joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10024933
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
mov dword [esp + 4], ecx
push ebx
push esi
push edi
mov edi, edx
mov dword [esp + 0x14], edi
test ecx, ecx
je 0x100249b9
cmp dword [ebp + 8], 0
je 0x100249b9
test edi, edi
jne 0x10024960
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, edi
xor edi, edi
push dword [ebp + 8]
lea eax, [ebx + ebx]
mov esi, 0x1f80000
cmp eax, 0x3f00000
lea eax, [ecx + edi*2]
cmovb esi, ebx
push esi
push 2
push eax
call fcn.10052e7d
add esp, 0x10
add edi, eax
sub ebx, eax
cmp esi, eax
jne 0x10024996
mov ecx, dword [esp + 0x10]
test ebx, ebx
jne 0x10024964
mov dword [esp + 0x10], edi
mov edi, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
test ebx, ebx
je 0x100249b5
push edi
push esi
push str.cimg::fread__:_Only__lu__lu_elements_could_be_read_from_file.
call fcn.1000188c
add esp, 0xc
mov eax, esi
jmp 0x10024959
push ecx
push dword [ebp + 8]
cmp edi, 1
mov eax, 0x100d2188
mov ecx, 0x10099e32
cmovbe eax, ecx
push eax
call fcn.10001707
push eax
push edi
lea eax, [esp + 0x2c]
push str.cimg::fread__:_Invalid_reading_request_of__u__s_s_from_file__p_to_buffer__p.
push eax
call fcn.10001470
add esp, 0x1c
lea eax, [esp + 0x18]
push 0x100dc0a4
push eax
call fcn.10044a07
int3

Function at 0x10024a16
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
mov dword [esp + 4], ecx
push ebx
push esi
push edi
mov edi, edx
mov dword [esp + 0x14], edi
test ecx, ecx
je 0x10024a9e
cmp dword [ebp + 8], 0
je 0x10024a9e
test edi, edi
jne 0x10024a43
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, edi
xor edi, edi
push dword [ebp + 8]
mov eax, ebx
mov esi, 0xfc0000
shl eax, 2
cmp eax, 0x3f00000
lea eax, [ecx + edi*4]
cmovb esi, ebx
push esi
push 4
push eax
call fcn.10052e7d
add esp, 0x10
add edi, eax
sub ebx, eax
cmp esi, eax
jne 0x10024a7b
mov ecx, dword [esp + 0x10]
test ebx, ebx
jne 0x10024a47
mov dword [esp + 0x10], edi
mov edi, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
test ebx, ebx
je 0x10024a9a
push edi
push esi
push str.cimg::fread__:_Only__lu__lu_elements_could_be_read_from_file.
call fcn.1000188c
add esp, 0xc
mov eax, esi
jmp 0x10024a3c
push ecx
push dword [ebp + 8]
cmp edi, 1
mov eax, 0x100d2188
mov ecx, 0x10099e32
cmovbe eax, ecx
push eax
call fcn.10001713
push eax
push edi
lea eax, [esp + 0x2c]
push str.cimg::fread__:_Invalid_reading_request_of__u__s_s_from_file__p_to_buffer__p.
push eax
call fcn.10001470
add esp, 0x1c
lea eax, [esp + 0x18]
push 0x100dc0a4
push eax
call fcn.10044a07
int3
Function at 0x10024af3
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
mov dword [esp + 4], ecx
push ebx
push esi
push edi
mov edi, edx
mov dword [esp + 0x14], edi
test ecx, ecx
je 0x10024b7b
cmp dword [ebp + 8], 0
je 0x10024b7b
test edi, edi
jne 0x10024b20
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, edi
xor edi, edi
push dword [ebp + 8]
mov eax, ebx
mov esi, 0xfc0000
shl eax, 2
cmp eax, 0x3f00000
lea eax, [ecx + edi*4]
cmovb esi, ebx
push esi
push 4
push eax
call fcn.10052e7d
add esp, 0x10
add edi, eax
sub ebx, eax
cmp esi, eax
jne 0x10024b58
mov ecx, dword [esp + 0x10]
test ebx, ebx
jne 0x10024b24
mov dword [esp + 0x10], edi
mov edi, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
test ebx, ebx
je 0x10024b77
push edi
push esi
push str.cimg::fread__:_Only__lu__lu_elements_could_be_read_from_file.
call fcn.1000188c
add esp, 0xc
mov eax, esi
jmp 0x10024b19
push ecx
push dword [ebp + 8]
cmp edi, 1
mov eax, 0x100d2188
mov ecx, 0x10099e32
cmovbe eax, ecx
push eax
call fcn.1002522a
push eax
push edi
lea eax, [esp + 0x2c]
push str.cimg::fread__:_Invalid_reading_request_of__u__s_s_from_file__p_to_buffer__p.
push eax
call fcn.10001470
add esp, 0x1c
lea eax, [esp + 0x18]
push 0x100dc0a4
push eax
call fcn.10044a07
int3

Function at 0x10024bb9
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
mov dword [esp + 4], ecx
push ebx
push esi
push edi
mov edi, edx
mov dword [esp + 0x14], edi
test ecx, ecx
je 0x10024c41
cmp dword [ebp + 8], 0
je 0x10024c41
test edi, edi
jne 0x10024be6
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, edi
xor edi, edi
push dword [ebp + 8]
mov eax, ebx
mov esi, 0xfc0000
shl eax, 2
cmp eax, 0x3f00000
lea eax, [ecx + edi*4]
cmovb esi, ebx
push esi
push 4
push eax
call fcn.10052e7d
add esp, 0x10
add edi, eax
sub ebx, eax
cmp esi, eax
jne 0x10024c1e
mov ecx, dword [esp + 0x10]
test ebx, ebx
jne 0x10024bea
mov dword [esp + 0x10], edi
mov edi, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
test ebx, ebx
je 0x10024c3d
push edi
push esi
push str.cimg::fread__:_Only__lu__lu_elements_could_be_read_from_file.
call fcn.1000188c
add esp, 0xc
mov eax, esi
jmp 0x10024bdf
push ecx
push dword [ebp + 8]
cmp edi, 1
mov eax, 0x100d2188
mov ecx, 0x10099e32
cmovbe eax, ecx
push eax
call fcn.10001719
push eax
push edi
lea eax, [esp + 0x2c]
push str.cimg::fread__:_Invalid_reading_request_of__u__s_s_from_file__p_to_buffer__p.
push eax
call fcn.10001470
add esp, 0x1c
lea eax, [esp + 0x18]
push 0x100dc0a4
push eax
call fcn.10044a07
int3
Function at 0x10024c7f
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
mov dword [esp + 4], ecx
push ebx
push esi
push edi
mov edi, edx
mov dword [esp + 0x14], edi
test ecx, ecx
je 0x10024d05
cmp dword [ebp + 8], 0
je 0x10024d05
test edi, edi
jne 0x10024cac
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, edi
xor edi, edi
push dword [ebp + 8]
lea eax, [ebx + ebx]
mov esi, 0x1f80000
cmp eax, 0x3f00000
lea eax, [ecx + edi*2]
cmovb esi, ebx
push esi
push 2
push eax
call fcn.10052e7d
add esp, 0x10
add edi, eax
sub ebx, eax
cmp esi, eax
jne 0x10024ce2
mov ecx, dword [esp + 0x10]
test ebx, ebx
jne 0x10024cb0
mov dword [esp + 0x10], edi
mov edi, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
test ebx, ebx
je 0x10024d01
push edi
push esi
push str.cimg::fread__:_Only__lu__lu_elements_could_be_read_from_file.
call fcn.1000188c
add esp, 0xc
mov eax, esi
jmp 0x10024ca5
push ecx
push dword [ebp + 8]
cmp edi, 1
mov eax, 0x100d2188
mov ecx, 0x10099e32
cmovbe eax, ecx
push eax
call fcn.1000170d
push eax
push edi
lea eax, [esp + 0x2c]
push str.cimg::fread__:_Invalid_reading_request_of__u__s_s_from_file__p_to_buffer__p.
push eax
call fcn.10001470
add esp, 0x1c
lea eax, [esp + 0x18]
push 0x100dc0a4
push eax
call fcn.10044a07
int3

Function at 0x10024d43
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
mov dword [esp + 4], ecx
push ebx
push esi
push edi
mov edi, edx
mov dword [esp + 0x14], edi
test ecx, ecx
je 0x10024dcb
cmp dword [ebp + 8], 0
je 0x10024dcb
test edi, edi
jne 0x10024d70
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, edi
xor edi, edi
push dword [ebp + 8]
mov eax, ebx
mov esi, 0x7e0000
shl eax, 3
cmp eax, 0x3f00000
lea eax, [ecx + edi*8]
cmovb esi, ebx
push esi
push 8
push eax
call fcn.10052e7d
add esp, 0x10
add edi, eax
sub ebx, eax
cmp esi, eax
jne 0x10024da8
mov ecx, dword [esp + 0x10]
test ebx, ebx
jne 0x10024d74
mov dword [esp + 0x10], edi
mov edi, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
test ebx, ebx
je 0x10024dc7
push edi
push esi
push str.cimg::fread__:_Only__lu__lu_elements_could_be_read_from_file.
call fcn.1000188c
add esp, 0xc
mov eax, esi
jmp 0x10024d69
push ecx
push dword [ebp + 8]
cmp edi, 1
mov eax, 0x100d2188
mov ecx, 0x10099e32
cmovbe eax, ecx
push eax
call fcn.1000172b
push eax
push edi
lea eax, [esp + 0x2c]
push str.cimg::fread__:_Invalid_reading_request_of__u__s_s_from_file__p_to_buffer__p.
push eax
call fcn.10001470
add esp, 0x1c
lea eax, [esp + 0x18]
push 0x100dc0a4
push eax
call fcn.10044a07
int3
Function at 0x10024e2c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
mov dword [esp + 4], ecx
push ebx
push esi
push edi
mov edi, edx
mov dword [esp + 0x14], edi
test ecx, ecx
je 0x10024eb4
cmp dword [ebp + 8], 0
je 0x10024eb4
test edi, edi
jne 0x10024e59
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, edi
xor edi, edi
push dword [ebp + 8]
mov eax, ebx
mov esi, 0xfc0000
shl eax, 2
cmp eax, 0x3f00000
lea eax, [ecx + edi*4]
cmovb esi, ebx
push esi
push 4
push eax
call fcn.10052e7d
add esp, 0x10
add edi, eax
sub ebx, eax
cmp esi, eax
jne 0x10024e91
mov ecx, dword [esp + 0x10]
test ebx, ebx
jne 0x10024e5d
mov dword [esp + 0x10], edi
mov edi, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
test ebx, ebx
je 0x10024eb0
push edi
push esi
push str.cimg::fread__:_Only__lu__lu_elements_could_be_read_from_file.
call fcn.1000188c
add esp, 0xc
mov eax, esi
jmp 0x10024e52
push ecx
push dword [ebp + 8]
cmp edi, 1
mov eax, 0x100d2188
mov ecx, 0x10099e32
cmovbe eax, ecx
push eax
call fcn.10001731
push eax
push edi
lea eax, [esp + 0x2c]
push str.cimg::fread__:_Invalid_reading_request_of__u__s_s_from_file__p_to_buffer__p.
push eax
call fcn.10001470
add esp, 0x1c
lea eax, [esp + 0x18]
push 0x100dc0a4
push eax
call fcn.10044a07
int3

Function at 0x10024f22
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
mov dword [esp + 4], ecx
push ebx
push esi
push edi
mov edi, edx
mov dword [esp + 0x14], edi
test ecx, ecx
je 0x10024faa
cmp dword [ebp + 8], 0
je 0x10024faa
test edi, edi
jne 0x10024f4f
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, edi
xor edi, edi
push dword [ebp + 8]
mov eax, ebx
mov esi, 0x7e0000
shl eax, 3
cmp eax, 0x3f00000
lea eax, [ecx + edi*8]
cmovb esi, ebx
push esi
push 8
push eax
call fcn.10052e7d
add esp, 0x10
add edi, eax
sub ebx, eax
cmp esi, eax
jne 0x10024f87
mov ecx, dword [esp + 0x10]
test ebx, ebx
jne 0x10024f53
mov dword [esp + 0x10], edi
mov edi, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
test ebx, ebx
je 0x10024fa6
push edi
push esi
push str.cimg::fread__:_Only__lu__lu_elements_could_be_read_from_file.
call fcn.1000188c
add esp, 0xc
mov eax, esi
jmp 0x10024f48
push ecx
push dword [ebp + 8]
cmp edi, 1
mov eax, 0x100d2188
mov ecx, 0x10099e32
cmovbe eax, ecx
push eax
call fcn.1000171f
push eax
push edi
lea eax, [esp + 0x2c]
push str.cimg::fread__:_Invalid_reading_request_of__u__s_s_from_file__p_to_buffer__p.
push eax
call fcn.10001470
add esp, 0x1c
lea eax, [esp + 0x18]
push 0x100dc0a4
push eax
call fcn.10044a07
int3
Function at 0x10024fe8
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
mov dword [esp + 4], ecx
push ebx
push esi
push edi
mov edi, edx
mov dword [esp + 0x14], edi
test ecx, ecx
je 0x10025070
cmp dword [ebp + 8], 0
je 0x10025070
test edi, edi
jne 0x10025015
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, edi
xor edi, edi
push dword [ebp + 8]
mov eax, ebx
mov esi, 0x7e0000
shl eax, 3
cmp eax, 0x3f00000
lea eax, [ecx + edi*8]
cmovb esi, ebx
push esi
push 8
push eax
call fcn.10052e7d
add esp, 0x10
add edi, eax
sub ebx, eax
cmp esi, eax
jne 0x1002504d
mov ecx, dword [esp + 0x10]
test ebx, ebx
jne 0x10025019
mov dword [esp + 0x10], edi
mov edi, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
test ebx, ebx
je 0x1002506c
push edi
push esi
push str.cimg::fread__:_Only__lu__lu_elements_could_be_read_from_file.
call fcn.1000188c
add esp, 0xc
mov eax, esi
jmp 0x1002500e
push ecx
push dword [ebp + 8]
cmp edi, 1
mov eax, 0x100d2188
mov ecx, 0x10099e32
cmovbe eax, ecx
push eax
call fcn.10001725
push eax
push edi
lea eax, [esp + 0x2c]
push str.cimg::fread__:_Invalid_reading_request_of__u__s_s_from_file__p_to_buffer__p.
push eax
call fcn.10001470
add esp, 0x1c
lea eax, [esp + 0x18]
push 0x100dc0a4
push eax
call fcn.10044a07
int3
Function at 0x10039dc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ecx
mov eax, dword [esp + 8]
push ebx
push ebp
push esi
movzx ebp, ax
xor eax, eax
mov esi, ebp
push edi
shr esi, 8
xor edi, edi
mov dword [esp + 0x10], esi
cmp dword [esp + 0x20], eax
jbe 0x10039e21
mov ebx, dword [esp + 0x24]
mov ecx, dword [esp + 0x1c]
movzx ecx, word [ecx + edi*2]
mov edx, ecx
movzx ecx, cl
shr edx, 8
add edx, eax
cmp esi, ecx
jb 0x10039e21
jne 0x10039e18
cmp eax, edx
jge 0x10039e18
mov ecx, dword [esp + 0x18]
movzx esi, cl
movzx ecx, byte [eax + ebx]
cmp cx, si
je 0x10039e49
inc eax
cmp eax, edx
jl 0x10039e06
mov esi, dword [esp + 0x10]
inc edi
mov eax, edx
cmp edi, dword [esp + 0x20]
jb 0x10039de3
mov edi, dword [esp + 0x2c]
xor eax, eax
mov bl, 1
test edi, edi
je 0x10039e5f
mov esi, dword [esp + 0x28]
movzx ecx, byte [eax + esi]
test cl, cl
jns 0x10039e51
movzx edx, byte [eax + esi + 1]
inc eax
and ecx, 0x7f
shl ecx, 8
or edx, ecx
jmp 0x10039e53
pop edi
pop esi
pop ebp
xor al, al
pop ebx
pop ecx
ret
mov edx, ecx
sub ebp, edx
js 0x10039e5f
inc eax
xor bl, 1
cmp eax, edi
jb 0x10039e31
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
pop ecx
ret

Function at 0x1003ef40
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ebx, dword [esp + 0x14]
test ebx, ebx
je 0x1003ef33
mov eax, dword [esp + 8]
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
mov edi, dword [esp + 0x1c]
sub ebp, edi
nop word [eax + eax]
inc byte [eax]
lea edi, [edi + 1]
movzx esi, byte [eax]
movzx ecx, byte [esi + eax + 2]
add byte [eax + 1], cl
movzx ecx, byte [eax + 1]
mov dl, byte [esi + eax + 2]
movzx ecx, byte [ecx + eax + 2]
mov byte [esi + eax + 2], cl
movzx ecx, byte [eax + 1]
mov byte [ecx + eax + 2], dl
movzx ecx, byte [eax + 1]
movzx edx, byte [ecx + eax + 2]
movzx ecx, byte [eax]
movzx ecx, byte [ecx + eax + 2]
add edx, ecx
movzx ecx, dl
movzx ecx, byte [ecx + eax + 2]
xor cl, byte [edi + ebp - 1]
mov byte [edi - 1], cl
sub ebx, 1
jne 0x1003eee0
pop edi
pop esi
pop ebp
pop ebx
ret
add dword [esp + 4], 0xc1
jmp 0x1003eec0
Function at 0x100482e5
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.100438c0
mov eax, dword [0x100e1c40]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.1004c8ce
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x10048327
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x10048483
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.1006fbf0
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x100e3778]
push dword [eax + edi + 0x24]
push dword [eax + edi + 0x20]
push ebx
call fcn.1005ac19
mov ecx, dword [esi*4 + 0x100e3778]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [ecx + edi + 0x20]
jne 0x1004847c
cmp eax, dword [ecx + edi + 0x24]
jne 0x1004847c
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [ecx + edi + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1004847c
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.1005ac19
add esp, 0x14
test edx, edx
jl 0x1004847c
jg 0x100483f2
test eax, eax
jb 0x1004847c
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x1004847c
jl 0x1004840c
cmp dword [ebp - 0x1008], eax
ja 0x1004847c
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x1004842a
test ebx, ebx
je 0x10048463
cmp ecx, edi
jae 0x10048463
mov al, byte [ecx]
cmp al, 0xd
jne 0x10048444
lea eax, [edi - 1]
cmp ecx, eax
jae 0x10048450
cmp byte [ecx + 1], 0xa
jne 0x10048450
inc ecx
jmp 0x10048450
movzx eax, al
movsx eax, byte [eax + 0x100e1ed0]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x1004842a
cmp edx, ebx
jne 0x1004842a
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x10048481
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.10042ec0
leave
ret

Function at 0x10058b0f
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x10058b4e
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10058b4e
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10058b4e
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x10058b4e
cmp dword [ecx + 0x74], 0xe
jbe 0x10058b4e
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x1005c9b4
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x100e3778]
mov dword [ebp - 0xc], ecx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x1005c9f4
cmp byte [ebx], 0xa
jne 0x1005c9f4
or byte [edi + eax + 0x28], 4
jmp 0x1005c9f9
and byte [edi + eax + 0x28], 0xfb
add ecx, ebx
mov eax, ebx
mov dword [ebp - 0x10], ecx
mov esi, ebx
mov dword [ebp - 8], eax
cmp ebx, ecx
jae 0x1005caf8
mov dl, byte [eax]
cmp dl, 0x1a
je 0x1005cadb
inc eax
cmp dl, 0xd
je 0x1005ca25
mov dword [ebp - 8], eax
mov byte [esi], dl
jmp 0x1005ca4b
cmp eax, ecx
jae 0x1005ca59
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add dword [ebp - 8], eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
xor edx, edx
inc edx
add esi, edx
cmp eax, ecx
jb 0x1005ca0d
jmp 0x1005caf8
push 0
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1005cad6
cmp dword [ebp - 0x10], 0
je 0x1005cad6
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx*4 + 0x100e3778]
test byte [eax + edi + 0x28], 0x48
je 0x1005cab0
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x1005ca9b
mov byte [esi], dl
jmp 0x1005caac
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x100e3778]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x1005caf8
cmp byte [ebp - 1], 0xa
jne 0x1005cabf
cmp esi, ebx
jne 0x1005cabf
mov byte [esi], 0xa
jmp 0x1005caf7
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.1005ac37
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x1005caf8
mov byte [esi], 0xd
jmp 0x1005caf7
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx*4 + 0x100e3778]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x1005caf5
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x1005caf8
mov byte [esi], dl
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x1005cb01
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
push esi
sar ecx, 6
push edi
imul edi, eax, 0x38
mov dword [ebp - 8], ecx
mov eax, dword [ecx*4 + 0x100e3778]
push 0xa
pop edx
mov dword [ebp - 0x18], edx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x1005cb47
cmp word [ebx], dx
jne 0x1005cb47
or byte [eax + edi + 0x28], 4
jmp 0x1005cb4c
and byte [eax + edi + 0x28], 0xfb
lea edx, [ebx + ecx*2]
mov eax, ebx
mov dword [ebp - 0xc], edx
mov esi, ebx
mov dword [ebp - 4], eax
cmp ebx, edx
jae 0x1005ccaf
mov dword [ebp - 0x10], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0xc]
cmp ecx, 0x1a
je 0x1005cc8f
add eax, 2
cmp cx, word [ebp - 0x10]
je 0x1005cb8d
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x1005cbc3
cmp eax, edx
jae 0x1005cbd1
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x18]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 0xc]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
push 2
pop ecx
add esi, ecx
cmp eax, edx
jb 0x1005cb68
jmp 0x1005ccaf
push 0
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1005cc8a
cmp dword [ebp - 0x18], 0
je 0x1005cc8a
mov edx, dword [ebp - 8]
push 0xa
mov eax, dword [edx*4 + 0x100e3778]
test byte [eax + edi + 0x28], 0x48
je 0x1005cc60
lea eax, [esi + 2]
mov dword [ebp - 0x1c], eax
mov ax, word [ebp - 4]
pop ecx
mov word [ebp - 2], ax
cmp ax, cx
jne 0x1005cc24
mov word [esi], cx
jmp 0x1005cc5b
push 0xd
pop ecx
mov word [esi], cx
movzx ecx, ax
mov eax, dword [edx*4 + 0x100e3778]
mov dx, word [ebp - 2]
shr ecx, 8
push 0xa
mov byte [eax + edi + 0x2a], dl
mov edx, dword [ebp - 8]
mov eax, dword [edx*4 + 0x100e3778]
mov byte [eax + edi + 0x2b], cl
mov eax, dword [edx*4 + 0x100e3778]
pop ecx
mov byte [eax + edi + 0x2c], cl
mov esi, dword [ebp - 0x1c]
jmp 0x1005ccaf
pop eax
cmp word [ebp - 4], ax
jne 0x1005cc70
cmp esi, ebx
jne 0x1005cc70
mov word [esi], ax
jmp 0x1005ccac
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.1005ac37
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x1005ccaf
push 0xd
pop eax
jmp 0x1005cc6b
mov edx, dword [ebp - 8]
mov edx, dword [edx*4 + 0x100e3778]
mov al, byte [edx + edi + 0x28]
test al, 0x40
jne 0x1005cca9
or al, 2
mov byte [edx + edi + 0x28], al
jmp 0x1005ccaf
mov word [esi], cx
add esi, 2
sub esi, ebx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x1005e270
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1008c908
push 0x1008c900
push str.FlsAlloc
push 0x1f
call fcn.1005e0db
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1005e2a4
push dword [ebp + 8]
mov ecx, esi
call dword [0x10074224]
call esi
jmp 0x1005e2aa
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1005e2ee
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1008c918
push 0x1008c910
push str.FlsGetValue
push 0x21
call fcn.1005e0db
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1005e325
push dword [ebp + 8]
mov ecx, esi
call dword [0x10074224]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1005e32d
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1008c920
push 0x1008c918
push str.FlsSetValue
push 0x22
call fcn.1005e0db
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1005e367
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x10074224]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]