 0x14
lea ecx, [eax + 0xbc]
push ecx
push 0
push 0
push edx
call dword [0x1007ef9c]
test eax, eax
je 0x10069b0a
cmp eax, 0xfffff8f6
je 0x10069afd
test eax, eax
jge 0x10069af9
mov ecx, dword [esp + 0x10]
mov edx, dword [ecx + 0xec]
push 0
push edx
push ecx
push eax
call fcn.1005a1e0
mov edi, eax
jmp 0x10069b0a
xor edi, edi
jmp 0x10069b0a
mov eax, dword [esp + 0x10]
mov word [eax + 0xbc], 0
mov ecx, dword [esp + 0x10]
push ecx
call fcn.10069840
mov edx, dword [esp + 0x10]
push edx
call fcn.100555e0
mov eax, edi
pop edi
pop esi
ret 8
Function at 0x1006a8e0
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
cmp word [ecx], 0x5a4d
je 0x1006a8f3
xor eax, eax
pop ebp
ret
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x1006a8ef
xor ecx, ecx
cmp word [eax + 0x18], 0x10b
sete cl
mov eax, ecx
pop ebp
ret

Function at 0x1006a910
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
push ebx
push esi
movzx esi, word [ecx + 6]
xor edx, edx
test esi, esi
push edi
lea eax, [eax + ecx + 0x18]
jbe 0x1006a94f
mov edi, dword [ebp + 0xc]
mov ecx, dword [eax + 0xc]
cmp edi, ecx
jb 0x1006a945
mov ebx, dword [eax + 8]
add ebx, ecx
cmp edi, ebx
jb 0x1006a951
add edx, 1
add eax, 0x28
cmp edx, esi
jb 0x1006a935
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x1006ac47
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1007e5f0]
jne 0x1006ac51
repz ret
jmp fcn.1006ac56

Function at 0x1006ac56
Capabilities:
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x320
push edi
mov dword [0x1007ec78], eax
mov dword [0x1007ec74], ecx
mov dword [0x1007ec70], edx
mov dword [0x1007ec6c], ebx
mov dword [0x1007ec68], esi
mov dword [0x1007ec64], edi
mov word [0x1007ec90], ss
mov word [0x1007ec84], cs
mov word [0x1007ec60], ds
mov word [0x1007ec5c], es
mov word [0x1007ec58], fs
mov word [0x1007ec54], gs
pushfd
pop dword [0x1007ec88]
mov eax, dword [ebp + 4]
lea ecx, [ebp + 4]
add ecx, 4
mov dword [0x1007ec8c], ecx
mov dword [0x1007ec80], eax
mov dword [0x1007ebc8], 0x10001
lea ecx, [ebp + 4]
mov ecx, dword [ecx - 4]
mov dword [0x1007eb84], eax
mov eax, dword [0x1007e5f0]
xor edi, edi
mov dword [0x1007ec7c], ecx
mov dword [0x1007eb78], 0xc0000409
inc edi
mov dword [0x1007eb7c], edi
mov dword [ebp - 4], eax
mov eax, dword [0x1007e5f4]
mov dword [ebp - 4], eax
push 0
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
push 0x1007815c
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
push 0xc0000409
mov dword [ebp - 0x320], edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop edi
leave
ret
Function at 0x404870
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
mov eax, dword [esi]
call dword [eax + 0xc]
cmp dword [esi + 4], 0xffffffff
je 0x4048e5
cmp dword [esi + 0x54], 0xffffffff
je 0x4048e5
cmp dword [esi + 0x1ac], 0
je 0x404898
mov ecx, esi
call fcn.00404bd0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0x198], eax
lea eax, [ebp - 4]
push eax
push 0
push esi
push 0x404cc0
push 0
push 0
mov dword [esi + 0x24], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x1ac], eax
test eax, eax
je 0x4048e5
push 2
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x10]
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x10]
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x404900
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
mov eax, dword [esi]
call dword [eax + 0xc]
cmp dword [esi + 0x2c], 0
je 0x404919
mov ecx, esi
call fcn.00404c70
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0x28], eax
test eax, eax
jne 0x40493c
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x10]
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 4]
mov dword [esi + 0x24], 0
push eax
push 0
push esi
push 0x406710
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x2c], eax
test eax, eax
je 0x40492e
push 2
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x10]
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x404bd0
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi]
call dword [eax + 0xc]
cmp dword [esi + 0x1ac], 0
je 0x404c5c
mov eax, dword [esi + 0x1a8]
test eax, eax
je 0x404c3b
push eax
mov dword [esi + 0x2c], 1
call dword [sym.imp.KERNEL32.dll_SetEvent]
test eax, eax
je 0x404c3b
mov eax, dword [esi + 0x1ac]
test eax, eax
je 0x404c5c
push 0x1388
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x404c46
push 0
push dword [esi + 0x1ac]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [esi + 0x1ac]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x1ac], 0
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x10]
xor eax, eax
pop esi
ret
push dword [esi + 0x1ac]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x1ac], 0
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x10]
mov eax, 1
pop esi
ret
Function at 0x405030
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x5a02b0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
test esi, esi
je 0x40504f
lea eax, [esi + 4]
jmp 0x405051
xor eax, eax
push 0x34
push 0
push eax
call fcn.00526610
mov eax, dword [esi + 0x38]
add esp, 0xc
test eax, eax
je 0x405083
push 0x104
lea ecx, [ebp - 0x20c]
mov dword [esi + 0x58], 1
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x405094
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00525b5c
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x54]
test eax, eax
je 0x4050ab
push eax
call fcn.00409dac
add esp, 4
mov dword [esi + 0x54], 0
push edi
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x20c]
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, eax
test edi, edi
je 0x405104
push edi
call fcn.00409db1
add esp, 4
mov dword [esi + 0x54], eax
push eax
push edi
push 0
lea eax, [ebp - 0x20c]
push eax
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x405104
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x210]
push eax
push 0x54f3e0
push dword [esi + 0x54]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
jne 0x405116
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00525b5c
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x210]
movdqu xmm0, xmmword [eax]
movdqu xmmword [esi + 4], xmm0
movdqu xmm0, xmmword [eax + 0x10]
movdqu xmmword [esi + 0x14], xmm0
movdqu xmm0, xmmword [eax + 0x20]
movdqu xmmword [esi + 0x24], xmm0
mov eax, dword [eax + 0x30]
mov dword [esi + 0x34], eax
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x210]
push eax
push 0x54f50c
push dword [esi + 0x54]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x405172
cmp dword [ebp - 0x214], 4
jb 0x405172
mov eax, dword [ebp - 0x210]
mov eax, dword [eax]
mov dword [esi + 0x3c], eax
mov ecx, dword [ebp - 4]
xor eax, eax
cmp dword [esi + 4], 0xfeef04bd
pop edi
sete al
xor ecx, ebp
pop esi
call fcn.00525b5c
mov esp, ebp
pop ebp
ret