joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003e0f0
Capabilities:
Enumerate processes

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006e6b3
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x2a8
mov eax, dword [0x10086040]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x288], edi
mov dword [ebp - 0x27c], edi
mov dword [ebp - 0x28c], edi
mov dword [ebp - 0x284], 0
push edx
lea ecx, [ebp - 0x44]
mov dword [ebp - 4], 0
call fcn.100051f0
lea eax, [ebx + 8]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x2c]
call fcn.100051f0
mov dword [ebp - 0x294], 0
push 0x34
mov byte [ebp - 4], 3
call fcn.10045ee0
add esp, 4
mov dword [ebp - 0x280], eax
mov byte [ebp - 4], 4
lea esi, [eax + 4]
mov dword [eax], 0x1007c160
mov ecx, esi
lea eax, [ebp - 0x44]
push eax
call fcn.100051f0
movups xmm0, xmmword [ebp - 0x2c]
mov dword [esi + 0x28], 0
xor eax, eax
mov dword [esi + 0x2c], 0
movups xmmword [esi + 0x18], xmm0
mov word [ebp - 0x2c], ax
movq xmm0, qword [ebp - 0x1c]
movq qword [esi + 0x28], xmm0
mov esi, dword [ebp - 0x280]
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x294], esi
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
push eax
mov byte [ebp - 4], 6
push 2
mov dword [ebp - 0x284], 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 0x27c], eax
cmp eax, 0xffffffff
je 0x1003e2a6
lea ecx, [ebp - 0x278]
mov dword [ebp - 0x278], 0x22c
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
nop dword [eax + eax]
test esi, esi
je 0x1003e248
mov eax, dword [esi]
lea ecx, [ebp - 0x278]
push ecx
mov ecx, esi
mov eax, dword [eax + 8]
call eax
test al, al
je 0x1003e283
mov eax, dword [edi + 4]
cmp eax, dword [edi + 8]
je 0x1003e274
mov ecx, 0x8b
lea esi, [ebp - 0x278]
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 0x288]
mov esi, dword [ebp - 0x280]
add dword [edi + 4], 0x22c
jmp 0x1003e283
lea ecx, [ebp - 0x278]
push ecx
push eax
mov ecx, edi
call fcn.10041fc0
lea eax, [ebp - 0x278]
push eax
push dword [ebp - 0x27c]
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1003e230
push dword [ebp - 0x27c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x1003e2c0
mov edx, dword [esi]
lea eax, [ebp - 0x2b8]
cmp esi, eax
mov ecx, esi
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
lea ecx, [ebp - 0x44]
call fcn.1003c8e0
mov ecx, dword [ebx + 0x1c]
cmp ecx, 7
jbe 0x1003e2fe
mov edx, dword [ebx + 8]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x1003e2f4
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1003e31e
push ecx
push edx
call fcn.1004633f
add esp, 8
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.10045df2
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.1004eae1
int3
Function at 0x1003e330
Capabilities:
Patch process command line

Disassembly:
sub esp, 0x4c
mov eax, dword [0x10086040]
xor eax, esp
mov dword [esp + 0x44], eax
push ebx
push ebp
push esi
push edi
push edx
mov esi, ecx
push 0
mov dword [esp + 0x1c], esi
push 0x410
mov dword [esp + 0x20], esi
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x1003e505
mov eax, dword [0x1008947c]
xorps xmm0, xmm0
movq qword [esp + 0x34], xmm0
movups xmmword [esp + 0x24], xmm0
test eax, eax
jne 0x1003e397
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push str.NtQueryInformationProcess
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1008947c], eax
push 0
push 0x18
lea ecx, [esp + 0x2c]
push ecx
push 0
push edi
call eax
test eax, eax
js 0x1003e4fe
mov eax, dword [esp + 0x28]
test eax, eax
je 0x1003e4fe
mov ebp, dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea ecx, [esp + 0x10]
push ecx
push 4
lea ecx, [esp + 0x1c]
mov dword [esp + 0x18], 0
push ecx
add eax, 0x10
push eax
push edi
call ebp
test eax, eax
je 0x1003e4fe
cmp dword [esp + 0x10], 4
jne 0x1003e4fe
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x10]
push ecx
push 8
lea ecx, [esp + 0x20]
add eax, 0x40
push ecx
push eax
push edi
call ebp
test eax, eax
je 0x1003e4fe
cmp dword [esp + 0x10], 8
jne 0x1003e4fe
movzx eax, word [esp + 0x1a]
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.10046383
add esp, 4
mov ebx, eax
movzx eax, word [esp + 0x1a]
push eax
push 0
push ebx
call fcn.1004b6f0
add esp, 0xc
lea eax, [esp + 0x10]
push eax
movzx eax, word [esp + 0x1c]
push eax
push ebx
push dword [esp + 0x28]
push edi
call ebp
test eax, eax
je 0x1003e4f5
movzx eax, word [esp + 0x18]
cmp dword [esp + 0x10], eax
jne 0x1003e4f5
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, ebx
mov dword [esp + 0x4c], 0
xorps xmm0, xmm0
mov dword [esp + 0x50], 0
movups xmmword [esp + 0x3c], xmm0
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1003e496
sub ecx, edx
sar ecx, 1
push ecx
push ebx
lea ecx, [esp + 0x44]
call fcn.10005600
push ebx
call fcn.10046370
xorps xmm0, xmm0
add esp, 4
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov eax, esi
movups xmm0, xmmword [esp + 0x3c]
mov dword [esi + 0x14], 0
movups xmmword [esi], xmm0
movq xmm0, qword [esp + 0x4c]
movq qword [esi + 0x10], xmm0
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x44]
xor ecx, esp
call fcn.10045df2
add esp, 0x4c
ret
push ebx
call fcn.10046370
add esp, 4
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xorps xmm0, xmm0
mov ecx, esi
push 0
movups xmmword [esi], xmm0
push 0x1007adcc
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.10005600
mov ecx, dword [esp + 0x54]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10045df2
add esp, 0x4c
ret
Function at 0x1003e540
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
mov eax, dword [0x10086bd8]
sub esp, 0x24
push ebx
push esi
push edi
cmp eax, 0xffffffff
jne 0x1003e5d7
push 0
push 0
push 2
push 2
push 1
push 0
push 3
push str..pipegpipe
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov edi, eax
cmp edi, 0xffffffff
je 0x1003e5d2
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
call fcn.1003dff0
mov ebx, eax
test ebx, ebx
je 0x1003e5cb
mov esi, dword [ebx]
xor edx, edx
test esi, esi
je 0x1003e5c2
lea ecx, [ebx + 8]
nop dword [eax + eax]
movq xmm0, qword [ecx + 0x10]
movq qword [esp + 0x20], xmm0
cmp edi, dword [ecx]
je 0x1003e5b9
inc edx
add ecx, 0x1c
cmp edx, esi
jb 0x1003e5a0
jmp 0x1003e5c2
mov eax, dword [esp + 0x20]
mov dword [0x10086bd8], eax
push ebx
call fcn.1005365e
add esp, 4
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x10086bd8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1003e5e0
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x18
mov eax, dword [0x10086040]
xor eax, esp
mov dword [esp + 0x14], eax
lea eax, [esp]
mov dword [esp], 0
push eax
xorps xmm0, xmm0
push 0x28
movlpd qword [esp + 0x10], xmm0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x1003e62c
xor al, al
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.10045df2
mov esp, ebp
pop ebp
ret
lea eax, [esp + 8]
mov dword [esp + 4], 1
push eax
push str.SeDebugPrivilege
push 0
mov dword [esp + 0x1c], 2
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x1003e669
push 0
push 0
push 0
lea eax, [esp + 0x10]
push eax
push 0
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push dword [esp]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x14]
mov al, 1
xor ecx, esp
call fcn.10045df2
mov esp, ebp
pop ebp
ret
Function at 0x10043e40
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006ed9c
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x10086040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov esi, ecx
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0
push eax
push 0x40
push 4
push dword [esi]
mov dword [ebp - 0x10], 0
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x10043e91
xor edi, edi
jmp 0x10043ec8
mov eax, dword [esi]
push 0x28
mov esi, dword [eax + edi*4]
call fcn.10045ee0
mov edi, eax
add esp, 4
mov dword [ebp - 0x14], edi
lea eax, [ebp + 8]
mov byte [ebp - 4], 1
push eax
lea ecx, [edi + 4]
mov dword [edi], 0
call fcn.10005430
mov eax, dword [ebp + 0x20]
mov dword [edi + 0x1c], esi
mov dword [edi + 0x20], eax
mov byte [edi + 0x24], 0
mov ecx, dword [ebp + 0x1c]
cmp ecx, 0xf
jbe 0x10043ef8
mov edx, dword [ebp + 8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10043eee
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10043f0b
push ecx
push edx
call fcn.1004633f
add esp, 8
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
call fcn.1004eae1
int3
Function at 0x10044940
Capabilities:
Enumerate threads
Suspend thread

Disassembly:
sub esp, 0x24
mov eax, dword [0x10086040]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push ebp
push esi
mov esi, ecx
mov dword [esp + 0xc], edx
push edi
push 0
push 4
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
je 0x10044a4b
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x10044a44
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebp, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
nop dword [eax]
cmp dword [esp + 0x14], 0x10
jb 0x10044a28
call ebx
cmp dword [esp + 0x20], eax
jne 0x10044a28
call ebp
cmp dword [esp + 0x1c], eax
je 0x10044a28
mov edx, dword [esi]
test edx, edx
jne 0x100449f0
push 0x200
push edx
push dword [0x10088ea8]
mov dword [esi + 4], 0x80
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
mov dword [esi], edx
test edx, edx
je 0x10044a44
jmp 0x10044a1b
mov eax, dword [esi + 4]
cmp dword [esi + 8], eax
jb 0x10044a1b
shl eax, 3
push eax
push edx
push 0
push dword [0x10088ea8]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov edx, eax
test edx, edx
je 0x10044a44
mov eax, dword [esi + 4]
add eax, eax
mov dword [esi], edx
mov dword [esi + 4], eax
mov ecx, dword [esi + 8]
mov eax, dword [esp + 0x1c]
mov dword [edx + ecx*4], eax
inc dword [esi + 8]
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x100449b0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esi], 0
je 0x10044a98
xor edi, edi
cmp dword [esi + 8], edi
jbe 0x10044a98
mov ebp, dword [esp + 0x38]
nop dword [eax + eax]
mov eax, dword [esi]
push dword [eax + edi*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov ebx, eax
test ebx, ebx
je 0x10044a92
push ebx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov edx, dword [esp + 0x10]
mov ecx, ebx
push ebp
call fcn.100447d0
add esp, 4
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, dword [esi + 8]
jb 0x10044a60
mov ecx, dword [esp + 0x30]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10045df2
add esp, 0x24
ret

Function at 0x10044ab0
Capabilities:
Resume thread

Disassembly:
push ebx
mov ebx, ecx
cmp dword [ebx], 0
je 0x10044b00
push esi
xor esi, esi
cmp dword [ebx + 8], esi
jbe 0x10044aef
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_ResumeThread]
push edi
mov eax, dword [ebx]
push dword [eax + esi*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov edi, eax
test edi, edi
je 0x10044ae7
push edi
call ebp
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, dword [ebx + 8]
jb 0x10044ac8
pop edi
pop ebp
push dword [ebx]
push 0
push dword [0x10088ea8]
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop esi
pop ebx
ret
Function at 0x10044b10
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
push ebx
push ebp
push esi
imul esi, ecx, 0x2c
mov ebx, edx
push edi
add esi, dword [0x10089730]
mov eax, dword [esi]
mov cl, byte [esi + 0x14]
and cl, 1
lea edi, [eax - 5]
cmove edi, eax
movzx eax, cl
lea ebp, [eax*2 + 5]
lea eax, [esp + 0x10]
push eax
push 0x40
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x10044b56
pop edi
pop esi
pop ebp
mov eax, 0xa
pop ebx
pop ecx
ret
test ebx, ebx
je 0x10044b77
mov byte [edi], 0xe9
mov eax, dword [esi + 4]
sub eax, edi
sub eax, 5
mov dword [edi + 1], eax
test byte [esi + 0x14], 1
je 0x10044b98
mov eax, dword [esi]
mov word [eax], 0xf9eb
jmp 0x10044b98
mov eax, dword [esi + 0xc]
test byte [esi + 0x14], 1
mov dword [edi], eax
je 0x10044b92
mov ax, word [esi + 0x10]
mov word [edi + 4], ax
mov al, byte [esi + 0x12]
mov byte [edi + 6], al
jmp 0x10044b98
mov al, byte [esi + 0x10]
mov byte [edi + 4], al
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x14]
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov cl, bl
shl bl, 2
add cl, cl
xor cl, byte [esi + 0x14]
and cl, 2
xor cl, byte [esi + 0x14]
xor bl, cl
and bl, 4
xor bl, cl
xor eax, eax
pop edi
mov byte [esi + 0x14], bl
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x10044be0
Capabilities:
Resume thread

Disassembly:
mov ecx, dword [0x10089738]
sub esp, 0xc
push ebx
push esi
xor ebx, ebx
xor esi, esi
test ecx, ecx
je 0x10044cba
mov eax, dword [0x10089730]
add eax, 0x14
nop
test byte [eax], 2
je 0x10044c15
inc esi
add eax, 0x2c
cmp esi, ecx
jb 0x10044c00
pop esi
mov eax, ebx
pop ebx
add esp, 0xc
ret
cmp esi, 0xffffffff
je 0x10044cba
push edi
push 1
or edx, 0xffffffff
lea ecx, [esp + 0x10]
call fcn.10044940
mov ecx, dword [0x10089738]
add esp, 4
cmp esi, ecx
jae 0x10044c6c
imul edi, esi, 0x2c
nop dword [eax]
mov eax, dword [0x10089730]
test byte [edi + eax + 0x14], 2
jne 0x10044c64
mov edx, 1
mov ecx, esi
call fcn.10044b10
mov ebx, eax
test ebx, ebx
jne 0x10044c6c
mov ecx, dword [0x10089738]
inc esi
add edi, 0x2c
cmp esi, ecx
jb 0x10044c40
push ebp
mov ebp, dword [esp + 0x10]
test ebp, ebp
je 0x10044cb8
xor esi, esi
cmp dword [esp + 0x18], esi
jbe 0x10044ca9
nop dword [eax]
push dword [ebp + esi*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov edi, eax
test edi, edi
je 0x10044ca2
push edi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, dword [esp + 0x18]
jb 0x10044c80
push ebp
push 0
push dword [0x10088ea8]
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop ebp
pop edi
pop esi
mov eax, ebx
pop ebx
add esp, 0xc
ret
Function at 0x10044ff0
Capabilities:
Allocate or change rwx memory

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov ebx, ecx
xor edi, edi
call fcn.10044cd0
cmp dword [0x10088ea8], edi
je 0x1004517d
mov edx, dword [0x10089738]
xor esi, esi
test edx, edx
je 0x1004502c
mov ecx, dword [0x10089730]
mov eax, ecx
cmp ebx, dword [eax]
je 0x10045036
inc esi
add eax, 0x2c
cmp esi, edx
jb 0x10045020
mov edi, 4
jmp 0x10045182
cmp esi, 0xffffffff
je 0x1004502c
imul ebp, esi, 0x2c
test byte [ecx + ebp + 0x14], 2
je 0x100450f9
push 0
mov edx, esi
lea ecx, [esp + 0x1c]
call fcn.10044940
mov edi, dword [0x10089730]
add esp, 4
add edi, ebp
mov eax, dword [edi]
mov cl, byte [edi + 0x14]
and cl, 1
lea ebx, [eax - 5]
cmove ebx, eax
movzx eax, cl
lea ecx, [esp + 0x10]
push ecx
push 0x40
lea eax, [eax*2 + 5]
push eax
push ebx
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x10045095
lea edi, [eax + 0xa]
jmp 0x100450e2
mov eax, dword [edi + 0xc]
test byte [edi + 0x14], 1
mov dword [ebx], eax
je 0x100450b0
mov ax, word [edi + 0x10]
mov word [ebx + 4], ax
mov al, byte [edi + 0x12]
mov byte [ebx + 6], al
jmp 0x100450b6
mov al, byte [edi + 0x10]
mov byte [ebx + 4], al
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x14]
push dword [esp + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push dword [esp + 0x14]
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
and byte [edi + 0x14], 0xf9
xor edi, edi
lea ecx, [esp + 0x18]
call fcn.10044ab0
test edi, edi
jne 0x10045182
mov ecx, dword [0x10089730]
mov ecx, dword [ecx + ebp + 8]
call fcn.100455d0
mov eax, dword [0x10089738]
lea edx, [eax - 1]
cmp esi, edx
jae 0x1004513e
mov ecx, dword [0x10089730]
imul eax, eax, 0x2c
movups xmm0, xmmword [eax + ecx - 0x2c]
movups xmmword [ecx + ebp], xmm0
movups xmm0, xmmword [eax + ecx - 0x1c]
movups xmmword [ecx + ebp + 0x10], xmm0
movq xmm0, qword [eax + ecx - 0xc]
movq qword [ecx + ebp + 0x20], xmm0
mov eax, dword [eax + ecx - 4]
mov dword [ecx + ebp + 0x28], eax
mov eax, dword [0x10089734]
shr eax, 1
mov dword [0x10089738], edx
cmp eax, 0x20
jb 0x10045182
cmp eax, edx
jb 0x10045182
imul eax, eax, 0x2c
push eax
push dword [0x10089730]
push 0
push dword [0x10088ea8]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
test eax, eax
je 0x10045182
shr dword [0x10089734], 1
mov dword [0x10089730], eax
jmp 0x10045182
mov edi, 2
xor ecx, ecx
mov eax, 0x10088ea4
xchg dword [eax], ecx
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x10046f7b
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push 2
lea eax, [ebp - 4]
push eax
push 0x20000001
push str._x_sys_default_locale
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
xor ecx, ecx
test eax, eax
jne 0x10046fa2
mov eax, ecx
mov dword [ebp - 4], eax
jmp 0x10046fa5
mov eax, dword [ebp - 4]
push esi
mov esi, dword [ebp + 0xc]
push ecx
push ecx
push esi
push eax
push dword [ebp + 8]
push ecx
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push eax
push dword [esi]
call fcn.10046f57
pop esi
leave
ret 8

Function at 0x10048c00
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
push edi
mov edi, dword [ebp + 0xc]
test eax, eax
jg 0x10048c21
jl 0x10048c18
test edi, edi
jne 0x10048c21
xor eax, eax
xor edx, edx
jmp 0x10048ce2
cmp dword [ebx + 0x38], 0
je 0x10048c36
push eax
push edi
push dword [ebp + 8]
call fcn.1000c3b0
jmp 0x10048ce2
mov eax, dword [ebx + 0x1c]
push esi
mov esi, edi
mov ecx, dword [eax]
test ecx, ecx
je 0x10048c7d
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax]
mov dword [ebp - 4], eax
test eax, eax
je 0x10048c7d
cmp eax, edi
jb 0x10048c57
mov eax, edi
mov dword [ebp - 4], edi
push eax
push ecx
push dword [ebp + 8]
call fcn.1004b850
mov ecx, dword [ebp - 4]
add esp, 0xc
mov eax, dword [ebp + 8]
sub esi, ecx
add eax, ecx
mov dword [ebp - 4], eax
mov eax, dword [ebx + 0x2c]
sub dword [eax], ecx
mov eax, dword [ebx + 0x1c]
add dword [eax], ecx
jmp 0x10048c83
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp dword [ebx + 0x4c], 0
je 0x10048cd7
mov ecx, ebx
call fcn.100484c5
mov ecx, dword [ebp - 4]
mov edx, esi
mov eax, 0xfff
cmp esi, eax
jbe 0x10048cc2
push dword [ebx + 0x4c]
push eax
push 1
push ecx
call fcn.10055bae
mov ecx, dword [ebp - 4]
sub esi, eax
add ecx, eax
add esp, 0x10
mov dword [ebp - 4], ecx
mov edx, esi
cmp eax, 0xfff
jne 0x10048cd7
jmp 0x10048c95
test edx, edx
je 0x10048cd7
push dword [ebx + 0x4c]
push esi
push 1
push ecx
call fcn.10055bae
add esp, 0x10
sub esi, eax
mov edx, dword [ebp + 0x10]
sub edi, esi
mov eax, edi
sbb edx, 0
pop esi
pop edi
pop ebx
leave
ret 0xc

Function at 0x100543ac
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x100543eb
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x100543eb
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x100543eb
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x100543eb
cmp dword [ecx + 0x74], 0xe
jbe 0x100543eb
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x1005ab1e
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10075a3c
push 0x10075a34
push str.FlsAlloc
push 0x1f
call fcn.1005a926
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1005ab52
push dword [ebp + 8]
mov ecx, esi
call dword [0x10071358]
call esi
jmp 0x1005ab58
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4
Function at 0x1005ab9c
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10075a4c
push 0x10075a44
push str.FlsGetValue
push 0x21
call fcn.1005a926
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1005abd3
push dword [ebp + 8]
mov ecx, esi
call dword [0x10071358]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1005abdb
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10075a54
push 0x10075a4c
push str.FlsSetValue
push 0x22
call fcn.1005a926
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1005ac15
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x10071358]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]

Function at 0x1005d29e
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1005d220
Function at 0x1005e40d
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1005e4aa
push ebx
push esi
call fcn.1005e3d6
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1005e36a
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x1005e457
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1005e4a9
push edi
push eax
call fcn.1005a568
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x1005e477
call fcn.1005a613
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1005e4a8
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1005e36a
add esp, 0x20
test eax, eax
jne 0x1005e496
push edi
call fcn.1005a613
jmp 0x1005e49e
push ebx
call fcn.1005a613
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret