joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6e3b6067
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0
push ecx
xor ecx, ecx
jne 0x6e3b60b1
mov ecx, esp
xor dword [ecx - 0x55], edi
pop ecx
call 0x6e3b6058
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
call 0x6e3b6067
cld
test edx, ebx
or ebp, eax
add dword [esi - 0x7cc26b19], esp
les ecx, [eax]
or dword [esp], ebp
mov ebp, esp
sub esp, 0x100
push ebx
push edx
push ecx
push edi
push esi
mov ebx, dword [ebp + 8]
mov edx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
lea ebx, [ebx + edx]
mov eax, dword [ebx + 0x24]
add eax, edx
xor edi, edi
jne 0x6e7bbd0a
or edi, dword [ebx + 0x20]
add edi, edx
mov ecx, dword [ebx + 0x18]
mov esi, dword [edi]
add esi, edx
push 0
push ecx
mov ecx, esp
push 0x55d34c8a
call 0x6e3b60b8
sti
sbb byte [ecx + 0x56], dh
xlatb
les ebp, [ebp + 0x8c483e2]
xchg dword [ecx + 4], eax
xor eax, edx
shl eax, 3
xor ecx, 0
shl eax, 0x1d
add eax, dword [ecx + 4]
pop ecx
push esi
call fcn.6e39cf2e
cmp eax, dword [ebp + 0xc]
pop eax
je 0x6e3b6157
add edi, 4
add eax, 2
dec ecx
jne 0x6e3b609d
call 0x6e3b6104
loope 0x6e3b60fa
invalid
sbb esi, ebx
mov edi, 0xdbead58c
js 0x6e3b6154
mov dh, 0xe8
or byte [eax], al
add byte [eax], al
mov bh, 0x24
lea eax, [edx + 0x53]
nop
mov dword [esi + 0x2308c483], ecx
sal byte [ecx], 0xc0
fsub st(7)
int 0xf
mov bh, 0
movzx eax, word [eax]
jmp 0x6e3b6165
shl eax, 2
add eax, dword [ebx + 0x1c]
add eax, edx
mov eax, dword [eax]
add eax, edx
mov ebx, edx
add ebx, dword [edx + 0x3c]
mov ecx, dword [ebx + 0x7c]
mov ebx, dword [ebx + 0x78]
add ebx, edx
add ecx, ebx
cmp eax, ebx
jb 0x6e3b6118
cmp eax, ecx
ja 0x6e3b6118
mov esi, eax
lea edi, [ebp - 0x100]
mov al, byte [esi]
mov byte [edi], al
inc edi
inc esi
js 0x6e3b61a2
or ecx, ecx
xor dword [esp - 0x6b], eax
cmp al, 0x2e
jne 0x6e3b6198
lea edi, [ebp - 0x100]
push 0x100
push edi
push esi
call fcn.6e39d40d
lea esp, [esp - 0x60]
mov dword [esp + 0x5c], edi
lea esp, [esp + 0x5c]
Function at 0x10215dfb
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
mov dword [0x10236540], 0
mov byte [0x10236544], 0
mov dword [0x10236538], 0x247e
mov dword [0x1023653c], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
jmp 0x10215e53
xor eax, eax
mov dword [0x1023653c], 0
mov dword [ebp - 0x20], eax
jmp 0x10215e7b
mov eax, dword [ebp - 0x1c]
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov eax, dword [0x1023653c]
add eax, 1
mov dword [0x1023653c], eax
cmp eax, 0x100
mov dword [ebp - 0x1c], eax
jl 0x10215e53
jmp 0x10215e42
mov eax, dword [ebp - 0x20]
mov ecx, 0x100
mov dword [0x10236548], 0
mov dword [ebp - 0x24], eax
xor edx, edx
mov esi, dword [ebp - 0x10]
div esi
mov edi, dword [0x10236534]
mov ebx, edi
add ebx, 0xffffd965
mov dword [0x10236538], ebx
mov ebx, dword [0x10236540]
mov esi, dword [ebp - 0x18]
mov dword [ebp - 0x28], ecx
mov ecx, dword [ebp - 0x24]
movzx ecx, byte [esi + ecx]
add ecx, ebx
mov ebx, dword [ebp - 0x14]
movzx edx, byte [ebx + edx]
add ecx, edx
mov dword [0x10236548], ecx
mov dword [0x10236538], 0x162a
mov eax, ecx
cdq
mov ecx, dword [ebp - 0x28]
idiv ecx
mov dword [0x10236540], edx
add edi, 0x26f4
mov dword [0x10236534], edi
mov edi, dword [ebp - 0x24]
mov cl, byte [esi + edi]
mov byte [0x10236544], cl
mov dword [0x10236534], 0x8fc
mov cl, byte [esi + edx]
mov byte [esi + edi], cl
mov dword [0x10236534], 0x721
mov cl, byte [0x10236544]
mov edx, dword [0x10236540]
mov byte [esi + edx], cl
mov dword [0x10236538], 0x15d4
mov edx, dword [0x1023653c]
add edx, 1
mov dword [0x1023653c], edx
cmp edx, 0x100
mov dword [ebp - 0x20], edx
jl 0x10215e7b
mov dword [0x10236534], 0x71f
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10215f65
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x60
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [0x10236538], 0x26bd
mov dword [0x10236534], 0xe95
mov edx, ecx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x38], ecx
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x34]
lea edx, section..data
imul esi, eax, 0x50
mov edi, edx
add edi, esi
add edi, 0x4c
mov esi, dword [edi]
imul edi, eax, 0x50
add edx, edi
add edx, 0x20
movzx edx, word [edx]
xor edx, esi
add edx, ecx
add eax, 1
cmp eax, 0x5aa
mov ecx, edx
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x38], eax
jne 0x10215f92
lea eax, [0x10219105]
mov ecx, 0xe
lea edx, [ebp - 0x2c]
mov dword [0x10236538], 0x130b
mov dword [0x10236534], 0x1346
mov dword [esp], edx
mov dword [esp + 4], eax
mov dword [esp + 8], 0xe
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x44], ecx
call fcn.10216235
mov dword [0x10236538], 0xb5d
mov dword [0x10236534], 0x6c2
call fcn.10216181
mov dword [esp], eax
mov eax, dword [ebp - 0x40]
mov dword [esp + 4], eax
call fcn.102163c4
mov ecx, eax
mov dword [0x10236554], eax
mov eax, esp
mov edx, dword [ebp - 0x3c]
mov dword [eax + 4], edx
mov dword [eax + 0xc], 4
mov dword [eax + 8], 0x1000
mov dword [eax], 0
call ecx
sub esp, 0x10
xor ecx, ecx
mov edx, ecx
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x4c], edx
mov dword [ebp - 0x50], ecx
mov eax, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x4c]
lea edx, section..data
imul esi, eax, 0x50
mov edi, edx
add edi, esi
add edi, 0x4c
mov esi, dword [edi]
imul edi, eax, 0x50
mov ebx, edx
add ebx, edi
mov edi, dword [ebx]
imul ebx, eax, 0x50
add edx, ebx
add edx, 0x20
movzx edx, word [edx]
xor edx, esi
mov esi, dword [ebp - 0x48]
add esi, ecx
mov dword [esp], esi
mov dword [esp + 4], edi
mov dword [esp + 8], edx
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x58], ecx
mov dword [ebp - 0x5c], edx
call fcn.10216d85
mov eax, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0x58]
add eax, ecx
mov edx, dword [ebp - 0x54]
add edx, 1
cmp edx, 0x5aa
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x50], edx
jne 0x10216075
mov dword [0x10236538], 0x9b1
mov eax, dword [ebp - 0x48]
mov dword [esp], eax
mov dword [esp + 4], eax
mov ecx, dword [ebp - 0x3c]
mov dword [esp + 8], ecx
call fcn.102162e2
xor eax, eax
mov ecx, dword [ebp - 0x48]
add ecx, 0xd7c94
mov edx, dword [ebp - 0x30]
mov dword [edx], ecx
mov ecx, dword [0x10236534]
add ecx, 0x183c
mov dword [0x10236534], ecx
mov dword [edx + 4], 0x11e600
mov dword [0x10236538], 0x13e1
mov ecx, dword [ebp - 0x48]
add ecx, 0xa3a93
mov dword [edx + 8], ecx
mov ecx, dword [0x10236534]
add ecx, 0x1510
mov dword [0x10236534], ecx
mov dword [edx + 0xc], 0x2090
mov ecx, dword [0x10236538]
add ecx, 0xfffff7d7
mov dword [0x10236538], ecx
add esp, 0x60
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10216572
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x4c
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
lea edx, [0x10219105]
mov esi, 0xe
lea edi, [ebp - 0x2c]
mov ebx, dword [0x10236534]
add ebx, 0x1e99
mov dword [0x10236534], ebx
mov dword [esp], edi
mov dword [esp + 4], edx
mov dword [esp + 8], 0xe
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x3c], esi
call fcn.10216235
mov eax, dword [0x10236534]
add eax, 0xfffffc44
mov dword [0x10236538], eax
mov dword [0x10236534], 0x6c2
call fcn.10216181
mov dword [esp], eax
mov eax, dword [ebp - 0x38]
mov dword [esp + 4], eax
call fcn.102163c4
xor ecx, ecx
mov dword [0x10236534], 0x236d
cmp eax, 0
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x44], ecx
je 0x102166bf
mov eax, dword [ebp - 0x40]
mov dword [0x10236534], 0x1258
mov ecx, esp
mov dword [ecx + 0xc], 0x40
mov dword [ecx + 8], 0x1000
mov dword [ecx + 4], 0x6000
mov dword [ecx], 0
call eax
sub esp, 0x10
mov ecx, dword [0x10236534]
add ecx, 0x194b
mov dword [0x10236538], ecx
mov dword [esp], eax
mov ecx, dword [ebp - 0x30]
mov dword [esp + 4], ecx
mov dword [ebp - 0x48], eax
call fcn.10215b8b
xor eax, eax
mov ecx, dword [ebp - 0x48]
mov word [ecx], 0x5a4d
mov dword [ecx + 0x3c], 0xd0
mov dword [ecx + 0xd0], 0x4550
add ecx, 0xffc00000
mov edx, dword [ebp - 0x34]
mov dword [edx + 0x18], ecx
mov dword [0x10236534], 0x341
mov ecx, dword [ebp - 0x48]
mov dword [edx + 4], ecx
cmp ecx, 0
mov dword [ebp - 0x44], eax
je 0x102166bf
mov eax, dword [ebp - 0x48]
add eax, 0x2311
mov dword [0x10236538], 0x1ddf
mov dword [0x10236534], 0xffffefc9
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
add esp, 0x4c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x102166ca
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x28
mov dword [ebp - 0xc], 0
mov dword [0x10236534], 0x1367
mov eax, dword fs:[0x30]
mov dword [ebp - 0xc], eax
xor ecx, ecx
mov edx, dword [ebp - 0xc]
mov edx, dword [edx + 0x10]
mov edx, dword [edx + 0x3c]
mov esi, dword [0x10236534]
mov edi, esi
add edi, 0xffffec0a
mov dword [0x10236534], edi
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], ecx
jmp 0x1021674a
mov dword [0x10236534], 0x2505
mov eax, dword [ebp - 0x20]
add eax, 0xfffffff5
mov dword [ebp - 0x24], eax
xor eax, eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x24]
cmp word [ecx + edx*2], 0x61
mov dword [ebp - 0x28], eax
je 0x102167c8
jmp 0x10216848
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
cmp word [ecx + eax*2], 0
mov edx, eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], edx
je 0x10216777
mov eax, dword [ebp - 0x2c]
add eax, 1
cmp eax, 0x104
mov ecx, eax
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x30], eax
jl 0x1021674a
mov eax, dword [ebp - 0x30]
xor ecx, ecx
mov edx, dword [ebp - 0x14]
add edx, 0xfffff5a8
mov dword [0x10236534], edx
mov edx, dword [ebp - 0x18]
cmp word [edx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x28], ecx
jne 0x10216848
xor eax, eax
mov dword [0x10236534], 0x28f
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x20]
cmp word [ecx + edx*2 - 0x18], 0x6f
mov dword [ebp - 0x28], eax
je 0x10216719
jmp 0x10216848
xor eax, eax
mov dword [0x10236538], 0x870
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x20]
cmp word [ecx + edx*2 - 0x14], 0x64
mov dword [ebp - 0x28], eax
jne 0x10216848
xor eax, eax
mov dword [0x10236534], 0x264f
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x20]
cmp word [ecx + edx*2 - 0x12], 0x64
mov dword [ebp - 0x28], eax
jne 0x10216848
xor eax, eax
mov dword [0x10236534], 0x1f9e
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x20]
cmp word [ecx + edx*2 - 0x10], 0x6c
mov dword [ebp - 0x28], eax
jne 0x10216848
xor eax, eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x20]
cmp word [ecx + edx*2 - 0xe], 0x6c
mov dword [ebp - 0x28], eax
jne 0x10216848
mov eax, 1
mov dword [0x10236534], 0x536
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
add esp, 0x28
pop esi
pop edi
pop ebp
ret
Function at 0x10216b99
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x40
mov eax, dword [ebp + 8]
mov ecx, dword [0x10236534]
add ecx, 0xffffea42
mov dword [0x10236538], ecx
mov dword [ebp - 0x10], eax
call fcn.10216f36
mov ecx, eax
mov edx, dword [eax + 0x3c]
mov dword [0x10236534], 0x1516
mov eax, dword [eax + edx + 0x78]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [0x10236534], 0x11d0
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x18]
add ecx, dword [ecx + edx + 0x20]
mov dword [0x10236538], 0x6c2
mov esi, dword [ebp - 0x14]
mov edi, dword [esi + edx + 0x18]
cmp edi, 0
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x24], eax
jne 0x10216c82
mov eax, dword [ebp - 0x24]
add esp, 0x40
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x28]
mov ecx, eax
mov edx, dword [ebp - 0x2c]
add ecx, edx
mov esi, dword [ebp - 0x14]
mov bl, byte [esi + ecx]
mov ecx, dword [ebp - 0x10]
mov bh, byte [ecx + eax]
cmp bl, bh
sete cl
cmp bl, 0
mov dword [ebp - 0x30], eax
mov byte [ebp - 0x31], bh
mov byte [ebp - 0x32], cl
je 0x10216ced
jmp 0x10216cc1
mov eax, 0xffffeebe
xor ecx, ecx
mov dword [0x10236534], 0x10da
mov edx, dword [ebp - 0x38]
add edx, 2
mov esi, dword [ebp - 0x3c]
add esi, 1
mov edi, dword [ebp - 0x1c]
cmp esi, edi
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x48], esi
jb 0x10216c9c
jmp 0x10216c10
mov eax, 0xffffefb4
xor ecx, ecx
mov edx, dword [ebp - 0x14]
mov esi, dword [ebp - 0x18]
add edx, dword [edx + esi + 0x24]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x48], ecx
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x44]
mov edx, dword [ebp - 0x40]
xor esi, esi
mov edi, dword [ebp - 0x20]
mov ebx, dword [edi + eax*4]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x4c], edx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], esi
jmp 0x10216c1b
mov eax, dword [ebp - 0x30]
add eax, 1
mov cl, byte [ebp - 0x31]
cmp cl, 0
setne dl
mov ch, byte [ebp - 0x32]
and ch, dl
cmp eax, 0x20
setb dl
and ch, dl
test ch, 1
mov dword [ebp - 0x28], eax
jne 0x10216c1b
mov al, byte [ebp - 0x32]
test al, 1
jne 0x10216cf9
jmp 0x10216c4a
mov eax, dword [ebp - 0x38]
movzx ecx, word [eax]
mov edx, dword [ebp - 0x4c]
mov dword [0x10236538], edx
mov esi, dword [ebp - 0x14]
mov edi, dword [ebp - 0x18]
add esi, dword [esi + edi + 0x1c]
mov ebx, dword [ebp - 0x14]
add ebx, dword [esi + ecx*4]
mov dword [0x10236534], 0x1a69
mov dword [ebp - 0x24], ebx
jmp 0x10216c10
Function at 0x102170d3
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [0x1023653c], 0
mov dword [0x10236540], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
xor eax, eax
mov ecx, 0x4207
mov dword [0x1023654c], 0
mov dword [0x10236538], 0x222c
mov dword [0x10236534], 0x4207
mov edx, dword [ebp - 0x10]
cmp edx, 0
mov esi, eax
mov edi, eax
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x2c], eax
je 0x1021727b
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x24]
mov esi, dword [ebp - 0x28]
mov edi, 0x100
add ecx, 0xfffff351
mov dword [0x10236534], ecx
add edx, 1
mov dword [ebp - 0x30], eax
mov eax, edx
cdq
idiv edi
mov dword [0x1023653c], edx
mov ecx, dword [ebp - 0x1c]
movzx ebx, byte [ecx + edx]
add ebx, esi
mov eax, ebx
mov dword [ebp - 0x34], edx
cdq
idiv edi
mov dword [0x10236540], edx
mov dword [0x10236534], 0x1bda
mov esi, dword [ebp - 0x34]
mov cl, byte [ecx + esi]
mov byte [0x10236544], cl
mov dword [0x10236534], 0x297
mov edi, dword [ebp - 0x1c]
mov cl, byte [edi + edx]
mov byte [edi + esi], cl
mov dword [0x10236534], 0x2f0
mov cl, byte [0x10236544]
mov edx, dword [0x10236540]
mov byte [edi + edx], cl
mov edx, dword [0x1023653c]
movzx edx, byte [edi + edx]
mov ebx, dword [0x10236540]
movzx ebx, byte [edi + ebx]
add ebx, edx
mov dword [0x10236538], 0xffffe4ab
and ebx, 0xff
mov dword [0x1023654c], ebx
mov dword [0x10236534], 0x1696
mov cl, byte [edi + ebx]
mov edx, dword [ebp - 0x14]
mov ebx, dword [ebp - 0x30]
mov ch, byte [edx + ebx]
mov byte [0x10236551], ch
mov byte [0x10236552], cl
xor ch, cl
mov byte [0x10236550], ch
mov dword [0x10236538], 0xffffef26
mov dword [0x10236534], 0x15f1
mov edx, dword [ebp - 0x18]
mov byte [edx + ebx], ch
add ebx, 1
mov edx, dword [ebp - 0x10]
cmp ebx, edx
mov dword [ebp - 0x38], ebx
je 0x1021727b
mov eax, dword [0x10236534]
mov ecx, dword [0x1023653c]
mov edx, dword [0x10236540]
mov esi, dword [ebp - 0x38]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x2c], esi
jmp 0x1021714c
mov dword [0x10236538], 0x23ec
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1021728d
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x98
call fcn.1000106e
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0x24], ecx
je 0x102172cb
mov eax, dword [esp + 0x24]
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x20]
cmp word [eax], 0x5a4d
mov dword [esp + 0x1c], eax
je 0x1021734e
jmp 0x10217362
lea eax, [esp + 0x28]
lea ecx, [esp + 0x38]
mov dword [esp], eax
mov dword [esp + 0x18], ecx
call fcn.10215f65
lea ecx, [0x10216d2a]
mov edx, dword [esp + 0x28]
mov dword [esp + 0x7c], edx
mov dword [0x10236538], 0x1082
mov dword [esp + 0x90], 0x11e600
mov edx, dword [0x10236520]
mov dword [esp + 0x6c], edx
mov edx, dword [0x10236524]
mov dword [esp + 0x74], edx
mov edx, dword [0x10236528]
mov dword [esp + 0x40], edx
mov edx, dword [0x1023652c]
mov dword [esp + 0x84], edx
mov edx, dword [0x10236530]
mov dword [esp + 0x68], edx
mov dword [0x10236534], 0xffffe113
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], ecx
jmp 0x102172b3
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
mov dword [esp + 0x10], ecx
je 0x10217379
mov eax, dword [esp + 0x1c]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [esp + 0x20], eax
jmp 0x102172b3
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x38], eax
mov dword [0x10236534], 0x1516
mov ecx, dword [esp + 0x10]
mov edx, dword [eax + ecx + 0x50]
mov dword [esp + 0x4c], edx
mov dword [0x10236538], 0x3a6
call fcn.102166ca
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0xc], ecx
jne 0x102173f6
lea eax, [esp + 0x28]
add eax, 8
mov dword [esp + 8], eax
lea eax, [esp + 0x38]
mov ecx, dword [esp + 8]
mov edx, dword [ecx]
mov dword [esp], eax
mov dword [esp + 4], edx
call fcn.10216572
mov dword [0x10236538], 0x2491
mov ecx, esp
lea edx, [esp + 0x38]
mov dword [ecx], edx
call eax
sub esp, 4
mov eax, 1
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 0x24], eax
jmp 0x102172ab
Function at 0xd0b058
Capabilities:
Decompress data using aplib

Disassembly:
call 0xd0b1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xd0b07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xd0b06a
add dl, dl
jne 0xd0b089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xd0b0dc
xor eax, eax
add dl, dl
jne 0xd0b096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xd0b17d
add dl, dl
jne 0xd0b0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd0b0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd0b0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd0b0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xd0b0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xd0b075
mov eax, 1
add dl, dl
jne 0xd0b0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd0b0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xd0b0e1
sub eax, ebx
mov ebx, 1
jne 0xd0b128
mov ecx, 1
add dl, dl
jne 0xd0b10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xd0b119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xd0b105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xd0b075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xd0b13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xd0b14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xd0b136
cmp eax, 0x7d00
jae 0xd0b16d
cmp eax, 0x500
jb 0xd0b168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xd0b075
cmp eax, 0x7f
ja 0xd0b170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xd0b075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xd0b19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xd0b075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x4036e0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.00403300
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x403712
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 8]
call dword [0x433120]
call dword [ebp - 8]
jmp 0x40371c
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esp, ebp
pop ebp
ret
Function at 0x41bc00
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x38
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
push eax
lea ecx, [ebp - 4]
call fcn.00406e50
lea ecx, [ebp - 4]
call fcn.0041bbd0
movzx eax, al
test eax, eax
jne 0x41bc3d
mov dword [ebp - 0x18], 0
lea ecx, [ebp - 4]
call fcn.0041bb10
mov eax, dword [ebp - 0x18]
jmp 0x41bd65
lea ecx, [ebp - 4]
call fcn.00406f60
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.0041bb90
add esp, 4
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x10]
sar edx, 1
mov dword [ebp - 0x14], edx
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0x14]
push eax
lea ecx, [ebp - 4]
call fcn.00406f60
push eax
push 0
push 0
call fcn.0041ba50
add esp, 0x20
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x41bca3
mov dword [ebp - 0x20], 0
lea ecx, [ebp - 4]
call fcn.0041bb10
mov eax, dword [ebp - 0x20]
jmp 0x41bd65
push 0x66
push str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
push 2
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.0040b6d0
add esp, 0x10
push eax
lea ecx, [ebp - 8]
call fcn.004026f0
lea ecx, [ebp - 8]
call fcn.00402730
movzx edx, al
test edx, edx
jne 0x41bcec
mov dword [ebp - 0x24], 0
lea ecx, [ebp - 8]
call fcn.00402710
lea ecx, [ebp - 4]
call fcn.0041bb10
mov eax, dword [ebp - 0x24]
jmp 0x41bd65
lea ecx, [ebp - 8]
call fcn.00402770
mov dword [ebp - 0x28], eax
lea ecx, [ebp - 4]
call fcn.00406f60
mov dword [ebp - 0x2c], eax
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x28]
push ecx
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x2c]
push eax
push 0
push 0
call fcn.0041ba50
add esp, 0x20
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jne 0x41bd47
mov dword [ebp - 0x34], 0
lea ecx, [ebp - 8]
call fcn.00402710
lea ecx, [ebp - 4]
call fcn.0041bb10
mov eax, dword [ebp - 0x34]
jmp 0x41bd65
lea ecx, [ebp - 8]
call fcn.00406f00
mov dword [ebp - 0x38], eax
lea ecx, [ebp - 8]
call fcn.00402710
lea ecx, [ebp - 4]
call fcn.0041bb10
mov eax, dword [ebp - 0x38]
mov esp, ebp
pop ebp
ret

Function at 0x41ec90
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.0041e5c0
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x41ecc4
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 8]
call dword [0x433120]
call dword [ebp - 8]
jmp 0x41ecca
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov esp, ebp
pop ebp
ret 4

Function at 0x41ed20
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.0041e600
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x41ed54
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 8]
call dword [0x433120]
call dword [ebp - 8]
jmp 0x41ed5e
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esp, ebp
pop ebp
ret 4
Function at 0x41ed70
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.0041e620
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x41eda8
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
call dword [0x433120]
call dword [ebp - 8]
jmp 0x41edb6
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov esp, ebp
pop ebp
ret 8