joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10084040
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 0xc]
push 0x1000
push 0x1000
push 0x101f4948
call fcn.10002e90
push dword [eax + 4]
push dword [eax]
call fcn.100cbcfa
add esp, 0x20
push 0x10
push str.Furion_Hack
push 0x101f4948
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop ebp
ret
Function at 0x10096090
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100f0f4d
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x101383dc]
xor eax, ebp
mov dword [ebp - 0x14], eax
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, dword [ebp + 8]
mov eax, edx
mov dword [0x1018db1c], 1
lea edi, [eax + 1]
nop dword [eax + eax]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100960d0
mov ecx, 0x7fffffff
sub eax, edi
sub ecx, dword [0x10186a24]
cmp ecx, eax
jb 0x100961f1
cmp dword [0x10186a28], 0x10
mov ecx, 0x10186a14
push eax
cmovae ecx, dword [0x10186a14]
push edx
push dword [0x10186a24]
push ecx
push ecx
push dword [ebp - 0x30]
lea ecx, [ebp - 0x2c]
call fcn.10018fb0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x2c]
cmp dword [ebp - 0x18], 0x10
push 0
cmovae eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
sub esp, 0x18
lea eax, [ebp - 0x2c]
mov ecx, esp
push eax
call fcn.1000c280
call fcn.10087320
lea eax, [ebp - 0x2c]
mov ecx, esp
push eax
call fcn.1000c280
call fcn.10088c20
lea eax, [ebp - 0x2c]
mov ecx, esp
push eax
call fcn.1000c280
call fcn.1008a4e0
lea eax, [ebp - 0x2c]
mov ecx, esp
push eax
call fcn.1000c280
call fcn.10091780
lea eax, [ebp - 0x2c]
mov ecx, esp
push eax
call fcn.1000c280
call fcn.1008f680
lea eax, [ebp - 0x2c]
mov ecx, esp
push eax
call fcn.1000c280
call fcn.10090a30
lea eax, [ebp - 0x2c]
mov ecx, esp
push eax
call fcn.1000c280
call fcn.10094120
mov ecx, dword [ebp - 0x18]
add esp, 0x18
cmp ecx, 0x10
jb 0x100961d5
mov edx, dword [ebp - 0x2c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x100961cb
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100961f6
push ecx
push edx
call fcn.100c3236
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.100c2ed5
mov esp, ebp
pop ebp
ret 4
call fcn.100030c0
call fcn.100cbff5
int3
Function at 0x10096b60
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x101383dc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0x10102914
push eax
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
call fcn.100d3936
mov edi, dword [ebp - 8]
add esp, 0xc
test edi, edi
jne 0x10096bac
lea eax, [edi - 3]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100c2ed5
mov esp, ebp
pop ebp
ret 4
push 2
push 0
push edi
call fcn.100ce839
add esp, 0xc
test eax, eax
je 0x10096bc4
mov esi, 0xfffffffd
jmp 0x10096c36
push edi
call fcn.100d4258
mov esi, eax
add esp, 4
test esi, esi
js 0x10096bbd
jne 0x10096bd9
xor esi, esi
jmp 0x10096c36
lea eax, [esi + 1]
push 0x100f61ed
push eax
call fcn.100c37fb
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x10096bf5
lea esi, [eax - 2]
jmp 0x10096c36
push 0
push 0
push edi
mov byte [ebx + esi], 0
call fcn.100ce839
add esp, 0xc
push edi
push esi
push 1
push ebx
call fcn.100ce3e9
add esp, 0x10
cmp eax, esi
je 0x10096c24
push ebx
call fcn.100c2ee3
mov esi, 0xfffffffd
jmp 0x10096c33
push eax
push ebx
call fcn.10097960
push ebx
mov esi, eax
call fcn.100c2ee3
add esp, 4
push dword [ebp - 8]
call fcn.100cd7dc
mov ecx, dword [ebp - 4]
add esp, 4
mov eax, esi
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.100c2ed5
mov esp, ebp
pop ebp
ret 4

Function at 0x1009abf0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
cmp byte [0x10183318], 0
push esi
je 0x1009acc8
movss xmm0, dword [0x101da128]
comiss xmm0, dword [0x1012a688]
jbe 0x1009acc8
movss xmm0, dword [0x101832f8]
comiss xmm0, dword [0x101da130]
jbe 0x1009acc8
movss xmm0, dword [0x1018331c]
divss xmm0, dword [0x1012a700]
cvtps2pd xmm1, xmm0
movsd xmm0, qword [0x10186c58]
addsd xmm1, qword [0x1012a500]
ucomisd xmm0, xmm1
movsd qword [esp + 8], xmm1
lahf
test ah, 0x44
jnp 0x1009acc8
push 0x1018db28
push 0x40
push 8
push dword [0x10189758]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
movsd xmm0, qword [esp + 8]
mulsd xmm0, qword [0x1012a5b8]
mov eax, dword [0x10189758]
push 0x1018db28
movsd qword [eax], xmm0
push dword [0x1018db28]
mov esi, dword [0x10189758]
push 8
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 8
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
movsd xmm0, qword [esp + 8]
movsd qword [0x10186c58], xmm0
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1009cb40
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
call fcn.10083fc0
cmp eax, 0x21ec
jl 0x1009cda8
cmp byte [0x1013986c], 0
je 0x1009cced
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, edi
cmp eax, 0x64
ja 0x1009cced
mov bl, byte [ebp + 8]
test bl, bl
je 0x1009cbcd
push 0x14
push str.rt.bmp
call fcn.1009c670
push 0x15
push str.bk.bmp
call fcn.1009c670
push 0x16
push str.lf.bmp
call fcn.1009c670
push 0x17
push str.ft.bmp
call fcn.1009c670
push 0x18
push str.up.bmp
call fcn.1009c670
push 0x19
push str.dn.bmp
call fcn.1009c670
cmp dword [0x101f59bc], 0
jne 0x1009cc03
cmp dword [0x101f59c0], 0
jne 0x1009cc03
cmp dword [0x101f59c4], 0
jne 0x1009cc03
cmp dword [0x101f59c8], 0
jne 0x1009cc03
cmp dword [0x101f59cc], 0
jne 0x1009cc03
cmp dword [0x101f59d0], 0
je 0x1009cc0b
test bl, bl
je 0x1009cda8
call fcn.10084230
cmp dword [0x101f59bc], 0
mov edx, eax
jne 0x1009cc2d
mov ecx, dword [edx]
mov dword [0x101f59bc], ecx
mov ecx, dword [0x1013996c]
mov dword [edx], ecx
jmp 0x1009cc38
test bl, bl
je 0x1009cc38
mov eax, dword [0x1013996c]
mov dword [edx], eax
cmp dword [0x101f59c0], 0
jne 0x1009cc4b
mov eax, dword [edx + 4]
mov dword [0x101f59c0], eax
jmp 0x1009cc4f
test bl, bl
je 0x1009cc57
mov eax, dword [0x10139970]
mov dword [edx + 4], eax
cmp dword [0x101f59c4], 0
jne 0x1009cc6a
mov eax, dword [edx + 8]
mov dword [0x101f59c4], eax
jmp 0x1009cc6e
test bl, bl
je 0x1009cc76
mov eax, dword [0x10139974]
mov dword [edx + 8], eax
cmp dword [0x101f59c8], 0
jne 0x1009cc89
mov eax, dword [edx + 0xc]
mov dword [0x101f59c8], eax
jmp 0x1009cc8d
test bl, bl
je 0x1009cc95
mov eax, dword [0x10139978]
mov dword [edx + 0xc], eax
cmp dword [0x101f59cc], 0
jne 0x1009cca8
mov eax, dword [edx + 0x10]
mov dword [0x101f59cc], eax
jmp 0x1009ccac
test bl, bl
je 0x1009ccb4
mov eax, dword [0x1013997c]
mov dword [edx + 0x10], eax
cmp dword [0x101f59d0], 0
jne 0x1009ccd5
mov eax, dword [edx + 0x14]
mov dword [0x101f59d0], eax
mov eax, dword [0x10139980]
mov dword [edx + 0x14], eax
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4
test bl, bl
je 0x1009cda8
mov eax, dword [0x10139980]
mov dword [edx + 0x14], eax
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp dword [0x101f59bc], 0
je 0x1009cda8
cmp dword [0x101f59c0], 0
je 0x1009cda8
cmp dword [0x101f59c4], 0
je 0x1009cda8
cmp dword [0x101f59c8], 0
je 0x1009cda8
cmp dword [0x101f59cc], 0
je 0x1009cda8
cmp dword [0x101f59d0], 0
je 0x1009cda8
call fcn.10084230
mov ecx, dword [0x101f59bc]
mov edx, eax
mov eax, dword [0x101f59c8]
mov dword [0x101f59bc], 0
mov dword [0x101f59c8], 0
mov dword [edx], ecx
mov ecx, dword [0x101f59c0]
mov dword [edx + 0xc], eax
mov eax, dword [0x101f59cc]
mov dword [edx + 4], ecx
mov ecx, dword [0x101f59c4]
mov dword [edx + 0x10], eax
mov eax, dword [0x101f59d0]
mov dword [edx + 8], ecx
mov dword [0x101f59c0], 0
mov dword [0x101f59c4], 0
mov dword [0x101f59cc], 0
mov dword [0x101f59d0], 0
mov dword [edx + 0x14], eax
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1009ce20
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
cmp byte [0x1018322c], 0
push esi
je 0x1009ce75
cmp dword [0x10183230], 0
je 0x1009ce45
cmp byte [0x10189f96], 0
je 0x1009ce75
cmp byte [0x101da118], 0
jne 0x1009ce75
cmp byte [0x10183236], 0
je 0x1009cea1
cmp byte [0x101da11c], 0
jne 0x1009cea1
call fcn.1009e200
movd xmm1, dword [0x101da100]
cvtdq2ps xmm1, xmm1
comiss xmm0, xmm1
jbe 0x1009cea1
cmp byte [0x101da7ac], 0
je 0x1009ce95
cmp byte [0x10183235], 0
je 0x1009ce95
push str._forward
call dword [0x10188258]
add esp, 4
mov byte [0x101da7ac], 0
pop esi
mov esp, ebp
pop ebp
ret
movss xmm0, dword [0x10183238]
divss xmm0, dword [0x1012a700]
mulss xmm0, dword [0x1012a5c8]
cvtps2pd xmm1, xmm0
movsd xmm0, qword [0x10186c58]
addsd xmm1, qword [0x1012a500]
ucomisd xmm0, xmm1
movsd qword [esp + 8], xmm1
lahf
test ah, 0x44
jnp 0x1009cf40
push 0x1018db28
push 0x40
push 8
push dword [0x10189758]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
movsd xmm0, qword [esp + 8]
mulsd xmm0, qword [0x1012a5b8]
mov eax, dword [0x10189758]
push 0x1018db28
movsd qword [eax], xmm0
push dword [0x1018db28]
mov esi, dword [0x10189758]
push 8
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 8
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
movsd xmm0, qword [esp + 8]
movsd qword [0x10186c58], xmm0
cmp byte [0x10183235], 0
je 0x1009cf6f
mov al, byte [0x101da7ac]
mov edx, 1
test al, al
movzx ecx, al
push str.forward
cmove ecx, edx
mov byte [0x101da7ac], cl
call dword [0x10188258]
add esp, 4
mov byte [0x101da7ac], 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100a3e20
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push 0x1018db28
push 0x40
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
setne al
pop ebp
ret 8

Function at 0x100a3e80
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 8]
push 0x1018db28
push 0x40
push 5
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp + 0xc]
push 0x1018db28
mov eax, dword [ecx]
mov dword [edi], eax
mov al, byte [ecx + 4]
mov byte [edi + 4], al
push dword [0x1018db28]
push 5
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 5
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
pop edi
pop ebp
ret 0xc
Function at 0x100a62d0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
movsd xmm0, qword [0x10186c58]
ucomisd xmm0, xmm1
movsd qword [ebp - 8], xmm1
lahf
test ah, 0x44
jnp 0x100a6351
push esi
push 0x1018db28
push 0x40
push 8
push dword [0x10189758]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
movsd xmm0, qword [ebp - 8]
mulsd xmm0, qword [0x1012a5b8]
mov eax, dword [0x10189758]
push 0x1018db28
movsd qword [eax], xmm0
push dword [0x1018db28]
mov esi, dword [0x10189758]
push 8
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 8
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
movsd xmm0, qword [ebp - 8]
movsd qword [0x10186c58], xmm0
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100bfc30
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov dword [ebp - 0xc], 0xcccccccc
mov dword [ebp - 8], 0xcccccccc
mov dword [ebp - 4], 0xcccccccc
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov dword [eax], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], 0
mov edx, dword [ebp + 8]
mov dword [edx + 8], 0
mov eax, dword [ebp + 8]
push eax
call fcn.100bf9f0
add esp, 4
test eax, eax
jne 0x100bfc8c
mov dword [ebp - 4], 9
jmp 0x100bfd19
mov ecx, dword [ebp + 8]
cmp dword [ecx], 0
je 0x100bfd19
mov dword [ebp - 8], 0
jmp 0x100bfcaa
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 8]
cmp ecx, dword [eax + 8]
jae 0x100bfd19
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov esi, esp
mov ecx, dword [ebp - 8]
mov edx, dword [eax + ecx*4]
push edx
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
cmp esi, esp
call fcn.100c3c35
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x100bfd17
mov esi, esp
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp esi, esp
call fcn.100c3c35
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0xc]
push eax
call fcn.100bf810
add esp, 0xc
mov esi, esp
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.100c3c35
jmp 0x100bfca1
mov eax, dword [ebp - 4]
pop esi
add esp, 0xc
cmp ebp, esp
call fcn.100c3c35
mov esp, ebp
pop ebp
ret

Function at 0x100bfd30
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov dword [ebp - 8], 0xcccccccc
mov dword [ebp - 4], 0xcccccccc
mov eax, dword [ebp + 8]
cmp dword [eax], 0
je 0x100bfddb
mov dword [ebp - 4], 0
jmp 0x100bfd63
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
cmp eax, dword [edx + 8]
jae 0x100bfdbe
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov esi, esp
mov eax, dword [ebp - 4]
mov ecx, dword [edx + eax*4]
push ecx
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
cmp esi, esp
call fcn.100c3c35
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x100bfdbc
mov esi, esp
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp esi, esp
call fcn.100c3c35
mov esi, esp
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.100c3c35
jmp 0x100bfd5a
mov esi, esp
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
push 0
mov eax, dword [0x10187484]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp esi, esp
call fcn.100c3c35
pop esi
add esp, 8
cmp ebp, esp
call fcn.100c3c35
mov esp, ebp
pop ebp
ret
Function at 0x100bfdf0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
push edi
mov eax, 0xcccccccc
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
imul eax, dword [ebp + 8], 0x2c
add eax, dword [0x101f74c0]
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], 5
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 4]
mov cl, byte [eax + 0x14]
and cl, 1
movzx edx, cl
test edx, edx
je 0x100bfe53
mov eax, dword [ebp - 0x18]
sub eax, 5
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x14]
add ecx, 2
mov dword [ebp - 0x14], ecx
mov esi, esp
lea edx, [ebp - 0xc]
push edx
push 0x40
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, esp
call fcn.100c3c35
test eax, eax
jne 0x100bfe7e
mov eax, 0xa
jmp 0x100bff80
cmp dword [ebp + 0xc], 0
je 0x100bfeca
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
mov byte [eax], 0xe9
mov ecx, dword [ebp - 0x18]
add ecx, 5
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
sub eax, ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 1], eax
mov edx, dword [ebp - 4]
mov al, byte [edx + 0x14]
and al, 1
movzx ecx, al
test ecx, ecx
je 0x100bfec8
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
mov byte [ecx], 0xeb
mov edx, dword [ebp - 0x20]
mov byte [edx + 1], 0xf9
jmp 0x100bff06
mov eax, dword [ebp - 4]
mov cl, byte [eax + 0x14]
and cl, 1
movzx edx, cl
test edx, edx
je 0x100bfef1
push 7
mov eax, dword [ebp - 4]
add eax, 0xc
push eax
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.100c58f0
add esp, 0xc
jmp 0x100bff06
push 5
mov edx, dword [ebp - 4]
add edx, 0xc
push edx
mov eax, dword [ebp - 0x18]
push eax
call fcn.100c58f0
add esp, 0xc
mov esi, esp
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, esp
call fcn.100c3c35
mov esi, esp
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x18]
push eax
mov edi, esp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp edi, esp
call fcn.100c3c35
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
cmp esi, esp
call fcn.100c3c35
mov cl, byte [ebp + 0xc]
and cl, 1
shl cl, 1
mov edx, dword [ebp - 4]
mov al, byte [edx + 0x14]
and al, 0xfd
or al, cl
mov ecx, dword [ebp - 4]
mov byte [ecx + 0x14], al
mov dl, byte [ebp + 0xc]
and dl, 1
shl dl, 2
mov eax, dword [ebp - 4]
mov cl, byte [eax + 0x14]
and cl, 0xfb
or cl, dl
mov edx, dword [ebp - 4]
mov byte [edx + 0x14], cl
xor eax, eax
push edx
mov ecx, ebp
push eax
lea edx, [0x100bffa4]
call fcn.100c3be1
pop eax
pop edx
pop edi
pop esi
add esp, 0x20
cmp ebp, esp
call fcn.100c3c35
mov esp, ebp
pop ebp
ret
Function at 0x100c0650
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov dword [ebp - 8], 0xcccccccc
mov dword [ebp - 4], 0xcccccccc
mov eax, dword [0x101f74b8]
mov dword [ebp - 4], eax
jmp 0x100c0677
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
je 0x100c0690
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
je 0x100c068e
mov eax, dword [ebp - 4]
jmp 0x100c0714
jmp 0x100c066f
mov esi, esp
push 0x40
push 0x3000
push 0x1000
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
cmp esi, esp
call fcn.100c3c35
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x100c0711
mov ecx, dword [ebp - 4]
add ecx, 0x20
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 4]
mov dword [edx + 4], 0
mov eax, dword [ebp - 4]
mov dword [eax + 8], 0
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
mov dword [ecx], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [ecx + 4], edx
mov eax, dword [ebp - 8]
add eax, 0x20
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 4]
cmp ecx, 0xfe0
jbe 0x100c06d3
mov edx, dword [ebp - 4]
mov eax, dword [0x101f74b8]
mov dword [edx], eax
mov ecx, dword [ebp - 4]
mov dword [0x101f74b8], ecx
mov eax, dword [ebp - 4]
pop esi
add esp, 8
cmp ebp, esp
call fcn.100c3c35
mov esp, ebp
pop ebp
ret

Function at 0x100c0c00
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp + 8]
movzx eax, byte [edx + ecx]
test eax, eax
je 0x100c0c49
mov ecx, 1
imul edx, ecx, 0
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + edx]
cmp ecx, 0x90
je 0x100c0c49
mov edx, 1
imul eax, edx, 0
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + eax]
cmp edx, 0xcc
je 0x100c0c49
xor eax, eax
jmp 0x100c0c8a
mov dword [ebp - 4], 1
jmp 0x100c0c5b
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x100c0c85
mov edx, dword [ebp + 8]
add edx, dword [ebp - 4]
movzx eax, byte [edx]
mov ecx, 1
imul edx, ecx, 0
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + edx]
cmp eax, edx
je 0x100c0c83
xor eax, eax
jmp 0x100c0c8a
jmp 0x100c0c52
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x100c1c13
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 2
lea eax, [ebp - 4]
push eax
push 0x20000001
push str._x_sys_default_locale
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov esi, dword [ebp + 0xc]
neg eax
sbb eax, eax
xor ecx, ecx
and eax, dword [ebp - 4]
push ecx
push ecx
push esi
push eax
push dword [ebp + 8]
mov dword [ebp - 4], eax
push ecx
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push eax
push dword [esi]
call fcn.100c1bef
pop esi
leave
ret 8

Function at 0x100d401b
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.100c4c20
mov eax, dword [0x101383dc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.100d8dec
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x100d405d
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x100d41b9
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.100eb1b0
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x10187da8]
push dword [edi + eax + 0x24]
push dword [edi + eax + 0x20]
push ebx
call fcn.100ddbe0
mov ecx, dword [esi*4 + 0x10187da8]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [edi + ecx + 0x20]
jne 0x100d41b2
cmp eax, dword [edi + ecx + 0x24]
jne 0x100d41b2
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [edi + ecx + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x100d41b2
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.100ddbe0
add esp, 0x14
test edx, edx
jl 0x100d41b2
jg 0x100d4128
test eax, eax
jb 0x100d41b2
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x100d41b2
jl 0x100d4142
cmp dword [ebp - 0x1008], eax
ja 0x100d41b2
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x100d4160
test ebx, ebx
je 0x100d4199
cmp ecx, edi
jae 0x100d4199
mov al, byte [ecx]
cmp al, 0xd
jne 0x100d417a
lea eax, [edi - 1]
cmp ecx, eax
jae 0x100d4186
cmp byte [ecx + 1], 0xa
jne 0x100d4186
inc ecx
jmp 0x100d4186
movzx eax, al
movsx eax, byte [eax + 0x10138660]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x100d4160
cmp edx, ebx
jne 0x100d4160
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x100d41b7
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.100c2ed5
leave
ret
Function at 0x100dc785
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100dc5f6

Function at 0x100dcc21
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100f9ba8
push 0x100f9ba0
push str.FlsAlloc
push 0x1e
call fcn.100dca8e
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100dcc55
push dword [ebp + 8]
mov ecx, esi
call dword [0x100f52fc]
call esi
jmp 0x100dcc5b
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x100dcc9f
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100f9bb8
push 0x100f9bb0
push str.FlsGetValue
push 0x20
call fcn.100dca8e
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100dccd6
push dword [ebp + 8]
mov ecx, esi
call dword [0x100f52fc]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]