joyce8/EMBER2024-capa huggingface dataset:
Function at 0x62ac79
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push edi
xor edi, edi
mov dword [ecx + 0x9c], edi
cmp dword [str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer], edi
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
mov dword [ebp - 0x14], 4
mov dword [ebp - 0xc], edi
mov ebx, 0x6b5464
je 0x62ad35
push esi
lea eax, [ebp - 4]
push eax
push 1
push edi
push dword [ebx]
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x62ad1d
mov esi, dword [ebx + 4]
jmp 0x62ad17
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 0xc]
push ecx
push edi
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x62ad07
cmp dword [ebp - 0xc], 4
jne 0x62ad07
cmp dword [ebp - 8], edi
mov eax, dword [ebp - 0x10]
mov ecx, dword [esi + 4]
je 0x62acff
or dword [eax + 0x9c], ecx
jmp 0x62ad07
not ecx
and dword [eax + 0x9c], ecx
mov dword [ebp - 8], edi
mov dword [ebp - 0x14], 4
mov dword [ebp - 0xc], edi
add esi, 8
mov eax, dword [esi]
cmp eax, edi
jne 0x62accb
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add ebx, 8
cmp dword [ebx], edi
mov dword [ebp - 4], edi
jne 0x62acae
pop esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
inc eax
pop ebx
leave
ret

Function at 0x62b0ee
Capabilities:
Query or enumerate registry key

Disassembly:
mov eax, 0x63a350
call fcn.00600064
sub esp, 0x11c
mov eax, dword [0x6b55d0]
push ebx
push esi
push edi
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [ebp - 0x10], esp
lea ecx, [ebp - 0x124]
push ecx
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov esi, eax
test esi, esi
jne 0x62b1e7
push 0x104
lea eax, [ebp - 0x11c]
push eax
push 0
push dword [ebp - 0x124]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov esi, eax
test esi, esi
jne 0x62b1bb
and dword [ebp - 4], eax
lea eax, [ebp - 0x11c]
push eax
lea ecx, [ebp - 0x120]
call fcn.004096e3
lea eax, [ebp - 0x120]
push eax
push dword [ebp - 0x124]
mov byte [ebp - 4], 1
call fcn.0062b0ee
mov ecx, dword [ebp - 0x120]
mov esi, eax
test esi, esi
setne bl
add ecx, 0xfffffff0
mov byte [ebp - 4], 0
call fcn.00405ba7
test bl, bl
jne 0x62b1bb
or dword [ebp - 4], 0xffffffff
jmp 0x62b12c
cmp esi, 0x103
je 0x62b1cb
cmp esi, 0x3f2
jne 0x62b1db
mov eax, dword [ebp + 0xc]
push dword [eax]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, eax
push dword [ebp - 0x124]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x14]
mov eax, esi
call fcn.006009d4
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x62b5b5
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [esp + 0x10]
test edi, edi
jle 0x62b5ea
cmp edi, dword [esi + 0xc]
jge 0x62b5ea
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x62b5ea
cmp edi, dword [eax + 8]
jge 0x62b5ea
mov eax, dword [eax + 0xc]
mov edi, dword [eax + edi*4]
jmp 0x62b5ec
xor edi, edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, edi
pop edi
pop esi
pop ebx
ret 4

Function at 0x62b6f0
Capabilities:
Allocate thread local storage

Disassembly:
xor eax, eax
push esi
mov esi, ecx
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x18], 4
mov dword [esi + 4], eax
mov dword [esi + 8], 1
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [esi], eax
jne 0x62b724
jmp fcn.0061d4ce
lea eax, [esi + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov eax, esi
pop esi
ret

Function at 0x62b795
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
lea esi, [edi + 0x1c]
push esi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp + 8]
xor ebx, ebx
cmp eax, ebx
jle 0x62b88e
cmp eax, dword [edi + 0xc]
jge 0x62b88e
push dword [edi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
cmp esi, ebx
je 0x62b7e6
mov ecx, dword [ebp + 8]
cmp ecx, dword [esi + 8]
jl 0x62b877
cmp dword [ebp + 0xc], ebx
je 0x62b877
jmp 0x62b810
push 0x10
call fcn.0062b481
cmp eax, ebx
je 0x62b7fc
mov ecx, eax
call fcn.0062b6e7
mov esi, eax
jmp 0x62b7fe
xor esi, esi
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov ecx, dword [edi + 0x14]
mov eax, dword [edi + 0x18]
mov dword [esi + eax], ecx
mov dword [edi + 0x14], esi
mov eax, dword [esi + 0xc]
cmp eax, ebx
jne 0x62b827
mov eax, dword [edi + 0xc]
shl eax, 2
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
jmp 0x62b837
mov ecx, dword [edi + 0xc]
push 2
shl ecx, 2
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_LocalReAlloc]
cmp eax, ebx
jne 0x62b849
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.0061d4ce
mov ecx, dword [esi + 8]
mov dword [esi + 0xc], eax
mov edx, dword [edi + 0xc]
sub edx, ecx
shl edx, 2
push edx
lea eax, [eax + ecx*4]
push ebx
push eax
call fcn.006007e0
mov eax, dword [edi + 0xc]
add esp, 0xc
push esi
mov dword [esi + 8], eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [ebp + 8]
mov eax, dword [esi + 0xc]
cmp eax, ebx
je 0x62b889
cmp ecx, dword [esi + 8]
jge 0x62b889
mov edx, dword [ebp + 0xc]
mov dword [eax + ecx*4], edx
push dword [ebp - 4]
jmp 0x62b88f
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x62b94e
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x62b97c
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x62b99a
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0062b8b8
jmp 0x62b99a
mov eax, dword [esi + 0x14]
test eax, eax
je 0x62b99a
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
push eax
mov ecx, esi
call fcn.0062b8b8
test edi, edi
mov eax, edi
jne 0x62b984
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
mov ecx, dword [0x96e464]
test ecx, ecx
je 0x62ba4d
jmp 0x62b94d
ret 8
Function at 0x4019d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ah, 0xca
mov byte [ebp - 0x4b], 0xee
mov byte [ebp - 0x4a], 0xc9
mov byte [ebp - 0x49], 0xc1
mov byte [ebp - 0x48], 0xc8
mov byte [ebp - 0x47], 0xa7
call fcn.00401747
not byte [ecx]
shr esp, 0x8d
inc ebp
test al, 0x50
call fcn.00401757
mov esi, dword [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
call fcn.0040170c
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x401a35
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.00401747
mov ch, 0xb1
into
pop eax
lea eax, [ebp - 0x40]
push eax
call fcn.00401757
push eax
push esi
push dword [ebp + 8]
call fcn.0040170c
add esp, 0x10
mov dword [ebp - 0x88], eax
call fcn.00401747
mov byte [0x8d7d7eb2], al
inc ebp

Function at 0x401ab0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
call 0x5128783d
mov byte [ebp - 0x17], bl
mov byte [ebp - 0x16], 0x40
mov byte [ebp - 0x15], bl
mov byte [ebp - 0x14], 0xe9
mov byte [ebp - 0x13], 0xd6
mov byte [ebp - 0x12], 0xcd
mov byte [ebp - 0x11], 0xcb
mov byte [ebp - 0x10], 0xca
mov byte [ebp - 0xf], 0xde
mov byte [ebp - 0xe], 0xd3
mov byte [ebp - 0xd], 0xf9
invalid

Function at 0x401ba0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc ebp
aam 0x88
pop ebp
aam 0x50
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.00401757
push eax
push esi
push dword [ebp + 8]
call fcn.0040170c
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.00401747
wait
jno 0x401b64
lcall 0xffff, 0xff7c9d88
invalid

Function at 0x401fa0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x34a], 0x46
mov byte [ebp - 0x349], 0x40
mov byte [ebp - 0x348], 0x56
mov byte [ebp - 0x347], 0x56
mov byte [ebp - 0x346], 0x6d
mov byte [ebp - 0x345], 0x40
mov byte [ebp - 0x344], 0x44
mov byte [ebp - 0x343], 0x55
mov byte [ebp - 0x342], 0x25
lea eax, [ebp - 0x354]
push eax
call fcn.00401757
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0040170c
add esp, 0xc
invalid
test dword [ecx + edi*8 - 1], esi
Function at 0x401006
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4ac004]
jne 0x401010
repz ret
jmp fcn.00401460

Function at 0x4082b5
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004058a1
and dword [ebp - 4], 0
cmp dword [0x4ae798], 0
mov ebx, eax
jne 0x408366
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x408417
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x408417
push eax
call fcn.0040582f
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4ae798], eax
call esi
push eax
call fcn.0040582f
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4ae79c], eax
call esi
push eax
call fcn.0040582f
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4ae7a0], eax
call esi
push eax
call fcn.0040582f
pop ecx
mov dword [0x4ae7a8], eax
test eax, eax
je 0x408366
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040582f
pop ecx
mov dword [0x4ae7a4], eax
mov eax, dword [0x4ae7a4]
cmp eax, ebx
je 0x4083be
cmp dword [0x4ae7a8], ebx
je 0x4083be
push eax
call fcn.004058aa
push dword [0x4ae7a8]
mov esi, eax
call fcn.004058aa
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4083be
test edi, edi
je 0x4083be
call esi
test eax, eax
je 0x4083b5
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4083b5
test byte [ebp - 0xc], 1
jne 0x4083be
or dword [ebp + 0x10], 0x200000
jmp 0x4083f7
mov eax, dword [0x4ae79c]
cmp eax, ebx
je 0x4083f7
push eax
call fcn.004058aa
pop ecx
test eax, eax
je 0x4083f7
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4083f7
mov eax, dword [0x4ae7a0]
cmp eax, ebx
je 0x4083f7
push eax
call fcn.004058aa
pop ecx
test eax, eax
je 0x4083f7
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4ae798]
call fcn.004058aa
pop ecx
test eax, eax
je 0x408417
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x408419
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10003c30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, edx
mov edx, dword [esp + 0x14]
mov ebp, dword [esp + 0x20]
xor esi, esi
lea edx, [eax + edx*2]
movzx ebx, byte [eax + 1]
cmp byte [eax], ch
lea eax, [eax + 2]
lea edi, [esi + ebx]
jne 0x10003c80
cmp edi, esi
jb 0x10003ce8
cmp edi, dword [esp + 0x1c]
ja 0x10003cfb
add esi, dword [esp + 0x18]
nop word [eax + eax]
test ebx, ebx
je 0x10003c82
dec ebx
cmp byte [esi], cl
lea esi, [esi + 1]
jne 0x10003c70
jmp 0x10003cdf
ja 0x10003c88
cmp eax, edx
mov esi, edi
jne 0x10003c43
mov edi, dword [esp + 0x24]
movzx ecx, cx
mov al, 1
add edi, ebp
nop word cs:[eax + eax]
nop dword [eax]
movzx edx, byte [ebp]
lea esi, [ebp + 1]
test dl, dl
js 0x10003cc0
mov ebp, esi
sub ecx, edx
jns 0x10003cd7
jmp 0x10003ce1
cmp esi, edi
je 0x10003d10
movzx esi, byte [ebp + 1]
and edx, 0x7f
add ebp, 2
shl edx, 8
or edx, esi
sub ecx, edx
js 0x10003ce1
xor al, 1
cmp ebp, edi
jne 0x10003ca0
jmp 0x10003ce1
xor eax, eax
and al, 1
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, esi
mov edx, edi
push 0x10034ab8
call fcn.10032ad0
add esp, 4
ud2
mov edx, dword [esp + 0x1c]
mov ecx, edi
push 0x10034ab8
call fcn.10032a70
add esp, 4
ud2
mov ecx, str.called__Option::unwrap____on_a__None__value_rustc_69f9c33d71c871fc16ac445211281c6e7a340943library_alloc_srccollections_btree_navigate.rs
mov edx, 0x2b
push 0x10034ac8
call fcn.10032a80
add esp, 4
ud2
Function at 0x1000cb30
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
mov eax, dword [0x10040050]
test eax, eax
je 0x1000cba8
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jbe 0x1000cb4f
cmp byte [eax + 4], 0
mov esi, eax
jne 0x1000cb9d
mov eax, dword [0x10040050]
test eax, eax
je 0x1000cbb4
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
je 0x1000cba2
mov esi, eax
test eax, eax
jne 0x1000cb97
mov ecx, 8
call fcn.10001000
test eax, eax
je 0x1000cbcc
mov byte [eax + 4], 0
mov dword [eax], 0x10040050
mov esi, eax
mov eax, dword [0x10040050]
test eax, eax
je 0x1000cbc0
dec eax
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov word [esi + 4], 1
add esi, 5
jmp 0x1000cba4
xor esi, esi
mov eax, esi
pop esi
ret
mov ecx, 0x10040050
call fcn.10033320
jmp 0x1000cb3b
mov ecx, 0x10040050
call fcn.10033320
jmp 0x1000cb59
mov ecx, 0x10040050
call fcn.10033320
jmp 0x1000cb8f
mov ecx, 8
mov edx, 4
call fcn.10032910
ud2
Function at 0x1000df90
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
mov eax, dword [0x10040070]
test eax, eax
je 0x1000e012
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jbe 0x1000dfb1
cmp dword [eax], 0
je 0x1000dfb1
add eax, 4
pop esi
ret
mov eax, dword [0x10040070]
test eax, eax
je 0x1000e021
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
je 0x1000e00e
mov esi, eax
test eax, eax
jne 0x1000dffc
mov ecx, 0xc
call fcn.10001000
test eax, eax
je 0x1000e039
mov dword [eax], 0
mov dword [eax + 8], 0x10040070
mov esi, eax
mov eax, dword [0x10040070]
test eax, eax
je 0x1000e02d
dec eax
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [esi], 1
lea eax, [esi + 4]
mov dword [esi + 4], 0
pop esi
ret
xor eax, eax
pop esi
ret
mov ecx, 0x10040070
call fcn.10033320
jmp 0x1000df9b
mov ecx, 0x10040070
call fcn.10033320
jmp 0x1000dfbb
mov ecx, 0x10040070
call fcn.10033320
jmp 0x1000dff4
mov ecx, 0xc
mov edx, 4
call fcn.10032910
ud2

Function at 0x1000e1a0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
mov eax, dword [0x10040060]
test eax, eax
je 0x1000e254
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jbe 0x1000e1cb
cmp dword [eax], 0
mov edi, eax
je 0x1000e1cb
add edi, 4
jmp 0x1000e24f
mov eax, dword [0x10040060]
test eax, eax
je 0x1000e263
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
je 0x1000e24d
mov esi, eax
test eax, eax
jne 0x1000e21e
mov ecx, 0x10
call fcn.10001000
test eax, eax
je 0x1000e27e
mov dword [eax], 0
mov dword [eax + 0xc], 0x10040060
mov esi, eax
mov eax, dword [0x10040060]
test eax, eax
je 0x1000e272
dec eax
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [esi + 8]
cmp dword [esi], 0
lea edi, [esi + 4]
mov dword [esi], 1
mov dword [esi + 4], 0
mov dword [esi + 8], 0
je 0x1000e24f
test ecx, ecx
je 0x1000e24f
lock dec dword [ecx]
jne 0x1000e24f
call fcn.1000c190
jmp 0x1000e24f
xor edi, edi
mov eax, edi
pop esi
pop edi
ret
mov ecx, 0x10040060
call fcn.10033320
jmp 0x1000e1b0
mov ecx, 0x10040060
call fcn.10033320
jmp 0x1000e1d9
mov ecx, 0x10040060
call fcn.10033320
jmp 0x1000e216
mov ecx, 0x10
mov edx, 4
call fcn.10032910
ud2
Function at 0x10016360
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
mov eax, dword [0x10040024]
test eax, eax
je 0x10016406
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jbe 0x10016388
cmp dword [eax], 0
mov edi, eax
je 0x10016388
add edi, 4
jmp 0x10016401
mov eax, dword [0x10040024]
test eax, eax
je 0x10016415
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
je 0x100163ff
mov esi, eax
test eax, eax
jne 0x100163d7
mov ecx, 0xc
call fcn.10001000
test eax, eax
je 0x10016430
mov dword [eax], 0
mov dword [eax + 8], 0x10040024
mov esi, eax
mov eax, dword [0x10040024]
test eax, eax
je 0x10016424
dec eax
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [esi + 4]
cmp dword [esi], 0
lea edi, [esi + 4]
mov dword [esi], 1
mov dword [esi + 4], 0
je 0x10016401
test ecx, ecx
je 0x10016401
lock dec dword [ecx]
jne 0x10016401
call fcn.10016450
jmp 0x10016401
xor edi, edi
mov eax, edi
pop esi
pop edi
ret
mov ecx, 0x10040024
call fcn.10033320
jmp 0x10016370
mov ecx, 0x10040024
call fcn.10033320
jmp 0x10016396
mov ecx, 0x10040024
call fcn.10033320
jmp 0x100163cf
mov ecx, 0xc
mov edx, 4
call fcn.10032910
ud2
Function at 0x1001cfa0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x100254e0
mov eax, dword [ebp + 8]
mov edi, ecx
lea ecx, [ebp - 0x18]
mov esi, dword fs:[0]
mov dword [ebp - 0x18], esi
mov dword fs:[0], ecx
lea ecx, [ebp - 0x30]
push eax
call fcn.10013d50
add esp, 4
mov esi, dword [ebp - 0x30]
test esi, esi
je 0x1001d008
mov ebx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x20], eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1001d056
mov eax, dword [ebp - 0x20]
mov dword [edi], esi
mov dword [edi + 4], ebx
mov dword [edi + 8], eax
jmp 0x1001d06c
cmp byte [ebp - 0x2c], 3
jne 0x1001d04e
mov ecx, dword [ebp - 0x28]
mov dword [ebp - 0x24], edi
mov eax, dword [ecx]
mov dword [ebp - 0x20], ecx
mov ecx, dword [ecx + 4]
mov dword [ebp - 0x10], 0
push eax
call dword [ecx]
add esp, 4
mov esi, dword [ebp - 0x20]
mov eax, dword [esi + 4]
cmp dword [eax + 4], 0
je 0x1001d03f
mov edx, dword [eax + 8]
mov ecx, dword [esi]
call fcn.10001030
mov ecx, esi
mov edx, 4
call fcn.10001030
mov edi, dword [ebp - 0x24]
mov dword [edi], 0
jmp 0x1001d06c
test ebx, ebx
mov dword [edi], 0
je 0x1001d06c
mov ecx, esi
mov edx, 2
call fcn.10001030
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1001f900
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
mov eax, 0x1060
call fcn.10025700
mov esi, esp
mov dword [esi + 0x1048], ebp
mov dword [esi + 0x104c], esp
mov dword [esi + 0x1058], 0xffffffff
mov dword [esi + 0x1054], 0x10025560
mov edi, ecx
lea eax, [esi + 0x1050]
mov dword [esi + 0x1c], edx
lea ebx, [esi + 0x48]
mov ecx, dword fs:[0]
mov dword [esi + 0x1050], ecx
mov dword fs:[0], eax
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edx
push 0x1000
push 0
push ebx
call fcn.10027f60
add esp, 0xc
xorps xmm0, xmm0
lea eax, [esi + 8]
mov dword [esi + 8], 0
movaps xmmword [esi + 0x20], xmm0
mov dword [esi + 0x30], eax
lea eax, [esi + 0x20]
push 0x10016db0
push eax
push 0x1000
push ebx
mov dword [esi + 0x14], edi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFileEx]
test eax, eax
je 0x1001fa83
mov ebx, dword [sym.imp.KERNEL32.dll_SleepEx]
nop word [eax + eax]
push 1
push 0xffffffffffffffff
call ebx
cmp dword [esi + 8], 1
jne 0x1001f9b0
cmp dword [esi + 0xc], 0
jne 0x1001fa89
mov ecx, dword [esi + 0x10]
mov dword [esi + 0x40], 4
test ecx, ecx
mov dword [esi + 0x44], ecx
je 0x1001fa89
cmp ecx, 0x1000
ja 0x1001facb
xor edi, edi
mov dword [esi + 0x18], ecx
nop dword [eax]
mov eax, ecx
sub eax, edi
jb 0x1001faad
xorps xmm0, xmm0
lea edx, [esi + 8]
lea ecx, [esi + edi + 0x48]
mov dword [esi + 8], 0
movaps xmmword [esi + 0x20], xmm0
mov dword [esi + 0x30], edx
push 0x10016db0
lea edx, [esi + 0x20]
push edx
push eax
push ecx
push dword [esi + 0x1c]
call dword [sym.imp.KERNEL32.dll_WriteFileEx]
test eax, eax
je 0x1001fa83
nop word [eax + eax]
push 1
push 0xffffffffffffffff
call ebx
cmp dword [esi + 8], 1
jne 0x1001fa30
cmp dword [esi + 0xc], 0
jne 0x1001fa89
add edi, dword [esi + 0x10]
mov ecx, dword [esi + 0x18]
cmp edi, ecx
jne 0x1001f9f0
xorps xmm0, xmm0
lea eax, [esi + 8]
mov dword [esi + 8], 0
movaps xmmword [esi + 0x20], xmm0
mov dword [esi + 0x30], eax
push 0x10016db0
lea eax, [esi + 0x20]
push eax
push 0x1000
lea eax, [esi + 0x48]
push eax
push dword [esi + 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFileEx]
test eax, eax
jne 0x1001f9b0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esi + 0x14]
call edi
push dword [esi + 0x1c]
call edi
mov eax, dword [esi + 0x1050]
mov dword fs:[0], eax
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov edx, dword [esi + 0x18]
mov dword [esi + 0x1058], 0
mov ecx, edi
push 0x10037c2c
call fcn.10032ad0
add esp, 4
jmp 0x1001fae7
mov dword [esi + 0x1058], 0
mov edx, 0x1000
push 0x10037c2c
call fcn.10032a70
add esp, 4
ud2
Function at 0x1001fb40
Capabilities:
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff0
sub esp, 0x40
mov dword [esp + 0x1c], ecx
mov esi, dword [0x100409c0]
test esi, esi
mov dword [esp], esi
jne 0x1001fb93
mov eax, esp
push 0
push 0
push 0x10037d28
push eax
call dword [sym.imp.bcrypt.dll_BCryptOpenAlgorithmProvider]
test eax, eax
js 0x1001fbb9
mov ecx, dword [esp]
xor eax, eax
lock cmpxchg dword [0x100409c0], ecx
jne 0x1001fb85
mov esi, dword [esp]
jmp 0x1001fb93
mov esi, eax
push 0
push dword [esp + 4]
call dword [sym.imp.bcrypt.dll_BCryptCloseAlgorithmProvider]
xorps xmm0, xmm0
mov eax, esp
movaps xmmword [esp], xmm0
push 0
push 0x10
push eax
push esi
call dword [sym.imp.bcrypt.dll_BCryptGenRandom]
test eax, eax
js 0x1001fbb9
mov eax, dword [esp]
mov edx, dword [esp + 4]
lea esp, [ebp - 4]
pop esi
pop ebp
ret
lea ecx, [esp + 0x1c]
lea edx, [esp + 0x20]
mov dword [esp], 0x10037d78
mov dword [esp + 4], 2
mov dword [esp + 8], 0x10037d88
mov dword [esp + 0xc], 2
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], ecx
lea ecx, [esp + 0x24]
mov dword [esp + 0x28], fcn.10004e30
mov dword [esp + 0x2c], edx
mov edx, 0x10037dc8
mov dword [esp + 0x30], fcn.10004e30
mov dword [esp + 0x10], ecx
mov ecx, esp
mov dword [esp + 0x14], 2
call fcn.100329c0
ud2