joyce8/EMBER2024-capa huggingface dataset:
Function at 0xab9820
Capabilities:
Encode data using xor

Disassembly:
mov byte [0xb3b79d7e], al
clc
mov eax, dword [0xf706852c]
pop eax
ret
inc ebx
sub al, 0xf0
in al, 0x25
fild qword [edi + esi*8]
push eax
test byte [edx], 0x45
or eax, 0x48a2161b
stosb byte es:[edi], al
loope 0xab97ec
mov esp, 0xa0bffe4a
int 0xf2
dec ecx
ret
jmp 0xab982a
pushal
call 0xab9830
pop ebp
sub ebp, 0x10
sub ebp, 0x9b9820
jmp 0xab9846
mov eax, 0x9b9820
add eax, ebp
add eax, 0x4c
mov ecx, 0x5ce
mov edx, 0x28a35181
xor byte [eax], dl
inc eax
dec ecx
jne 0xab985d
jmp 0xab9870
or cl, byte [edx + ecx + 8]
mov ebp, 0x818181
inc eax
jns 0xab97fd
add dword [ecx - 0x7dc6b37e], 0x3b818181
test eax, 0x76818181
arpl word [edx - 0x72fff5b7], ax
add dword [ecx - 0x2ebb7d7f], 0x7da5e50c
or byte [ebp + 0x5bade9a5], al
mov al, byte [0x3c75e981]
clc
add dword [eax - 0x4f165a53], 0x696e8536
test byte [ecx - 0x54977e7f], al
add dword [ecx - 0x12f32b7f], 0x40a81a5
mov dword [ecx + 0x140a8181], eax
lea eax, [ecx + 0xc0a8181]
xchg ecx, eax
add dword [ecx - 0x7c97bf7f], 0x430283b0
test eax, ecx
mov es, word [esi*2 - 0x23818182]
inc ebx
lea eax, [ecx - 0x7a5af2f6]
add dword [ecx + 0x5bade981], 0x75e981a0
cmp al, 0xf8
add dword [eax - 0x1af35a53], 0x8d087da5
movsd dword es:[edi], dword [esi]
imul eax, dword [ecx + eax*4 - 0x33977e7f], 0xc818183
in eax, 0xa5
add dword [ecx - 0x5a1af37f], 0x7d
or byte [ebp - 0x5a12f35b], ch
jge 0xab9916
lodsd eax, dword [esi]
movsd dword es:[edi], dword [esi]
or al, 0xed
movsd dword es:[edi], dword [esi]
cmp dword [esi - 0xc], 0x89f47e8d
imul edi, ecx, 0xa818181
cmp al, 0x89
add dword [ecx - 0x218fff7f], 0x849719
jo 0xab990c
lea edi, [esi - 0xc]
mov dword [ecx - 7], ebp
add dword [ecx - 0x76c3f57f], 0x818181
jo 0xab9906
sbb dword [edi - 0x218fff7c], edx
sbb dword [edi - 0x4db74d7c], edx
push ebx
add ch, byte [ecx - 0x7c]
leave
mov es, word [0x818181cf]
mov cs, word [ecx]
leave
add dword [ecx - 0x62f5187f], 0x697a01b8
mov es, word [0x8181819b]
add dword [edx + 0x68], edi
mov es, word [0x81818190]
out 0, eax
jp 0xab99dd
movsb byte es:[edi], byte [esi]
mov es, word [0x81818194]
shr byte [eax + 0x4d], 0x7e
jle 0xab99ea
test al, 0xcd
mov eax, 0x84400280
add ch, byte [ecx - 0x7b]
push 0x7e7e7e3c
test al, 0xd5
mov eax, 0x87400283
add ch, byte [ebx - 0x7b]
add ch, byte [ecx - 0x7c]
push 0x7e7e7e2a
or ch, byte [ebp - 0x5a1af35b]
test dword [ebx - 0x73], eax
adc esp, 0xd6d76d0a
aam 0xa
hlt
jmp 0xab9960
or dword [ebx], 0x5393c797
mov es, word [edx]
stosd dword es:[edi], eax
add byte [ecx - 0x71ac7c7f], 4
test byte [ecx - 0x68f47e7f], al
invalid
Function at 0x42bf64
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x18
mov al, byte [ecx]
and dword [esp + 0x14], 0
push ebx
push ebp
mov byte [edx], al
lea eax, [edx + 1]
push esi
mov dword [esp + 0x18], eax
push edi
mov dword [esp + 0x14], edx
mov esi, dword [esp + 0x14]
lea eax, [ecx + 1]
xor edi, edi
xor ebp, ebp
mov dword [esp + 0x18], eax
lea ecx, [esp + 0x18]
call fcn.0042bf0d
test eax, eax
je 0x42c0bd
lea ecx, [esp + 0x18]
call fcn.0042bf0d
lea ecx, [esp + 0x18]
test eax, eax
je 0x42c02c
call fcn.0042bf0d
test eax, eax
je 0x42bfee
push 4
xor edi, edi
pop ebx
lea ecx, [esp + 0x18]
call fcn.0042bf0d
lea edi, [eax + edi*2]
dec ebx
jne 0x42bfc4
mov edx, dword [esp + 0x1c]
test edi, edi
je 0x42bfe5
mov eax, edx
sub eax, edi
mov al, byte [eax]
mov byte [edx], al
jmp 0x42bfe8
mov byte [edx], 0
inc edx
jmp 0x42c0cf
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
movzx esi, byte [eax]
mov ecx, esi
and ecx, 1
inc eax
add ecx, 2
shr esi, 1
mov dword [esp + 0x18], eax
je 0x42c024
test ecx, ecx
je 0x42c0b8
mov edi, edx
sub edi, esi
mov al, byte [edi]
mov byte [edx], al
inc edx
inc edi
dec ecx
jne 0x42c016
jmp 0x42c0b4
xor ebp, ebp
inc ebp
jmp 0x42c0b8
call fcn.0042bf43
test edi, edi
jne 0x42c061
cmp eax, 2
jne 0x42c05c
lea ecx, [esp + 0x18]
call fcn.0042bf43
mov edx, dword [esp + 0x1c]
mov edi, eax
test edi, edi
je 0x42c0b8
mov ecx, edx
sub ecx, esi
mov al, byte [ecx]
mov byte [edx], al
inc edx
inc ecx
dec edi
jne 0x42c051
jmp 0x42c0b4
sub eax, 3
jmp 0x42c064
sub eax, 2
mov ecx, dword [esp + 0x18]
mov esi, eax
movzx eax, byte [ecx]
shl esi, 8
add esi, eax
inc ecx
mov dword [esp + 0x18], ecx
lea ecx, [esp + 0x18]
call fcn.0042bf43
mov ecx, eax
cmp esi, 0x7d00
jb 0x42c08b
inc ecx
cmp esi, 0x500
jb 0x42c094
inc ecx
cmp esi, 0x80
jae 0x42c09f
add ecx, 2
mov edx, dword [esp + 0x1c]
test ecx, ecx
je 0x42c0b8
mov edi, edx
sub edi, esi
mov al, byte [edi]
mov byte [edx], al
inc edx
inc edi
dec ecx
jne 0x42c0ab
mov dword [esp + 0x1c], edx
xor edi, edi
inc edi
jmp 0x42c0d5
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov al, byte [ecx]
mov byte [edx], al
inc edx
inc ecx
mov dword [esp + 0x18], ecx
xor edi, edi
mov dword [esp + 0x1c], edx
test ebp, ebp
je 0x42bf94
sub edx, dword [esp + 0x14]
pop edi
mov eax, edx
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x42c25a
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov ebx, edi
shr ebx, 2
and edi, 3
mov esi, ecx
test ebx, ebx
je 0x42c28c
mov al, byte [esp + 0x14]
mov edx, dword [esi]
add al, bl
movzx ecx, al
mov eax, dword [esp + 0x10]
ror edx, cl
xor edx, eax
sub edx, ebx
mov dword [esi], edx
add esi, 4
dec ebx
jne 0x42c26d
jmp 0x42c290
mov eax, dword [esp + 0x10]
test edi, edi
je 0x42c29a
xor byte [esi], al
inc esi
dec edi
jne 0x42c294
pop edi
pop esi
pop ebx
ret 0xc
Function at 0x430b70
Capabilities:
Terminate process

Disassembly:
push 0xc
push 0x4368a0
call fcn.004315d8
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov edi, ebx
mov edx, 0x438d38
mov ecx, esi
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
je 0x430998
cmp eax, esi
jne 0x43098b
xor esi, esi
inc esi
mov edi, esi
jmp 0x43099b
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x43096f
xor esi, esi
inc esi
cmp dword [0x438d3c], esi
jne 0x4309ad
push 0x1f
call fcn.004cc000
pop ecx
jmp 0x4309e7
cmp dword [0x438d3c], ebx
jne 0x4309e1
mov dword [0x438d3c], esi
push 0x40102c
push 0x401020
call fcn.00430acc
pop ecx
pop ecx
test eax, eax
je 0x4309e7
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x430abc
mov dword [0x438224], esi
cmp dword [0x438d3c], esi
jne 0x430a0a
push 0x40101c
push section..text
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x438d3c], 2
test edi, edi
jne 0x430a17
xor eax, eax
mov ecx, 0x438d38
xchg dword [ecx], eax
cmp dword [0x438d48], 0
je 0x430a43
push 0x438d48
call fcn.00431430
pop ecx
test eax, eax
je 0x430a43
push ebx
push 2
push ebx
mov esi, dword [0x438d48]
mov ecx, esi
call dword [0x4392d8]
call esi
push dword [0x438230]
push dword [0x43822c]
push dword [0x438228]
call fcn.004173e3
add esp, 0xc
mov dword [0x438220], eax
cmp dword [0x438238], 0
jne 0x430aa1
push eax
call dword [sym.imp.msvcrt.dll_exit]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ecx]
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
push ecx
push eax
call sub.msvcrt.dll__XcptFilter
pop ecx
pop ecx
ret
cmp dword [0x438224], 0
jne 0x430ab5
call dword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x438220]
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret
call fcn.00431525
jmp 0x430953

Function at 0x431314
Capabilities:
Parse pe header

Disassembly:
push 0xc
push 0x436998
call fcn.004315d8
xor ecx, ecx
mov eax, dword [ebp + 8]
test eax, eax
je 0x431374
cmp eax, 0xffffffff
je 0x431374
mov dword [ebp - 4], ecx
mov edx, 0x5a4d
cmp word [eax], dx
jne 0x43136d
mov edx, dword [eax + 0x3c]
test edx, edx
js 0x43136d
cmp edx, 0x10000000
jae 0x43136d
add eax, edx
mov dword [ebp - 0x1c], eax
mov ecx, dword [eax]
sub ecx, 0x4550
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
jmp 0x43136a
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, ecx
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x4313e0
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x43141e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x431416
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x431420
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x431406
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4c4e60
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x98000]
push edi
or ebp, 0xffffffff
jmp 0x4c4e82
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4c4e89
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4c4e78
mov eax, 1
add ebx, ebx
jne 0x4c4e9b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4c4eac
jne 0x4c4ecb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4c4ecb
dec eax
add ebx, ebx
jne 0x4c4eb8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4c4e90
add ebx, ebx
jne 0x4c4ec7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4c4f1d
xor ecx, ecx
sub eax, 3
jb 0x4c4ee3
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4c4f52
sar eax, 1
mov ebp, eax
jmp 0x4c4eee
add ebx, ebx
jne 0x4c4eee
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4c4ebc
inc ecx
add ebx, ebx
jne 0x4c4efc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4c4ebc
add ebx, ebx
jne 0x4c4f09
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4c4efe
jne 0x4c4f1a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4c4efe
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4c4f3c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4c4f2e
jmp 0x4c4e7e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4c4f3c
add edi, ecx
jmp 0x4c4e7e
pop esi
lea edi, [esi + 0xc0000]
mov ecx, 4
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4c4f5e
mov eax, dword [edi]
mov bl, byte [edi + 4]
xchg ah, al
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4c4f63
lea edi, [esi + 0xc1000]
mov eax, dword [edi]
or eax, eax
je 0x4c4fcb
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xc6590]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xc6640]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4c4f89
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xc6648]
or eax, eax
je 0x4c4fc5
mov dword [ebx], eax
add ebx, 4
jmp 0x4c4fa6
call dword [esi + 0xc6644]
mov ebp, dword [esi + 0xc664c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x20f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4c4fff
sub esp, 0xffffff80
jmp 0x417862
Function at 0x100012c0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x10066f98]
mov dword [ebp - 4], eax
jmp 0x100012d9
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
je 0x100012f6
lea eax, [ebp - 8]
push eax
push 0x40
push 0x10000
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x100012d0
mov esp, ebp
pop ebp
ret

Function at 0x10001300
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x10066fa8], eax
je 0x1000131e
mov eax, 0x10dd
jmp 0x100013ff
mov eax, dword [0x10066fb8]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1000139c
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x14]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
movzx eax, byte [edx + 0x36]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
jne 0x1000137a
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x10], 0
je 0x1000137a
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
push eax
call fcn.10001470
add esp, 4
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
push edx
call fcn.1000e4e0
add esp, 4
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
jmp 0x10001326
mov dword [0x10066fb8], 0
call fcn.10001410
mov ecx, dword [0x10066fb4]
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], 0
je 0x100013e9
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.1000e4e0
add esp, 4
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x10], edx
jmp 0x100013b4
mov dword [0x10066fb4], 0
mov dword [0x10066fa8], 0
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x100022c0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push eax
call fcn.10002390
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x1000237c
cmp dword [ebp - 4], 0x50000000
jb 0x100022fc
cmp dword [ebp - 4], 0x80000000
ja 0x100022fc
mov dword [ebp - 4], 0x80010000
jmp 0x100022d5
push 0x1c
push 0
lea edx, [ebp - 0x20]
push edx
call fcn.1000fb50
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x10002322
jmp 0x1000237c
cmp dword [ebp - 0x10], 0x10000
jne 0x10002365
cmp dword [ebp - 0x14], 0x10000
jb 0x10002365
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x10002358
mov eax, dword [ebp - 0x24]
jmp 0x1000237e
mov eax, dword [ebp - 4]
add eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x10002377
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0x14]
push ecx
call fcn.10002390
add esp, 4
mov dword [ebp - 4], eax
jmp 0x100022d5
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x100023c0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
sub eax, 0x10000
push eax
call fcn.10002490
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jbe 0x10002484
cmp dword [ebp - 4], 0x50000000
jb 0x10002401
cmp dword [ebp - 4], 0x80000000
ja 0x10002401
mov dword [ebp - 4], 0x4fff0000
jmp 0x100023da
push 0x1c
push 0
lea edx, [ebp - 0x20]
push edx
call fcn.1000fb50
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x10002427
jmp 0x10002484
cmp dword [ebp - 0x10], 0x10000
jne 0x1000246a
cmp dword [ebp - 0x14], 0x10000
jb 0x1000246a
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x1000245d
mov eax, dword [ebp - 0x24]
jmp 0x10002486
mov eax, dword [ebp - 4]
sub eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x1000247f
mov ecx, dword [ebp - 0x1c]
sub ecx, 0x10000
push ecx
call fcn.10002490
add esp, 4
mov dword [ebp - 4], eax
jmp 0x100023da
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x100054d0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x10066094]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0
mov edi, edx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 0xc], eax
mov ecx, dword [eax + 0x3c]
mov ebx, dword [ecx + eax + 0x80]
add ebx, 0xc
add ebx, eax
mov ecx, dword [ebx]
test ecx, ecx
je 0x1000557a
add eax, ecx
push str.Kernel32.dll
push eax
call fcn.1001552b
add esp, 8
test eax, eax
jne 0x10005533
mov esi, dword [ebx + 4]
add esi, dword [ebp - 0xc]
mov eax, dword [esi]
test eax, eax
je 0x10005533
cmp eax, edi
je 0x10005542
mov eax, dword [esi + 4]
add esi, 4
test eax, eax
jne 0x10005525
mov ecx, dword [ebx + 0x14]
add ebx, 0x14
test ecx, ecx
je 0x1000557a
mov eax, dword [ebp - 0xc]
jmp 0x10005505
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push esi
call edi
mov eax, dword [ebp + 8]
mov dword [esi], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 4
push esi
call edi
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000db64
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000db64
mov esp, ebp
pop ebp
ret
Function at 0x100187e4
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x10018823
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10018823
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10018823
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x10018823
cmp dword [ecx + 0x74], 0xe
jbe 0x10018823
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x1001c310
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1005bd58
push 0x1005bd50
push str.FlsAlloc
push 0x1f
call fcn.1001c1d8
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1001c344
push dword [ebp + 8]
mov ecx, esi
call dword [0x1002b16c]
call esi
jmp 0x1001c34a
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1001c38e
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1005bd68
push 0x1005bd60
push str.FlsGetValue
push 0x21
call fcn.1001c1d8
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1001c3c5
push dword [ebp + 8]
mov ecx, esi
call dword [0x1002b16c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1001c3cd
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1005bd70
push 0x1005bd68
push str.FlsSetValue
push 0x22
call fcn.1001c1d8
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1001c407
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x1002b16c]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x1001f311
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.1000ed30
mov eax, dword [0x10066094]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.1001d843
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x1001f353
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x1001f4af
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.10029e10
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x10067a68]
push dword [eax + edi + 0x24]
push dword [eax + edi + 0x20]
push ebx
call fcn.1002030e
mov ecx, dword [esi*4 + 0x10067a68]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [ecx + edi + 0x20]
jne 0x1001f4a8
cmp eax, dword [ecx + edi + 0x24]
jne 0x1001f4a8
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [ecx + edi + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1001f4a8
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.1002030e
add esp, 0x14
test edx, edx
jl 0x1001f4a8
jg 0x1001f41e
test eax, eax
jb 0x1001f4a8
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x1001f4a8
jl 0x1001f438
cmp dword [ebp - 0x1008], eax
ja 0x1001f4a8
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x1001f456
test ebx, ebx
je 0x1001f48f
cmp ecx, edi
jae 0x1001f48f
mov al, byte [ecx]
cmp al, 0xd
jne 0x1001f470
lea eax, [edi - 1]
cmp ecx, eax
jae 0x1001f47c
cmp byte [ecx + 1], 0xa
jne 0x1001f47c
inc ecx
jmp 0x1001f47c
movzx eax, al
movsx eax, byte [eax + 0x10066320]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x1001f456
cmp edx, ebx
jne 0x1001f456
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x1001f4ad
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.1000db64
leave
ret
Function at 0x1001f7a6
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x10067a68]
mov dword [ebp - 0xc], ecx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x1001f7e6
cmp byte [ebx], 0xa
jne 0x1001f7e6
or byte [edi + eax + 0x28], 4
jmp 0x1001f7eb
and byte [edi + eax + 0x28], 0xfb
add ecx, ebx
mov eax, ebx
mov dword [ebp - 0x10], ecx
mov esi, ebx
mov dword [ebp - 8], eax
cmp ebx, ecx
jae 0x1001f8ea
mov dl, byte [eax]
cmp dl, 0x1a
je 0x1001f8cd
inc eax
cmp dl, 0xd
je 0x1001f817
mov dword [ebp - 8], eax
mov byte [esi], dl
jmp 0x1001f83d
cmp eax, ecx
jae 0x1001f84b
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add dword [ebp - 8], eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
xor edx, edx
inc edx
add esi, edx
cmp eax, ecx
jb 0x1001f7ff
jmp 0x1001f8ea
push 0
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1001f8c8
cmp dword [ebp - 0x10], 0
je 0x1001f8c8
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx*4 + 0x10067a68]
test byte [eax + edi + 0x28], 0x48
je 0x1001f8a2
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x1001f88d
mov byte [esi], dl
jmp 0x1001f89e
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x10067a68]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x1001f8ea
cmp byte [ebp - 1], 0xa
jne 0x1001f8b1
cmp esi, ebx
jne 0x1001f8b1
mov byte [esi], 0xa
jmp 0x1001f8e9
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.1002032c
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x1001f8ea
mov byte [esi], 0xd
jmp 0x1001f8e9
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx*4 + 0x10067a68]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x1001f8e7
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x1001f8ea
mov byte [esi], dl
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret