joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002e99d
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov dword [ebp - 0xc], 0
jmp 0x1002e9b3
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 1
jge 0x1002e9c6
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x40], 0x624039b
jmp 0x1002e9ac
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1002e9de
push 1
push 0x36
push 0
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
mov byte [ebp - 2], 0
movzx eax, byte [ebp - 2]
test eax, eax
je 0x1002e9f4
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1002eb5b
mov dword [ebp - 8], 0x928c176b
mov dword [ebp - 0x28], 0x7d50f82b
mov dword [ebp - 0x50], 0x6f9b6917
mov dword [ebp - 0x4c], 0x6f9b6917
mov dword [ebp - 0x48], 0x6f9b6917
mov dword [ebp - 0x44], 0x6f9b6917
mov dword [ebp - 8], 0
jmp 0x1002ea3a
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x15
jl 0x1002eb4c
mov dword [ebp - 0x10], 0xfffffffa
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x38], 1
cmp dword [ebp - 0x10], 0
je 0x1002ea92
cmp dword [ebp - 0x10], 0
jne 0x1002ea7a
cmp dword [ebp - 0x28], 0
jne 0x1002ea7a
mov eax, 0xf6e2
test eax, eax
jne 0x1002ea7a
and dword [ebp - 0x18], 0
jmp 0x1002ea81
mov dword [ebp - 0x18], 1
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x18], eax
jle 0x1002ea92
mov dword [ebp - 0x1c], 1
jmp 0x1002ea96
and dword [ebp - 0x1c], 0
cmp dword [ebp - 0x1c], 4
jb 0x1002eaa5
mov dword [ebp - 0x20], 1
jmp 0x1002eaa9
and dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x20], eax
jle 0x1002eaba
mov dword [ebp - 0x24], 1
jmp 0x1002eabe
and dword [ebp - 0x24], 0
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x24]
sub ecx, dword [ebp - 0x28]
add eax, ecx
cmp eax, dword [ebp - 8]
jg 0x1002ead7
mov dword [ebp - 0x14], 1
jmp 0x1002eadb
and dword [ebp - 0x14], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x14]
mov dword [ebp + eax - 0x50], ecx
cmp dword [ebp - 0x14], 0
je 0x1002eb31
mov dword [ebp - 0x3c], 0xd76270e7
cmp dword [ebp - 0x38], 0x3d3b
jne 0x1002eb07
mov dword [ebp - 0x2c], 1
jmp 0x1002eb0b
and dword [ebp - 0x2c], 0
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x3c], eax
mov byte [ebp - 3], 0
movzx eax, byte [ebp - 3]
test eax, eax
je 0x1002eb2f
push 0x246f
push 0x9ae
push 0
call dword [sym.imp.USER32.dll_OffsetRect]
jmp 0x1002eb47
mov dword [ebp - 0x30], 1
cmp dword [ebp - 0x10], 0
je 0x1002eb40
jmp 0x1002eb4c
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
jmp 0x1002ea33
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetParent]
jmp 0x1002eb6a
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov esp, ebp
pop ebp
ret
Function at 0x10036f9e
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10036fe1
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
lea eax, [eax*4 + 4]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
push dword [eax + 8]
call fcn.100766dc
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
mov dword [ecx + 8], eax
jmp 0x10037006
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x10037006
push 0x391
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esp, ebp
pop ebp
ret

Function at 0x100371f4
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1003721a
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov eax, dword [eax]
and dword [eax + 0xc], 0
jmp 0x10037220
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esp, ebp
pop ebp
ret
Function at 0x10037f71
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
and dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, word [eax]
cmp eax, 0x5a4d
je 0x10037f95
xor eax, eax
jmp 0x100380b5
push 0x3bfa
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp + 8]
push eax
push 1
lea eax, [ebp - 8]
push eax
call fcn.10037e11
add esp, 0x14
mov eax, dword [ebp - 8]
cmp dword [eax], 0x4550
je 0x10037fc2
xor eax, eax
jmp 0x100380b5
push dword [ebp - 8]
push 1
lea eax, [ebp - 0xc]
push eax
call fcn.10037165
add esp, 0xc
cmp dword [ebp - 0xc], 0
jne 0x10037fe0
xor eax, eax
jmp 0x100380b5
push dword [ebp - 8]
push 1
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x10]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.10037cca
add esp, 0x18
push dword [ebp - 4]
push dword [ebp - 8]
push 0
push dword [ebp + 8]
call fcn.1002eb6e
add esp, 0x10
lea eax, [ebp - 0x14]
push eax
push 1
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
call fcn.10037e83
add esp, 0x10
cmp dword [ebp - 0x14], 0
je 0x1003803d
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x14]
push eax
push 1
call fcn.10037edc
add esp, 0xc
push dword [ebp - 4]
call fcn.10037047
pop ecx
test eax, eax
jne 0x1003804e
xor eax, eax
jmp 0x100380b5
push 1
lea eax, [ebp - 4]
push eax
call fcn.10037f32
pop ecx
pop ecx
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp dword [eax + 0x28], 0
je 0x1003809d
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + 0x28]
mov dword [ebp - 0x18], ecx
jne 0x1003807a
xor eax, eax
jmp 0x100380b5
push 0
push 1
push 0xdeadbeef
call dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x10038093
xor eax, eax
jmp 0x100380b5
mov eax, dword [ebp - 4]
mov dword [eax + 0x10], 1
mov eax, dword [ebp - 4]
cmp dword [eax + 0x10], 0
je 0x100380ae
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
jmp 0x100380b2
and dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret
Function at 0x10049cfb
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], 0xffffffff
push 2
mov esi, ecx
mov dword [ebp - 0x10], ebx
pop ecx
jmp 0x10049d25
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x20], 0x8bbca631
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x10049d17
xor edi, edi
mov dword [ebp - 0xc], ebx
inc edi
jmp 0x10049d54
mov dword [ebp - 0x10], 0x265ab3e9
mov dword [ebp - 0x10], ebx
jmp 0x10049d4c
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x20], 0x624cdb8f
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x10049d3e
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edi
jle 0x10049d32
mov dword [ebp - 0x20], 0x77ab3921
cmp dword [esi], ebx
je 0x10049e86
push dword [esi]
push ebx
push dword [esi + 4]
call fcn.1002d1fe
mov dword [ebp - 8], 0x2b1c
add esp, 0xc
mov dword [ebp - 0xc], 0x9d81479b
mov dword [ebp - 0x10], 0xfffffff7
mov dword [ebp - 0x10], ebx
jmp 0x10049d9e
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x14], 0x145c1747
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x10049d90
mov byte [ebp - 1], bl
cmp byte [ebp - 1], bl
je 0x10049db6
push 0xf67
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov eax, dword [ebp - 8]
sub eax, 0x89a5
neg eax
sbb eax, eax
inc eax
imul eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
neg eax
sbb eax, eax
neg eax
sub eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
sub edx, 0x8f69f7fd
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setne cl
cmp dword [ebp - 8], ecx
jne 0x10049e10
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x14], eax
jmp 0x10049e64
mov dword [ebp - 8], ebx
jmp 0x10049e5f
mov dword [ebp - 0x10], ebx
jmp 0x10049e28
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x18], 8
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x10049e1a
mov dword [ebp - 0xc], ebx
jmp 0x10049e57
mov dword [ebp - 0x10], ebx
jmp 0x10049e48
mov ecx, dword [ebp + eax*4 - 0x14]
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x14], ecx
mov dword [ebp - 0x18], edi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
mov eax, dword [ebp - 8]
jle 0x10049e37
mov eax, dword [ebp + eax*4 - 0x14]
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ebx
jle 0x10049e32
inc dword [ebp - 8]
cmp dword [ebp - 8], ebx
jle 0x10049e15
push esi
push 0xe5f
push ebx
call fcn.1004dfc9
push ebx
push esi
call fcn.1004db51
push esi
push ebx
push 0x1539
call fcn.1004df6d
add esp, 0x20
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1004de92
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x1004df00
mov eax, dword [ebp + 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ecx]
add ecx, dword [eax + 0x1c]
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
lea eax, [ecx + eax*4]
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x28]
mov eax, dword [ecx + eax]
mov dword [edx], eax
jmp 0x1004df06
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esp, ebp
pop ebp
ret

Function at 0x1004e499
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x1004e4f1
mov eax, dword [ebp + 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x18]
add eax, dword [ecx]
mov ecx, dword [ebp - 0x1c]
add eax, dword [ecx]
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ecx]
mov byte [ecx + eax], 0
jmp 0x1004e4f7
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esp, ebp
pop ebp
ret
Function at 0x10083cb7
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10093330]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.1007b234
mov dword [ebp - 0x14], eax
cmp dword [0x1067f960], esi
jne 0x10083daa
push 0x800
push esi
push 0x1000aa8c
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x10083d37
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x10083e8a
push esi
push esi
push 0x1000aa8c
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x10083e8a
push 0x1000aaa4
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10083e8a
push eax
call ebx
push 0x1000aab0
push edi
mov dword [0x1067f960], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x1000aac0
push edi
mov dword [0x1067f964], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x1000aad4
push edi
mov dword [0x1067f968], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x1067f970], eax
test eax, eax
je 0x10083da7
push 0x1000aaf0
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x1067f96c], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x10083dcf
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x10083dc2
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x10083de4
push 4
pop eax
jmp 0x10083e8c
cmp dword [ebp - 0x14], esi
je 0x10083de4
push dword [0x1067f960]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x10083dc9
mov eax, dword [0x1067f96c]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x10083e42
cmp dword [0x1067f970], edi
je 0x10083e42
push eax
call ebx
push dword [0x1067f970]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x10083e42
test eax, eax
je 0x10083e42
call ecx
test eax, eax
je 0x10083e37
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x10083e37
test byte [ebp - 8], 1
jne 0x10083e42
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x10083e72
mov eax, dword [0x1067f964]
cmp eax, edi
je 0x10083e6f
push eax
call ebx
test eax, eax
je 0x10083e6f
call eax
mov esi, eax
test esi, esi
je 0x10083e6f
mov eax, dword [0x1067f968]
cmp eax, edi
je 0x10083e6f
push eax
call ebx
test eax, eax
je 0x10083e6f
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x1067f960]
call ebx
test eax, eax
je 0x10083e8a
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x10083e8c
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call main
mov esp, ebp
pop ebp
ret
Function at 0x40f9cb
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x431c80]
jne 0x40f9d5
repz ret
jmp fcn.00414b9c

Function at 0x41c043
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0041458c
and dword [ebp - 4], 0
cmp dword [0x435cfc], 0
mov ebx, eax
jne 0x41c0f4
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x41c1a5
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x42b1b0
push edi
call esi
test eax, eax
je 0x41c1a5
push eax
call fcn.0041451a
mov dword [esp], 0x42b1a0
push edi
mov dword [0x435cfc], eax
call esi
push eax
call fcn.0041451a
mov dword [esp], 0x42b18c
push edi
mov dword [0x435d00], eax
call esi
push eax
call fcn.0041451a
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x435d04], eax
call esi
push eax
call fcn.0041451a
pop ecx
mov dword [0x435d0c], eax
test eax, eax
je 0x41c0f4
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0041451a
pop ecx
mov dword [0x435d08], eax
mov eax, dword [0x435d08]
cmp eax, ebx
je 0x41c14c
cmp dword [0x435d0c], ebx
je 0x41c14c
push eax
call fcn.00414595
push dword [0x435d0c]
mov esi, eax
call fcn.00414595
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x41c14c
test edi, edi
je 0x41c14c
call esi
test eax, eax
je 0x41c143
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x41c143
test byte [ebp - 0xc], 1
jne 0x41c14c
or dword [ebp + 0x10], 0x200000
jmp 0x41c185
mov eax, dword [0x435d00]
cmp eax, ebx
je 0x41c185
push eax
call fcn.00414595
pop ecx
test eax, eax
je 0x41c185
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x41c185
mov eax, dword [0x435d04]
cmp eax, ebx
je 0x41c185
push eax
call fcn.00414595
pop ecx
test eax, eax
je 0x41c185
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x435cfc]
call fcn.00414595
pop ecx
test eax, eax
je 0x41c1a5
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x41c1a7
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1000b3e3
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x1000b422
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1000b422
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1000b422
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x1000b422
cmp dword [ecx + 0x74], 0xe
jbe 0x1000b422
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x1000e09f
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1000e13c
push ebx
push esi
call fcn.1000e068
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1000dffc
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x1000e0e9
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1000e13b
push edi
push eax
call fcn.1000f05a
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x1000e109
call fcn.1000cb44
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1000e13a
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1000dffc
add esp, 0x20
test eax, eax
jne 0x1000e128
push edi
call fcn.1000cb44
jmp 0x1000e130
push ebx
call fcn.1000cb44
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x1000e3a9
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10015678
push 0x10015670
push str.FlsAlloc
push 0x1f
call fcn.1000e2c5
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1000e3dd
push dword [ebp + 8]
mov ecx, esi
call dword [0x10014158]
call esi
jmp 0x1000e3e3
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1000e427
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10015688
push 0x10015680
push str.FlsGetValue
push 0x21
call fcn.1000e2c5
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1000e45e
push dword [ebp + 8]
mov ecx, esi
call dword [0x10014158]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1000e466
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10015690
push 0x10015688
push str.FlsSetValue
push 0x22
call fcn.1000e2c5
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1000e4a0
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x10014158]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x10013b20
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10013b4d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10013b4d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0xd9d058
Capabilities:
Decompress data using aplib

Disassembly:
call 0xd9d1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xd9d07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xd9d06a
add dl, dl
jne 0xd9d089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xd9d0dc
xor eax, eax
add dl, dl
jne 0xd9d096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xd9d17d
add dl, dl
jne 0xd9d0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd9d0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd9d0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd9d0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xd9d0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xd9d075
mov eax, 1
add dl, dl
jne 0xd9d0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd9d0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xd9d0e1
sub eax, ebx
mov ebx, 1
jne 0xd9d128
mov ecx, 1
add dl, dl
jne 0xd9d10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xd9d119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xd9d105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xd9d075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xd9d13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xd9d14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xd9d136
cmp eax, 0x7d00
jae 0xd9d16d
cmp eax, 0x500
jb 0xd9d168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xd9d075
cmp eax, 0x7f
ja 0xd9d170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xd9d075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xd9d19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xd9d075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10