joyce8/EMBER2024-capa huggingface dataset:
Function at 0x481e7c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
xor ecx, ecx
mov dword [ebp - 4], ecx
mov ebx, edx
xor eax, eax
push ebp
push 0x481fa5
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
call fcn.0040a1ec
push eax
call sub.shell32.dll_SHGetDesktopFolder
call fcn.0044b18c
test al, al
je 0x481ee7
lea eax, [ebp - 8]
push eax
push 0x10
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
lea eax, [ebp - 0x110]
push eax
push 0x8000
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0x2c]
mov eax, ebx
mov edx, dword [ebp - 0x10c]
call fcn.00407570
jmp 0x481f5d
call fcn.0044b160
test al, al
je 0x481f25
lea eax, [ebp - 8]
push eax
push 0x19
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
lea eax, [ebp - 0x110]
push eax
push 0x8000
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0x2c]
mov eax, ebx
mov edx, dword [ebp - 0x10c]
call fcn.00407570
jmp 0x481f5d
lea eax, [ebp - 8]
push eax
push 0x10
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
lea eax, [ebp - 0x110]
push eax
push 0x8000
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0x2c]
mov eax, ebx
lea edx, [ebp - 0x10c]
mov ecx, 0x104
call fcn.004075ac
cmp dword [ebx], 0
je 0x481f8f
mov eax, dword [ebx]
mov dword [ebp - 0x114], eax
mov eax, dword [ebp - 0x114]
test eax, eax
je 0x481f79
sub eax, 4
mov eax, dword [eax]
mov edx, dword [ebx]
cmp word [edx + eax*2 - 2], 0x5c
je 0x481f8f
mov eax, ebx
mov edx, 0x481fc0
call fcn.004077d8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x481fac
lea eax, [ebp - 4]
call fcn.0040a1ec
ret
Function at 0x10003057
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x100508ea
call fcn.1004f5b8
push ecx
push ecx
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
mov dword [ebp - 0x14], edi
push 0x48
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
call fcn.1001ef5c
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [edi + 4], eax
lea ecx, [edi + 0x10]
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], ecx
and dword [ebp - 0x10], ebx
push eax
call fcn.10005672
mov byte [ebp - 4], 1
lea esi, [edi + 0x30]
mov dword [ebp - 0x10], esi
and dword [esi], ebx
push 0x1c
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
call fcn.1001ef5c
pop ecx
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [esi + 4], eax
lea ecx, [esi + 0xc]
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
mov byte [ebp - 4], 3
mov dword [esi + 0x18], 7
mov dword [esi + 0x1c], 8
mov dword [esi], 0x3f800000
push dword [esi + 4]
push 0x10
call fcn.100057cb
lea ecx, [edi + 0x50]
mov byte [ebp - 4], 4
push ecx
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], ecx
and dword [ebp - 0x10], ebx
push eax
call fcn.1000536e
mov ecx, edi
mov byte [ebp - 4], 5
call fcn.1000315a
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret

Function at 0x10003270
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 4]
test edx, edx
jne 0x1000328e
mov edx, dword [edi + 0xc]
lea eax, [edx + 1]
mov dword [edi + 0xc], eax
mov dword [ecx + 4], edx
xor ecx, ecx
mov dword [ebp + 0xc], edx
mov ebx, 0x811c9dc5
mov esi, ecx
movzx eax, byte [ebp + esi + 0xc]
xor eax, ebx
imul ebx, eax, 0x1000193
inc esi
cmp esi, 4
jb 0x1000329a
mov esi, dword [edi + 0x28]
and esi, ebx
mov ebx, dword [edi + 0x1c]
mov eax, dword [ebx + esi*8 + 4]
cmp eax, dword [edi + 0x14]
je 0x100032d1
mov esi, dword [ebx + esi*8]
jmp 0x100032ca
cmp eax, esi
je 0x100032d1
mov eax, dword [eax + 4]
cmp edx, dword [eax + 8]
jne 0x100032c3
jmp 0x100032d3
mov eax, ecx
test eax, eax
cmove eax, dword [edi + 0x14]
cmp eax, dword [edi + 0x14]
pop edi
pop esi
pop ebx
je 0x100032eb
mov ecx, dword [eax + 0xc]
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov cl, 1
mov al, cl
pop ebp
ret 8

Function at 0x100068a8
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x10]
mov ebx, ecx
push eax
push 0x40
push 5
mov ebp, dword [ebx]
push ebp
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [esp + 0x10]
call fcn.100080b0
mov esi, dword [ebx + 0xc]
mov edi, eax
sub esi, dword [ebx + 8]
push esi
push dword [ebx + 8]
push dword [ebx]
call fcn.10020730
push edi
push 5
pop edx
mov ecx, ebp
call fcn.10007a4a
add esp, 0x10
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x100068f1
Capabilities:
Allocate or change rwx memory

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x10]
mov esi, ecx
push eax
push 0x40
push 5
mov edi, dword [esi]
pop ebp
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [esp + 0x10]
call fcn.100080b0
mov ecx, dword [esi + 0x14]
mov ebx, eax
mov byte [esp + 0x14], 0xe9
lea eax, [esp + 0x14]
push ebp
push eax
mov ecx, dword [ecx + 0x1c]
sub ecx, dword [esi]
push dword [esi]
sub ecx, ebp
mov dword [esp + 0x21], ecx
call fcn.10020730
mov ecx, dword [esi + 0xc]
add esp, 0xc
sub ecx, dword [esi + 8]
cmp ecx, ebp
jbe 0x1000695e
mov eax, dword [esi]
lea esi, [eax + 5]
sub eax, esi
add eax, ecx
push eax
push 0x90
push esi
call fcn.10020cc0
add esp, 0xc
push ebx
mov edx, ebp
mov ecx, edi
call fcn.10007a4a
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret

Function at 0x1000981a
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1a4
lea eax, [esp + 0x14]
push esi
mov esi, ecx
push eax
push 0x202
mov byte [esi], 0
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov ecx, eax
test ecx, ecx
jne 0x1000987a
mov eax, dword [esp + 0x18]
cmp al, 2
jne 0x1000985b
shr eax, 8
cmp al, 2
jne 0x1000985b
mov byte [esi], 1
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
call dword [sym.imp.WS2_32.dll_WSACleanup]
push str.Invalid_WinSock_version
lea ecx, [esp + 8]
call fcn.100096db
push 0x1006a700
lea eax, [esp + 8]
jmp 0x10009898
push str.WSAStartup_failed
call fcn.100097fe
push eax
push ecx
lea ecx, [esp + 0x10]
call fcn.10002186
push 0x1006a6ac
lea eax, [esp + 8]
push eax
call fcn.100206c2
int3

Function at 0x1000992d
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push esi
mov esi, ecx
mov cl, byte [ebp + 8]
push 6
push 1
call fcn.100098b1
push eax
call dword [sym.imp.WS2_32.dll_socket]
mov dword [esi], eax
cmp eax, 0xffffffff
je 0x100099a8
lea ecx, [esp + 8]
mov dword [esp + 8], 1
push ecx
push 0x8004667e
push eax
call dword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
je 0x1000999f
mov ecx, esi
call fcn.10009ce1
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push str.Failed_to_get_socket_flags
mov ecx, eax
call fcn.100097fe
push eax
push ecx
lea ecx, [esp + 0x18]
call fcn.10002186
push 0x1006a6ac
lea eax, [esp + 0x10]
jmp 0x100099cd
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4
call sub.WS2_32.dll_WSAGetLastError
push str.Failed_to_create_socket
mov ecx, eax
call fcn.100097fe
push eax
push ecx
lea ecx, [esp + 0x18]
call fcn.10002186
push 0x1006a6ac
lea eax, [esp + 0x10]
push eax
call fcn.100206c2
int3
Function at 0x100099e2
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x20
push esi
push edi
push dword [ebp + 0xc]
mov edi, ecx
push dword [ebp + 8]
push dword [edi]
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x10009a24
mov esi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call esi
cmp eax, 0x2714
jne 0x10009a2c
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi]
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x10009a08
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
call esi
cmp eax, 0x2733
jne 0x10009a97
push dword [ebp + 0x14]
mov ecx, edi
push dword [ebp + 0x10]
push 1
call fcn.10009bc6
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 4
push eax
lea eax, [esp + 0x10]
push eax
push 0x1007
push 0xffff
push dword [edi]
call dword [sym.imp.WS2_32.dll_getsockopt]
cmp eax, 0xffffffff
je 0x10009abb
cmp dword [esp + 0xc], 0
je 0x10009a24
push str.Failed_to_connect
call fcn.100097fe
push eax
push dword [esp + 0x14]
lea ecx, [esp + 0x20]
call fcn.10002186
push 0x1006a6ac
lea eax, [esp + 0x18]
jmp 0x10009add
call esi
push str.Failed_to_connect
mov ecx, eax
call fcn.100097fe
push eax
push ecx
lea ecx, [esp + 0x20]
call fcn.10002186
push 0x1006a6ac
lea eax, [esp + 0x18]
jmp 0x10009add
call esi
push str.Failed_to_get_socket_option
mov ecx, eax
call fcn.100097fe
push eax
push ecx
lea ecx, [esp + 0x20]
call fcn.10002186
push 0x1006a6ac
lea eax, [esp + 0x18]
push eax
call fcn.100206c2
int3

Function at 0x10009bc6
Capabilities:
Get socket status

Disassembly:
sub esp, 0x128
mov eax, dword [ecx]
push ebx
push ebp
mov ebp, dword [esp + 0x13c]
push esi
push edi
mov edi, dword [esp + 0x140]
xor esi, esi
push esi
push 0x3e8
push ebp
push edi
mov dword [esp + 0x44], eax
mov dword [esp + 0x40], 1
call fcn.1004f120
mov dword [esp + 0x10], eax
imul eax, ecx, 0x3e8
mov dword [esp + 0x14], ebx
mov dword [esp + 0x14], edx
mov dword [esp + 0x14], eax
cmp ebp, esi
jl 0x10009c21
jg 0x10009c1b
cmp edi, esi
jb 0x10009c21
lea eax, [esp + 0x10]
jmp 0x10009c23
mov eax, esi
xor ecx, ecx
lea ebx, [esp + 0x30]
cmp dword [esp + 0x13c], 1
push eax
cmovne ebx, ecx
lea ecx, [esp + 0x34]
xor edx, edx
cmp dword [esp + 0x140], edx
push esi
cmovne ecx, edx
push ebx
push ecx
push esi
mov dword [esp + 0x2c], ecx
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
jne 0x10009c8e
mov esi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call esi
cmp eax, 0x2714
jne 0x10009cb8
test ebp, ebp
jl 0x10009c77
jg 0x10009c71
test edi, edi
jb 0x10009c77
lea eax, [esp + 0x10]
jmp 0x10009c79
xor eax, eax
push eax
push 0
push ebx
push dword [esp + 0x24]
push 0
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
je 0x10009c5e
test eax, eax
je 0x10009c9f
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x128
ret 0xc
push str.Request_timed_out
lea ecx, [esp + 0x20]
call fcn.10009cea
push 0x1006a824
lea eax, [esp + 0x20]
jmp 0x10009cda
call esi
push str.Failed_to_select_socket
mov ecx, eax
call fcn.100097fe
push eax
push ecx
lea ecx, [esp + 0x28]
call fcn.10002186
push 0x1006a6ac
lea eax, [esp + 0x20]
push eax
call fcn.100206c2
int3
Function at 0x100101bc
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
mov dword [esp + 0x10], ecx
push edi
test esi, esi
jg 0x100101e5
jl 0x100101dc
test ebx, ebx
jne 0x100101e5
xor eax, eax
xor edx, edx
jmp 0x100102af
cmp dword [ecx + 0x38], 0
je 0x100101fa
push esi
push ebx
push dword [ebp + 8]
call fcn.10010d5d
jmp 0x100102af
mov eax, dword [ecx + 0x1c]
mov edi, ebx
mov edx, dword [eax]
test edx, edx
je 0x1001023f
mov eax, dword [ecx + 0x2c]
cmp dword [eax], 0
jbe 0x1001023f
cmp dword [eax], ebx
mov esi, ebx
mov edi, dword [ebp + 8]
cmovb esi, dword [eax]
push esi
push edx
push edi
call fcn.10020730
mov ecx, dword [esp + 0x20]
add edi, esi
mov dword [esp + 0x1c], edi
add esp, 0xc
mov edi, ebx
sub edi, esi
mov eax, dword [ecx + 0x2c]
sub dword [eax], esi
mov eax, dword [ecx + 0x1c]
add dword [eax], esi
mov esi, dword [ebp + 0x10]
jmp 0x10010246
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], eax
cmp dword [ecx + 0x4c], 0
je 0x100102a6
call fcn.1001163c
mov ecx, dword [esp + 0x10]
mov edx, edi
cmp edi, 0xfff
jbe 0x1001028d
mov eax, dword [esp + 0x14]
push dword [eax + 0x4c]
push 0xfff
push 1
push ecx
call fcn.10034be5
mov ecx, dword [esp + 0x20]
sub edi, eax
add ecx, eax
add esp, 0x10
mov dword [esp + 0x10], ecx
mov edx, edi
cmp eax, 0xfff
jne 0x100102a6
jmp 0x10010257
test edx, edx
je 0x100102a6
mov eax, dword [esp + 0x14]
push dword [eax + 0x4c]
push edi
push 1
push ecx
call fcn.10034be5
add esp, 0x10
sub edi, eax
sub ebx, edi
mov eax, ebx
sbb esi, 0
mov edx, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10011f74
Capabilities:
Encode data using base64

Disassembly:
mov eax, 0x1005179a
call fcn.1004f5b8
sub esp, 0x54
mov edx, ecx
xor eax, eax
mov dword [ebp - 0x18], edx
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
movaps xmm0, xmmword [0x100644c0]
push ebx
push esi
push edi
mov edi, edx
movups xmmword [ebp - 0x60], xmm0
movaps xmm0, xmmword [0x100644d0]
stosd dword es:[edi], eax
movups xmmword [ebp - 0x50], xmm0
movaps xmm0, xmmword [0x100644e0]
stosd dword es:[edi], eax
movups xmmword [ebp - 0x40], xmm0
movaps xmm0, xmmword [str.wxyz0123456789_]
stosd dword es:[edi], eax
movups xmmword [ebp - 0x30], xmm0
stosd dword es:[edi], eax
mov dword [edx + 0x10], ecx
mov dword [edx + 0x14], 0xf
mov byte [edx], cl
mov dword [ebp - 4], ecx
mov edi, ecx
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], 1
cmp esi, eax
je 0x100120fa
mov cl, byte [esi]
mov byte [ebp + edi - 0x14], cl
inc edi
mov bl, byte [ebp - 0x13]
mov bh, byte [ebp - 0x14]
mov byte [ebp - 0xd], bl
cmp edi, 3
jne 0x1001206e
movzx eax, bh
mov ecx, edx
shr eax, 2
movzx eax, byte [ebp + eax - 0x60]
push eax
call fcn.10011b65
mov edi, dword [ebp - 0x18]
mov cl, bh
and cl, 3
mov al, bl
shr al, 4
shl cl, 4
add cl, al
movzx eax, cl
mov ecx, edi
movzx eax, byte [ebp + eax - 0x60]
push eax
call fcn.10011b65
mov al, byte [ebp - 0x12]
mov cl, bl
and cl, 0xf
shr al, 6
shl cl, 2
add cl, al
movzx eax, cl
mov ecx, edi
movzx eax, byte [ebp + eax - 0x60]
push eax
call fcn.10011b65
movzx eax, byte [ebp - 0x12]
mov ecx, edi
and eax, 0x3f
movzx eax, byte [ebp + eax - 0x60]
push eax
call fcn.10011b65
mov eax, dword [ebp + 0xc]
xor edi, edi
mov edx, dword [ebp - 0x18]
inc esi
cmp esi, eax
jne 0x10011fe8
test edi, edi
je 0x100120fa
movzx eax, bh
mov ecx, edx
shr eax, 2
movzx eax, byte [ebp + eax - 0x60]
push eax
call fcn.10011b65
mov esi, dword [ebp - 0x18]
and bh, 3
mov ecx, esi
cmp edi, 1
jne 0x100120b2
shl bh, 4
movzx eax, bh
movzx eax, byte [ebp + eax - 0x60]
push eax
call fcn.10011b65
push 4
inc edi
pop ebx
jmp 0x100120e8
mov al, bl
shl bh, 4
shr al, 4
add bh, al
movzx eax, bh
movzx eax, byte [ebp + eax - 0x60]
push eax
call fcn.10011b65
and bl, 0xf
mov ecx, esi
shl bl, 2
movzx eax, bl
movzx eax, byte [ebp + eax - 0x60]
push eax
call fcn.10011b65
push 4
inc edi
pop ebx
cmp edi, ebx
jae 0x100120fd
sub ebx, edi
push 0x3d
mov ecx, esi
call fcn.10011b65
sub ebx, 1
jne 0x100120ea
jmp 0x100120fd
mov esi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x1001d378
Capabilities:
Enumerate threads

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x1006c048]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0
push 4
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
je 0x1001d458
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x1001d451
push ebx
cmp dword [ebp - 0x20], 0x10
jb 0x1001d436
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [ebp - 0x14], eax
jne 0x1001d436
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp - 0x18], eax
je 0x1001d436
mov edx, dword [esi]
test edx, edx
jne 0x1001d404
push 0x200
push edx
push dword [0x1006f454]
mov dword [esi + 4], 0x80
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
mov dword [esi], edx
test edx, edx
je 0x1001d450
lea ebx, [esi + 8]
jmp 0x1001d42c
mov eax, dword [esi + 4]
lea ebx, [esi + 8]
cmp dword [ebx], eax
jb 0x1001d42c
shl eax, 3
push eax
push edx
push 0
push dword [0x1006f454]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov edx, eax
test edx, edx
je 0x1001d450
shl dword [esi + 4], 1
mov dword [esi], edx
mov ecx, dword [ebx]
mov eax, dword [ebp - 0x18]
mov dword [edx + ecx*4], eax
inc dword [ebx]
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x1001d3bc
pop ebx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1001f77e
leave
ret

Function at 0x1001d466
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], edx
xor ebx, ebx
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
call fcn.1001d378
cmp dword [esi], ebx
je 0x1001d4c6
push edi
mov edi, ebx
cmp dword [esi + 8], ebx
jbe 0x1001d4c5
mov eax, dword [esi]
push dword [eax + edi*4]
push ebx
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov ebx, eax
test ebx, ebx
je 0x1001d4bc
push ebx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push dword [ebp + 8]
mov edx, dword [ebp - 4]
mov ecx, ebx
call fcn.1001d225
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
push 0
pop ebx
cmp edi, dword [esi + 8]
jb 0x1001d48c
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1001d4ca
Capabilities:
Resume thread

Disassembly:
push esi
mov esi, ecx
cmp dword [esi], 0
je 0x1001d516
push edi
xor edi, edi
cmp dword [esi + 8], edi
jbe 0x1001d505
push ebx
mov eax, dword [esi]
push dword [eax + edi*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov ebx, eax
test ebx, ebx
je 0x1001d4fe
push ebx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, dword [esi + 8]
jb 0x1001d4db
pop ebx
push dword [esi]
push 0
push dword [0x1006f454]
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
ret
Function at 0x1001d518
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
imul edi, ecx, 0x2c
add edi, dword [0x10085fb0]
mov al, byte [edi + 0x14]
mov esi, dword [edi]
and al, 1
je 0x1001d534
sub esi, 5
movzx eax, al
lea ebx, [eax*2 + 5]
lea eax, [ebp - 4]
push eax
push 0x40
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1001d555
push 0xa
pop eax
jmp 0x1001d594
mov byte [esi], 0xe9
mov eax, dword [edi + 4]
sub eax, esi
sub eax, 5
mov dword [esi + 1], eax
test byte [edi + 0x14], 1
je 0x1001d570
mov eax, dword [edi]
mov word [eax], 0xf9eb
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
or byte [edi + 0x14], 6
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1001da3d
Capabilities:
Allocate or change rwx memory

Disassembly:
mov edx, dword [0x10085fa8]
push esi
xor esi, esi
jmp 0x1001da4f
cmp dword [edx + 4], esi
jne 0x1001daa3
mov edx, dword [edx]
test edx, edx
jne 0x1001da48
push 0x40
push 0x3000
push 0x1000
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edx, eax
test edx, edx
je 0x1001da9f
push edi
push 0x20
lea ecx, [edx + 0x20]
mov dword [edx + 8], esi
pop edi
mov dword [ecx], esi
mov eax, ecx
mov dword [edx + 4], ecx
add edi, 0x20
add ecx, 0x20
mov esi, eax
cmp edi, 0xfe0
jbe 0x1001da76
mov eax, dword [0x10085fa8]
mov dword [edx], eax
mov dword [0x10085fa8], edx
pop edi
test edx, edx
jne 0x1001daa3
xor eax, eax
pop esi
ret
mov eax, dword [edx + 4]
pop esi
mov ecx, dword [eax]
inc dword [edx + 8]
mov dword [edx + 4], ecx
ret

Function at 0x1001e5d3
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 2
lea eax, [ebp - 4]
push eax
push 0x20000001
push str._x_sys_default_locale
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov esi, dword [ebp + 0xc]
neg eax
sbb eax, eax
xor ecx, ecx
and eax, dword [ebp - 4]
push ecx
push ecx
push esi
push eax
push dword [ebp + 8]
mov dword [ebp - 4], eax
push ecx
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push eax
push dword [esi]
call fcn.1001e5af
pop esi
leave
ret 8

Function at 0x1003f588
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1003f50a

Function at 0x1003fd81
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10058200
push 0x100581f8
push str.FlsAlloc
push 0x1e
call fcn.1003fb6e
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1003fdb5
push dword [ebp + 8]
mov ecx, esi
call dword [0x100531f0]
call esi
jmp 0x1003fdbb
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4
Function at 0x1003fdff
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10058210
push 0x10058208
push str.FlsGetValue
push 0x20
call fcn.1003fb6e
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1003fe36
push dword [ebp + 8]
mov ecx, esi
call dword [0x100531f0]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x10041a9e
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1004190f

Function at 0x10041fcb
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.1001ff50
mov eax, dword [0x1006c048]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.1003c3f3
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x1004200d
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x10042169
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.1004f070
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x1006efc0]
push dword [edi + eax + 0x24]
push dword [edi + eax + 0x20]
push ebx
call fcn.10043be9
mov ecx, dword [esi*4 + 0x1006efc0]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [edi + ecx + 0x20]
jne 0x10042162
cmp eax, dword [edi + ecx + 0x24]
jne 0x10042162
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [edi + ecx + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10042162
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.10043be9
add esp, 0x14
test edx, edx
jl 0x10042162
jg 0x100420d8
test eax, eax
jb 0x10042162
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x10042162
jl 0x100420f2
cmp dword [ebp - 0x1008], eax
ja 0x10042162
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x10042110
test ebx, ebx
je 0x10042149
cmp ecx, edi
jae 0x10042149
mov al, byte [ecx]
cmp al, 0xd
jne 0x1004212a
lea eax, [edi - 1]
cmp ecx, eax
jae 0x10042136
cmp byte [ecx + 1], 0xa
jne 0x10042136
inc ecx
jmp 0x10042136
movzx eax, al
movsx eax, byte [eax + 0x1006c480]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x10042110
cmp edx, ebx
jne 0x10042110
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x10042167
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.1001f77e
leave
ret