joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402350
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x408044
call sym._EnterCriticalSection_4
mov ebx, dword [0x40803c]
sub esp, 4
test ebx, ebx
je 0x40239b
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x402394
test esi, esi
je 0x402394
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x402370
mov dword [esp], 0x408044
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x402580
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
lea esi, [esp + 0x24]
lea ebx, [eax + 0x40]
mov dword [esp + 4], 1
mov dword [esp + 0xc], ebx
mov dword [esp], str.Mingw_runtime_failure:_n
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x4025d0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, edx
push esi
mov esi, ecx
push ebx
mov ebx, eax
sub esp, 0x3c
lea eax, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov dword [esp], ebx
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x4026a4
mov eax, dword [esp + 0x28]
cmp eax, 0x40
je 0x40260e
cmp eax, 4
jne 0x402630
test esi, esi
je 0x402622
xor eax, eax
movzx ecx, byte [edi + eax]
mov byte [ebx + eax], cl
add eax, 1
cmp eax, esi
jb 0x402614
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x20]
lea ebp, [esp + 0x10]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov ecx, dword [esp + 0x28]
test esi, esi
je 0x40266f
xor edx, edx
movzx eax, byte [edi + edx]
mov byte [ebx + edx], al
add edx, 1
cmp edx, esi
jb 0x402661
cmp ecx, 0x40
je 0x402622
cmp ecx, 4
je 0x402622
mov eax, dword [esp + 0x10]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.00402580
lea esi, [esi]
Function at 0x1a97820
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
sub esi, edi
mov dword [ebp - 0x44], esi
mov esi, edi
cmp edx, 0x1be80609
jmp 0x1bffe61
inc edi
cmp edx, edi
cmc
or esi, edx
jmp 0x1c2836a
mov dword [ecx], ebx
btc cx, 0xdd
mov ecx, dword [eax + 4]
rcl al, 3
add ecx, esi
rcr al, 0x2e
mov eax, 0x300
test cx, sp
shl eax, cl
mov dword [ebp - 0x3c], esi
cmc
jmp 0x2351c2c
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], edi
jmp 0x1c05bf6
call fcn.016511fa
push ebp
mov ebp, esp
lea esp, [esp - 0x48]
mov ecx, dword [eax + 8]
rcr edx, 0x56
setns dl
bsf edx, ebp
mov edx, dword [eax + 0xc]
stc
clc
cmp esp, 0x26893587
push ebx
cmp si, 0x2c98
push esi
xor esi, 0x7fd7865
neg si
push edi
mov edi, 1
mov esi, edi
test dh, 0xa8
shl esi, cl
mov ecx, dword [eax + 4]
sub ebx, ebx
mov dword [ebp - 0x20], edx
cmc
cmp cx, 0xf01
jmp 0x15fe13e
je 0x1c45164
movzx edx, byte [ecx]
cmp sp, cx
shl esi, 8
jmp 0x164f2b8
shl esi, cl
or cl, al
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x18], ebx
cmc
test di, ax
test esp, 0x4fb20754
mov byte [ebp - 1], bl
cmp ax, 0x9ed
sub esi, edi
clc
cmp ebx, ebp
mov dword [ebp - 0x48], esi
ror esi, 0x46
mov esi, dword [eax]
stc
mov dword [ecx], ebx
mov cx, sp
mov ecx, dword [ebp + 0x14]
test ah, bh
jmp 0x16b7567
mov dword [ebp - 0x2c], edi
je 0x1c3ee60
mov ecx, eax
mov eax, 0x400
sbb edi, 0x6ad0729d
mov edi, edx
xadd dh, dh
movzx edx, ax
mov eax, edx
cmp ebp, ebp
clc
shl edx, 0x10
cmp esi, edi
or eax, edx
test si, 0x2b52
shr ecx, 1
rep stosd dword es:[edi], eax
jmp 0x1c3ee55
inc ecx
cmp edi, 5
jmp 0x2351594
adc ecx, ecx
rep stosw word es:[edi], ax
bswap cx
sar ch, 0x1f
mov ecx, dword [ebp + 8]
btc ax, ax
mov ah, 0x27
sar ah, 0xb9
lea eax, [ecx - 1]
test dx, di
mov dword [ebp - 0x40], eax
sub esi, esi
cmp ch, dl
or eax, 0xffffffff
sub edi, edi
stc
cmp ecx, dword [ebp - 0x40]
jmp 0x1b017e5
jl 0x1c3ee80
mov dword [ebp - 8], ecx
and di, si
sub edx, ebx
btc di, sp
lea esp, [esp]
sub dx, sp
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], edi
add eax, 0x736
jmp 0x16dfe6b
Function at 0x10007f10
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10051c1c
mov eax, dword fs:[0]
push eax
sub esp, 0x248
mov eax, dword [0x10086050]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x254], 0
mov dword [ebp - 0x24c], 0x224
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 0x250], eax
cmp dword [ebp - 0x250], 0xffffffff
jne 0x10007f98
push 0x1007e83c
mov ecx, dword [ebp + 8]
call fcn.100084a0
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x254]
or eax, 1
mov dword [ebp - 0x254], eax
mov eax, dword [ebp + 8]
jmp 0x10008022
push str.Unknown
lea ecx, [ebp - 0x28]
call fcn.100084a0
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x24c]
push ecx
mov edx, dword [ebp - 0x250]
push edx
call dword [sym.imp.KERNEL32.dll_Module32First]
test eax, eax
je 0x10007feb
lea eax, [ebp - 0x12c]
push eax
lea ecx, [ebp - 0x28]
call fcn.1000de30
lea ecx, [ebp - 0x24c]
push ecx
mov edx, dword [ebp - 0x250]
push edx
call dword [sym.imp.KERNEL32.dll_Module32Next]
test eax, eax
jne 0x10007fc4
mov eax, dword [ebp - 0x250]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x28]
push ecx
mov ecx, dword [ebp + 8]
call fcn.1000df20
mov edx, dword [ebp - 0x254]
or edx, 1
mov dword [ebp - 0x254], edx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.1000de50
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100302a2
mov esp, ebp
pop ebp
ret
Function at 0x10008040
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10051c92
mov eax, dword fs:[0]
push eax
sub esp, 0x310
mov eax, dword [0x10086050]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2ec], 0
mov dword [ebp - 0x2e4], 0x224
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 0x2e8], eax
cmp dword [ebp - 0x2e8], 0xffffffff
jne 0x100080c8
push 0x1007e84c
mov ecx, dword [ebp + 8]
call fcn.100084a0
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x2ec]
or eax, 1
mov dword [ebp - 0x2ec], eax
mov eax, dword [ebp + 8]
jmp 0x10008245
push str.Module_not_found
lea ecx, [ebp - 0x28]
call fcn.100084a0
mov dword [ebp - 4], 1
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x2f0], ecx
lea edx, [ebp - 0x2e4]
push edx
mov eax, dword [ebp - 0x2e8]
push eax
call dword [sym.imp.KERNEL32.dll_Module32First]
test eax, eax
je 0x1000820e
mov ecx, dword [ebp - 0x2d0]
mov dword [ebp - 0x2f4], ecx
mov edx, dword [ebp - 0x2f4]
add edx, dword [ebp - 0x2cc]
mov dword [ebp - 0x2f8], edx
mov eax, dword [ebp - 0x2f0]
cmp eax, dword [ebp - 0x2f4]
jb 0x100081f2
mov ecx, dword [ebp - 0x2f0]
cmp ecx, dword [ebp - 0x2f8]
jae 0x100081f2
mov edx, dword [ebp - 0x2f0]
sub edx, dword [ebp - 0x2f4]
mov dword [ebp - 0x304], edx
push 0x98
lea ecx, [ebp - 0xc0]
call fcn.10003710
push 1
lea ecx, [ebp - 0xc0]
call fcn.1000d4c0
mov byte [ebp - 4], 2
lea eax, [ebp - 0x2c4]
push eax
lea ecx, [ebp - 0xc0]
push ecx
call fcn.10016ba0
add esp, 8
lea edx, [ebp - 0x31c]
push edx
lea ecx, [ebp - 0xc0]
call fcn.1000d3c0
mov dword [ebp - 0x2fc], eax
mov eax, dword [ebp - 0x2fc]
mov dword [ebp - 0x300], eax
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x300]
push ecx
lea ecx, [ebp - 0x28]
call fcn.1000deb0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x31c]
call fcn.1000de50
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xc0]
call fcn.10008260
jmp 0x1000820e
lea edx, [ebp - 0x2e4]
push edx
mov eax, dword [ebp - 0x2e8]
push eax
call dword [sym.imp.KERNEL32.dll_Module32Next]
test eax, eax
jne 0x10008101
mov ecx, dword [ebp - 0x2e8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [ebp - 0x28]
push edx
mov ecx, dword [ebp + 8]
call fcn.1000df20
mov eax, dword [ebp - 0x2ec]
or eax, 1
mov dword [ebp - 0x2ec], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.1000de50
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100302a2
mov esp, ebp
pop ebp
ret
Function at 0x10008290
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
mov eax, dword [0x10086050]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x228], 0x224
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 0x22c], eax
cmp dword [ebp - 0x22c], 0xffffffff
jne 0x100082d2
xor eax, eax
jmp 0x1000836e
mov eax, dword [ebp + 8]
mov dword [ebp - 0x230], eax
lea ecx, [ebp - 0x228]
push ecx
mov edx, dword [ebp - 0x22c]
push edx
call dword [sym.imp.KERNEL32.dll_Module32First]
test eax, eax
je 0x1000835f
mov eax, dword [ebp - 0x214]
mov dword [ebp - 0x234], eax
mov ecx, dword [ebp - 0x234]
add ecx, dword [ebp - 0x210]
mov dword [ebp - 0x238], ecx
mov edx, dword [ebp - 0x230]
cmp edx, dword [ebp - 0x234]
jb 0x10008347
mov eax, dword [ebp - 0x230]
cmp eax, dword [ebp - 0x238]
jae 0x10008347
mov ecx, dword [ebp - 0x230]
sub ecx, dword [ebp - 0x234]
mov dword [ebp - 0x23c], ecx
mov eax, dword [ebp - 0x23c]
jmp 0x1000836e
lea edx, [ebp - 0x228]
push edx
mov eax, dword [ebp - 0x22c]
push eax
call dword [sym.imp.KERNEL32.dll_Module32Next]
test eax, eax
jne 0x100082f3
mov ecx, dword [ebp - 0x22c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100302a2
mov esp, ebp
pop ebp
ret

Function at 0x10008380
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10051ce5
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x10086050]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
sub esp, 0x10
mov ecx, esp
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0xc]
push eax
call fcn.10016f30
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
push str.path
mov ecx, dword [ebp + 8]
call fcn.10016ec0
mov dword [ebp - 4], 0xffffffff
mov ecx, eax
call fcn.1000caa0
sub esp, 0x10
mov ecx, esp
mov dword [ebp - 0x18], esp
mov edx, dword [ebp + 0xc]
add edx, 0x18
push edx
call fcn.10016f30
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 1
push str.baseAddress
mov ecx, dword [ebp + 8]
call fcn.10016ec0
mov dword [ebp - 4], 0xffffffff
mov ecx, eax
call fcn.1000caa0
sub esp, 0x10
mov ecx, esp
mov dword [ebp - 0x20], esp
mov eax, dword [ebp + 0xc]
add eax, 0x30
push eax
call fcn.10016f30
mov dword [ebp - 0x24], eax
mov dword [ebp - 4], 2
push str.size
mov ecx, dword [ebp + 8]
call fcn.10016ec0
mov dword [ebp - 4], 0xffffffff
mov ecx, eax
call fcn.1000caa0
sub esp, 0x10
mov ecx, esp
mov dword [ebp - 0x28], esp
mov edx, dword [ebp + 0xc]
add edx, 0x48
push edx
call fcn.10016f30
mov dword [ebp - 0x2c], eax
mov dword [ebp - 4], 3
push str.entryPoint
mov ecx, dword [ebp + 8]
call fcn.10016ec0
mov dword [ebp - 4], 0xffffffff
mov ecx, eax
call fcn.1000caa0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x1000acb0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x10086050]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push 0x40
push 5
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov ecx, dword [edx + 4]
mov dword [0x10088320], eax
mov dword [0x10088324], ecx
mov edx, dword [ebp + 8]
mov byte [edx], 0xe9
mov eax, dword [ebp + 0xc]
sub eax, dword [ebp + 8]
sub eax, 5
mov ecx, dword [ebp + 8]
mov dword [ecx + 1], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100302a2
mov esp, ebp
pop ebp
ret

Function at 0x1000b080
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x10086050]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
add eax, 0xa58d8
mov dword [ebp - 0xc], eax
lea ecx, [ebp - 8]
push ecx
push 0x40
push 5
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, 0x1000b040
sub eax, dword [ebp - 0xc]
sub eax, 5
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0xc]
mov byte [ecx], 0xe9
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
mov dword [edx + 1], eax
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp - 8]
push edx
push 5
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100302a2
mov esp, ebp
pop ebp
ret

Function at 0x1000b180
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x10086050]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], 0x6e0961
lea eax, [ebp - 8]
push eax
push 0x40
push 5
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edx, 0x1000b0f0
sub edx, dword [ebp - 0xc]
sub edx, 5
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0xc]
mov byte [eax], 0xe9
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
mov dword [ecx + 1], edx
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 8]
push ecx
push 5
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100302a2
mov esp, ebp
pop ebp
ret

Function at 0x1000b250
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x10086050]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], 0x68a50e
lea eax, [ebp - 8]
push eax
push 0x40
push 5
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edx, 0x1000b1f0
sub edx, dword [ebp - 0xc]
sub edx, 5
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0xc]
mov byte [eax], 0xe9
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
mov dword [ecx + 1], edx
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 8]
push ecx
push 5
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100302a2
mov esp, ebp
pop ebp
ret
Function at 0x1000b2c0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x10086050]
xor eax, ebp
mov dword [ebp - 4], eax
movzx eax, byte [0x10088201]
cmp eax, 1
jne 0x1000b2e6
mov eax, 1
jmp 0x1000b4aa
mov byte [0x10088201], 1
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
push 0x100881e4
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x10008a50
push 1
call dword [sym.imp.KERNEL32.dll_AddVectoredExceptionHandler]
push 0x10088210
push 0x105
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push 0x1007ebc0
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100881e0], eax
push 0x1000ade0
mov edx, dword [0x100881e0]
push edx
call fcn.1000acb0
add esp, 8
mov byte [ebp - 0x14], 0x6a
mov byte [ebp - 0x13], 0
lea eax, [ebp - 0x14]
push eax
push 0x6c0420
call fcn.10017500
add esp, 8
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], ecx
push str.samp.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x34], eax
push 0xc
lea edx, [ebp - 0x10]
push edx
mov eax, dword [ebp - 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_K32GetModuleInformation]
mov byte [ebp - 0x18], 0x6a
mov byte [ebp - 0x17], 1
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [ebp - 0x10]
add edx, 0x7535c
push edx
call fcn.10017500
add esp, 8
mov byte [ebp - 0x28], 0xf
mov byte [ebp - 0x27], 0x85
mov byte [ebp - 0x26], 0xf7
mov byte [ebp - 0x25], 0
mov byte [ebp - 0x24], 0
mov byte [ebp - 0x23], 0
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x60970
push ecx
call fcn.10017550
add esp, 8
mov byte [ebp - 0x20], 0x3d
mov byte [ebp - 0x1f], 0x7f
mov byte [ebp - 0x1e], 0x3e
mov byte [ebp - 0x1d], 0
mov byte [ebp - 0x1c], 0
lea edx, [ebp - 0x20]
push edx
mov eax, dword [ebp - 0x10]
add eax, 0xe5dd
push eax
call fcn.100175b0
add esp, 8
mov byte [ebp - 0x30], 0x81
mov byte [ebp - 0x2f], 0xfa
mov byte [ebp - 0x2e], 0x80
mov byte [ebp - 0x2d], 0x3e
mov byte [ebp - 0x2c], 0
mov byte [ebp - 0x2b], 0
lea ecx, [ebp - 0x30]
push ecx
mov edx, dword [ebp - 0x10]
add edx, 0xa58d0
push edx
call fcn.10017550
add esp, 8
mov eax, dword [ebp - 0x10]
add eax, 0xa58f5
mov dword [0x1008820c], eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xa58fe
mov dword [0x10088208], ecx
sub esp, 0xc
mov edx, esp
mov eax, dword [ebp - 0x10]
mov dword [edx], eax
mov ecx, dword [ebp - 0xc]
mov dword [edx + 4], ecx
mov eax, dword [ebp - 8]
mov dword [edx + 8], eax
call fcn.1000b080
mov ecx, esp
mov edx, dword [ebp - 0x10]
mov dword [ecx], edx
mov eax, dword [ebp - 0xc]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 8]
mov dword [ecx + 8], edx
call fcn.1000b180
mov eax, esp
mov ecx, dword [ebp - 0x10]
mov dword [eax], ecx
mov edx, dword [ebp - 0xc]
mov dword [eax + 4], edx
mov ecx, dword [ebp - 8]
mov dword [eax + 8], ecx
call fcn.1000b250
add esp, 0xc
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100302a2
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1000b8b0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x10086050]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], ecx
cmp dword [ebp + 0x10], 0
jg 0x1000b8da
jl 0x1000b8d1
cmp dword [ebp + 0xc], 0
ja 0x1000b8da
xor eax, eax
xor edx, edx
jmp 0x1000ba1b
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x38], 0
je 0x1000b8fc
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x10]
call fcn.1000d890
jmp 0x1000ba1b
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 8], ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x10]
call fcn.10010ca0
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jbe 0x1000b96b
lea ecx, [ebp - 0xc]
push ecx
lea edx, [ebp - 8]
push edx
call fcn.10006470
add esp, 8
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
push ecx
mov ecx, dword [ebp - 0x10]
call fcn.10010e40
push eax
mov edx, dword [ebp + 8]
push edx
call fcn.1000e270
add esp, 0xc
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x14]
mov dword [ebp + 8], eax
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 0x14]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x14]
push edx
mov ecx, dword [ebp - 0x10]
call fcn.10010dc0
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x4c], 0
je 0x1000ba0c
mov ecx, dword [ebp - 0x10]
call fcn.1000fcb0
mov dword [ebp - 0x2c], 0xfff
cmp dword [ebp - 8], 0xfff
jbe 0x1000b9db
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x4c]
push edx
push 0xfff
push 1
mov eax, dword [ebp + 8]
push eax
call fcn.10039016
add esp, 0x10
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x18]
mov dword [ebp + 8], ecx
mov edx, dword [ebp - 8]
sub edx, dword [ebp - 0x18]
mov dword [ebp - 8], edx
cmp dword [ebp - 0x18], 0xfff
je 0x1000b9d9
xor eax, eax
mov ecx, dword [ebp - 0x20]
sub ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x1c]
sbb edx, eax
mov eax, ecx
jmp 0x1000ba1b
jmp 0x1000b987
cmp dword [ebp - 8], 0
jbe 0x1000ba0c
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x4c]
push eax
mov ecx, dword [ebp - 8]
push ecx
push 1
mov edx, dword [ebp + 8]
push edx
call fcn.10039016
add esp, 0x10
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
sub ecx, dword [ebp - 0x28]
mov dword [ebp - 8], ecx
xor edx, edx
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x1c]
sbb ecx, edx
mov edx, ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100302a2
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10017500
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x10086050]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push 0x40
push 2
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov cx, word [eax]
mov word [edx], cx
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp - 8]
push eax
push 2
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100302a2
mov esp, ebp
pop ebp
ret

Function at 0x10017550
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x10086050]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push 0x40
push 6
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov ecx, dword [edx]
mov dword [eax], ecx
mov dx, word [edx + 4]
mov word [eax + 4], dx
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 8]
push ecx
push 6
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100302a2
mov esp, ebp
pop ebp
ret

Function at 0x100175b0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x10086050]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push 0x40
push 5
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov ecx, dword [edx]
mov dword [eax], ecx
mov dl, byte [edx + 4]
mov byte [eax + 4], dl
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 8]
push ecx
push 5
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100302a2
mov esp, ebp
pop ebp
ret

Function at 0x1003c945
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x1003c984
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1003c984
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1003c984
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x1003c984
cmp dword [ecx + 0x74], 0xe
jbe 0x1003c984
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x100426c7
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100750c0
push 0x100750b8
push str.FlsAlloc
push 0x1f
call fcn.10042532
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100426fb
push dword [ebp + 8]
mov ecx, esi
call dword [0x100541a4]
call esi
jmp 0x10042701
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x10042745
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100750d0
push 0x100750c8
push str.FlsGetValue
push 0x21
call fcn.10042532
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1004277c
push dword [ebp + 8]
mov ecx, esi
call dword [0x100541a4]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x10042784
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100750d8
push 0x100750d0
push str.FlsSetValue
push 0x22
call fcn.10042532
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100427be
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x100541a4]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]