joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10002003
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x10008fa0]
xor eax, dword [ebp + 4]
mov ecx, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 4], eax
xor edx, edx
push edi
xor eax, eax
cmp ecx, dword [eax*8 + 0x10008ad0]
je 0x10002030
inc eax
cmp eax, 0x12
jb 0x10002021
mov esi, eax
shl esi, 3
cmp ecx, dword [esi + 0x10008ad0]
jne 0x10002164
mov eax, dword [0x1000936c]
cmp eax, 1
je 0x1000213f
cmp eax, edx
jne 0x10002060
cmp dword [0x10009370], 1
je 0x1000213f
cmp ecx, 0xfc
je 0x10002164
push 0x104
lea eax, [ebp - 0x10c]
push eax
push edx
mov byte [ebp - 8], dl
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x10002099
lea eax, [ebp - 0x10c]
push str._program_name_unknown_
push eax
call fcn.10003810
pop ecx
pop ecx
lea eax, [ebp - 0x10c]
push eax
lea edi, [ebp - 0x10c]
call fcn.10003910
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x100020db
lea eax, [ebp - 0x10c]
push eax
call fcn.10003910
mov edi, eax
lea eax, [ebp - 0x10c]
sub eax, 0x3b
push 3
add edi, eax
push 0x10006860
push edi
call fcn.10003de0
add esp, 0x10
push edi
call fcn.10003910
push dword [esi + 0x10008ad4]
mov ebx, eax
call fcn.10003910
lea eax, [ebx + eax + 0x1c]
pop ecx
add eax, 3
pop ecx
and eax, 0xfffffffc
call fcn.10001fc0
mov ebx, esp
push str.Runtime_Error__n_nProgram:
push ebx
call fcn.10003810
push edi
push ebx
call fcn.10003820
push 0x10006840
push ebx
call fcn.10003820
push dword [esi + 0x10008ad4]
push ebx
call fcn.10003820
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebx
call fcn.10003cdd
add esp, 0x2c
jmp 0x10002164
push edx
lea eax, [ebp + 8]
push eax
lea esi, [esi + 0x10008ad4]
push dword [esi]
call fcn.10003910
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea esp, [ebp - 0x118]
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
call fcn.10003f35
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401a80
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x409008], 0x8088405
inc edx
mov dword [ebx + 0x409008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x406480
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, eax
mov eax, dword [0x409214]
mov dword [eax], ecx
mov ebx, edx
test ebx, ebx
jle 0x4064a1
mov eax, 0xff
call fcn.00401a80
xor byte [esi], al
inc esi
dec ebx
jne 0x406491
pop esi
pop ebx
ret

Function at 0x40a727
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
push edi
push 4
pop eax
call fcn.004058d0
mov ebx, esp
push 0x1c
lea eax, [ebp - 0x24]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x40a7bc
mov edi, dword [ebp - 0x20]
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x44]
lea esi, [eax - 1]
not esi
and esi, ebx
sub esi, eax
mov dword [ebp - 4], eax
mov eax, dword [0x411950]
mov ecx, eax
dec ecx
neg ecx
sbb ecx, ecx
and ecx, 0xffff1000
add ecx, 0x11000
add ecx, edi
cmp esi, ecx
jb 0x40a7bc
cmp eax, 1
je 0x40a7d4
mov ebx, edi
mov edi, 0x1000
push 0x1c
lea eax, [ebp - 0x24]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x40a7bc
add ebx, dword [ebp - 0x18]
test dword [ebp - 0x14], edi
je 0x40a791
test byte [ebp - 0xf], 1
mov ebx, dword [ebp - 0x24]
je 0x40a7b8
xor eax, eax
inc eax
jmp 0x40a7f0
cmp esi, ebx
jae 0x40a7c0
xor eax, eax
jmp 0x40a7f0
push 4
push edi
push dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x411950]
jmp 0x40a7d6
mov ebx, esi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 8]
push ecx
inc eax
push eax
push dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x54]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x80b004]
jne 0x40100a
repz ret
jmp fcn.00401368

Function at 0x40425b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x80b004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00403568
and dword [ebp - 0x14], 0
cmp dword [0x80d940], 0
mov dword [ebp - 0x18], eax
jne 0x40430e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4043b6
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x4043b6
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x80d940], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x80d944], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x80d948], eax
call edi
push eax
call esi
mov dword [0x80d950], eax
test eax, eax
je 0x40430e
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x80d94c], eax
mov eax, dword [0x80d94c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x404367
cmp dword [0x80d950], ecx
je 0x404367
push eax
call esi
push dword [0x80d950]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x404367
test ebx, ebx
je 0x404367
call edi
test eax, eax
je 0x40435e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40435e
test byte [ebp - 8], 1
jne 0x404367
or dword [ebp + 0x10], 0x200000
jmp 0x40439a
mov eax, dword [0x80d944]
cmp eax, dword [ebp - 0x18]
je 0x40439a
push eax
call esi
test eax, eax
je 0x40439a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40439a
mov eax, dword [0x80d948]
cmp eax, dword [ebp - 0x18]
je 0x40439a
push eax
call esi
test eax, eax
je 0x40439a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x80d940]
call esi
test eax, eax
je 0x4043b6
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4043b8
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401000
leave
ret

Function at 0x806ba0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0x20
add dword [ebp - 4], 0x20
mov edx, dword [0x22dfde4]
mov eax, dword [0x22dfb08]
xor ecx, ecx
mov word [0x22dfe00], cx
lea ecx, [ebp - 8]
push ecx
push 0x40
push edx
push eax
mov dword [0x22dfdec], 0x6e0072
mov dword [0x22dfdf0], 0x6c0065
mov dword [0x22dfdf4], 0x320033
mov dword [0x22dfdf8], 0x64002e
mov dword [0x22dfdfc], 0x6c006c
mov dword [0x22dfde8], 0x65006b
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esp, ebp
pop ebp
ret
Function at 0x806dd0
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x80bdc0]
sub esp, 0x10
push ebx
mov ebx, dword [0x22dfb08]
push edi
mov edi, dword [0x22dfde4]
push eax
call fcn.00806cf0
add esp, 4
cmp dword [0x22dfde4], 0x2f
jne 0x806e2d
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0x10]
push edx
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
call fcn.00806d40
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100092c3
Capabilities:
Get common file path

Disassembly:
push ebp
push edi
push pe_nt_image_headers32
call sub.glib_lite.dll_Ordinal_406
mov edi, eax
pop ecx
test edi, edi
je 0x1000934d
push edi
xor ebp, ebp
push ebp
push 0x1001d834
push 0x10023880
call dword [sym.imp.kernel32.dll_GetTempFileNameA]
test eax, eax
je 0x10009352
push ebx
push ebp
mov ebx, 0x4000100
push ebx
push 2
push ebp
push 5
push 0xc0000000
push edi
call dword [sym.imp.kernel32.dll_CreateFileA]
push ebp
push ebx
push 3
push ebp
push 7
push Ordinal_1
push edi
mov dword [edi + 0x108], eax
call dword [sym.imp.kernel32.dll_CreateFileA]
cmp dword [edi + 0x108], 0xffffffff
mov dword [edi + 0x104], eax
pop ebx
je 0x10009352
cmp eax, 0xffffffff
je 0x10009352
mov dword [edi + 0x118], ebp
mov dword [edi + 0x11c], ebp
mov dword [edi + 0x110], ebp
mov dword [edi + 0x114], ebp
mov eax, edi
pop edi
pop ebp
ret
push edi
call sub.glib_lite.dll_Ordinal_109
pop ecx
xor eax, eax
jmp 0x1000934f

Function at 0x10010530
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
push ebx
push ebp
mov ebp, dword [esp + 0x10]
mov ecx, dword [eax*4 + 0x1001e2c8]
push esi
push edi
push 0xffffffffffffff80
mov dword [esp + 0x18], ecx
lea edi, [ecx + ecx]
pop esi
mov ebx, esi
xor edx, edx
sar ebx, 0x1f
mov eax, ebx
xor eax, esi
sub eax, ebx
cmp eax, edi
cmovl edx, eax
mov al, bl
sub edx, ecx
mov ecx, edx
sar ecx, 0x1f
xor dl, cl
sub al, dl
add al, cl
mov ecx, dword [esp + 0x14]
add al, cl
xor al, bl
mov byte [esi + ebp], al
inc esi
cmp esi, 0x80
jle 0x1001054d
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x10013a24
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x10013a33
pop dword [ebp - 0x3c]
mov eax, 0xafe47dfa
add eax, 0x601cbc39
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0x6009e4b9
sub dword [ebp - 0x4c], 0x11b79f6e
mov dword [ebp - 0x48], 0x7fff265c
sub dword [ebp - 0x48], 0x4dcbda17
mov dword [ebp - 0x44], 0xde907f46
add dword [ebp - 0x44], 0x6dbbc4e8
mov dword [ebp - 0x40], 0x1bb1e02f
sub dword [ebp - 0x40], 0x1bb1e02f
lea eax, [ebp - 0x4c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0x62b44923
add dword [ebp - 0x4c], 0x11be2033
mov dword [ebp - 0x48], 0xee08c8f8
add dword [ebp - 0x48], 0x5363987d
mov dword [ebp - 0x44], 0xd3fe3b7d
add dword [ebp - 0x44], 0x8f7130ef
mov dword [ebp - 0x40], 0x26bc03a4
add dword [ebp - 0x40], 0xd943fc5c
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push 0x356e1
push 0
call eax
mov ecx, 0x72a10926
sub ecx, 0x72a0c913
mov edi, eax
mov ebx, 0x10026800
add ebx, dword [ebp - 0x3c]
mov edx, 0x9e50597c
add edx, 0x4c57f9c9
xor dword [ebp - 0x14], edx
mov esi, dword [ebx]
add dword [ebp - 4], ebx
add esi, edx
mov dword [edi], esi
xor dword [ebp - 0x1c], 0x32494bb0
add edi, 4
add ebx, 0x34e02f53
add ebx, 0xcb1fd0b1
loop 0x10013b45
add eax, 0xf31f
xor ebx, ebx
add ebx, eax
add eax, 0x1a46dabf
add eax, 0xe5b92546
mov ecx, 0x8698521c
sub ecx, 0x7698521c
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret
Function at 0x40d908
Capabilities:
Get file attributes

Disassembly:
call fcn.0040502c
push eax
call sub.kernel32.dll_GetFileAttributesA
inc eax
je 0x40d91c
dec eax
and al, 0x10
sete al
ret

Function at 0x40d998
Capabilities:
Get common file path

Disassembly:
push ebx
xchg ebx, eax
sub esp, 0x104
mov eax, esp
push 0x104
push eax
call sub.kernel32.dll_GetSystemDirectoryA
mov eax, ebx
mov edx, esp
call fcn.00403870
mov edx, ebx
mov eax, dword [edx]
call fcn.00405c64
add esp, 0x104
pop ebx
ret

Function at 0x40d9c8
Capabilities:
Get common file path

Disassembly:
push ebx
xchg ebx, eax
sub esp, 0x104
mov eax, esp
push 0x104
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
mov eax, ebx
mov edx, esp
call fcn.00403870
mov edx, ebx
mov eax, dword [edx]
call fcn.00405c64
add esp, 0x104
pop ebx
ret

Function at 0x40d9f8
Capabilities:
Get common file path

Disassembly:
push eax
sub esp, 0x108
push esp
push 0x105
call sub.kernel32.dll_GetTempPathA
mov edx, esp
mov eax, dword [esp + 0x108]
call fcn.00403870
add esp, 0x108
pop edx
mov eax, dword [edx]
call fcn.00405c64
ret

Function at 0x40e488
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov word [ebp - 2], cx
mov edi, edx
mov esi, eax
push 0
push 0x8000080
push 3
push 0
push 1
push 0xc0000000
push esi
call sub.kernel32.dll_CreateFileA
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x40e4bc
xor eax, eax
jmp 0x40e50d
lea eax, [ebp - 0xc]
push eax
mov ax, word [ebp - 2]
push eax
push edi
call sub.kernel32.dll_DosDateTimeToFileTime
test eax, eax
je 0x40e4f0
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
call sub.kernel32.dll_LocalFileTimeToFileTime
test eax, eax
je 0x40e4f0
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 0x14]
push eax
push ebx
call sub.kernel32.dll_SetFileTime
push ebx
call sub.kernel32.dll_CloseHandle
mov ax, word [ebp + 8]
and ax, 0x27
movzx eax, ax
push eax
push esi
call sub.kernel32.dll_SetFileAttributesA
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x415a14
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push dword [ebp - 0x748]
push dword [ebp - 0x380]
call dword [ebp - 0x730]
push dword [ebp - 0x380]
call dword [ebp - 0x680]
jmp 0x415a39
and dword [ebp - 0x37c], 0
invalid
mov ch, 0x60
cld
Function at 0x1002d870
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x1002d87f
pop dword [ebp - 8]
mov eax, 0xde155c26
sub eax, 0xce1283a7
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0xd8db7fe6
add dword [ebp - 0x18], 0x7576c565
mov dword [ebp - 0x14], 0xb8db3ad8
add dword [ebp - 0x14], 0x7958116d
mov dword [ebp - 0x10], 0x1362bd49
add dword [ebp - 0x10], 0x38e986e5
mov dword [ebp - 0xc], 0x40774bd5
add dword [ebp - 0xc], 0xbf88b42b
lea eax, [ebp - 0x18]
push eax
mov eax, 0x538fb44
add eax, 0xacb04f8
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0xc18d90c4
sub dword [ebp - 0x18], 0x4d1b276e
mov dword [ebp - 0x14], 0xec1bc00a
add dword [ebp - 0x14], 0x5550a16b
mov dword [ebp - 0x10], 0x7447b09c
sub dword [ebp - 0x10], 0x10d84430
mov dword [ebp - 0xc], 0xb5dbfab4
add dword [ebp - 0xc], 0x4a24054c
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, 0x78b471a0
sub eax, 0x68b07170
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x4d7c7
push 0
call eax
mov ecx, 0x640f
xor edi, edi
add edi, eax
mov esi, 0x6699ff9f
add esi, 0xa96b6e61
add esi, dword [ebp - 8]
mov ebx, 0xdf3c2279
add ebx, 0xd0c4768a
sub dword [ebp - 4], ebx
mov edx, dword [esi]
xor edx, ebx
add dword [ebp - 4], 0xeb2f6db8
mov dword [edi], edx
xor dword [ebp - 4], ecx
add edi, 0xa87fac27
add edi, 0x578053dd
add esi, 0xee3e5751
sub esi, 0xee3e574d
loop 0x1002d99d
add eax, 0x1830f
xor ebx, ebx
add ebx, eax
add eax, 0xdb81ac51
add eax, 0x247e53b4
mov ecx, 0xc777d684
sub ecx, 0xb777d684
add ecx, dword [ebp - 8]
call ebx
leave
ret
Function at 0x10031820
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x1004f37c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x10031850
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10038620
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
mov eax, dword [eax]
test eax, eax
je 0x10031880
mov edx, dword [esi + 0x30]
mov edx, dword [edx]
add edx, eax
cmp eax, edx
jae 0x10031880
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void_]
pop esi
mov byte [eax], bl
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10038620
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
push edi
je 0x1003197a
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x100318a9
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x100318dd
push dword [esi + 0x4c]
movsx eax, bl
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10038620
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x28], bl
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x27]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
test eax, eax
js 0x1003197a
cmp eax, 1
jle 0x1003193b
cmp eax, 3
jne 0x1003197a
push dword [esi + 0x4c]
push dword [ebp - 0x28]
call fcn.1002d870
add esp, 8
or ecx, 0xffffffff
test al, al
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10038620
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x10031959
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x1003197a
lea eax, [ebp - 0x28]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
je 0x1003197a
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10038620
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10038620
mov esp, ebp
pop ebp
ret 4
Function at 0x10036f80
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003ecf8
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x1004f37c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x1004f338]
cmp eax, 0xffffffff
jne 0x10036fb6
xor ebx, ebx
jmp 0x10036fbf
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov ebx, eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], 0
test ebx, ebx
je 0x10036fff
mov eax, dword [ebx + 0x18]
mov esi, dword [ebx + 0xc]
test eax, eax
jne 0x1003703e
test esi, esi
jne 0x10037042
push 0x10035760
push 0x10050e58
call fcn.1002d870
mov eax, dword [0x1004f338]
add esp, 8
cmp eax, 0xffffffff
je 0x10036fff
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov dword [ebp - 4], 1
test ebx, ebx
je 0x1003702c
or eax, 0xffffffff
lock xadd dword [ebx + 4], eax
jne 0x1003702c
mov eax, dword [ebx]
mov ecx, ebx
push 0
call dword [eax]
push ebx
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x10037084
mov eax, dword [esi + 4]
mov dword [ebx + 0xc], eax
mov ecx, dword [esi]
test ecx, ecx
je 0x1003706d
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [esi]
mov ecx, edi
push 0
mov eax, dword [edi]
call dword [eax]
push edi
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapFree]
push esi
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov esi, dword [ebx + 0xc]
test esi, esi
jne 0x10037042
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x10036fd0
nop
mov esi, dword [ebx + 0x14]
mov esi, dword [esi]
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x100370a9
mov edx, dword [esi + 0x1c]
test edx, edx
je 0x100370a9
mov eax, dword [ecx]
push edx
call dword [eax + 4]
push esi
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebx + 0x14]
call fcn.1002d870
mov eax, dword [ebx + 0x18]
test eax, eax
jne 0x10037090
jmp 0x10036fd0

Function at 0x100370d0
Capabilities:
Create thread
Resume thread

Disassembly:
push ebx
push esi
mov esi, ecx
mov edx, dword [esi]
lea eax, [edx + 0x10]
push eax
push 4
push edx
push 0x10037130
push 0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov ebx, eax
add esp, 0x18
test ebx, ebx
jne 0x100370fa
pop esi
xor al, al
pop ebx
ret
mov eax, dword [esi]
push edi
add eax, 4
lock inc dword [eax]
mov edi, dword [esi]
mov eax, dword [edi + 8]
test eax, eax
je 0x10037118
cmp eax, 0xffffffff
je 0x10037118
push eax
call dword [sym.imp.kernel32.dll_CloseHandle]
mov dword [edi + 8], ebx
mov eax, dword [esi]
push dword [eax + 8]
call dword [sym.imp.kernel32.dll_ResumeThread]
pop edi
pop esi
mov al, 1
pop ebx
ret
Function at 0x10006c2a
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
call dword [ecx - 0x18]
or eax, dword [eax]
add byte [eax], al
add byte [esi], dh
xor eax, 0x383d343c
cmp al, 0x4a
dec edi
inc eax
add esp, 4
xor ecx, 0xdff2
add bl, ch
pop es
sub ecx, 0xc679
pop ecx
push edi
xor edi, 0xe61e
pop edi
mov edx, dword [ebp - 0x3f4]
mov dword [ebp - 0x4f8], edx
jmp 0x10006c04
push ecx
xor ecx, 0x2d72
jmp 0x10006c13
jmp 0x10006c18
pop ecx
push edi
push edi
add esp, 4
call 0x10006c2a
add byte [eax + 0x39], al
xor eax, 0x833f473c
les eax, [ebx + ebp*8]
push es
xor eax, 0x454c4747
pop edi
mov ecx, dword [ebp - 0x4f8]
sub ecx, dword [ebp - 0x3f4]
cmp ecx, 0xffffffff
jb 0x10006c7e
push eax
sub eax, 0xae62
call 0x10006c5d
add byte [ebx], dh
dec ebx
inc ecx
cmp dword [edx], esi
inc eax
inc ebp
push eax
aas
add esp, 4
jmp 0x10006c67
call 0x10006c75
add byte [esi], bh
inc edi
inc edi
cmp bh, byte [0x833e3f3b]
les eax, [eax + ebx*2]
jmp 0x10006e7a
mov dword [ebp - 0xc90], 7
mov edx, dword [ebp - 0x4f8]
mov dword [ebp - 0xa64], edx
push ebx
and ebx, 0xd4a
or ebx, 0xdb2b
add ebx, 0x14869
dec eax
add dword [eax], eax
pop ebx
push ecx
and ecx, 0x1258a
call 0x10006cbc
invalid
push edx
and edx, 0x16bb
sub edx, 0x98b
sub edx, 0x4345
pop edx
push ecx
push ebx
add esp, 4
add ecx, 0xce96
or ecx, 0x1161a
sub ecx, 0xb084
sub ecx, 0x6726
pop ecx
mov dword [ebp - 0x3fc], 0

Function at 0x10006c5d
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
call dword [ecx - 0x18]
or eax, dword [eax]
add byte [eax], al
add byte [esi], dh
xor eax, 0x383d343c
cmp al, 0x4a
dec edi
inc eax
add esp, 4
xor ecx, 0xdff2
add bl, ch
pop es
sub ecx, 0xc679
pop ecx
push edi
xor edi, 0xe61e
pop edi
mov edx, dword [ebp - 0x3f4]
mov dword [ebp - 0x4f8], edx
jmp 0x10006c04
push ecx
xor ecx, 0x2d72
jmp 0x10006c13
jmp 0x10006c18
pop ecx
push edi
push edi
add esp, 4
call 0x10006c2a
add byte [eax + 0x39], al
xor eax, 0x833f473c
les eax, [ebx + ebp*8]
push es
xor eax, 0x454c4747
pop edi
mov ecx, dword [ebp - 0x4f8]
sub ecx, dword [ebp - 0x3f4]
cmp ecx, 0xffffffff
jb 0x10006c7e
push eax
sub eax, 0xae62
call 0x10006c5d
add byte [ebx], dh
dec ebx
inc ecx
cmp dword [edx], esi
inc eax
inc ebp
push eax
aas
add esp, 4
jmp 0x10006c67
call 0x10006c75
add byte [esi], bh
inc edi
inc edi
cmp bh, byte [0x833e3f3b]
les eax, [eax + ebx*2]
jmp 0x10006e7a
mov dword [ebp - 0xc90], 7
mov edx, dword [ebp - 0x4f8]
mov dword [ebp - 0xa64], edx
push ebx
and ebx, 0xd4a
or ebx, 0xdb2b
add ebx, 0x14869
dec eax
add dword [eax], eax
pop ebx
push ecx
and ecx, 0x1258a
call 0x10006cbc
invalid
push edx
and edx, 0x16bb
sub edx, 0x98b
sub edx, 0x4345
pop edx
push ecx
push ebx
add esp, 4
add ecx, 0xce96
or ecx, 0x1161a
sub ecx, 0xb084
sub ecx, 0x6726
pop ecx
mov dword [ebp - 0x3fc], 0