joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2580bbb6
Capabilities:
Query remote server for available data

Disassembly:
push 0x18
push 0x258207c0
call fcn.2581ad00
and dword [ebp - 0x20], 0
and dword [ebp - 4], 0
push 0
push 0
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0x134]
add eax, 0x28
push eax
push dword [ecx + 0x130]
call dword [sym.imp.WININET.dll_InternetQueryDataAvailable]
mov dword [ebp - 0x20], eax
xor edi, edi
inc edi
mov ebx, edi
mov dword [ebp - 0x24], ebx
mov dword [ebp - 4], 0xfffffffe
jmp 0x2580bcb6
test ebx, ebx
jne 0x2580bcde
xor eax, eax
mov word [ebp - 0x1c], ax
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [0x25823e2c]
mov esi, dword [eax + 0x1218]
mov ecx, esi
call dword [0x2581d220]
call esi
pop ecx
test ebx, ebx
je 0x2580bce4
cmp dword [ebp - 0x20], 0
jne 0x2580bce6
xor edi, edi
mov eax, edi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x2580c1db
Capabilities:
Check internet connectivity via wininet

Disassembly:
push 0x1c
push 0x258208e8
call fcn.2581ad00
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], eax
push eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.WININET.dll_InternetGetConnectedState]
mov dword [ebp - 0x20], eax
xor edi, edi
inc edi
mov ebx, edi
mov dword [ebp - 0x28], ebx
mov dword [ebp - 4], 0xfffffffe
jmp 0x2580c2cc
test ebx, ebx
jne 0x2580c2f4
xor eax, eax
mov word [ebp - 0x1c], ax
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [0x25823e2c]
mov esi, dword [eax + 0x1218]
mov ecx, esi
call dword [0x2581d220]
call esi
pop ecx
test ebx, ebx
je 0x2580c303
cmp dword [ebp - 0x20], 0
je 0x2580c303
test byte [ebp - 0x24], 0x20
jne 0x2580c303
push 2
pop edi
mov ax, di
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x2580f206
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x2580f215
pop dword [ebp - 8]
mov eax, 0x1b993f00
add eax, 0x9e7b315
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0xacaa512
sub dword [ebp - 0x18], 0xbc785fc7
mov dword [ebp - 0x14], 0xb2bc5649
add dword [ebp - 0x14], 0x7f76f5fc
mov dword [ebp - 0x10], 0x6da78ae5
add dword [ebp - 0x10], 0xdea4b949
mov dword [ebp - 0xc], 0x10533c9f
add dword [ebp - 0xc], 0xefacc361
lea eax, [ebp - 0x18]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0x96a96537
sub dword [ebp - 0x18], 0x2236fbe1
mov dword [ebp - 0x14], 0x8a6bc382
sub dword [ebp - 0x14], 0x48ff620d
mov dword [ebp - 0x10], 0x63748947
sub dword [ebp - 0x10], 0x51cdb
mov dword [ebp - 0xc], 0x4de3c647
add dword [ebp - 0xc], 0xb21c39b9
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, 0x64d8f89c
sub eax, 0x3f57281c
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x41545
push 0
call eax
mov ecx, 0x573df944
add ecx, 0xa8c261ae
xor ebx, ebx
add ebx, eax
mov edi, 0x25829600
add edi, dword [ebp - 8]
mov edx, 0x9046056a
sub edx, 0xd49ec3ce
sub dword [ebp - 4], edx
mov esi, dword [edi]
sub dword [ebp - 4], eax
sub esi, edx
xor dword [ebp - 4], 0x127dabea
mov dword [ebx], esi
sub dword [ebp - 4], edi
add ebx, 0xad483979
sub ebx, 0xad483975
add edi, 0xe78fc217
sub edi, 0xe78fc213
loop 0x2580f32e
add eax, 0xbf2ca43d
sub eax, 0xbf2b45a2
mov ebx, eax
add eax, 0x4612e60d
sub eax, 0x4612e608
mov ecx, 0x25800000
add ecx, dword [ebp - 8]
call ebx
leave
ret
Function at 0x1002aadf
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x1002aaee
pop dword [ebp - 0x24]
mov eax, 0xe8ef7d19
add eax, 0x27132dd5
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0x3e7c0b24
sub dword [ebp - 0x34], 0xf029c5d9
mov dword [ebp - 0x30], 0xc41abd29
sub dword [ebp - 0x30], 0x91e770e4
mov dword [ebp - 0x2c], 0x8ff0262a
add dword [ebp - 0x2c], 0xbc5c1e04
mov dword [ebp - 0x28], 0x9e447bc
add dword [ebp - 0x28], 0xf61bb844
lea eax, [ebp - 0x34]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0xe3d9fe8
add dword [ebp - 0x34], 0x6634c96e
mov dword [ebp - 0x30], 0xe83df105
sub dword [ebp - 0x30], 0xa6d18f90
mov dword [ebp - 0x2c], 0xb461865
sub dword [ebp - 0x2c], 0xa7d6abf9
mov dword [ebp - 0x28], 0x8f005a20
sub dword [ebp - 0x28], 0x8f005a20
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x397ac
push 0
call eax
mov ecx, 0x2eb2bd46
add ecx, 0xd14d96c6
xor ebx, ebx
add ebx, eax
mov esi, 0x10039600
add esi, dword [ebp - 0x24]
mov edx, 0x80d1305e
add edx, 0x75849b50
xor dword [ebp - 0x18], 0xfb189718
mov edi, dword [esi]
xor dword [ebp - 0xc], eax
xor edi, edx
xor dword [ebp - 0x1c], 0xb66df689
mov dword [ebx], edi
mov dword [ebp - 0x14], 0xede2f1a6
add ebx, 4
add esi, 4
loop 0x1002ac02
add eax, 0x71c80fc2
add eax, 0x8e393341
mov ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 0x24]
call ebx
leave
ret

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40c7d0
nop
nop
mov ecx, 0x77dc7a0f
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x432024
nop
nop
nop
mov eax, section..text_1
nop
mov ebx, 0x42f314
mov ecx, 0x62e1154d
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x432084
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x40a15c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [ebp + 0xc]
mov word [ebp + 0xc], ax
mov ebx, 0x19826993
mov eax, ebx
mul ebx
mov dword [ebp - 0x10], eax
mov ebx, eax
xor esi, esi
mov eax, ebx
mul ebx
mov dword [ebp - 0x14], eax
mov ebx, eax
mov word [ebp - 0xc], 0
jmp 0x40a272
mov eax, ebx
xor eax, ebx
mov ebx, eax
mov eax, dword [ebp + 8]
add eax, esi
push eax
call fcn.00405066
pop ecx
mov edx, eax
mov byte [ebp - 1], dl
cmp byte [ebp - 1], 0
jne 0x40a1b3
mov byte [ebp - 2], 0
jmp 0x40a1dd
call fcn.0040ddd8
mov dword [ebp - 0x18], eax
mov eax, 0x7fff
mov edi, 7
movzx edx, byte [ebp - 1]
mov ecx, edi
sub ecx, edx
cdq
idiv ecx
mov ecx, eax
mov eax, dword [ebp - 0x18]
cdq
idiv ecx
mov edx, eax
mov byte [ebp - 2], dl
mov eax, dword [ebp + 8]
mov al, byte [esi + eax]
cmp al, 0x70
jb 0x40a1fc
cmp al, 0x7f
ja 0x40a1fc
mov eax, dword [ebp + 8]
add eax, esi
inc eax
movzx edx, byte [eax]
movzx ecx, byte [ebp - 2]
sub edx, ecx
mov byte [eax], dl
mov eax, dword [ebp + 8]
movzx eax, byte [esi + eax]
cmp eax, 0xe2
jne 0x40a21b
mov eax, dword [ebp + 8]
add eax, esi
inc eax
movzx edx, byte [eax]
movzx ecx, byte [ebp - 2]
sub edx, ecx
mov byte [eax], dl
mov eax, ebx
sub eax, ebx
mov ebx, eax
push 8
push 0x90
lea eax, [ebp - 0xa]
push eax
call fcn.0040ddc0
movzx eax, byte [ebp - 1]
push eax
mov eax, dword [ebp + 8]
add eax, esi
push eax
lea eax, [ebp - 0xa]
movzx edx, byte [ebp - 2]
add eax, edx
push eax
call fcn.0040ddb4
mov eax, ebx
sub eax, ebx
mov ebx, eax
push 6
lea eax, [ebp - 0xa]
push eax
mov eax, dword [ebp + 8]
add eax, esi
push eax
call fcn.0040ddb4
add esp, 0x24
mov eax, ebx
add eax, ebx
mov ebx, eax
add esi, 6
inc word [ebp - 0xc]
movzx eax, word [ebp + 0xc]
dec eax
cmp esi, eax
jb 0x40a190
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4348af
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
movsb byte es:[edi], byte [esi]
call fcn.0043492e
jae 0x4348bb
xor ecx, ecx
call fcn.0043492e
jae 0x4348e5
xor eax, eax
call fcn.0043492e
jae 0x4348f6
mov al, 0x10
call fcn.0043492e
adc al, al
jae 0x4348d7
jne 0x434923
stosb byte es:[edi], al
jmp 0x4348bc
call fcn.0043493a
dec ecx
loop 0x434902
mov eax, ebp
call fcn.00434938
jmp 0x434924
lodsb al, byte [esi]
shr eax, 1
je 0x43494a
adc ecx, 2
mov ebp, eax
jmp 0x434924
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
mov ebp, eax
call fcn.00434938
cmp eax, 0x7d00
jae 0x434922
cmp eax, 0x500
jae 0x434923
cmp eax, 0x7f
ja 0x434924
inc ecx
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x4348bc
pop ebp
ret 8
Function at 0x4028a5
Capabilities:
Get common file path
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1400
call reloc.KERNEL32.dll_LeaveCriticalSection
mov eax, dword [0x2e7dff8]
mov ecx, dword [0x2e7cf48]
push esi
shr eax, 3
xor esi, esi
cmp eax, esi
jbe 0x402980
push ebx
push edi
mov edi, ecx
mov ebx, eax
cmp dword [0x2e7dff8], 0x959
jne 0x40296e
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SleepEx]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateJobObjectW]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumDateFormatsExA]
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetFileShortNameA]
push esi
lea eax, [ebp - 0xc00]
push eax
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_LCMapStringA]
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
call dword [sym.imp.KERNEL32.dll_HeapUnlock]
push esi
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push esi
lea eax, [ebp - 0x800]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push esi
lea eax, [ebp - 0x1400]
push eax
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_FoldStringW]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push edi
call fcn.004026ee
add edi, 8
dec ebx
jne 0x4028d1
pop edi
pop ebx
pop esi
leave
ret
Function at 0x403870
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x8090c8]
jne 0x40387a
repz ret
jmp fcn.00405dce

Function at 0x4059f4
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00404509
and dword [ebp - 4], 0
cmp dword [0x80a884], 0
mov ebx, eax
jne 0x405aa5
push 0x401930
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x405b56
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x401924
push edi
call esi
test eax, eax
je 0x405b56
push eax
call fcn.00404497
mov dword [esp], 0x401914
push edi
mov dword [0x80a884], eax
call esi
push eax
call fcn.00404497
mov dword [esp], 0x401900
push edi
mov dword [0x80a888], eax
call esi
push eax
call fcn.00404497
mov dword [esp], 0x4018e4
push edi
mov dword [0x80a88c], eax
call esi
push eax
call fcn.00404497
pop ecx
mov dword [0x80a894], eax
test eax, eax
je 0x405aa5
push 0x4018cc
push edi
call esi
push eax
call fcn.00404497
pop ecx
mov dword [0x80a890], eax
mov eax, dword [0x80a890]
cmp eax, ebx
je 0x405afd
cmp dword [0x80a894], ebx
je 0x405afd
push eax
call fcn.00404512
push dword [0x80a894]
mov esi, eax
call fcn.00404512
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x405afd
test edi, edi
je 0x405afd
call esi
test eax, eax
je 0x405af4
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x405af4
test byte [ebp - 0xc], 1
jne 0x405afd
or dword [ebp + 0x10], 0x200000
jmp 0x405b36
mov eax, dword [0x80a888]
cmp eax, ebx
je 0x405b36
push eax
call fcn.00404512
pop ecx
test eax, eax
je 0x405b36
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x405b36
mov eax, dword [0x80a88c]
cmp eax, ebx
je 0x405b36
push eax
call fcn.00404512
pop ecx
test eax, eax
je 0x405b36
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x80a884]
call fcn.00404512
pop ecx
test eax, eax
je 0x405b56
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x405b58
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10005c70
Capabilities:
Create directory
Encode data using xor
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1004117d
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
mov eax, dword [0x1005400c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
mov eax, 6
mov dword [ebp - 0x20], eax
xor ecx, ecx
mov dword [ebp - 0x1c], 0x85e096be
mov dword [ebp - 0x18], 0x5f6476de
mov dword [ebp - 0x14], 0xd001f
mov dword [ebp - 0x10], 0x34
lea eax, [ecx + 0x2e]
xor word [ebp + ecx*2 - 0x1c], ax
inc ecx
mov eax, dword [ebp - 0x20]
cmp ecx, eax
jb 0x10005cc3
xor ecx, ecx
lea edx, [ebp - 0x1c]
mov word [ebp + eax*2 - 0x1c], cx
push dword [ebp + 8]
call fcn.1000dfe0
mov ecx, eax
call fcn.1000af90
push eax
call fcn.1000e2a0
add esp, 4
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x10005d26
push 2
push dword [ebp + 8]
call fcn.10027378
add esp, 8
test eax, eax
je 0x10005d26
push 4
push dword [ebp + 8]
call fcn.10027378
add esp, 8
test eax, eax
jne 0x10005d5a
push 0x2006
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x10005d5e
push 2
push dword [ebp + 8]
call fcn.10027378
add esp, 8
test eax, eax
je 0x10005d5e
push 4
push dword [ebp + 8]
call fcn.10027378
add esp, 8
test eax, eax
je 0x10005d5e
xor bl, bl
jmp 0x10005d60
mov bl, 1
mov dword [ebp - 4], 0xffffffff
or ecx, 0xffffffff
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x10005d82
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10009d50
Capabilities:
Contain obfuscated stackstrings
Create thread
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
sub dword [ebp + 0xc], 1
jne 0x10009de5
mov dword [ebp - 0x24], 0xf
xor eax, eax
mov dword [ebp - 0x20], 0x5b005d
mov dword [ebp - 0x1c], 0x500055
mov dword [ebp - 0x18], 0x50005f
mov dword [ebp - 0x14], 0x5c0058
mov dword [ebp - 0x10], 0x590053
mov dword [ebp - 0xc], 0x17004c
mov dword [ebp - 8], 0x57005e
mov dword [ebp - 4], 0x3d0050
lea ecx, [eax + 0x2e]
xor word [ebp + eax*2 - 0x20], cx
inc eax
mov ecx, dword [ebp - 0x24]
cmp eax, ecx
jb 0x10009da1
xor eax, eax
push eax
mov word [ebp + ecx*2 - 0x20], ax
lea eax, [ebp - 0x20]
push eax
call fcn.10027378
add esp, 8
test eax, eax
jne 0x10009de5
call fcn.10008640
push 0
push 0
push 0
push 0x10008bf0
push 0
push 0
call fcn.10027e5b
add esp, 0x18
mov eax, 1
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1000a3d0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [esp + 0xc], edi
test eax, eax
jg 0x1000a402
jl 0x1000a3f5
test ecx, ecx
jne 0x1000a402
xor eax, eax
xor edx, edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x1000a4c2
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], eax
mov ecx, ebx
call fcn.1000c920
mov esi, eax
mov eax, edx
mov dword [esp + 0x14], eax
test eax, eax
jl 0x1000a46e
jg 0x1000a42d
test esi, esi
je 0x1000a46e
mov ecx, dword [esp + 0xc]
cmp ecx, eax
jg 0x1000a445
mov eax, dword [esp + 0x10]
jl 0x1000a43f
cmp eax, esi
jae 0x1000a445
mov esi, eax
mov dword [esp + 0x14], ecx
mov eax, dword [ebx + 0x1c]
push esi
push dword [eax]
push edi
call fcn.10019420
mov eax, dword [ebx + 0x2c]
add esp, 0xc
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
sub ecx, esi
sbb edx, dword [esp + 0x14]
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
jmp 0x1000a48f
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x1c]
mov edx, dword [esp + 0xc]
cmp eax, 0xffffffff
je 0x1000a4ab
mov ecx, dword [esp + 0x10]
mov esi, 1
add ecx, 0xffffffff
mov byte [edi], al
adc edx, 0xffffffff
add edi, esi
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], ecx
test edx, edx
jg 0x1000a414
jl 0x1000a4ab
test ecx, ecx
jne 0x1000a414
mov eax, dword [ebp + 0xc]
sub eax, dword [esp + 0x10]
mov ecx, dword [ebp + 0x10]
sbb ecx, edx
mov edx, ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
lea esi, [ebx + 0x2c]
mov edi, ecx
mov edx, dword [eax]
test edx, edx
je 0x1000a506
mov eax, dword [esi]
mov eax, dword [eax]
test eax, eax
je 0x1000a506
mov edi, dword [esp + 0xc]
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push edx
push edi
call fcn.10019420
mov eax, dword [ebx + 0x2c]
add edi, esi
mov dword [esp + 0x18], edi
add esp, 0xc
mov edi, dword [ebp + 0xc]
sub edi, esi
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
lea esi, [ebx + 0x2c]
cmp dword [ebx + 0x4c], 0
je 0x1000a577
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x1000a52c
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi]
mov dword [eax], edx
mov esi, dword [esp + 0xc]
cmp edi, 0xfff
jbe 0x1000a562
nop dword [eax + eax]
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call fcn.1002a27c
add esp, 0x10
add esi, eax
sub edi, eax
cmp eax, 0xfff
jne 0x1000a577
cmp edi, eax
ja 0x1000a540
test edi, edi
je 0x1000a577
push dword [ebx + 0x4c]
push edi
push 1
push esi
call fcn.1002a27c
add esp, 0x10
sub edi, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1000c7b0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100417d0
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x1005400c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x18], eax
push 8
mov dword [ebp - 0x18], eax
mov dword [eax], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.10015a2f
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.10017d07
mov dword [esi + 4], eax
add esp, 8
mov eax, dword [ebp - 0x10]
lea ecx, [eax + 0x18]
lea edx, [eax + 0x24]
lea edi, [eax + 0x14]
mov dword [eax + 0x34], esi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [ebx], 0
mov ebx, dword [ebp - 0x10]
mov dword [edi], 0
mov dword [edx], 0
mov dword [eax + 0x10], esi
mov dword [ebx], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov byte [ebx + 0x48], 0
mov byte [ebx + 0x3d], 0
mov ebx, dword [ebp - 0x14]
mov dword [eax + 0xc], ebx
mov ebx, dword [ebp - 0x10]
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
mov eax, dword [ebp - 0x18]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [ebx], 0
mov dword [edi], 0
mov dword [edx], 0
mov dword [eax + 0x4c], 0
mov ecx, dword [0x10056150]
mov edx, dword [0x10056154]
mov dword [eax + 0x40], ecx
mov dword [eax + 0x44], edx
mov dword [eax + 0x38], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000d630
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100418b0
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x1005400c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
push 8
mov dword [eax], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.10015a2f
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.10017d07
mov dword [esi + 4], eax
add esp, 8
mov eax, dword [ebp - 0x10]
lea edi, [eax + 0x14]
lea ecx, [eax + 0x18]
lea edx, [eax + 0x24]
mov dword [eax + 0x34], esi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [ebx], 0
mov dword [edi], 0
mov dword [edx], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10010270
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x100102cb
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x100102cb
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 8]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x100102b8
cmp esi, edx
jae 0x100102cb
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x100102a6
cmp esi, edx
jae 0x100102cb
xor eax, eax
cmp word [esi], ax
pop edi
cmove esi, eax
mov eax, esi
pop esi
pop ebx
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x1002876f
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x1005400c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push 0x10045e68
push esi
call fcn.10031e2d
pop ecx
pop ecx
test eax, eax
jne 0x1002879d
xor al, al
jmp 0x1002881a
push ebx
lea eax, [ebp - 0x210]
xor ebx, ebx
push eax
push 0x104
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x210], ebx
push esi
push eax
call fcn.100284b2
mov edx, eax
add esp, 0x10
test edx, edx
jne 0x100287d7
push dword [ebp - 0x210]
call fcn.10025443
xor al, al
jmp 0x10028818
mov ecx, edx
push edi
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x100287dd
sub ecx, edi
sar ecx, 1
pop edi
cmp ecx, 3
je 0x100287fd
push edx
call fcn.100286a5
pop ecx
test al, al
je 0x100287c8
push esi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x1002880b
mov bl, 1
push dword [ebp - 0x210]
call fcn.10025443
mov al, bl
pop ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.100154d9
leave
ret

Function at 0x1003126f
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100476a4
push 0x1004769c
push str.FlsAlloc
push 0x1e
call fcn.1003109c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100312a3
push dword [ebp + 8]
mov ecx, esi
call dword [0x100431d0]
call esi
jmp 0x100312a9
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x100312ed
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100476b4
push 0x100476ac
push str.FlsGetValue
push 0x20
call fcn.1003109c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10031324
push dword [ebp + 8]
mov ecx, esi
call dword [0x100431d0]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]