joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1f003290
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1f055c96
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x24ac
call fcn.1f03eb30
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x20], esi
xor edi, edi
mov dword [ebp - 0x14], edi
mov dword [esi + 8], edi
mov ebx, dword [ebp + 8]
cmp ebx, edi
je 0x1f0033d3
push ebx
call fcn.1f0340c0
add esp, 4
test eax, eax
je 0x1f00339e
lea ecx, [ebp - 0x24bc]
call fcn.1f0066d0
mov dword [ebp - 4], edi
mov dword [ebp - 0x142c], edi
push edi
push edi
push edi
push edi
push ebx
lea ecx, [ebp - 0x24bc]
call fcn.1f005a90
push str..apiset
lea ecx, [ebp - 0x24bc]
call fcn.1f0306a0
mov edi, eax
mov dword [ebp - 0x24], edi
test edi, edi
je 0x1f00338c
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x1f00338c
mov ebx, dword [edi + 0x10]
push ebx
call fcn.1f03f6ec
add esp, 4
mov edi, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], 0
push 0
push 0
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 0x14]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea edx, [ebp - 0x1c]
push edx
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
test eax, eax
jne 0x1f0033b3
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call fcn.1f03f6e1
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24bc]
call fcn.1f006770
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24bc]
call fcn.1f006770
mov esi, dword [ebp - 0x20]
mov ebx, dword [ebp + 8]
jmp 0x1f0033e2
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov edi, dword [eax + 0x38]
mov dword [ebp - 0x18], edi
mov ecx, esi
call fcn.1f002150
mov eax, dword [edi]
mov dword [esi + 8], eax
mov dword [ebp - 4], 1
call fcn.1f02bb20
mov eax, dword [esi + 8]
sub eax, 2
je 0x1f003438
sub eax, 2
je 0x1f003422
sub eax, 2
jne 0x1f003445
push esi
push edi
call fcn.1f0030f0
add esp, 8
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0xffffffff
jmp 0x1f00348f
push esi
push edi
call fcn.1f002f50
add esp, 8
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0xffffffff
jmp 0x1f00348f
push esi
push edi
call fcn.1f002d90
add esp, 8
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0xffffffff
jmp 0x1f00348f
test ebx, ebx
je 0x1f00349c
push edi
call fcn.1f03f6e1
add esp, 4
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1f0034c0
Capabilities:
Get common file path

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x1f055cab
push eax
mov eax, 0x111c
mov dword fs:[0], esp
call fcn.1f03eb30
push ebx
mov ebx, ecx
call fcn.1f001720
lea ecx, [esp + 4]
call fcn.1f0073b0
mov dword [esp + 0x1128], 0
mov eax, dword [esp + 8]
cmp eax, 6
ja 0x1f003511
jne 0x1f00350d
cmp dword [esp + 0xc], 1
jae 0x1f003511
xor eax, eax
jmp 0x1f003516
mov eax, 1
mov ecx, dword [esp + 0x1134]
mov dword [ebx + 0xc], eax
test eax, eax
mov eax, dword [esp + 0x1130]
jne 0x1f00353b
test eax, eax
je 0x1f0035e2
test ecx, ecx
je 0x1f0035e2
test eax, eax
je 0x1f0035d6
xor eax, eax
mov word [esp + 0x120], ax
push 0x800
test ecx, ecx
je 0x1f003582
mov ecx, dword [esp + 0x113c]
push ecx
lea edx, [esp + 0x128]
push edx
call fcn.1f03ea07
add esp, 0xc
xor eax, eax
mov word [esp + 0x111e], ax
lea eax, [esp + 0x120]
push eax
jmp 0x1f0035d8
lea ecx, [esp + 0x124]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x1f0035e2
push esi
lea edx, [esp + 0x124]
push edi
push edx
call fcn.1f034420
lea edi, [esp + 0x12c]
add esp, 4
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x1f0035b0
mov ecx, 8
mov esi, str.apisetschema.dll
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
pop edi
pop esi
lea eax, [esp + 0x120]
push eax
jmp 0x1f0035d8
push 0
mov ecx, ebx
call fcn.1f003290
mov dword [ebx + 0x10], eax
mov dword [esp + 0x1128], 0xffffffff
lea ecx, [esp + 4]
call fcn.1f007420
mov ecx, dword [esp + 0x1120]
pop ebx
mov dword fs:[0], ecx
add esp, 0x1128
ret 0xc
Function at 0x1f004680
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1f004693
xor eax, eax
ret
and eax, 0x400
xor ecx, ecx
cmp eax, 0x400
sete cl
mov eax, ecx
ret

Function at 0x1f0046b0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1f0046c3
xor eax, eax
ret
test al, 0x10
je 0x1f0046c0
and eax, 0x400
xor ecx, ecx
cmp eax, 0x400
sete cl
mov eax, ecx
ret
Function at 0x1f007430
Capabilities:
Get common file path

Disassembly:
sub esp, 0x208
push esi
mov esi, dword [esp + 0x210]
push edi
push 4
push 0x1f0578c8
push esi
call fcn.1f03f864
add esp, 0xc
test eax, eax
jne 0x1f007478
mov edx, dword [esp + 0x218]
lea eax, [esi + 8]
sub edx, eax
nop
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x1f007460
pop edi
pop esi
add esp, 0x208
ret
push 0xc
push str.SystemRoot_
push esi
call fcn.1f03f864
add esp, 0xc
test eax, eax
jne 0x1f0074e4
push 0x104
lea ecx, [esp + 0xc]
push ecx
mov word [esp + 0x10], ax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov edi, dword [esp + 0x218]
lea eax, [esp + 8]
mov edx, edi
mov ecx, eax
sub edx, ecx
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x1f0074b2
lea eax, [esi + 0x16]
mov edx, eax
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1f0074c6
sub eax, edx
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x1f0074d6
jmp 0x1f007550
push 9
push 0x1f057898
push esi
call fcn.1f03f864
add esp, 0xc
test eax, eax
jne 0x1f007569
push 0x104
lea eax, [esp + 0xc]
xor edx, edx
push eax
mov word [esp + 0x10], dx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov edi, dword [esp + 0x218]
lea eax, [esp + 8]
mov edx, edi
mov ecx, eax
sub edx, ecx
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x1f007520
lea eax, [esi + 0x10]
mov edx, eax
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1f007534
sub eax, edx
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x1f007544
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
add esp, 0x208
ret
mov edx, dword [esp + 0x218]
mov eax, esi
sub edx, esi
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x1f007574
pop edi
pop esi
add esp, 0x208
ret
Function at 0x1f007590
Capabilities:
Enumerate process modules

Disassembly:
mov eax, dword [esp + 0x10]
sub esp, 0x428
push eax
call dword [sym.imp.KERNEL32.dll_IsBadCodePtr]
test eax, eax
je 0x1f0075ae
xor eax, eax
add esp, 0x428
ret
push ebx
push 0x424
lea ecx, [esp + 0xc]
push 0
push ecx
mov dword [esp + 0x10], 0
call fcn.1f03f700
mov edx, dword [esp + 0x43c]
mov eax, dword [esp + 0x440]
add esp, 0xc
push edx
push eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
cmp ebx, 0xffffffff
je 0x1f007605
lea ecx, [esp + 4]
push ecx
push ebx
mov dword [esp + 0xc], 0x428
call sub.KERNEL32.dll_Module32FirstW
test eax, eax
jne 0x1f00760f
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop ebx
add esp, 0x428
ret
push ebp
mov ebp, dword [esp + 0x444]
push esi
mov esi, dword [esp + 0x440]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test esi, esi
je 0x1f007636
push 0
push esi
call edi
cmp eax, 0x102
jne 0x1f007656
push ebp
lea edx, [esp + 0x14]
push edx
call dword [esp + 0x450]
test eax, eax
je 0x1f007656
lea eax, [esp + 0x10]
push eax
push ebx
call sub.KERNEL32.dll_Module32NextW
test eax, eax
jne 0x1f007626
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x428
ret

Function at 0x1f007710
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 4]
push esi
push edi
push 0
push eax
mov edi, ecx
mov ecx, dword [esp + 0x18]
mov eax, dword [edi + 0x1c]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov esi, eax
test esi, esi
jne 0x1f00774a
cmp dword [edi + 4], eax
je 0x1f00774a
push eax
push str.Pipe_read_error_:
call fcn.1f0295f0
add esp, 8
mov eax, esi
pop edi
pop esi
ret 0xc

Function at 0x1f007750
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 4]
push esi
push edi
push 0
push eax
mov edi, ecx
mov ecx, dword [esp + 0x18]
mov eax, dword [edi + 0x1c]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov esi, eax
test esi, esi
jne 0x1f00778a
cmp dword [edi + 4], eax
je 0x1f00778a
push eax
push str.Pipe_write_error_:
call fcn.1f0295f0
add esp, 8
mov eax, esi
pop edi
pop esi
ret 0xc
Function at 0x1f013e40
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x1f0837c0]
push eax
cmp eax, 0x40
jae 0x1f013e52
call section..text
jmp 0x1f013e58
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0x1f013e5d
ret
mov eax, dword [eax + 4]
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
mov eax, dword [edx + eax + 0x10]
mov edx, dword [eax]
push esi
push edi
mov edi, dword [esp + 0xc]
lea esi, [edx + 0x1d30]
mov ecx, 0xc
rep movsd dword es:[edi], dword [esi]
fld qword [edx + 0x1d60]
sub esp, 8
fstp qword [esp]
call fcn.1f0138f0
mov eax, dword [edx + 0x1d74]
mov ecx, dword [edx + 0x38]
add esp, 8
pop edi
mov dword [ecx + 0x1b48], eax
mov eax, dword [edx + 0x1d70]
pop esi
ret

Function at 0x1f0141f0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push 0xffffffffffffffff
push 0x1f05690b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
push edi
call fcn.1f00104b
mov ebp, eax
mov eax, dword [0x1f0837c4]
push eax
cmp eax, 0x40
jae 0x1f014223
call section..text
jmp 0x1f014229
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [0x1f0837c4]
mov ebx, dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov edi, eax
lea eax, [edi + 1]
push eax
push ecx
cmp ecx, 0x40
jae 0x1f014248
call fcn.1f001021
jmp 0x1f01424a
call ebx
push 0x78
call fcn.1f03e9a2
add esp, 4
mov dword [esp + 0x10], eax
xor esi, esi
mov dword [esp + 0x1c], esi
cmp eax, esi
je 0x1f014272
mov ecx, dword [0x1f0837b8]
push ecx
mov ecx, eax
call fcn.1f01db80
mov esi, eax
mov dword [esp + 0x1c], 0xffffffff
mov eax, dword [0x1f0837c0]
push esi
push eax
cmp eax, 0x40
jae 0x1f01428d
call fcn.1f001021
jmp 0x1f01428f
call ebx
mov eax, dword [0x1f0837cc]
mov edx, dword [eax]
mov ecx, dword [edx + 4]
mov edx, dword [ecx + eax]
add ecx, eax
mov eax, dword [edx + 0x10]
push esi
call eax
mov eax, dword [0x1f0837c4]
push edi
push eax
cmp eax, 0x40
jae 0x1f0142b7
call fcn.1f001021
jmp 0x1f0142b9
call ebx
push ebp
call fcn.1f001055
mov ecx, dword [esp + 0x14]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x1f0143e0
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x1f0837c0]
push eax
cmp eax, 0x40
jae 0x1f0143f2
call section..text
jmp 0x1f0143f8
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0x1f0143fd
ret
dec dword [eax + 0x70]
mov ecx, dword [eax + 0x70]
push esi
mov esi, dword [eax + ecx*8 + 0x24]
cmp dword [esi + 0x1b2c], 0
push edi
mov edi, dword [eax + ecx*8 + 0x20]
jne 0x1f01443b
movzx eax, byte [esi + 0xb4]
mov edx, dword [esi + 0xb0]
push eax
lea ecx, [esi + 8]
push ecx
push edx
mov dword [esi + 0xa0], 0
call fcn.1f03f910
add esp, 0xc
lea eax, [esi + 0xa8]
mov ecx, eax
or edx, 0xffffffff
lock xadd dword [ecx], edx
mov ecx, dword [eax]
test ecx, ecx
jge 0x1f014456
mov dword [eax], 0
mov eax, edi
pop edi
pop esi
ret
Function at 0x1f014460
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x1f0837c8]
push eax
cmp eax, 0x40
jae 0x1f014479
call section..text
shl eax, 4
add eax, 0x1f07e9d8
ret
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
shl eax, 4
add eax, 0x1f07e9d8
ret

Function at 0x1f0144f0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebx
push esi
call fcn.1f00104b
mov ebx, eax
mov eax, dword [0x1f083734]
push 0x1f4
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov esi, 1
mov eax, 0x1f07e9f0
cmp dword [eax], 0
je 0x1f01452a
inc esi
add eax, 0x10
cmp esi, 0x400
jb 0x1f014514
pop esi
xor eax, eax
pop ebx
ret
mov eax, dword [0x1f0837c8]
push edi
mov edi, esi
shl edi, 4
mov dword [edi + 0x1f07e9e0], 1
push eax
cmp eax, 0x40
jae 0x1f01454c
call section..text
jmp 0x1f014552
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [edi + 0x1f07e9e4], eax
mov eax, dword [0x1f0837c8]
push esi
push eax
cmp eax, 0x40
jae 0x1f01456b
call fcn.1f001021
jmp 0x1f014571
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [0x1f083734]
push ecx
call dword [sym.imp.KERNEL32.dll_SetEvent]
push ebx
call fcn.1f001055
lea eax, [edi + 0x1f07e9d8]
pop edi
pop esi
pop ebx
ret

Function at 0x1f014630
Capabilities:
Allocate or change rwx memory

Disassembly:
sub esp, 0x618
push esi
mov esi, dword [esp + 0x620]
movzx ecx, byte [esi + 0xb4]
mov edx, dword [esi + 0xb0]
lea eax, [esi + 0xa4]
push eax
push 0x40
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1f0146b1
cmp dword [esp + 0x624], eax
mov eax, str.Error_removing_memory_protection_at_0x_p_for_function__s_in_module__s._Hook_wont_be_installed_for_this_function
jne 0x1f014673
mov eax, str.Error_removing_memory_protection_at_0x_p_for_function__s_in_module__s.
mov ecx, dword [esi + 0x1b04]
mov edx, dword [esi + 0x1b08]
push ecx
mov ecx, dword [esi + 0xb0]
push edx
push ecx
push eax
lea edx, [esp + 0x14]
push 0x30c
push edx
call fcn.1f03ea51
add esp, 0x18
lea eax, [esp + 4]
push eax
push 3
call fcn.1f029250
xor eax, eax
pop esi
add esp, 0x618
ret
mov eax, 1
pop esi
add esp, 0x618
ret
Function at 0x1f015c50
Capabilities:
Terminate thread

Disassembly:
sub esp, 0x818
push ebp
mov ebp, dword [esp + 0x820]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
push 0xc
push ebp
call edi
test eax, eax
je 0x1f015c79
pop edi
xor eax, eax
pop ebp
add esp, 0x818
ret
push esi
mov esi, dword [ebp]
push 0x1b78
push esi
call edi
test eax, eax
je 0x1f015c95
pop esi
pop edi
xor eax, eax
pop ebp
add esp, 0x818
ret
cmp dword [esi + 0x1b30], 0
je 0x1f015cad
pop esi
pop edi
mov eax, 1
pop ebp
add esp, 0x818
ret
movzx edi, byte [esi + 0xb4]
push ebx
push edi
lea ebx, [esi + 8]
lea eax, [esp + 0x20]
push ebx
push eax
mov dword [esi + 0x1b2c], 1
call fcn.1f03f910
push edi
lea ecx, [esi + 0x14]
push ecx
push ebx
call fcn.1f03f910
mov edx, dword [esi + 0xb0]
add esp, 0x18
push edx
call dword [sym.imp.KERNEL32.dll_IsBadCodePtr]
test eax, eax
je 0x1f015d03
push ebp
call fcn.1f00d960
pop ebx
pop esi
pop edi
mov eax, 1
pop ebp
add esp, 0x818
ret
lea eax, [esp + 0x1c]
push eax
push esi
call fcn.1f0158a0
mov ecx, dword [0x1f08372c]
add esp, 8
push ecx
xor edi, edi
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov edx, dword [esi + 0xac]
push 0x3e8
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x1f015db7
mov eax, dword [esi + 0xa8]
test eax, eax
je 0x1f015db7
mov ebp, dword [sym.imp.KERNEL32.dll_TerminateThread]
inc ebx
call fcn.1f033e60
test eax, eax
je 0x1f015d5f
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call ebp
jmp 0x1f015da6
test edi, edi
jne 0x1f015d9e
cmp ebx, 0xa
jbe 0x1f015d9e
mov ecx, dword [esi + 0x1b08]
mov edx, dword [esi + 0x1b04]
push ecx
push edx
push str.Waiting_for_return_of_api__s:_s...
lea eax, [esp + 0x34]
push 0x400
push eax
mov edi, 1
call fcn.1f03ea51
add esp, 0x14
lea ecx, [esp + 0x28]
push ecx
push 2
call fcn.1f029250
push 0x14
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [esi + 0xa8]
test edx, edx
jne 0x1f015d48
mov ebp, dword [esp + 0x82c]
mov edi, 1
mov dword [esi + 0x1b30], edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [0x1f06c378], 0
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], ebp
je 0x1f015de6
cmp byte [esi + 0xb5], 0
mov dword [esp + 0x18], edi
ja 0x1f015dee
mov dword [esp + 0x18], 0
mov eax, dword [0x1f0837a4]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
mov eax, dword [0x1f083700]
jne 0x1f015e36
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
lea ecx, [edx + eax]
mov eax, dword [ecx]
mov eax, dword [eax + 0x10]
lea edx, [esp + 0x10]
push edx
call eax
mov ecx, dword [0x1f083724]
push ecx
call dword [sym.imp.KERNEL32.dll_SetEvent]
pop ebx
pop esi
mov eax, edi
pop edi
pop ebp
add esp, 0x818
ret
mov edx, dword [eax]
mov ecx, dword [edx + 4]
mov edx, dword [ecx + eax]
mov edx, dword [edx + 0xc]
add ecx, eax
push edi
lea eax, [esp + 0x14]
push eax
call edx
pop ebx
pop esi
mov eax, edi
pop edi
pop ebp
add esp, 0x818
ret
Function at 0x1f016200
Capabilities:
Enumerate process modules

Disassembly:
sub esp, 0x630
push esi
push 0x424
lea eax, [esp + 0xc]
push 0
push eax
mov dword [esp + 0x10], 0
call fcn.1f03f700
mov ecx, dword [0x1f0836f0]
add esp, 0xc
push ecx
push 0x18
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
jne 0x1f016242
xor eax, eax
pop esi
add esp, 0x630
ret
push edi
mov edi, dword [esp + 0x63c]
push 0x5c
push edi
call fcn.1f03ed86
add esp, 8
test eax, eax
je 0x1f01625c
lea edi, [eax + 2]
lea edx, [esp + 8]
push edx
push esi
mov dword [esp + 0x10], 0x428
call sub.KERNEL32.dll_Module32FirstW
test eax, eax
je 0x1f016294
lea eax, [esp + 0x28]
push edi
push eax
call fcn.1f03ecf3
add esp, 8
test eax, eax
je 0x1f0162a6
lea ecx, [esp + 8]
push ecx
push esi
call sub.KERNEL32.dll_Module32NextW
test eax, eax
jne 0x1f016273
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor eax, eax
pop esi
add esp, 0x630
ret
mov eax, dword [esp + 0x640]
cmp eax, dword [esp + 0x20]
jbe 0x1f0162f0
push edi
push eax
push str.0x_p_is_an_invalid_relative_address_for_module__s
lea edx, [esp + 0x43c]
push 0x104
push edx
call fcn.1f03ea51
add esp, 0x14
lea eax, [esp + 0x430]
push eax
push 3
call fcn.1f029250
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor eax, eax
pop esi
add esp, 0x630
ret
mov ecx, dword [esp + 0x1c]
push esi
lea edi, [ecx + eax]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
add esp, 0x630
ret
Function at 0x1f018590
Capabilities:
Get thread local storage value

Disassembly:
push 0xffffffffffffffff
push 0x1f05690b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [0x1f0837c0]
push esi
push eax
cmp eax, 0x40
jae 0x1f0185b9
call section..text
jmp 0x1f0185bf
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x1f0185d5
pop esi
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret
push 0x3c
call fcn.1f03e9a2
add esp, 4
mov dword [esp + 4], eax
mov dword [esp + 0x10], 0
test eax, eax
je 0x1f018637
mov ecx, dword [esp + 0x44]
mov edx, dword [esp + 0x40]
push ecx
mov ecx, dword [esp + 0x40]
push esi
push edx
mov edx, dword [esp + 0x44]
push ecx
mov ecx, dword [esp + 0x44]
push edx
mov edx, dword [esp + 0x44]
push ecx
mov ecx, dword [esp + 0x44]
push edx
mov edx, dword [esp + 0x44]
push ecx
mov ecx, dword [esp + 0x44]
push edx
mov edx, dword [esp + 0x44]
push ecx
mov ecx, dword [esp + 0x44]
push edx
mov edx, dword [esp + 0x44]
push ecx
push edx
mov ecx, eax
call fcn.1f01dd30
mov esi, eax
jmp 0x1f018639
xor esi, esi
push edi
mov dword [esp + 0x14], 0xffffffff
mov ecx, esi
call fcn.1f01e4e0
mov edi, eax
test esi, esi
je 0x1f01865f
mov ecx, esi
call fcn.1f01e590
push esi
call fcn.1f03e97c
add esp, 4
mov ecx, dword [esp + 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x1f0193b0
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x1f0837c0]
push ebp
push eax
cmp eax, 0x40
jae 0x1f0193c3
call section..text
jmp 0x1f0193c9
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebp, eax
test ebp, ebp
je 0x1f01953a
mov eax, dword [ebp + 4]
test eax, eax
je 0x1f01953a
cmp dword [esp + 8], 0
je 0x1f0193f5
mov ecx, dword [eax]
mov ecx, dword [ecx + 4]
add ecx, eax
call fcn.1f03dac0
test eax, eax
jmp 0x1f019404
mov edx, dword [eax]
mov ecx, dword [edx + 4]
add ecx, eax
call fcn.1f03dac0
cmp eax, 1
je 0x1f01953a
mov eax, dword [ebp + 4]
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
cmp dword [edx + eax + 0x10], 0
je 0x1f01953a
push ebx
push esi
push edi
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
mov eax, dword [edx + eax + 0x10]
mov edi, dword [eax]
cmp dword [edi + 0x48], 0
je 0x1f019537
cmp dword [esp + 0x14], 0
mov ebx, dword [edi + 0x9c]
mov esi, dword [esp + 0x18]
je 0x1f01945d
mov eax, dword [edi + 0x3c]
cmp esi, eax
ja 0x1f0194ef
jne 0x1f01945d
cmp dword [esp + 0x1c], ebx
ja 0x1f0194ef
cmp esi, dword [edi + 0x3c]
je 0x1f01949d
mov ecx, dword [esp + 0x18]
push 8
push ecx
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x1f01949d
mov edx, dword [esp + 0x18]
push 8
push edx
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x1f019498
mov esi, dword [esi]
cmp esi, dword [edi + 0x3c]
je 0x1f01949d
push 8
push esi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
je 0x1f019484
cmp esi, dword [edi + 0x3c]
ja 0x1f0194ef
cmp dword [esp + 0x14], 0
je 0x1f0194b0
cmp dword [esp + 0x1c], ebx
jbe 0x1f019537
jmp 0x1f0194ef
mov edi, dword [edi + 0x38]
movzx eax, byte [edi + 0xb5]
xor edx, edx
test eax, eax
jbe 0x1f0194e1
lea ecx, [edi + 0x174]
mov esi, eax
mov eax, dword [ecx]
cmp eax, 4
ja 0x1f0194d4
mov eax, 4
add edx, eax
add ecx, 0xa4
sub esi, 1
jne 0x1f0194c8
mov eax, dword [esp + 0x1c]
add edx, ebx
cmp eax, edx
ja 0x1f0194ef
cmp eax, ebx
jae 0x1f019537
mov eax, dword [ebp + 8]
test eax, eax
je 0x1f019515
mov edx, dword [ebp + 4]
mov esi, dword [edx]
mov ecx, dword [eax]
mov esi, dword [esi + 4]
mov ecx, dword [ecx + 4]
mov edx, dword [esi + edx + 0x10]
mov edx, dword [edx]
add ecx, eax
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
push edx
push 0
call eax
mov ecx, dword [ebp + 4]
push 0
push ecx
push ebp
call fcn.1f018ef0
mov eax, dword [ebp + 4]
mov edx, dword [eax]
mov ecx, dword [edx + 4]
add esp, 0xc
cmp dword [ecx + eax + 0x10], 0
jne 0x1f019420
pop edi
pop esi
pop ebx
pop ebp
ret